This question recently came across my desk: “Where are the instructions for postal mailing of CUI?”
The answer is right in 32 CFR 2002.14(d), and it is considerably simpler than many people expect.
You can hard-copy mail CUI.
You can use USPS or a commercial delivery service
In fact, the government-wide CUI regulation expressly permits authorized holders to send CUI using the United States Postal Service or a commercial delivery service. The regulation recommends using in-transit automated tracking and accountability tools.
No special “CUI-certified” carrier is required. There is no general requirement to use registered mail. FedEx and UPS are not required to have some special CUI authorization.
Protect the CUI without advertising its presence
The important distinction is between protecting the CUI and advertising its presence.
The CUI itself must be appropriately marked and protected. The exterior package should not be marked “CUI.”
The NARA CUI Marking Handbook instructs senders to address packages for delivery only to a specific recipient, keep CUI markings off the outside of the envelope or package, and use tracking and accountability tools where possible. Check agency implementation guidance for any additional instructions, including restrictions on forwarding.
What that looks like in practice
In practical terms, mailing ordinary CUI Basic can be as straightforward as placing the properly marked material in an appropriate envelope or package, addressing it to an authorized recipient, and sending it through USPS, FedEx, UPS, or another commercial carrier with tracking.
Of course, always check whether the particular CUI category holds additional special control requirements or whether your contract or agency has imposed additional handling requirements.
Often the best place to start is simply with the regulation.
For mailing CUI, that place is 32 CFR 2002.14(d).
The regulatory text
(d) Protecting CUI when shipping or mailing. When sending CUI, authorized holders:
- May use the United States Postal Service or any commercial delivery service when they need to transport or deliver CUI to another entity;
- Should use in-transit automated tracking and accountability tools when they send CUI;
- May use interoffice or interagency mail systems to transport CUI; and
- Must mark packages that contain CUI according to marking requirements contained in this part and in guidance published by the CUI EA. See § 2002.20 for more guidance on marking requirements.
Source: 32 CFR 2002.14(d), Protecting CUI when shipping or mailing. For the full regulation, see 32 CFR Part 2002. For exterior package markings, see the CUI Marking Handbook, page 30.
