Controlled Unclassified Information (CUI) Program Implementation Assessment

OMB Control No. 3095-0070
Expiration date 12/31/2020

Controlled Unclassified Information (CUI) Program Implementation Assessment
1. Have you received any awareness training on the handling, protection, and/or sharing of Controlled
Unclassified Information?
- Yes (branch question, see below)
- No
1.a. When did you receive this training?





Within the last 6 months
Within the last 12 months
Within the last 18 months
Within the last 24 months

1.b. Which of the following options best describes the frequency with which personnel are required to
participate in your organization’s training or awareness program on how to properly handle and protect
sensitive information? Select all that apply.









Once Every Two Years
Annually
Every 6 Months
Quarterly
Monthly
Upon Hire
I Don’t Know
Other (Please Specify)

1.c. Select the topics that were addressed in your training (select all that apply):












My individual responsibilities related to protecting CUI;
The categories routinely handled by agency personnel and any special handling requirements for
CUI Specified;
The CUI Registry and its purpose, structure, and location (i.e., http://www.archives.gov/cui/);
The differences between CUI Basic and CUI Specified;
The CUI marking requirements, as described by agency policy;
Who has oversight responsibilities for the CUI Program;
The required physical safeguards and methods for protecting CUI, as described by agency
policy;
The destruction requirements and methods, as described by agency policy;
The incident reporting procedures, as described by agency policy;
The methods and practices for properly sharing or disseminating CUI within the agency and with
external entities inside and outside of the executive branch; and
The methods and practices for properly decontrolling CUI, as described by agency policy.

Page 1 of 6

OMB Control No. 3095-0070
Expiration date 12/31/2020

1.d. Which of the following options best describes your organization’s formal training program on how
to properly handle and protect Controlled Unclassified Information? Select all that apply.








Computer or Web-Based Training
Instructor-Led Classroom or Instructor-Led Virtual Training
Informal On-The-Job Training (OJT)
Hard Copy Bulletins, Information Sheets, Job Aids, or Other Reference Materials
Electronic Bulletins, Information Sheets, Job Aids, or Other Reference Materials
Website
Other (Please Specify)

2. My agency (office, bureau, directorate) has given me adequate training and provided the resources I need to
protect CUI.






Strongly agree
Agree
Neither agree or disagree
Disagree
Strongly disagree

3. My agency has a CUI Policy?
- Yes (branch question, see below)
- No
- I Don’t Know
3.a. Which of the following option(s) best describes your organization’s policies or procedures for how to
properly handle and protect CUI? Select all that apply.







Government-wide Policies
Agency Policies
Local Policies or Standard Operating Procedures
Internal Memorandums
No Written Policies or Procedures
Other (Please Specify)

4. My agency has established controls to ensure that CUI is used, stored, protected, transmitted, or destroyed
under conditions that would prevent unauthorized access.






Strongly agree
Agree
Neither agree or disagree
Disagree
Strongly disagree

Page 2 of 6

OMB Control No. 3095-0070
Expiration date 12/31/2020

5. I am confident that when I share CUI within my agency that information will be protected and shared
appropriately.






Strongly agree
Agree
Neither agree or disagree
Disagree
Strongly disagree

6. I know where and when to report a CUI incident.






Strongly agree
Agree
Neither agree or disagree
Disagree
Strongly disagree

7. My coworkers who work with CUI are aware of their responsibilities for reporting loss, suspected
compromise, and unauthorized handling.






Strongly agree
Agree
Neither agree or disagree
Disagree
Strongly disagree

8. My organization has a system in place to investigate and mitigate incidents involving CUI?
- Yes (branch question, see below)
- No
- I Don’t Know
8.a. How satisfied are you with the way your organization handles incidents involving CUI?






Very Satisfied
Satisfied
Neither Satisfied nor Dissatisfied
Dissatisfied
Very Dissatisfied

9. My workspace routinely handles (processes, discusses, stores) CUI?
- Yes (branch question, see below)
- No

Page 3 of 6

OMB Control No. 3095-0070
Expiration date 12/31/2020

9.a. I observe unescorted individuals who do not have a lawful government purpose or access to CUI in
my workspace.





Frequently
Occasionally
Rarely
Never

9.b. I have a place (or designated area) to discuss or have meetings that include CUI without being
overheard and where CUI is not visible to anyone not involved in the meeting.
- Yes
- No
10. Approved destruction equipment and methods are easy to find and use.






Strongly agree
Agree
Neither agree or disagree
Disagree
Strongly disagree

11. My organization conducts periodic reviews (i.e., inspections or assessments) to ensure the proper handling
and protection of CUI?
- Yes (branch question, see below)
- No
- I Don’t Know
11.a. Who in your organization conducts reviews (i.e., inspections or assessments) to ensure the proper
handling and protection of CUI? Select all that apply.





Designated individuals who are within my chain of command.
Designated individuals who are outside of my chain of command.
Unknown
Other (Please Specify)

11.b. How satisfied are you with your organization’s periodic reviews (i.e., inspections or assessments)
to ensure the proper handling and protection of CUI?






Very Satisfied
Satisfied
Neither Satisfied nor Dissatisfied
Dissatisfied
Very Dissatisfied

Page 4 of 6

OMB Control No. 3095-0070
Expiration date 12/31/2020

11.c. Which of the following options best describes the frequency with which your organization
conducts periodic reviews (i.e., inspections or assessments) to ensure the proper handling and protection
of CUI? Select all that apply.










Once Every Two Years
Annually
Every 6 Months
Quarterly
Monthly
Weekly
Daily
I Don’t Know
Other (Please Specify)

12. When marking CUI at my agency I am required to (select all that apply):









Include “CUI” or “CONTROLLED” at or near the top of every page of the document, including
in emails;
Include “CUI” or “CONTROLLED” at or near the bottom of every page of the document;
Include “SP-“ before any specified category marking;
Include portion markings throughout a document;
Include a designation indicator for all CUI documents;
Include a SF 901 Coversheet;
Include the word “DRAFT” in the CUI banner marking if the document is not final; and
Include applicable limited dissemination control markings.

13. Select the correct banner marking, appearing at the top of the page, for CUI BASIC information:




CUI
BASIC
No marking necessary

14. Select the correct banner marking, appearing at the top of the page, for a Specified Category:





CUI//SP-PRVCY
SP-PRVCY
SPECIFIED
No marking necessary

Page 5 of 6

OMB Control No. 3095-0070
Expiration date 12/31/2020

15. I am allowed to telework with CUI.
- Yes (branch question, see below)
- No

-

15.a. Are you permitted to print CUI at home when teleworking?
Yes (branch question, see below)
No

-

15.a.1. I store CUI at my telework site.
Yes (branch question, see below)
No

-

15.a.2. Do you have a way to secure CUI at your telework site.
Yes (branch question, see below)
No

-

15.b. I telework with CUI at locations other than my approved telework site.
Yes
No

PAPERWORK REDUCTION ACT PUBLIC BURDEN STATEMENT: You are not required to provide the information requested on a form
that is subject to the Paperwork Reduction Act unless the form displays a valid OMB control number. Public burden reporting for this collection
of information is estimated to be less than 5 minutes per response. Send comments regarding the burden estimate or any other aspect of the
collection of information, including suggestions for reducing this burden, to National Archives and Records Administration (MP), 8601 Adelphi
Rd, College Park, MD 20740-6001. DO NOT SEND COMPLETED FORMS TO THIS ADDRESS.

Page 6 of 6