The Department relies on schools participating in the federal student financial assistance programs and other grant programs under the Higher Education Act (HEA) to help carry out a wide range of business functions. Schools routinely process, store, and transmit Controlled Unclassified Information (CUI), which includes personally identifiable information (PII), sensitive personally identifiable information (SPII), and information. The protection of sensitive data while residing in school information systems is of paramount importance to the Department.

To assure schools properly protect CUI, as required by Executive Order 13556, and the regulations at 32 CFR part 2002 which require non-Federal entities handling CUI to implement NIST 800-171 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (NIST 800-171), the Department plans to propose to regulate on information security requirements.