Executive Order 13556: Controlled Unclassified Information
President: Barack Obama
Replaced inconsistent sensitive-but-unclassified labels with a uniform program for legally protected unclassified information.
Status: In effect.
Is Executive Order 13556 still in effect? Yes. EO 13556 remains the foundation of the government-wide Controlled Unclassified Information program implemented through 32 CFR part 2002 and NARA oversight.
What does Executive Order 13556 do?
EO 13556 addressed a patchwork of agency labels for sensitive information that was not classified national-security information. Agencies had used different markings and disclosure practices for records involving privacy, business confidentiality, law enforcement and security. Obama directed a uniform Controlled Unclassified Information system so authorized holders could understand both protection requirements and opportunities to share information. Signed order.
The order made NARA the executive agent and required a public registry of approved categories, subcategories, markings and procedures. Agencies could not label a document CUI simply because an official disliked disclosure: the protection had to rest on a law, regulation or government-wide policy. If significant doubt remained about whether information qualified, the order said not to designate it CUI. This program excluded material classified under EO 13526 or the Atomic Energy Act and did not introduce a new classification level. Signed order.
Before and after
Before the order
Agencies had maintained inconsistent, sometimes nonpublic sensitive-but-unclassified policies. EO 13556 rescinded the May 7, 2008 presidential memorandum on CUI and replaced it with an executive-agent model, a common registry and implementation reporting. The intended change was consistent treatment across agencies instead of an unlimited new secrecy authority. Signed order.
After the order
Agency heads had to inventory their existing categories and identify the legal basis for proposed controls. NARA developed uniform implementation policies and required phased agency compliance plans. Its September 14, 2016 final rule established 32 CFR part 2002, effective November 14, 2016. The framework describes handling, marking, safeguarding, sharing and decontrol, while agency and contractor obligations still depend on applicable rules, agreements and the underlying information-protection authority. Signed order. Sources: NARA CUI final rule and effective date; NARA current CUI program and registry.
Who had to do what
| Agency / office | Action | Timing / position |
|---|---|---|
| NARA / Executive Agent | Approve uniform categories and markings, issue implementation directives, chair interagency meetings, maintain public registry, set phased deadlines and publish implementation reports. | Initial directives within 180 days; registry within one year; annual reports for first five years, then biennially. |
| Agency heads handling or originating CUI | Review old categories, submit proposed controls and legal bases, then propose compliance plans. | Category submissions within 180 days of signing; plans within 180 days after initial executive-agent policies. |
| OMB Director | Consult on phased implementation and serve as channel for unresolved disputes appealed to the President. | After review of agency plans; disputes as needed. |
| Director of National Intelligence | Issue consistent intelligence-community implementation policies after consulting affected heads. | As necessary; no fixed deadline. |
| Intelligence-community element heads | Align their procedures with DNI policies and executive-agent directives. | During implementation. |
| Attorney General | Interpret the order when an agency head or executive agent requests an administrative ruling. | Upon request; no fixed deadline. |
| National Institute of Standards and Technology | Provide government-wide standards and guidelines with which implementation must remain consistent. | Existing and applicable standards; no separate new deadline assigned. |
What happened next
Obama established the CUI program and made NARA executive agent. Official source
NARA published the final government-wide CUI rule. Official source
The CUI rule in 32 CFR part 2002 became effective. Official source
Legal and source detail
How it works legally
CUI designation does not decide a Freedom of Information Act request. Section 2(b) specifically says the label alone must not determine disclosure under laws requiring release or permitting discretionary release, including disclosure to Congress and courts. A record may require controlled handling while still needing a separate FOIA exemption analysis. Conversely, unclassified does not mean unrestricted when privacy or another statute controls distribution. NARA's implementation must respect statutory agency authority, confidentiality and privacy rights, NIST government-wide standards and OMB policies. Intelligence directives must remain consistent with the executive-agent framework rather than create a conflicting system. The order provides an appeal to the President through OMB for unresolved agency disputes, authorizes Attorney General interpretations on request and creates no private enforceable benefit. A contract or a regulation, rather than this label alone, must establish a particular recipient's binding obligations. Signed order. Sources: NARA CUI final rule and effective date; NARA current CUI program and registry.
Sources by type
If a source is unavailable, first check the cited publisher or another official repository. The cited publisher remains the authority.
Primary and official sources
Orders, laws, court records and official implementation material.
How we checked this
Last checked against the sources above on September 15, 2026. How we research →