Controlled Unclassified Information (¶¶ÒõÂÃÐÐÉäI) Policy

Effective: November 1, 2025 

Approved by: Justin Schwartz, Chancellor

Policy Owner: Office of Compliance, Ethics and Policy (OCEP)

Policy Contact: Information Security Officer

Supersedes: N/A

Applies to: Faculty, staff, students, ¶¶ÒõÂÃÐÐÉä Boulder affiliates

I. Introduction

On November 4, 2010, Federal Executive Order 13556 Controlled Unclassified Information (the Order) established a comprehensive Controlled Unclassified Information (¶¶ÒõÂÃÐÐÉäI) Program for the Executive Branch of the government (Government) and all agencies. The Order designated the National Archives and Records Administration (NARA) to serve as the Executive Agent to implement and oversee federal agency actions to ensure compliance with the Order. The Order was further codified by 32 CFR Part 2002 Controlled Unclassified Information as published in the Federal Register on September 12, 2016, which established the National Archives and Records Administration (NARA) as the governing federal agency overseeing ¶¶ÒõÂÃÐÐÉäI.

The following policy is established to maximize the University of Colorado Boulder’s (¶¶ÒõÂÃÐÐÉä Boulder) ability to abide by its legal commitments and comply with the rules and regulations of the Government ¶¶ÒõÂÃÐÐÉäI Program. All ¶¶ÒõÂÃÐÐÉä Boulder employees, students, and affiliates who are authorized to use University IT resources and to receive, access, process, store, generate, or transmit information as part of their ¶¶ÒõÂÃÐÐÉä responsibilities and designated as ¶¶ÒõÂÃÐÐÉäI by NARA or Federal Agencies are subject to this policy.

II. Definitions

Controlled Unclassified Information: means any information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or allows an agency to handle using safeguarding or dissemination controls. It is information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and Federal Government-wide policies but is not classified under Executive Order 13526 or the Atomic Energy Act, as amended.

¶¶ÒõÂÃÐÐÉä Person: This includes all individuals who are authorized to use University IT resources and may hold roles such as:

  1. ¶¶ÒõÂÃÐÐÉä Boulder faculty, researcher, staff, and student.
  2. IT Service Provider
  3. Person of Interest (POI): an individual affiliated with the university but not paid as an employee for official university needs.
  4. Sponsored Affiliate: an individual affiliated with the university for official university needs when an HR appointment, including POI, is not a possibility.
  5. An individual who may be authenticated by external means and authorized by a ¶¶ÒõÂÃÐÐÉä IT service provider to access ¶¶ÒõÂÃÐÐÉä-managed IT services or data (e.g., an external research collaborator or contractor authenticated via federated techniques).

IT Resource: Computers, networking equipment, storage media, software, and other electronic devices that store, process, or transmit University information. In the context of IT security policy, this includes all IT resources that are owned, leased, licensed, or authorized for use by the University.

III. Policy Statement

  1. ¶¶ÒõÂÃÐÐÉä Boulder will establish and maintain a ¶¶ÒõÂÃÐÐÉäI program to address legal and contractual requirements for handling information as prescribed by NARA and federal agencies.
  2. ¶¶ÒõÂÃÐÐÉä Persons who handle ¶¶ÒõÂÃÐÐÉäI are responsible for safeguarding ¶¶ÒõÂÃÐÐÉäI in accordance with this policy and the standards, guidelines, and best practices established by the university’s ¶¶ÒõÂÃÐÐÉäI program. ¶¶ÒõÂÃÐÐÉä Persons may have additional responsibilities based on their use of ¶¶ÒõÂÃÐÐÉäI as specified in the ¶¶ÒõÂÃÐÐÉäI Standard.
  3. ¶¶ÒõÂÃÐÐÉä Boulder’s ¶¶ÒõÂÃÐÐÉäI program will facilitate ¶¶ÒõÂÃÐÐÉä Persons fulfilling safeguarding responsibilities by providing resources, including training and coordinated campus website(s), devoted to providing information regarding the ¶¶ÒõÂÃÐÐÉä Boulder ¶¶ÒõÂÃÐÐÉäI program. The training and resources shall include specific information for identifying ¶¶ÒõÂÃÐÐÉäI, appropriately marking ¶¶ÒõÂÃÐÐÉäI, requirements for controlling and protecting ¶¶ÒõÂÃÐÐÉäI information, and handling and reporting of incidents related to ¶¶ÒõÂÃÐÐÉäI as required by applicable Federal laws, rules, regulations, and contractual requirements.
  4. ¶¶ÒõÂÃÐÐÉä persons who handle ¶¶ÒõÂÃÐÐÉäI must complete all applicable training as defined in the ¶¶ÒõÂÃÐÐÉäI Standard or specified by their role.
  5. ¶¶ÒõÂÃÐÐÉä Boulder’s secure enclave(s) must operate under the unified governance structure leveraging campus-wide interdependencies to ensure coordination and oversight.
  6. The Senior Vice Chancellor for Research (SVCR), the Vice Chancellor for IT (VC for IT), and Information Security Officer (ISO), in coordination with the Office of Compliance, Ethics and Policy (OCEP) are responsible for:
    1. having the ultimate authority and oversight of ¶¶ÒõÂÃÐÐÉäI on campus.
    2. establishing and maintaining ¶¶ÒõÂÃÐÐÉä Boulder’s ¶¶ÒõÂÃÐÐÉäI program;
    3. establishing ¶¶ÒõÂÃÐÐÉä Boulder’s ¶¶ÒõÂÃÐÐÉäI Compliance Steering Committee with representative campus stakeholders to participate thereon;
    4. reporting ¶¶ÒõÂÃÐÐÉäI-related incidents, in consultation with University Counsel, in accordance with Federal Requirements;
    5. reviewing and reporting on program effectiveness to the University Executive Leadership Team (UELT);
    6. executing any other related responsibilities as assigned by the Chancellor or their designee(s).
  7. ¶¶ÒõÂÃÐÐÉä Boulder’s ¶¶ÒõÂÃÐÐÉäI program includes a ¶¶ÒõÂÃÐÐÉäI Compliance Steering Committee. Members of the Committees shall include a cross-representation of campus stakeholders. The duties of the steering committee include but are not limited to the following, as established in the committee’s charter:
    1. creating, revising, and publishing campus ¶¶ÒõÂÃÐÐÉäI standards, best practices, and resources supporting the campus ¶¶ÒõÂÃÐÐÉäI program;
    2. developing and maintaining ¶¶ÒõÂÃÐÐÉäI training content, including the frequency of trainings;
    3. proactively communicating with appropriate campus stakeholders regarding the shared responsibilities of interacting with ¶¶ÒõÂÃÐÐÉäI in accordance with standards, best practices, training, and resource information;
    4. periodically reviewing and approving updates to this Policy and the campus ¶¶ÒõÂÃÐÐÉäI standard.

IV. Procedures

Any ¶¶ÒõÂÃÐÐÉä Person who handles ¶¶ÒõÂÃÐÐÉäI in violation of Federal law, Contractual requirements, or University or Campus policy is subject to loss of privileges, disciplinary action, personal liability, and/or criminal prosecution. Further, ¶¶ÒõÂÃÐÐÉä Boulder may temporarily block or remove ¶¶ÒõÂÃÐÐÉä Boulder IT resource access when ¶¶ÒõÂÃÐÐÉäI is mishandled or used for inappropriate or illegal use.

If there is a need outside of the campus ¶¶ÒõÂÃÐÐÉäI IT solution, a department or unit may support an additional enclave if it meets the minimum requirements as set out in the ¶¶ÒõÂÃÐÐÉäI standards, is vetted through the Office of IT Security, and is approved by the ¶¶ÒõÂÃÐÐÉäI Steering Committee.

The SVCR, along with the VC for IT shall, as determined by the circumstances of a potential policy violation, work with the appropriate University offices such as University Counsel, the Office of Student Conduct (in cases involving students), the ¶¶ÒõÂÃÐÐÉä Boulder Police Department, Infrastructure and Resilience, Office of Contracts and Grants, the Office of Research Integrity, deans and directors, supervisors and others to enforce the ¶¶ÒõÂÃÐÐÉäI Policy.

Exceptions to the ¶¶ÒõÂÃÐÐÉäI Policy will be considered on a case-by-case basis by contacting the Office of Compliance, Ethics and Policy at: compliance@colorado.edu Exception requests will be reviewed by the ¶¶ÒõÂÃÐÐÉäI Program Manager, and Office of IT Security and may be forwarded to the SVC for Research and VC for IT for final decision.

V. Related policies, forms, guidelines and other resources 

  3. Acceptable Use of ¶¶ÒõÂÃÐÐÉä Boulder's IT Resources Policy
  8. ¶¶ÒõÂÃÐÐÉäI security requirements; refer to relevant project contract to determine whether revision 2 or 3 is applicable:
  9. DFARS Clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting

VI. History

  1. Adopted: January 1, 2025
  2. Revised: November 10, 2025
  3. Last Reviewed: November 10, 2025