California Views
The Pat Hathaway Photo Collection
Mr. Pat Hathaway, Photo Archivist
Historic Monterey, California • (831) 373-3811
Historic Monterey, California • (831) 373-3811
CUI Photography now requires closer review in archives that hold sensitive wellness, health, rehabilitation, or community care images. On September 2, 2026, the Information Security Oversight Office published revised Executive Agent guidance for implementing the Controlled Unclassified Information Program, revising and rescinding CUI Notices 2022-01 and 2020-01 in ISOO Notice 2026-07. For photo collections, the practical issue is not that every sensitive-looking image becomes controlled. The issue is that agencies, contractors, museums, and archive partners need a documented basis for how images are identified, marked, safeguarded, shared, and later reviewed for access.
Photography adds a specific challenge because meaning is often carried in context. A frame may show a person, a clinic room, a training program, or a government activity, but the image alone may not reveal whether CUI rules apply. Catalog notes, captions, accession files, donor records, and related documents can change the status of the image. For wellness collections, that context may involve personal privacy or sensitive program information. A cautious archive treats the photograph and its descriptive record as a linked evidence set.
Wellness-related archives can include images made for public communication, internal documentation, training, inspection, research, or participant support. The CUI question depends on the applicable law, regulation, or government policy tied to the record. It should not be answered by visual impression alone. A photograph of a fitness class, for example, may be open outreach material in one collection and restricted program documentation in another, depending on the record context supplied by the controlling office.
CUI Photography does not mean turning an archive into a closed system by default. The revised guidance points toward consistent protection of sensitive government information, including information in physical and digital forms. That matters because over-restriction can limit public access and research value, while under-review can expose material that should have remained controlled. Both outcomes weaken trust in the archive.
The confirmed federal change is the September 2, 2026 ISOO guidance. Local procedures may still vary by agency, repository, contract, or collection agreement. For that reason, photo staff should separate three things in their notes: what the federal guidance says, what the originating agency has determined, and what the repository is doing as an internal handling practice. That separation is especially useful when a collection contains both unrestricted photographs and images that may require controls.
For photography teams, the safest editorial habit is to avoid altering the historical image to make a policy point. Instead, the record can preserve the original image while access systems, captions, metadata fields, container labels, or review logs carry the handling information required by the responsible institution. This keeps the visual record stable while still supporting compliance review.
On May 13, 2026, NIST listed updated enhanced security requirements and assessment material for protecting CUI on nonfederal systems and organizations through its NIST CUI project. For archives, the nonfederal point is central. A museum, contractor, university lab, digitization vendor, or preservation partner may process government-linked images outside a federal environment. If those images are CUI, the digital storage and processing environment becomes part of the handling question.
This does not mean every archive needs the same technical system. It means the record owner and repository should know whether the collection includes CUI and whether a nonfederal system is being used to scan, store, catalog, back up, transmit, or publish the material. The practical photography workflow begins before scanning: identify the controlling authority, confirm the status of the material, and document who made the determination.
Archival photography depends on metadata for provenance, description, rights, and access. CUI status, if present, should be treated as part of that recordkeeping environment. A useful review file can identify the source collection, the deciding office, the date of review, the handling status, and any access limits known to the repository. This does not replace formal agency instructions, but it helps prevent future staff from guessing.
Photo preservation staff may already document scanning resolution, color decisions, file formats, and records schedules. That habit connects with the records-care approach discussed in NARA digitization standards, where technical choices affect long-term access. For CUI, the same discipline applies to sensitivity review: record the decision, avoid informal relabeling, and keep the audit trail with the collection.
For CUI Photography stored or processed by an archive, the strongest workflow is a staged review rather than a single visual pass. First, identify whether the material came from a federal source, a contractor, or a partner that had CUI obligations. Second, compare the photograph with its caption, folder title, accession file, and related text records. Third, confirm whether the repository has authority to release, restrict, or refer the item back to another office. Fourth, record the decision in a place that future staff can find.
This workflow also protects the dignity of people depicted in wellness or fitness-related government collections. A photograph can be historically valuable without requiring public release of every associated detail. Careful description can let researchers understand the setting while avoiding unsupported statements about private health circumstances.
Archives serve communities by preserving evidence and enabling lawful access. The revised CUI guidance should not be read as a reason to close sensitive photo collections without review. It should be read as a reason to make review decisions traceable. Community historians, families, public health researchers, and photographers all benefit when an institution can explain why one image is open, another is restricted, and another has been referred for agency determination.
Photography also helps wellness communities see their own history: training programs, care settings, recovery events, and public education campaigns may all appear in archival records. The responsible approach is to protect sensitive government information where required while preserving the descriptive value of the collection. For broader comparisons in visual culture and archive practice, readers may also find additional insights within the same network at The Parative Project.
CUI Photography is best understood as a records-status issue, not a genre of photography. The same image style can be unrestricted in one context and controlled in another. The revised ISOO guidance, paired with NIST’s work on nonfederal systems, points archives toward consistent designation, clear documentation, and careful storage decisions. It does not remove the need for institution-specific review by the office or authority responsible for the records.
For wellness archives, the practical standard is restraint. Do not assume a photograph is controlled simply because it appears sensitive. Do not assume it is open simply because it is old, visually familiar, or already digitized. Keep the original image stable, link it to reliable metadata, document the review path, and make access decisions that reflect confirmed authority rather than guesswork. That approach supports preservation, lawful access, and public trust in photographic records.