CUI Handling and Data Classification Course (Self-Paced)
IDCYSE7006SP

Module 1

• Introduction to CUI and the Federal Framework
• Defining CUI in plain language
• The three-tier framework of classified, CUI and public
• Where CUI comes from and why personal judgment does not create it
• Executive Order 13556 and 32 CFR Part 2002
• The roles across the CUI lifecycle. Includes a sort-the-information-tier activity.

Module 2

• CUI Categories and Recognizing CUI
• The CUI Registry as the single authoritative source
• CUI Basic versus CUI Specified
• Common category groupings covering privacy, procurement-sensitive, law-enforcement-sensitive and export-controlled or critical infrastructure information
• Everyday examples
• What CUI is not. Includes a CUI-or-not-CUI sorting activity.

Module 3

• Marking and Labeling CUI 
• Why markings are handling instructions rather than decoration
• Banner marking components
• Portion marking
• Marking email, removable media and file names
• What to do with unmarked or mismarked CUI. Includes a build-the-banner-marking assembly activity and a marking-location matching activity.

Module 4

• Safe Handling, Storage, Transmission, and Destruction
• Need-to-know
• Physical storage and visual access
• Authorized systems and approved storage locations
• Encrypted transmission and approved file transfer
• Remote work and travel
• Destruction and media sanitization
• The common mistakes that cause most incidents. Includes a scenario-to-safeguard matching activity.

Module 5

• Incident Reporting, Consequences, and Emerging Considerations
• What counts as a CUI incident
• Reporting promptly and to whom
• Why speed reduces harm
• What not to do
• The range of administrative, civil and criminal consequences
• CUI and artificial intelligence under current government-wide guidance