Information handling, classification and secure disposal

For all employees who handle business or personal information: classify it, handle it by its label, keep it as long as required, and destroy it so it cannot be recovered.

For: All employees who handle business or personal information, including office, HR, finance, records, property management, IT asset and federal contractor staff

  • 2 contact hours
  • 7 modules
  • 8 interactives
  • 4 job aids
  • Updated October 11, 2026

What you will be able to do

  • Explain why information is an asset and classify it as Public, Internal, Confidential or Restricted, accounting for aggregation, context and timing.
  • Recognize Controlled Unclassified Information and describe the basic marking, safeguarding, sharing and destruction requirements of 32 CFR Part 2002 for federal contractors.
  • Apply everyday handling controls, including clean desk and clean screen, need-to-know sharing, secure printing and mail, and visitor and tailgating controls.
  • Follow retention schedules and legal holds, and select secure disposal methods for paper and media consistent with the FTC Disposal Rule and NIST SP 800-88 Rev. 2.
  • Report information handling incidents promptly with the right facts, without investigating on your own, and support a fair reporting culture.

Learn to treat information as an asset across its whole lifecycle. You will classify information using a four-level scheme, recognize Controlled Unclassified Information (CUI) on federal contracts, apply clean desk, need-to-know sharing, secure printing and visitor controls, follow retention schedules and legal holds, and dispose of paper and devices in line with the FTC Disposal Rule and the 2025 revision of NIST SP 800-88.

This course is for every employee who handles customer, employee, client or business information, with practical detail for records, HR, finance, property management and IT asset staff and for teams working on federal contracts. No technical background is needed.

Most information exposure happens on desks, in printer trays, in misdirected emails and in recycling bins, not in data centers. The course uses realistic workplace scenarios, separates legal requirements from good practice, and gives you a handling and disposal checklist, a policy starter, a scenario worksheet and a one-page classification quick reference.

What you’ll be able to do Monday morning

  1. Lock your screen every time you step away and clear Confidential and Restricted paper into a locked drawer.
  2. Classify and label the files you create, and check hidden columns before sending any list outside.
  3. Use the shredding console for all non-public paper and return old devices and USB drives to IT.
  4. Check with legal or records staff for holds before any cleanup or destruction.
  5. Report misdirected emails, lost items and near misses immediately through the designated channel.

Curriculum

7 modules · 28 lessons · about 2 contact hours

01Why treat information as an asset, and what rules shape how you handle it?Free preview14 min
  1. What makes information an asset?
  2. Which laws and standards shape information handling?
  3. Who is responsible for information?
  4. What does good information handling look like day to day?
  • Self-assessment: How strong are your information handling habits?

Diagram · In practice checklist · 2-question knowledge check

02How do you classify information, and what does each label require?16 min
  1. What is a classification scheme, and why use one?
  2. How do you decide the right level?
  3. What handling rules go with each level?
  4. What about information you receive from others?
  • Sort activity: Classify it

Diagram · In practice checklist · 3-question knowledge check

03What is Controlled Unclassified Information, and what changes for federal contractors?16 min
  1. What is CUI?
  2. How is CUI marked?
  3. How do you safeguard, share and destroy CUI?
  4. What do you do if CUI is mishandled?
  • Matching activity: Match the term

Diagram · In practice checklist · 2-question knowledge check

04How do you handle, share, print and protect information every day?17 min
  1. What do clean desk and clean screen mean in practice?
  2. How do you store and share information on a need-to-know basis?
  3. How do you handle printing, copying and mail?
  4. How do you deal with visitors and tailgating?
  • Spot the issue: Lunchtime walk-through

Diagram · In practice checklist · 2-question knowledge check

05How long should you keep information, and what is a legal hold?16 min
  1. What is a records retention schedule?
  2. Why is keeping too much a risk too?
  3. What is a legal hold, and what must you do?
  4. How did Yvette's firm respond, and what should you take from it?
  • Branching scenario: The office move

Diagram · In practice checklist · 3-question knowledge check

06How do you destroy paper and media so information cannot be recovered?18 min
  1. What does the FTC Disposal Rule require?
  2. What does NIST SP 800-88 Rev. 2 say about media sanitization?
  3. How should you dispose of paper and everyday media?
  4. How did Duc handle the pallet?
  • Decision tree: How should this item be disposed of?
  • Spot the issue: Review a disposal certificate and contract

Diagram · In practice checklist · 3-question knowledge check

07What should you report, how fast, and what happens next?15 min
  1. What counts as an information handling incident?
  2. How should you report, and what should you include?
  3. What happens after a report?
  4. How do you build a reporting culture on your team?
  • Ethics dilemma: The Friday afternoon email

Diagram · In practice checklist · 2-question knowledge check

Final assessment: 23 questions, 70% to pass, then your certificate

Try it now, no account needed

The office move

A branching scenario from this course. Your choices are not saved.

Free sample activity

The office move

You are coordinating a team's move to a new floor. There are 30 file boxes, four old laptops and a copier to deal with by Friday.

Inside the course

Practice activities

  • Self-assessment1
  • Sort activity1
  • Matching activity1
  • Spot the issue2
  • Branching scenario1
  • Decision tree1
  • Ethics dilemma1

Job aids you keep

  • Information Handling and Disposal ChecklistChecklist
  • Information Classification and Handling Policy StarterPolicy starter
  • Information Handling Scenario WorksheetWorksheet
  • Classification and Disposal Quick ReferenceReference sheet

Credit and approval status

Certificate of completion

This course awards a certificate of completion for 2 contact hours of instruction. It has not been approved or accredited by IACET, any licensing board, any state agency or any other accreditor, and it does not satisfy any specific contractual CUI training requirement unless your contracting officer or security officer accepts it. Check with your employer, security officer or professional body whether this course can count toward your training records.

A pathway we are pursuing or may pursue is IACET accreditation of our course development process. No approval exists today; we will show an approval on this page only after it is granted.

Our full approvals list

Questions about this course

Who should take this course?

Any employee who handles business or personal information, including office, HR, finance, records, property management and IT asset staff, and anyone working on federal contracts that involve Controlled Unclassified Information. No technical background is required.

Does this course count toward continuing education or CUI training requirements?

You receive a certificate of completion for 2 contact hours of instruction. The course is not approved or accredited by IACET or any board, and it provides CUI awareness only. Ask your security officer or contracting officer whether it meets any specific contract training requirement.

Does it cover the 2025 update to NIST SP 800-88?

Yes. The course explains NIST SP 800-88 Revision 2 (September 2025), including its focus on sanitization programs, clear, purge and destroy, verification and certificates, and cryptographic erase, in plain language for non-specialists.

How long does it take?

Plan on about 2 hours, including seven modules, interactive activities, knowledge checks and a 23-question final assessment with a 70% pass mark. You can pause and return at any time.

Is this legal advice about retention periods?

No. Retention periods depend on federal and state laws, contracts and business needs. The course explains how schedules and legal holds work; your legal and records teams set the actual periods.

Will the course teach me how to wipe drives myself?

No. It explains the methods so you can make the right disposal decision and recognize good documentation. Actual sanitization should be done by IT or an approved vendor following your organization's procedures.

This course is general education and information handling training from CE Courses Hub. It is not legal or records-management advice and does not replace your organization's policies, retention schedule, contract requirements or advice from your legal counsel, security officer or records manager. Completing it earns a certificate of completion for the stated contact hours; it is not approved or accredited by any licensing board, state agency or accreditor unless an approval is shown on the course page. Check with your board, employer or state agency whether this course meets your specific requirement.