What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Do not enter classified information or Controlled Unclassified Information (CUI) into an AI assistant unless the specific system and its connected environment are authorized for that information and your agency has approved the use. ISOO Notice 2026-01 prohibits agency personnel from inputting classified information or CUI into AI systems that are internet-enabled, connected to infrastructure outside agency control, or otherwise connected to environments that lack the applicable accreditation or CUI protections. A privacy toggle or a user’s own judgment cannot establish that a system meets those requirements.
First, identify what kind of information you have
“Sensitive” is not a single government information category. Before using an AI assistant, determine the information’s classification or CUI status and follow its governing handling rules and your agency’s policy. Do not assume that information is unrestricted just because it is unclassified.
As an Amazon Associate I earn from qualifying purchases.
| Information category | What it means for AI use |
|---|---|
| Classified national security information | Handle under Executive Order 13526 and its implementing regulation, 32 CFR 2001. Do not enter it in an AI system unless the system and environment are accredited for classified information and the use is authorized by your agency. ISOO Notice 2026-01 |
| Controlled Unclassified Information (CUI) | CUI is unclassified information that still requires safeguarding or dissemination controls. Handle it under Executive Order 13556, 32 CFR 2002, applicable CUI requirements, and agency policy; use only an AI environment that meets the required CUI protections and is approved for the information. ISOO Notice 2026-01 |
| Other government information | Its sensitivity alone does not establish whether it is classified or CUI. Check the applicable records, privacy, contract, agency, and system-use rules before entering it into an assistant. Do not treat the absence of a CUI marking as permission to disclose information if other rules restrict it. |
ISOO Notice 2026-01, dated March 30, 2026, directs agencies to apply the rules governing classified information and CUI to AI use. For CUI program context, ISOO Notice 2026-07, dated September 2, 2026, describes agency requirements for documented policies and procedures, consistent marking, personnel training, and safeguards for CUI at rest and in transit. Read ISOO Notice 2026-07.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check the specific system—not just the chatbot brand
Authorization depends on the actual service environment and how it is connected and operated. Ask agency security and information-governance officials to assess the exact assistant, account or deployment, connected services, and intended use. Under ISOO Notice 2026-01, agency personnel may not input classified information or CUI into an AI system if it is internet-enabled, connected to infrastructure external to agency control, or connected to an environment that lacks the applicable classified-information accreditation or CUI protection standard.
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
Questions for the approving officials
- Is this specific system accredited for the classification level involved, or does it meet the protection standards applicable to the CUI involved?
- Does it connect to the public internet, external infrastructure, or other systems outside agency control?
- What data may the service store, retain, transmit, or expose through its connected tools and integrations, and what controls apply?
- Is the proposed use allowed by agency policy, and are there limits on the information, users, tasks, or outputs?
ISOO advises agencies to involve the CIO, CISO, CUI program manager, classification management staff, and IT staff in decisions about AI use, and to update relevant classified-information and CUI policies. Follow your agency’s authorization process rather than treating a vendor’s general privacy statement, a “private” chat setting, a consumer subscription, or deletion of chat history as proof of authorization; those details do not establish accreditation or CUI compliance.
Use a decision process before entering any information
- Identify the information. Check its markings, designation, source, and applicable handling rules. If you cannot determine whether it is classified, CUI, or subject to another restriction, do not submit it until the responsible office clarifies its status.
- Confirm approval for the intended use. Check current agency policy and obtain a decision from the officials responsible for security and information governance. Approval of a tool for one kind of information or task does not automatically approve it for another.
- Verify the deployment and connections. Have the responsible technical and security staff assess the actual environment, including relevant integrations and data flows, against the applicable accreditation or CUI requirements. Do not infer suitability from a product name or account label.
- Follow handling controls while using the system. Use only the information and functions allowed by the authorization. Apply required markings and safeguards, and follow agency rules for information at rest and in transit.
- Check outputs before relying on or sharing them. Treat generated answers as unverified. Review them for errors, unsafe recommendations, and information that should not be disclosed, then follow the applicable handling rules for any output that contains government information.
What contractors need to check
For CUI handled in a nonfederal system, check the contract or other agreement and ask the contracting agency which requirements apply to the system components involved. NIST SP 800-171 Rev. 3, published in May 2024 and superseding Rev. 2, sets requirements for protecting CUI in nonfederal systems and organizations. It applies to components that process, store, or transmit CUI and components that protect them. NIST SP 800-171 Rev. 3.
Rank #2
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- This BookFactory log book is for security guards in any sector or business. You can report location, circumstances and report number.
- There are spaces to log the individual's names address, description and other identifying information. There are also spaces to note others involved, notes, and vehicle information if one was involved
- Wire-O, 100 Pages, Dimensions 3.5" x 5.25"
- Reorder SKU: LOG-100-M3CW-PP(Security-Report)
Do not assume every contractor must apply every enhanced requirement in SP 800-172 Rev. 3. Published in May 2026, it supplements SP 800-171 for CUI associated with a critical program or high-value asset; agencies select enhanced requirements based on mission and business needs and ongoing risk assessment. Ask the contracting agency whether it selected these requirements for the relevant program or asset. NIST SP 800-172 Rev. 3.
NIST SP 800-172A Rev. 3 provides assessment procedures for the enhanced requirements. NIST describes self-assessments, independent third-party assessments, and government-sponsored assessments as possible approaches; agencies and assessors can tailor assessment depth and coverage. An assessment approach is not, by itself, agency authorization to use a particular AI assistant. NIST SP 800-172A Rev. 3.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Account for risks from prompts and generated answers
Protecting inputs is not the only concern. An assistant can produce inaccurate or unsafe output, and a user may not understand how submitted information is processed or exposed. GAO reported that agency officials raised the possibility that generative AI could aggregate unclassified training information and unintentionally output classified information. It also reported that agencies must protect personal information, CUI, and classified data used in model training and deployment. These are oversight findings and reported concerns, not a measured rate of exposure across agencies. GAO-25-107653.
If you realize that restricted information may have been entered into an unapproved assistant, stop submitting information and promptly follow your agency’s incident-reporting and security procedures. Do not try to resolve the issue solely by deleting a chat or changing account settings.
Quick Recap
Best Value
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
