Marking controlled unclassified information

← All Insights

1. Only Registry markings count

Under the Controlled Unclassified Information (CUI) rule, the markings listed in the CUI Registry are the only markings authorized to designate unclassified information requiring safeguarding or dissemination controls (32 CFR 2002.20(a)(1)). On the implementation timelines the CUI Executive Agent sets for each agency, agencies and authorized holders must stop using legacy or other markings not permitted by part 2002 or the Registry. They must uniformly and conspicuously apply CUI markings to all CUI, exclusively under part 2002 and the Registry, unless specifically permitted otherwise.

Agencies may not modify CUI markings, or deviate from the prescribed method of use to fit existing agency practices, except where the CUI Executive Agent approves (32 CFR 2002.20(a)(2)). Legacy markings left on information are void. They no longer indicate that the information is protected or that it qualifies as CUI.

2. Who marks and when

The designating agency determines that information qualifies for CUI status and applies the appropriate marking when it designates the information (32 CFR 2002.20(a)(4)). Information that qualifies as CUI but was never marked, for example under an internal marking waiver, must be marked before it is disseminated (32 CFR 2002.20(a)(5)). An agency receiving an incorrectly marked document should notify the disseminating entity or the designating agency and request a properly marked document (32 CFR 2002.20(a)(3)).

Agencies must not mark information as CUI to conceal illegality, negligence, ineptitude or other disreputable circumstances embarrassing to anyone (32 CFR 2002.20(a)(6)). Nor may they mark it for any purpose other than following the authority that requires the control. The lack of a marking on information that qualifies as CUI does not exempt the authorized holder from the applicable handling requirements (32 CFR 2002.20(a)(7)).

Where marking each item is impractical because of quantity or nature, or under a limited marking waiver, holders must make recipients aware of CUI status by another readily apparent method (32 CFR 2002.20(a)(8)). Examples include user access agreements, a system splash screen, or signs in storage areas or on containers.

3. The banner marking

Designators must mark all CUI with a CUI banner marking, which may include up to three elements (32 CFR 2002.20(b)). The control marking is mandatory and may be either the word “CONTROLLED” or the acronym “CUI”, at the designator’s discretion (32 CFR 2002.20(b)(1)(i)). Agencies may set in policy that employees use one or the other.

Category and subcategory markings are mandatory for CUI Specified (32 CFR 2002.20(b)(2)). The program does not require them on CUI Basic, though an agency’s CUI senior agency official may mandate them by policy. Where an authority requires specific dissemination, distribution limitation or warning statements, agencies use them as that authority requires or permits, but not in the banner or portion markings (32 CFR 2002.20(b)(2)(iii)). Limited dissemination control markings align with the controls the Executive Agent establishes (32 CFR 2002.20(b)(3)(i)).

The content of the banner must apply to the whole document, including all CUI within it, and must be the same on each page that includes CUI (32 CFR 2002.20(c)(1)).

4. Designation and decontrol indicators

All documents containing CUI must carry an indicator of who designated it, including at least the designator’s agency (32 CFR 2002.20(d)(1)). It may take any form that identifies the agency, such as letterhead or a “Controlled by” line. The indicator must be readily apparent and may appear only on the first page or cover (32 CFR 2002.20(d)(2)).

Where feasible, designating agencies must include a specific decontrol date or event with all CUI (32 CFR 2002.20(e)(1)). Holders may treat CUI as decontrolled as of the indicated date, with no further review by or communication with the designator (32 CFR 2002.20(e)(2)). A decontrol event must be foreseeable and verifiable by any authorized holder, without special access or knowledge (32 CFR 2002.20(e)(3)).

5. Portion marking

Agencies are permitted and encouraged to portion mark all CUI, to help sharing and proper handling (32 CFR 2002.20(f)(1)). A portion marking consists of the control marking, which must be the acronym “CUI”, with category or subcategory markings and limited dissemination control markings where required or permitted (32 CFR 2002.20(f)(3)). Holders who designate CUI and use portion markings must mark both CUI and uncontrolled unclassified portions (32 CFR 2002.20(f)(4)(ii)).

Where a portion has several segments at the same control level, a single portion marking may be placed at the start of the primary paragraph or bullet (32 CFR 2002.20(f)(5)). Each portion must reflect the control level of that portion only (32 CFR 2002.20(f)(6)). A sub-paragraph in a different category does not raise its parent paragraph to the same level.

6. Mixed documents, packages and working papers

Where CUI appears in documents that also contain classified national security information, the CUI decontrol provisions apply only to portions marked as CUI (32 CFR 2002.20(g)). Holders must portion mark all CUI so it can be told apart from classified and uncontrolled portions. They must also include the CUI control marking, CUI Specified markings and limited dissemination control markings in an overall banner.

Packages containing CUI are addressed for delivery only to a specific recipient (32 CFR 2002.20(i)). CUI markings must not be placed on the outside of an envelope or package, and nothing on the outside may indicate that it contains CUI. A transmittal document accompanying CUI must carry a CUI marking on its face and an instruction on its status once the enclosure is removed (32 CFR 2002.20(j)).

Working papers containing CUI are marked the same way as the finished product would be (32 CFR 2002.20(k)). Agency heads may authorize supplemental administrative markings such as draft or pre-decisional, but not to set safeguarding requirements or dissemination restrictions, or to designate information as CUI (32 CFR 2002.20(l)). Those markings may not be built into, or duplicate, the CUI marking scheme. How marked CUI is protected is covered in safeguarding CUI in practice.

Key terms

Banner marking	The overall marking for a CUI document, with a mandatory control marking.
Control marking	The word CONTROLLED or the acronym CUI.
Designation indicator	A mandatory statement of the agency that designated the CUI.
Decontrol indicator	A date or event after which the CUI is no longer controlled.
Portion marking	A marking on each part of a document showing its control level.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

Correct markings help CUI move safely between partners. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.