Important Takeaways From DHS's Proposed Rule On Controlled Unclassified Information

The Department of Homeland Security (DHS) has now officially entered the government data security fray with its own proposed rule (HSAR Case 2015-001; 82 FR 6429; Jan. 19, 2017) for safeguarding Controlled Unclassified Information (CUI).

We have previously commented on the National Archives and Record Administration's Final Rule on CUI,  the Department of Defense's rules on Controlled Defense Information, and the morass of federal data security rules generally.

The DHS's CUI rule adds yet another layer of complexity, as federal contractors and subcontractors are now faced with the prospect of having to comply with different rules for different agencies.  This notion runs counter to the intent of Executive Order 13556 (75 FR 68675; Nov. 4, 2010), which sought to standardize the treatment of CUI across government.