Three main entities can decontrol Controlled Unclassified Information (CUI):

• The originator or creator of the information.
• The Original Classification Authority (OCA), if the CUI is identified in a Security Classification Guide.
• Designated offices authorized for decontrolling CUI, which vary depending on the agency and type of information.

Decontrolling means removing the controls that safeguard or limit dissemination of the CUI, but it does not mean the information is publicly released or destroyed. Decontrol can happen automatically under certain laws or policies, or proactively by authorized agencies when the information no longer requires protection

. Government contractors typically cannot decontrol CUI themselves unless specifically authorized by contract provisions. They must wait for official decontrol actions by these authorized entities and then remove CUI markings accordingly

. In summary, only the originator, the OCA, or designated decontrol offices have the authority to decontrol CUI according to federal regulations and DoD instructions