CUI marking
Marking is how controlled unclassified information (CUI) tells the next person what it is and what they may do with it. The rules come from 32 CFR Part 2002, the CUI Registry maintained by the National Archives and Records Administration (NARA), and, inside the Department of War (DoW), from DoD Instruction 5200.48.
Marking is not optional decoration. An unmarked document holding CUI is a handling failure, and a wrongly marked one spreads the error to everyone downstream.
This page covers the three marking elements, how the banner line is built, what the Registry controls, and what retires a marking.
The three elements
| Element | Where it goes | What it does |
|---|---|---|
| Banner marking | Top center of every page | States that the document contains CUI, and may name the category and any dissemination limit |
| Portion marking | Start of each paragraph, subject, title, or section | Tells the reader which parts are controlled and which are not |
| Designation indicator | First page of the document | Names the agency or organization that designated the information and how to reach them |
The banner marking is mandatory on a document containing CUI. The designation indicator is required on documents an agency designates. Portion marking is optional under 32 CFR 2002.20 unless the agency requires it, so check the policy that governs the document rather than assuming.
Building the banner line
The banner reads either CUI or CONTROLLED. Both are authorized. Pick one and be consistent inside a document.
A fuller banner adds a category and a limited dissemination control, separated by double slashes:
CUI
CONTROLLED
CUI//SP-CTI
CUI//SP-CTI//NOFORN
CONTROLLED//SP-CTI//FEDCON
Reading left to right: the control marking, then the category from the CUI Registry, then the limited dissemination control. The SP- prefix marks a CUI Specified category.
If a document carries more than one category, list them in the banner. If any portion carries a dissemination limit, the banner reflects it, because the banner describes the most restrictive content on the page.
CUI Basic and CUI Specified
The Registry divides CUI into two handling types, and the difference changes what you may do with the information.
| Type | Handling | Example |
|---|---|---|
| CUI Basic | The default handling in 32 CFR Part 2002 | Most categories, including general procurement and acquisition information |
| CUI Specified | Handling set by a specific law, regulation, or government-wide policy that overrides the default | Controlled Technical Information, export-controlled information, and other categories the Registry marks with SP- |
A CUI Specified category can impose requirements the baseline does not, including stricter dissemination limits. Read the Registry entry for the category, not a summary of it.
Limited dissemination controls
These restrict who may receive the information. They sit after the category in the banner.
| Control | Meaning |
|---|---|
| NOFORN | No foreign dissemination |
| FEDCON | Federal employees and contractors only |
| NOCON | No dissemination to contractors |
| DL ONLY | Dissemination list controlled |
| REL TO | Releasable to the named countries only |
| DISPLAY ONLY | May be displayed to, but not released to, the named entities |
Use the current list in the CUI Registry. The set has changed over time.
The designation indicator
A block on the first page that identifies who designated the information. The common form carries four lines:
Controlled by: [Organization and office]
CUI Category: [Category from the Registry]
Limited Dissemination Control: [Control, if any]
POC: [Name, email, or phone]
Its purpose is practical. A recipient three steps down the supply chain needs to know who to ask about decontrolling, release, or a marking that looks wrong.
Cover sheets and transmission
Standard Form 901 is the CUI cover sheet. It goes on top of a physical document and does not replace the markings on the document itself.
For electronic transmission, identify the CUI in the message as well as in the attachment. An email forwarding a marked attachment with an unmarked body loses the marking the moment someone replies without the file.
Legacy markings are retired
"For Official Use Only" (FOUO), "Sensitive But Unclassified," "Law Enforcement Sensitive," and the other agency-specific markings were replaced by CUI. Do not apply them to new documents.
Encountering a legacy marking on an existing document does not automatically make it CUI. Whether the information is CUI depends on whether it falls into a Registry category, not on the old marking. Ask the originator.
Decontrolling
CUI status ends when the designating agency decontrols it, when a stated event or date arrives, or when the information is released under a public release process. Decontrolling is the designating agency's decision, not the holder's.
When a document is decontrolled, mark it so. Striking the banner without a decontrol notation leaves the next reader guessing.
Why this matters to a contract
DFARS 252.204-7012 obliges you to safeguard covered defense information and to report incidents involving it. You cannot safeguard what is not identified, and you cannot report accurately on information whose category you never recorded.
Marking is also what makes scoping possible. A secure enclave only narrows your assessment boundary if you can tell which information belongs inside it. See controlled unclassified information for what CUI is, and NIST SP 800-171 self-assessment for how the safeguarding requirements are measured.
How the kit relates to marking
| Item | Kit role |
|---|---|
| Hold a classification label on records inside the kit, including Unclassified, Federal Contract Information (FCI), CUI, and CUI Specified | Performs |
| Enforce the label, so a person cannot read a record marked above their clearance | Performs |
| Record who read or changed a marked record, and when | Records |
| Carry national and corporate marking catalogs alongside the CMMC set | Performs |
| Apply banner, portion, or designation markings to your Word, PDF, or email documents | Organization |
| Decide the category a document falls into | Organization |
| Decontrol information | Organization |
The kit classifies and protects what it holds. Marking the documents your people author is work that stays with your organization. See classification for the full catalog and the mandatory access control modes.
Common questions
Is it CUI or CONTROLLED?
Both are authorized banner markings. Choose one convention and apply it consistently.
Do I have to portion mark?
Under 32 CFR 2002.20 it is optional unless the agency requires it. Within DoW, follow DoD Instruction 5200.48 and the guidance in your contract.
What if a document has one CUI paragraph and thirty that are not?
The banner reflects the document, so the banner says CUI. Portion marking is what tells a reader the other thirty are not.
Can I mark something CUI to be safe?
No. Over-marking is a designation error in the same way under-marking is. The information either falls into a Registry category or it does not.
Does FOUO still mean anything?
Not as a current marking. Do not apply it. Treat existing FOUO documents by asking the originator whether the content is CUI.
Who can decontrol?
The designating agency. A contractor holding the information cannot decontrol it.
What marks a CUI Specified category?
The SP- prefix on the category in the banner, and a Registry entry pointing at the law or policy that sets its handling.
Does marking satisfy DFARS 252.204-7012?
No. Marking identifies the information. The clause requires the 110 safeguarding requirements of NIST SP 800-171 on the systems that hold it.
Related pages
- Controlled unclassified information: what counts as CUI
- Classification: the marking catalog the kit carries, and enforcement
- DFARS 252.204-7012: the safeguarding clause
- NIST SP 800-171 self-assessment
- CMMC Level 2: the level that applies when CUI is in scope
- Secure enclaves: narrowing where CUI lives
- Supplier Performance Risk System (SPRS) score
- AIC CMMC Complete™ and pricing
- Glossary