Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1696589303761.pdf (United States)
Lawful Government Purpose: The standard for sharing and protecting CUI under the CUI program is “Lawful Government Purpose.” Lawful Government Purpose is a pro-active standard to apply in making decisions about when to share and when not to share information between Federal agencies and non-Federal partners who handle CUI in government projects and operations.

The definition of Lawful Government Purpose is explicit in the Federal regulation establishing the CUI program [32 CFR 2002.4 (bb)].
Lawful Government Purpose is a dynamic standard for deciding when to share and when not to share CUI, because it focuses on the purposes CUI may serve as a resource in achieving the mission objectives of government operations and projects.
In principle, CUI should be [but is not required to be] shared between Executive branch agencies and with non-federal partners, when for example the CUI resource (the contents of CUI), will help to achieve the goals of a common project or operation between Federal agencies or under a contract or agreement with the designating agency.

If sharing the CUI resource would obstruct or harm the government purpose, then do not share the CUI.
REMEMBER: Lawful Government Purpose is any activity, mission, function, operation, or endeavor that the U.S. Government authorizes or recognizes as within the scope of its legal authorities or the legal authorities of non-executive branch entities (such as state and local law enforcement).

The mandate for sharing and protecting CUI follows agency policies, which implement the CUI program across the Federal government.
All agency policies follow the same fundamental rules that distinguish between CUI Basic and CUI Specified, and which allow designating agencies to apply Limited Dissemination Controls approved by the CUI Executive Agent.

Agencies may only designate information as CUI under the authority of a law, Federal regulation, or Government-wide policy.

If the authority identifies what information to control without further asserting how to control it, that is CUI Basic.
If the law, Federal regulation, or Government-wide policy goes further into details about how to control information, that is CUI Specified.

The categories and sub-categories for all CUI, and the details for how to control CUI Specified, appear in the CUI Registry.
The CUI Registry also lists Limited Dissemination Controls, which may be applied to CUI (Basic and Specified) by Authorized Holders – unless, in the case of CUI Specified, such a Limited Dissemination Control conflicts with the law, Federal regulation, or Government-wide policy that establishes that category or subcategory.

An “Authorized holder is an individual, agency, organization, or group of users that is permitted to designate or handle CUI” (32 CFR 2002.4 (d)).
The CUI program only permits Authorized Holders – those who designate or handle CUI – to apply additional markings called Limited Dissemination Controls, to CUI handled or designated by the Authorized Holder.

All Limited Dissemination Controls must be approved by CUI Executive Agent and listed in the CUI Registry, which currently lists just seven (for example, CUI marked “FED Only,” further restricts sharing to Federal Employees; CUI marked NOCON, prohibits sharing with Contractors).
Authorized Holders should apply these Limited Dissemination Controls only to promote a Lawful Government Purpose.

In short, the principle of Lawful Government Purpose requires that Authorized Holders of CUI must not share CUI where sharing is prohibited, restricted, or further subject to Limited Dissemination Controls.

Sharing all CUI (including CUI Basic) is prohibited outside of Executive branch agencies, or non-Federal partners under contracts or agreements with Executive branch agencies.
Prohibitions and restrictions on sharing categories and subcategories of CUI Specified must be specific, based on specific laws, Federal regulations or Government-wide policies.

It is also important to remember that CUI EA-approved Limited Dissemination Controls applied by Authorized Holders to promote a Lawful Government Purpose, may further restrict and prohibit the sharing of CUI in certain ways.

(More examples: NOFORN, No Foreign Dissemination; DL, Dissemination List Controls).
Finally, Lawful Government Purpose is a dynamic standard, which requires risk-based decision making.

To get the most out of CUI resources, Authorized Holders must respond to risks and opportunities as they develop.

When sharing CUI will promote the objectives of a government project or operation, then share it with other Executive branch agencies, and non-Federal partners under contracts and agreements.
Protect, and do not share CUI when law, Federal regulation, or Government-wide policy prohibit sharing.

Government projects and operations require Authorized Holders of CUI to assess risks, and respond to opportunities, in determining whether sharing or restricting access within the law will best promote a Lawful Government Purpose.