On December 8, the NRC issued Regulatory Issue Summary (RIS) 2022-03 detailing its plans regarding the use of “Information-Sharing Agreements” to share controlled unclassified information (CUI) with non-executive branch entities. The NRC is targeting the summer of 2023 to begin establishing formal agreements with NRC licensees, applicants, certificate of compliance (CoC) holders, agreement state radiation control program directors, state liaison officers, and tribes.
Background
As detailed in a series of previous Up & Atom posts on December 30, 2021, December 8, 2021, and January 24, 2019, the NRC is in the process of replacing its legacy sensitive unclassified non-safeguards information (SUNSI) program with a new CUI program consistent with the government-wide CUI rule in 32 CFR Part 2002. Among other things, that rule requires agencies to enter into formal information-sharing agreements, whenever feasible, when they intend to share CUI with a non-executive branch entity.
The NRC’s CUI public website provides additional information regarding the transition to CUI, including a living document of frequently asked questions about CUI.
RIS 2022-03
In its recently released guidance in RIS 2022-03, the NRC noted that its information-sharing agreements will set forth safeguarding, access, and dissemination controls for CUI shared with outside entities. Most notably, the NRC confirmed that it will require compliance with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations,” for non-executive branch entities that take possession of CUI on a non-Federal information system.
However, the NRC is also providing a “view only” alternative for non-executive branch entities that do not meet NIST SP 800-171, or do not intend to take possession of CUI on an information system. This “view only” mode will permit signees to securely view CUI electronically without having to take possession of CUI onto their non-federal information system.
Looking Ahead
The NRC is expected to begin establishing formal CUI information-sharing agreements in the summer of 2023. However, the agency also plans to hold additional public meetings in the coming months to report on progress made towards finalizing CUI information-sharing agreements, including scheduling.
As Morgan Lewis continues to counsel NRC-regulated entities that handle sensitive information, we will closely follow developments in this area.