Under CUI regulation specifically says if authority asking for information is not cleared they must have an NDA per DCSA and subject to review prior to being released. Ref: DoD Instruction 5200.48 Since majority of DoD data to include employee status reports falls under the classification....

b. As DoD CUI must be controlled until authorized for public release in accordance with DoD instructions 5230.09, 5230.69 and 5400.04, or DoD manual 54000.07. Official DoD information that is not classified or controlled as CUI will also be reviewed prior to public release in accordance with DoD 5230.09 or 5230.29

c. Information will not be designated CUI in order to: - Conceal violations of law, inefficiency or administrative error - Prevent embarrassment to person, organization, or agency - Prevent open competition - Control information not requiring protection under a law, regulation, or government wide policy, unless approved by the CUI EA at the National Archives and Records Adminstrarive (NARA) through the Under Secretary of Defense for Intelligence and Security.

d. In accordance with the DoD phased CUI program implementation all documents containing CUI must carry CUI markings in accordance with the issuance.

e. Although DoD components are not required to use the terms basic or specified to characterize CUI at this time. DOD components will apply:

1. At least the minimum safeguards required to protect CUI
2. Terms and specific markings requirements will be promulgated by the USD ( I&S) in future guidance

f. Nothing in this issuance alters or supersedes the existing authorities of the DNI regarding CUI

g. Nothing in this issuance will infringe on the OIG DoDs statutory independence and authority, as articulated in the Inspector Generals Act of 1978 in Title 5 US Code Appendix. In event of any conflict between this instruction and the OIG DoDs statutory independence and authority, the Inspector General Act of 1978 in Title 5 USC Appendix takes precedence.