CUI Documents Must Be Reviewed According to Which Procedures Before Destruction: The Full Control Chain

CUI documents must be reviewed before destruction under the procedures set by each agency's CUI program—typically a destruction review that verifies the document is no longer needed, confirms its CUI designation and any legal hold status, checks whether the agency or NARA requires retention, and documents the destruction itself in a certificate or log. The governing framework is 32 CFR Part 2002, which requires agencies to establish CUI destruction procedures consistent with the Federal Records Act, plus the ISOO marking handbook that defines the review steps. In practice, "review before destruction" means a documented, role-assigned check—not a quick look—because destruction is irreversible and an improper destruction can violate both records law and privacy law at once.

The keyword phrase gets typed into search bars by facility security officers, records managers, and IT staff who are about to press "delete" on something that says CONTROLLED. What they need is not a definition of CUI but a chain of custody: who reviews, what they check, in what order, and what evidence survives the shredder. This explainer walks that chain from legal driver to paper trail, with the thresholds and edge cases that thin guides skip.

What the destruction-review requirement actually obliges

CUI exists because Executive Order 13556 created a single government-wide system for unclassified information that still needs safeguarding. Before that order, agencies used ad hoc labels—"For Official Use Only," "Sensitive But Unclassified," "Law Enforcement Sensitive"—with inconsistent handling rules. The order moved that sprawl into one registry overseen by the National Archives and Records Administration, through the Information Security Oversight Office.

The implementing regulation, 32 CFR Part 2002, is short on destruction ceremony but precise on accountability. It requires each agency to designate a senior official, publish a CUI policy, and define destruction methods appropriate to the medium and the sensitivity. Crucially, it ties CUI destruction to the Federal Records Act: CUI that qualifies as a federal record cannot be destroyed on the CUI program's authority alone. Records retention schedules, not the CUI label, set the earliest legal destruction date. The CUI label sets the protection required until that date arrives.

That two-key structure—records authority plus information-protection authority—is the mechanism most short explainers miss. A destruction review is therefore two reviews fused into one: a records review (may this be destroyed, and when) and an information-protection review (how must it be destroyed, and what proves it was). 32 CFR 2002.14 and the ISOO CUI marking handbook supply the marking and safeguarding detail; NARA's records management regulations supply the disposition rules. The review procedure each agency publishes is where those two authorities get operationalized into checklists, roles, and forms.

Plain language: the CUI sticker decides how carefully you destroy the document; the records schedule decides whether you are allowed to destroy it at all.

The review chain, step by step

A defensible CUI destruction review runs as a sequence, and skipping a step usually means redoing the whole thing—or discovering the error during an audit. The steps below reflect the common structure agencies publish under their 32 CFR Part 2002 programs.

Confirm CUI status and category: identify the designation indicator (the agency marking block), the CUI categories applied, and whether any portion is also classified or carries special handling such as Privacy Act data. Run the records disposition check: match the document series to the applicable NARA-approved retention schedule and confirm the retention period has expired and no event-based trigger remains pending. Screen for legal holds and litigation: check with counsel or the agency's hold register for preservation obligations, FOIA requests, congressional inquiries, or open investigations that freeze destruction. Verify medium-specific destruction method: confirm the method (cross-cut shred, burn, degauss, cryptographic erase, physical destruction of media) meets the agency's standard for that CUI category and that contractors performing it are cleared and bonded as required. Execute and witness: destruction is performed by authorized personnel, with a second person or supervisor witnessing bulk destructions where the agency requires it. Record the certificate: log the date, document identifiers, quantity, method, personnel, and witness; retain the certificate per the applicable records schedule.

The counterintuitive detail sits in step two. Most improper destructions are not caused by someone ignoring the CUI label; they are caused by someone obeying it too eagerly—shredding a document because it looks sensitive, when the real problem is that it was a federal record with three years left on its retention clock. The CUI marking is a handling instruction, not a disposal permission slip.

Quantified context: timelines, volumes, and thresholds

Destruction review is not instantaneous, and the time cost is where compliance programs quietly fail. The table below shows the typical sequence and realistic durations for a mid-size agency or contractor program.

The retention period dominates the timeline by orders of magnitude. A routine administrative CUI record might become destruction-eligible in two years; a contract file might run six; records with permanent retention never become eligible at all and instead transfer to NARA. The destruction review itself is the short, high-stakes gate at the end.

Volume matters for method selection. Paper destruction via cross-cut shredding is standard for CUI on paper, with strip-cut shredders generally disallowed because strips are reconstructable. Electronic CUI requires either sanitization to a recognized standard or physical destruction of the storage device; overwriting alone is insufficient on modern drives where wear-leveling can leave residual copies. Bulk destructions—say, a room of case files—usually require a witnessed batch process and a manifest listing box or document identifiers, not just a count.

Where the procedure breaks: edge cases that defeat checklists

Edge cases are where destruction reviews earn their keep, because each one can convert a routine shred into a reportable incident.

Mixed-media documents. A single file may contain paper, a printed copy of an email, and a USB drive. Each medium has its own approved destruction method, and the review must cover all of them. Destroying the paper and forgetting the drive is a common audit finding.

Embedded third-party CUI. A document marked with one agency's CUI category may contain another agency's CUI, received under a sharing agreement. Some agreements require notification before destruction or specify the receiving agency's method. The review should confirm no sharing agreement overrides the local procedure.

Contractor-held CUI. Contractors handling CUI must flow down the safeguarding requirements, and destruction procedures must appear in the contract. A contractor that shreds on its own schedule without the agency's disposition authority has destroyed a federal record, regardless of good intentions.

Legacy labels. Documents marked "FOUO" or "SBU" predating the CUI program still exist in file rooms. They are treated as CUI for handling purposes, but their destruction still follows the records schedule. Programs that relabeled everything but never reconciled schedules create a class of documents nobody is sure how to dispose of.

Red-flag warnings worth posting at the shred bin:

A destruction request that arrives the same week as a FOIA request, subpoena, or audit notice covering the same records. Boxes of CUI with no disposition authority cited on the destruction request. Destruction certificates missing witness signatures or document identifiers. A vendor pickup scheduled without confirming the vendor's facility clearance or destruction standard. Electronic "deletion" of CUI files with no sanitization record for the media.

Misconceptions that survive because they sound efficient

The most durable misconception is that CUI destruction is a security function. It is a records-and-security function jointly, and the records half usually has veto power. Security officers who shred on sensitivity alone create records-law violations; records managers who dispose on schedule alone create information-protection violations when the method is wrong. The review exists to force both signatures.

A second misconception: that a destruction certificate is proof the document is gone. It is proof the process was followed, which is different. Certificates are only as good as the identifiers they list; a certificate that says "12 boxes, miscellaneous" cannot be matched to a disputed record later, which is exactly when it will be needed.

A third: that digital destruction is a keystroke. Deletion removes a pointer, not the data, and backup tapes, email archives, and cloud replicas may outlive the deletion by months or years. The review must account for replicas and backup rotation schedules, and the certificate should state which systems were purged and when. Some agencies handle this by scheduling destruction of CUI in backups on the backup rotation cycle rather than at the moment of primary deletion.

A fourth, subtler one: that destruction review can be delegated entirely to a records officer. Agency procedures typically assign the eligibility determination to records staff but keep the legal-hold screen with counsel and the method approval with the security office. The roles are separate on paper because they fail separately in practice.

Comparing disposition paths

Not every CUI document ends in a shredder. The table below contrasts the main paths and what each requires at review.

The comparison makes the reconciliation point explicit: the CUI label governs how a document is protected on every path, but only the records schedule and the hold register govern whether destruction may happen at all. A destruction review that checks one and not the other is half a review.

Practical actions: turning the chain into a routine

Programs that pass audits share a small set of habits. The first is a disposition authority field on every destruction request—a schedule number and item, not a free-text justification. Requests without a citation go back, no exceptions, because a citation is the cheapest possible test of whether anyone checked.

The second is a single hold register that both records staff and counsel can query before any destruction batch runs. The screen should be timestamped and attached to the batch manifest, so the review leaves its own evidence. A hold check older than the batch is not a hold check.

The third is method matrices by medium and category, published so that staff do not improvise. Cross-cut shredding for paper CUI, sanitization or physical destruction for electronic media, vendor standards spelled out in the contract, and a named approver for each method.

The fourth is certificate discipline. Every certificate lists document or box identifiers, quantity, method, date, operator, and witness. Certificates are themselves records and are retained per schedule—typically several years—because they are the only defense in a dispute about whether a record existed and when it was destroyed.

The fifth is periodic reconciliation: sample destruction batches quarterly against the hold register and the schedule to catch drift. Programs that skip reconciliation discover problems during litigation, which is the most expensive possible audit.

Limits of what this framework can settle

The procedures described here are stable across agencies because they derive from the same executive order and regulation, but the specifics vary. Each agency publishes its own CUI policy and destruction procedures, and contractors work under flow-down clauses that can be stricter than the agency's own rules. Nothing here tells you what a particular agency's schedule says about a particular series, and nothing substitutes for reading the applicable schedule and the agency's current CUI directive.

Evidence also ages. Retention schedules get revised, CUI categories get added or retired, and methods approved last year can be superseded. A procedure document that cites a schedule item should record the schedule version it relied on, so a later reviewer can tell whether the authority was current at the time of destruction. Where this article states mechanisms, they reflect the regulatory structure; where it states durations or volumes, treat them as planning ranges rather than audited statistics.

For legal questions about records disposition, litigation holds, or a specific destruction decision, consult your agency's records officer and legal counsel. This article is general educational information about how CUI destruction review procedures are structured, not a legal opinion or a compliance determination for any particular document, agency, or contract.