What is the goal of destroying CUI?
Confidential Unclassified Information (CUI) refers to sensitive data that, while not classified, is still subject to strict handling and sanitization requirements. The goal of destroying CUI is to ensure the data is rendered unreadable, indecipherable and irrecoverable, so it cannot fall into the wrong hands. This type of information is typically managed by federal agencies, defense contractors and other government-related organizations.
When it comes to protecting sensitive data, simple deletion isn’t enough. To comply with federal regulations and minimize security risks, organizations must take extra steps to ensure that Confidential Unclassified Information (CUI) is thoroughly sanitized beyond forensic recovery and, therefore, safe from unauthorized access.
In this blog, we’ll walk you through the key elements of CUI destruction:
- What is CUI?
- What is the goal of CUI destruction?
- When do you need to destroy CUI?
- How must CUI be destroyed?
- Step-by-step instructions on using trusted data sanitization tools, like BCWipe, to achieve secure and compliant erasure
What Is CUI?
CUI stands for Controlled Unclassified Information. This category of data includes sensitive information that, while not classified, must still be protected from unauthorized access. The U.S. National Archives and Records Administration (NARA) defines CUI as follows:
Controlled Unclassified Information (CUI) is information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies but is not classified.
Even though CUI isn’t classified, mishandling it can violate federal rules and create serious security risks. That’s why proper sanitization is mandatory.
What Is the Goal of Destroying CUI?
The CUI program was established to standardize how the Executive Branch handles this type of data and ensure consistent protection across federal agencies.
The primary goal of destroying CUI is to prevent unauthorized access once the data is no longer needed. Whether stored on paper or digital media, CUI must be disposed of in a way that makes it unreadable, indecipherable and irrecoverable.
Secure destruction supports the following objectives:
- Protects national interests by preventing leaks of sensitive but unclassified data
- Ensures compliance with federal standards, such as DoDI 5200.48, NIST SP 800-88 and 32 CFR Part 2002
- Maintains data integrity and confidentiality throughout the data lifecycle
When Do You Need to Destroy CUI?
CUI must be destroyed when it is no longer required for operational use and when permitted by the appropriate records retention schedule. Agencies must follow proper records management procedures before destruction.
How Must CUI Be Destroyed?
Once approved for destruction, the data must be rendered unreadable, indecipherable and irrecoverable.
If a specific law, regulation or government-wide policy requires a method of destruction, agencies must follow that method. Otherwise, for digital data, the most relevant guidance comes from NIST 800-88 Rev. 1, a widely recognized standard for media sanitization issued by the National Institute of Standards and Technology.
NIST SP 800-88 outlines 3 primary methods for sanitizing electronic media:
- Clear: Overwrite data using standard read/write commands, either once or with multiple passes.
- Purge: Apply advanced techniques, such as degaussing, secure erase or cryptographic erase, to make data unrecoverable.
- Destroy: Damage the media using methods like shredding, incineration or pulverization to prevent reuse.
While paper destruction also falls under CUI policy, this blog focuses on electronic media. For guidance on destroying printed CUI (e.g., using cross-cut shredders or disintegrators), refer to ISOO CUI Notice 2019-03.
Why the Right CUI Destruction Tool Matters
At the end of its lifecycle, data containing CUI must be permanently removed, not just deleted. Simple actions like sending files to the Recycle Bin or using basic delete commands can leave behind residual information, also known as Data Remanence.
Without proper sanitization, this data remains vulnerable to recovery by unauthorized individuals, potentially leading to security breaches or compliance violations.
Federal agencies, defense contractors and other government-affiliated organizations should rely on data erasure software like BCWipe to ensure secure and compliant CUI destruction. An effective solution should:
- Provide complete sanitization of targeted files and folders, including wiping data remanence, free space and temporary files beyond forensic recovery
- Support wiping standards aligned with widely accepted data erasure guidelines commonly used in defense and government sectors, such as U.S. DoD 5220.22-M, NIST 800-88 and U.S. DoE M 205.1-2
- Generate verifiable certificates of erasure to meet audit and compliance requirements
How to Use BCWipe to Destroy CUI
Ready to securely remove CUI from your systems? Follow these steps to securely erase CUI, whether you know exactly what needs to be deleted or you’re unsure where sensitive data may be hiding.
If you don’t already have BCWipe installed, contact us to request a free trial. You can use it as a standalone tool or deploy it across multiple devices using a central management console.
Step 1: Target Specific Files (You Know What Needs to Go)
If you already know which files contain CUI, you can erase them directly with BCWipe:
- 🖥️ Local Deployment (for single-computer use):
Install BCWipe on a single computer.
Once installed, you’ll see the “Wipe with BCWipe” option on your right-click menu.
Just right-click the target file or folder and select “Delete with wiping” to securely erase it beyond recovery. - 🌐 Centralized Deployment (for managing multiple computers via a central management console):
For broader use across multiple systems, deploy BCWipe through a central management console.
You can then create and push secure wiping tasks to multiple endpoints, targeting specific files or folders across your network.
Step 2: Search Before You Wipe (Not Sure Where CUI Is)
Not sure where CUI is stored? Before you can erase anything, you need to know what you’re dealing with. That’s where the Search tool in the central management console comes in—it helps you locate sensitive files across your network.
Here’s how to use it:
- Open the Search module in the central management console
- Start a new search and select the ‘CUI template’ from the Add Filter menu
- Run the search to identify files that match CUI criteria
- Review the results
- Select the files, then click “Wipe Data” to securely erase CUI in a single step
Step 3: Generate Wiping Reports & Logs for Compliance
Secure erasure is only part of the process. Whether you’re wiping CUI on a single computer or across a network, generating reports and logs helps demonstrate your compliance with internal policies and external regulations.
Here’s how to document your wiping activity:
- 🖥️ Local Deployment (for single-computer use):
BCWipe automatically creates a local wiping log on the workstation. Use these logs for internal tracking or as supporting documentation during audits. - 🌐 Centralized Deployment (for managing multiple computers via a central management console):
The central management console generates centralized wiping reports. Use these reports to document activity across all endpoints—ideal for compliance reviews and regulatory audits.
Meeting CUI Destruction Requirements with Jetico
Destroying Confidential Unclassified Information is a compliance obligation for any organization that handles sensitive federal data.
Trusted by the U.S. Department of Defense for over 20 years, BCWipe is Jetico’s solution for securely wiping selected files and folders beyond forensic recovery. With reliable tools like BCWipe, organizations can strengthen their data protection efforts, minimize the risk of mishandled information and ensure CUI is permanently erased.
When businesses need to go beyond selective file wiping, especially when dealing with full IT asset disposal, Jetico offers BCWipe Total WipeOut, a solution that sanitizes entire drives and ensures complete data erasure, even when operating systems are no longer accessible. BCWipe Total WipeOut supports both NIST Clear and Purge-level sanitization, helping organizations meet federal standards for secure data destruction.
Need to destroy CUI today? Start your secure wiping process with BCWipe by contacting our Data Protection Specialists and requesting a free trial.
Frequently Asked Questions (FAQs)
What Qualifies as CUI?
What qualifies as CUI?
Controlled Unclassified Information (CUI) includes unclassified data that federal law, regulation or policy requires to be protected and marked. Broad categories include:
- Privacy & Personal Data – such as health or student records, social security numbers, and other personally identifiable information
- Export-Controlled Material – data on technologies, software or items that could impact national security if improperly disclosed
- Technical & Defense Information – like engineering drawings, technical reports or defense-related specifications
- Financial Records & Procurement Data – including budgeting, contracts, sourcing, pricing and vendor documentation
- Law Enforcement or National Security Data – criminal records, surveillance intel, vulnerability assessments or infrastructure protection details
The NARA CUI Registry lists over 120 specific categories across domains like Privacy, Law Enforcement, Finance, Critical Infrastructure, Science & Technology and more.
Who Is Responsible for CUI Policy?
The National Archives and Records Administration (NARA) is responsible for overseeing the CUI Program and developing the related policies. Specifically, the Information Security Oversight Office (ISOO) within NARA issues directives and guidance for implementing CUI requirements across federal agencies.
While NARA sets the overarching policy, each executive branch agency is responsible for implementing and enforcing CUI rules internally.
How Should CUI Be Destroyed?
CUI must be destroyed in a way that renders it unreadable, indecipherable and irrecoverable. For digital media, this means using data sanitization methods such as wiping or degaussing, in line with NIST 800-88. For paper, cross-cut shredding or pulverization may be required.
How Do You Identify CUI?
CUI (Controlled Unclassified Information) is often marked with labels like “CUI” or category-specific tags (e.g., CUI//SP-PROPRIETARY) on documents, emails or files. If no markings are present, look at the content. When unsure, refer to your organization’s CUI policies or consult the CUI Registry maintained by NARA.
What Is the Relationship Between CUI and DoDI 5200.48?
DoDI 5200.48 is the Department of Defense’s policy for handling CUI. It provides specific guidance on how CUI must be marked, protected and destroyed within DoD operations, in line with federal requirements set by NARA.