32 CFR § 2002.22 - Limitations on applicability of agency CUI policies.

---
identifier: "/us/cfr/t32/s2002.22"
source: "ecfr"
legal_status: "authoritative_unofficial"
title: "32 CFR § 2002.22 - Limitations on applicability of agency CUI policies."
title_number: 32
title_name: "National Defense"
section_number: "2002.22"
section_name: "Limitations on applicability of agency CUI policies."
chapter_name: "INFORMATION SECURITY OVERSIGHT OFFICE, NATIONAL ARCHIVES AND RECORDS ADMINISTRATION"
part_number: "2002"
part_name: "CONTROLLED UNCLASSIFIED INFORMATION (CUI)"
positive_law: false
currency: "2026-03-24"
last_updated: "2026-03-24"
format_version: "1.1.0"
generator: "[email protected]"
authority: "E.O. 13556, 75 FR 68675, 3 CFR, 2010 Comp., pp. 267-270."
regulatory_source: "81 FR 63336, Sept. 14, 2016, unless otherwise noted."
cfr_part: "2002"
---


# 2002.22 Limitations on applicability of agency CUI policies.

(a) Agency CUI policies do not apply to entities outside that agency unless a law, regulation, or Government-wide policy requires or permits the controls contained in the agency policy to do so, and the CUI Registry lists that law, regulation, or Government-wide policy as a CUI authority.

(b) Agencies may not include additional requirements or restrictions on handling CUI other than those permitted in the Order, this part, or the CUI Registry when entering into agreements.