CUI documents must be reviewed according to the agency's records disposition schedule and applicable destruction procedures before destruction. Under 32 CFR Part 2002, the reviewing official verifies that the record's retention period has expired, that no litigation hold, FOIA request, or audit applies, and that the destruction method matches the CUI category's requirements. Destruction without documented review is a reportable unauthorized disclosure risk.
This obligation sits at the intersection of three overlapping regimes: the Freedom of Information Act (FOIA), the Federal Records Act, and the CUI Program itself. Each imposes a review gate, and the gates do not close at the same time. A document can satisfy one and violate another.
The short answer that most thin explainers give, "follow the records schedule," is technically correct and operationally useless. Retention schedules run to hundreds of pages. Litigation holds arrive without warning. CUI designations expire on their own timeline regardless of the underlying record's retention period.
This explainer walks through the mechanism, the quantified context, the edge cases that break naive procedures, the misconceptions that survive audits, the practical steps that hold up, and the limits of what any procedure can guarantee.
The review mechanism: three gates, one document
Before a CUI document can be destroyed, three independent review processes must clear it. Each answers a different question, and each can stop destruction on its own.
The first gate is records disposition review. The Federal Records Act requires that no federal record be destroyed without authorization from the National Archives and Records Administration (NARA). The mechanism is the records control schedule: a document series is mapped to a disposition authority, and that authority specifies a retention period and a destruction instruction. The review confirms the series is correctly identified and the retention period has actually run.
The second gate is legal hold review. Litigation, congressional inquiries, FOIA litigation, and audits all impose preservation obligations that override any schedule. The review confirms no active hold applies to the document, its series, or the custodial file. This is the gate most often skipped, because holds arrive by email and schedules live in a records management system that does not talk to the legal hold tracker.
The third gate is the CUI designation review itself. CUI designations carry their own duration and decontrol rules. A document's CUI status can expire before its records retention period, and the reverse can also be true. The review confirms which designation applies at the moment of destruction and whether the controlling authority imposes any destruction-method requirement.
The plain-language version: you must prove the document is (1) old enough to destroy under its schedule, (2) not frozen by a legal hold, and (3) destroyable by the method your CUI category requires. All three, every time.
Quantified context: scale, timelines, and where the review burden concentrates
The review burden scales with document volume, and CUI volume is large. Federal agencies designate millions of documents as CUI each year across more than 100 designated categories under 32 CFR Part 2002. Each category carries its own marking requirements, safeguarding rules, and destruction instructions, which means a single custodial file can contain documents governed by five or more authorities.
Retention periods span a wide range. Temporary records commonly run from 2 years to 30 years, and some series extend to 75 years or longer. Permanent records are never destroyed; they transfer to NARA. That range matters for procedure design: a review process built for a 2-year series will fail on a 30-year series, because the document's CUI designation and the responsible officials will both have changed.
Destruction method requirements concentrate in the highest-sensitivity categories. Paper CUI is generally destroyed by cross-cut shredding or pulping; the specific particle size standard depends on the category's controlling authority. Electronic CUI is destroyed by deletion, overwriting, or physical destruction of the media, with the method matched to the media and the category. Reviewers must confirm the method in advance, because method mismatches are unrecoverable: once a document is improperly destroyed, no review can restore it.
The timeline table below shows the typical sequence for a scheduled destruction cycle. Durations are illustrative ranges drawn from common federal practice, not fixed legal deadlines; the controlling schedule for the specific series sets the actual numbers.
| Stage | Typical timing before destruction | What the reviewer confirms |
|---|---|---|
| Series identification | 12–24 months prior | The document maps to the correct records schedule and disposition authority |
| Retention expiration check | 6–12 months prior | The retention period has run and the cutoff date is documented |
| Legal hold sweep | 90 days prior, then again at 30 days | No litigation hold, FOIA request, audit, or congressional inquiry applies |
| CUI designation review | 60 days prior | The CUI category, duration, and decontrol status are current |
| Method verification | 30 days prior | The destruction method matches the CUI category's requirement |
| Final pre-destruction sign-off | 7–14 days prior | All prior gates cleared and the destruction is logged |
| Destruction and certificate | Day of destruction | Destruction is executed and a certificate of destruction is filed |
The counterintuitive detail: the final sign-off window is the most important and the most frequently compressed. Holds and FOIA requests arrive in the last 30 days of a destruction cycle far more often than in the first year, because requesters and litigants learn about scheduled destruction from public notices. A procedure that clears all gates 12 months out and does not re-check at 7 days is not a review procedure; it is a paperwork ritual.
Edge cases that break naive destruction review
Four edge cases account for most destruction errors in practice, and each requires an explicit procedural branch.
The first is the mixed file. A single folder frequently contains CUI documents from multiple categories, records with different retention periods, and non-record convenience copies. The review must proceed document by document, not folder by folder. Folder-level review is the single largest source of premature destruction, because the folder's label reflects the oldest or most prominent item, not the item with the longest retention.
The second is the expiring CUI designation. When a CUI designation lapses, the document does not stop being a federal record. It stops being CUI. The record's retention period continues to govern, and destruction without a new review is still a violation of the Federal Records Act. Reviewers who treat decontrol as a destruction trigger have inverted the procedure.
The third is the FOIA request that arrives after clearance. A FOIA request received before destruction freezes the record even if every other gate has cleared. The review procedure must include a request-receipt check at the final sign-off, not only at the 90-day checkpoint.
The fourth is the electronic backup. Deleting a document from a shared drive does not destroy it if a backup, archive, or litigation-hold collection holds a copy. Electronic CUI destruction review must confirm the destruction scope includes all copies, or must document that residual copies are under a separate authorized retention.
Red-flag warnings that should stop any destruction:
The document's series maps to more than one disposition authority and the file has never been reconciled. The legal hold tracker and the records management system are not integrated, so no automated hold check exists. The reviewer cannot name the specific disposition authority by number. The proposed destruction method differs from the method in the CUI category's controlling authority. A FOIA request, audit notice, or congressional inquiry was received in the last 90 days for the same program office. The destruction would occur during a government shutdown or office closure when the final sign-off cannot be re-verified.
Misconceptions that survive audits
The most common misconception is that destruction procedure is primarily about the shredder. In audit findings, method errors are less common than review-sequence errors. The failure is almost always that a gate was cleared once and never re-checked.
A second misconception holds that CUI designation and records retention are the same timeline. They are independent. CUI designation duration is set by the controlling authority for the category; records retention is set by the disposition schedule. A document can be decontrolled and still retainable for years, or still designated CUI and past its retention period (in which case destruction proceeds under the designation's method requirements after review).
A third misconception is that a certificate of destruction substitutes for review. The certificate documents what happened; it does not document that the gates were cleared. Auditors ask for the review record, not the certificate, and a certificate without a review record is treated as evidence of an unreviewed destruction.
A fourth misconception is that only permanent records require legal hold review. Temporary records are the more common hold target, because they are scheduled for destruction and therefore create urgency for requesters and litigants. Holds attach to temporary series more often than to permanent ones.
When alternatives exist for the destruction event, the comparison table below shows how the main approaches differ in review burden and risk. It reflects common federal practice rather than a single mandated standard; the controlling authority for each CUI category governs.
| Approach | Review gates covered | Typical weakness | Appropriate when |
|---|---|---|---|
| Folder-level review with single sign-off | Series and retention only | Misses holds, mixed files, and late FOIA requests | Never for CUI; acceptable only for non-record convenience copies |
| Document-level review with 90-day hold sweep | Series, retention, hold, CUI, method | Late-arriving holds between sweep and destruction | Standard temporary CUI series with stable legal posture |
| Document-level review with 90-day and 7-day hold re-checks | All gates, re-verified | Higher labor cost per document | Litigation-prone programs, FOIA-heavy offices |
| Automated schedule-plus-hold-tracker integration | All gates, continuously | Depends on tracker completeness and data quality | Large-volume CUI programs with mature records systems |
| Third-party certified destruction with agency review record | All gates plus vendor certification | Vendor chain-of-custody gaps | High-sensitivity CUI categories and offsite storage |
Practical actions: the review sequence that holds up
The procedure below reflects the sequence that survives audits. It is written for a records officer or CUI reviewer working a scheduled destruction cycle. Adjust the intervals to the series, but do not remove a gate.
Step 1: Identify the disposition authority by number. For each document series in the destruction batch, record the NARA disposition authority number and the retention period. If a series cannot be mapped to a single authority, stop and escalate before proceeding.
Step 2: Confirm the retention period has run. Document the cutoff date, the retention period, and the computed destruction eligibility date. Store this in the review record, not in the file being destroyed.
Step 3: Run the legal hold sweep at 90 days. Query the legal hold tracker, the FOIA tracking system, and the audit and inquiry logs for the series, the program office, and the custodial file. Record the query results. A negative result is a finding; record it.
Step 4: Review the CUI designation at 60 days. Confirm the category, the designation duration, the decontrol status, and the destruction method required by the controlling authority. If the designation has lapsed, confirm that the record remains a federal record and continue the review under the retention schedule.
Step 5: Verify the destruction method at 30 days. Match the method to the media and the CUI category. For paper, confirm the shred standard; for electronic media, confirm the sanitization or physical destruction standard. Record the method and the standard in the review record.
Step 6: Re-run the hold and FOIA check at 7 to 14 days. This is the gate that catches late-arriving holds and requests. Do not skip it because the 90-day sweep was clean.
Step 7: Execute destruction and file the review record with the certificate. The review record, not the certificate alone, is what auditors request.
Thresholds to reconcile explicitly: retention periods are measured from cutoff, not from document creation; CUI designation duration is measured from designation, not from creation; and legal hold periods run from the hold notice, not from the document date. A document that is 8 years old may be past a 7-year retention period, still within a 10-year CUI designation, and frozen by a hold issued 2 years ago. All three clocks must be checked.
Limitations: what a review procedure cannot guarantee
No review procedure can guarantee that destruction is correct in every case, and the CUI Program does not promise that. Three limits are structural.
The first limit is data quality. Automated schedule-plus-hold integration is only as good as the hold tracker and the records inventory. If a hold was never entered into the tracker, no automated check will catch it. The practical mitigation is the 7-day manual re-check, which is why it stays in the procedure even when automation is mature.
The second limit is timing. Holds and FOIA requests can arrive after the final sign-off and before the destruction is executed, particularly when destruction is scheduled during a shutdown or a holiday period. The only robust mitigation is to execute destruction promptly after the final sign-off and to log the execution time.
The third limit is scope. A review procedure covers the documents in the batch. It does not cover copies that were never inventoried, including personal downloads, shared drive duplicates, and email attachments. Electronic CUI destruction review must include a scope statement identifying what was searched and what was excluded.
A professional caveat worth stating: the review record is the deliverable. Destruction without a review record is treated as unreviewed destruction regardless of what actually happened, because the agency cannot prove the gates were cleared. Reviewers who treat the record as paperwork are creating audit exposure with every destruction cycle.
Discipline-specific note: this article addresses federal CUI handling under 32 CFR Part 2002 and related records law. It is general educational information, not a legal opinion or a compliance determination for any specific document, series, or agency. Records schedules, CUI category authorities, and agency-specific destruction procedures vary, and legal holds can override any schedule. Consult your agency records officer, CUI program office, or counsel before destroying CUI documents, and treat any active litigation, FOIA, audit, or safety-related hold as an immediate stop.