CUI marking requirements: how to read and mark CUI
Published 2026-10-23, 13 min read
Example only
Control marking
Always. CUI or CONTROLLED, the designator's choice.
32 CFR 2002.20(b)(1)
Category marking
Required for CUI Specified (SP- in front); optional for Basic.
32 CFR 2002.20(b)(2)
Dissemination control
Only when the designating agency limits who may receive it.
32 CFR 2002.20(b)(3)
Every CUI document carries a banner: 'CUI' or 'CONTROLLED' (mandatory), plus the category or subcategory markings, which are mandatory for CUI Specified. The first page also names who designated it. Those two marks go on every CUI document; portion marks are optional unless the agency or the contract requires them. On DoD paper you will often see only CUI, top and bottom of every page. If you first need to know whether something is CUI at all, start with what CUI is.
What a marked document carries
The rule's first instruction is short: authorized holders must uniformly and conspicuously apply CUI markings. Uniformly means the same markings in the same places, which is why the Registry's markings are the only ones allowed. Here is everything that can appear, and which of it is mandatory.
| Element | Required? | Where and how |
|---|---|---|
| Banner marking2002.20(b), (c)(1); DoDI 3.4.a | Always | Top of every page, the same on each, covering all the CUI in the document. DoD adds it at the bottom too. |
| Designation indicator2002.20(d) | Always | First page or cover: the designating agency at minimum, by letterhead or a “Controlled by” line. |
| Decontrol indicator2002.20(e) | Where feasible | A date or a verifiable event after which the CUI is decontrolled, set by the designating agency. |
| Portion marks2002.20(f); DoDI 3.4.b | Optional | Permitted and encouraged; required where agency policy says so. If used, every portion is marked, CUI and (U) alike. |
| Required statements2002.20(b)(2)(iii); DoDI 4.3.c | When the authority requires | Distribution statements, export control warnings and the like: on the document, never inside the banner or portion marks. |
| Supplemental markings2002.20(l) | Only under agency policy | “Draft”, “Pre-decisional” and the like: beside the CUI markings, never part of them. |
| Outside of a package2002.20(i) | Never | No CUI marking on an envelope or box; address it to a specific recipient. |
On paper it looks like this. The example below is a first page drawn to DoD's layout, the one a shop meets on a customer's drawing package or statement of work.
CUI
- Controlled by:
- [Name of DoD Component]
- Controlled by:
- [Name of Office]
- CUI Category:
- CTI
- Distribution/
Dissemination Control: - [Distribution Statement]
- POC:
- [Phone or email address]
CUI
- Banner, the same on every page; DoD puts CUI at the top and the bottom.
- Portion marks, if used: (CUI) or (U) in front of every title and paragraph.
- A statement the authority requires (here, the drawing's distribution statement) sits in its own block, never in the banner.
- The designation indicator, first page or cover only.
- Under the full rule the banner would read CUI//SP-CTI; DoD's phased rollout lets it stay CUI and lists the category in line 3 of the block.
The banner line, part by part
The banner is the one marking nobody may skip. It tells anyone holding the page that it is CUI and, when the law behind it sets special rules, which law. Five rules govern how it is written.
- Start with CUI or CONTROLLED. Either is allowed; an agency may tell its people which one to use. 2002.20(b)(1)
- Use only markings listed in the CUI Registry. No home-made words, no older agency stamps in their place. 2002.20(a)(1)–(2)
- Cover the whole document: the banner sums up every portion, and reads the same on every page. 2002.20(c)(1)
- Separate the parts with //, and two of a kind with /. Categories and controls each go in A to Z order, Specified before Basic. Handbook pp. 6, 11, 12
- Put it at the top of each page, centred in capitals. A footer copy is a best practice under the rule, and required by DoD. Handbook p. 7; DoDI 3.4.f
Try it. The builder below assembles a banner from the Registry's markings in the order the handbook sets, and says what each part asks of you. It is for reading what arrives and for marking the copies you make from it; the markings themselves are the designating agency's call.
Pre-filled with a drawing marked as Controlled Technical Information. Change any choice; the banner rebuilds.
Example only
Banner, top of every page
CUI//SP-CTI
Portion mark, same content in one paragraph
(CUI//SP-CTI)
- CUIThe control marking: this is CUI. Portion marks always use the acronym CUI, never the word.
- SP-CTIControlled Technical Information, Specified under DFARS 252.204-7012. Expect a distribution statement (B to F) on the same document.
The designation block on the first page
The banner says what the document is. The designation indicator says whose it is, so anyone with a question knows where to send it.
It may appear only on the first page or the cover. DoD asks for more than the federal minimum: a five-line block, each line with a job.
| Line on the document | What goes there |
|---|---|
| Controlled by: [DoD Component]DoDI 5200.48 3.4.f(1) | The designating agency, at minimum. May be omitted when letterhead shows it. |
| Controlled by: [Office]DoDI 5200.48 3.4.f(2) | The office that made the determination. |
| CUI Category:DoDI 5200.48 3.4.f(3) | Every type of CUI in the document. |
| Distribution/Dissemination Control:DoDI 5200.48 3.4.f(4) | The distribution statement or the dissemination controls that apply. |
| POC:DoDI 5200.48 3.4.f(5) | A phone number or office mailbox. |
The decontrol indicator
Where feasible, the designating agency adds a date or an event after which the CUI is decontrolled. A date lets you treat the item as decontrolled from that day with no further check. An event must be one any holder can foresee and verify, and should come with a contact who can confirm it happened. DoD adds that media holding CUI must carry decontrolling indicators too. With no date or event on it, decontrol is the designating agency's decision; you can ask for it, and decontrolled is still not cleared for public release.
Portion marks: optional until someone requires them
Portion marks show which paragraph holds the CUI, so a reader can quote the rest freely. The federal rule leaves them optional for most documents; DoD sets the form they take when they are used.
- Optional under the federal rule, which permits and encourages it; your agency or your contract can make it required.
- Once you start, mark every portion: titles, paragraphs and bullets, CUI and uncontrolled alike.
- In parentheses, at the start of the portion, always the acronym CUI, never the word.
- Uncontrolled portions get (U). DoD requires it whenever a document is portion marked.
- A paragraph whose parts share one level takes one mark at its start; mixed parts are marked one by one.
- Each portion shows only its own level. A CUI sub-bullet does not make its parent bullet CUI.
Example only
CUI//SP-CTI
Example only
CUI
The second page puts a Specified category in a paragraph and leaves it out of the banner. Under the federal rule every Specified category in the document must appear in the banner, so a reader who sees only the top line misses the stricter handling. On a DoD page whose banner is the bare CUI, the portions are the bare (CUI) too, and the category sits in the designation block.
CUI Specified, CTI and the distribution statement
A Specified category gets SP- in front of its marking so the banner shows at a glance that a law sets extra handling rules. The handbook is blunt that Specified is not a higher level of CUI, only a different one. The CUI Registry lists 128 categories in 20 organizational index groupings (category list last reviewed 2025-03-06), and its CUI Markings list gives each one's banner. The basics of Basic and Specified are in what CUI is; here is what they look like on paper.
The distribution statement on a drawing is not part of the banner. The rule keeps statements a law requires out of the banner and the portion marks, and DoD keeps distribution statements, plus an export control warning where one applies, on export-controlled technical information while its other new documents use the Registry's dissemination controls instead. DoD lines the two systems up in one table.
| Distribution statement | Dissemination control DoD aligns it with |
|---|---|
| Distribution A | None: publicly releasable after review |
| Distribution B | Federal Employees Only (FED ONLY) |
| Distribution C | Federal Employees and Contractors Only (FEDCON) |
| Distribution D | Dissemination list, Government and contractors only |
| Distribution E | Dissemination list, Government only |
| Distribution F | Dissemination List Controlled (DL ONLY) |
| Distribution X | None: cancelled, superseded by Distribution C |
For a shop that means the statement already tells you the audience. (What the clause behind CTI asks of your systems is in DFARS 252.204-7012.) Distribution C lines up with FEDCON: Government and contractors, for the contract's purpose. Distribution B lines up with FED ONLY, an audience with no contractors in it, so a B print in your shop deserves a question to whoever sent it. Keep the statement exactly as it is on every copy you make; DoD does not let its wording be changed to add readers.
Dissemination controls: NOFORN, FEDCON and the rest
A dissemination control narrows who may receive the CUI. Agencies may limit dissemination only with the controls the Registry lists, and only the designating agency applies them. An authorized holder, which is what your shop is, may add one only with the designating agency's approval, and must follow every control already on the document. In the banner they come last, after their own //, in A to Z order.
| Control | Marking and portion form | What it allows | For your shop |
|---|---|---|---|
| No foreign dissemination | NOFORN(CUI//NF) | Not to foreign governments, foreign nationals, foreign or international organizations, or non-US citizens, in any form. | Check who on the floor, in IT support and at your subs is a US citizen before it moves. |
| Federal employees only | FED ONLY(CUI//FED ONLY) | Executive branch employees and US armed forces (incl. Active Guard and Reserve) only. | Not meant for a contractor. Ask the sender. |
| Federal employees and contractors only | FEDCON(CUI//FEDCON) | Adds people and firms under a contract with the US, so long as sharing furthers that contract. | Use it on the job it came with, not on the next quote. |
| No dissemination to contractors | NOCON(CUI//NOCON) | No contractors; state, local and tribal employees may receive it. | Not meant for a contractor. Ask the sender. |
| Dissemination list controlled | DL ONLY(CUI//DL ONLY) | Only those on the dissemination list that accompanies it; overrides other controls, not the law. | Keep the list with the document and share with no one off it. |
| Releasable by information disclosure official | RELIDO(CUI//RELIDO) | Intelligence material a Senior Foreign Disclosure and Release Authority may share further. | Rare in a machine shop; ask before anything moves. |
| Authorized for release to certain nationals only | REL TO [USA, LIST](CUI/ | Releasable only to the countries or organizations listed, USA first, then country codes A to Z. | Only the listed nationalities, and only through the channel the sender set up. |
| Display only | DISPLAY ONLY [USA, LIST](CUI/ | May be shown to the listed foreign recipients, but no copy left with them, in any medium. | Show on screen or paper in the meeting; hand over nothing. |
| Attorney-client | Attorney-Client(CUI//AC) | Attorney-client privileged; only with the Legal Privilege category. | Seldom on technical data; route it to whoever handles legal. |
| Attorney work product | Attorney-WP(CUI//AWP) | Attorney work product; only with the Legal Privilege category. | Seldom on technical data; route it to whoever handles legal. |
Marking emails, drawings, media and files
The rule is written around documents, and it counts an email, a computer file and a drawing as documents. What changes from one format to the next is where the marking can physically go.
Emails
- The banner goes at the top of the message body. “Contains CUI” in the subject line is an optional extra alert.
- Reply or forward, and the markings come with you: carry every one into the new message.
- A cover note whose only CUI is the attachment works like a transmittal document: mark it CUI and add “When enclosure is removed, this document is Uncontrolled Unclassified Information” (our reading of 2002.20(j) for email).
- Marking is not protection. How the message travels is a safeguarding question: CMMC-ready email.
Example only
To[buyer at the prime]
SubjectContains CUI: rev C bracket, inspection results
CUI//SP-CTI
Drawings and models
- DoD wants CUI at the top and the bottom of every sheet, the designation block on the first sheet, the distribution statement in its own block, and the export control warning where one applies.
- Build the banner into your title block or drawing template so every plot carries it, instead of stamping by hand.
- Marked-up prints, travelers and inspection sheets made from the drawing are working papers: marked like the original.
- A model or CAM file is a document too. Put the marking in the file where the software allows; a folder name is a reminder, not a marking.
USB drives, discs and hard drives
- At minimum, the control marking and the designating agency on the device. Categories and controls if the label has room.
- NIST SP 800-171 3.8.4: “Mark media with necessary CUI markings and distribution limitations.”
- DoD adds decontrolling indicators for media. When the drive is done, wipe it the way NIST SP 800-88 sets out.
Example only
File shares, cabinets and rooms
- Where marking each item is impractical, the rule allows other plain signals: a splash screen at sign-in, signs on storage areas, markings on containers.
- Those methods are set by agency policy and stand beside the document markings, not in place of them.
- Mark the cabinet or box that stores CUI so whoever opens it knows.
Envelopes and boxes
- Address it to a specific person, for delivery only to that recipient.
- No CUI marking anywhere on the outside. The documents inside stay marked.
- Use a tracked service where you can.
FOUO and other old stamps
Older prints and specs arrive with markings from before the CUI rule took effect on 2016-11-14. Agencies and holders alike were told to stop using them, and the rule says what they are worth now.
| On the document | What it tells you now |
|---|---|
| FOR OFFICIAL USE ONLY, U/ | Void as a marking. It neither proves nor rules out CUI: check what the information is. |
| Other pre-2016 agency stamps2002.36 | Same: void. Legacy information is not automatically CUI; the agency decides when it is re-used. |
| Distribution statement B to FDoDI 4.3.c | Still current on technical data. Not a legacy marking: keep it. |
| DRAFT, PRE-DECISIONAL2002.20(l) | Allowed beside CUI markings under agency policy; never inside the banner, never a reason to protect. |
Void cuts both ways. An old FOUO stamp does not make a drawing CUI, and it does not make it safe to post either. When you re-use content from a legacy document in something new, NARA's steps are short: identify what you are re-using, look its type up in the CUI Registry, and if it is there, the new document is marked as CUI. Ask the originator when you can. And a document with no CUI in it may still be federal contract information, which carries no marking at all: FCI vs CUI sorts the two.
Unmarked or mis-marked CUI: what a contractor does
It happens in every busy shop: a drawing package without a banner, an email that forwards a marked file under an unmarked note, a print that says FOUO and nothing else. The rule is clear about the first question.
So the job is to protect first and settle the marking second. If you are not sure the information qualifies at all, walk it through the Is it CUI? tool, then follow these steps.
Unmarked or mis-marked CUI: six steps, cuideck.com
- Read the contract. Whenever DoD provides information to contractors, it must identify whether any of the information is CUI via the contracting vehicle. If the contract or your prime names it as CUI, treat it as CUI whatever the paper says. DoDI 5200.48 5.3.a
- Protect it now. Move it onto the systems that already hold CUI and handle it as CUI while you ask. A missing marking changes nothing about the duty. 2002.20(a)(7)
- Ask the sender in writing. Tell whoever sent it that it looks unmarked or wrongly marked, and ask for a properly marked copy. A subcontractor asks the prime. 2002.50(a); 7012(m)(1)
- Keep the marked level. If you think a marking is wrong, keep protecting and sharing it at the level shown until the answer comes back. 2002.50(d)
- Do not re-mark the original. The designating agency applies the marking, and a dissemination control needs its approval. Wait for the corrected copy. 2002.20(a)(4); Registry
- Write it down. Date, document, who you asked, what they said. It is the evidence that you handled it on purpose. Our advice
Pin it by the receiving desk or the printer where drawing packages land.
Marking cheat sheet
Most of what a shop marks is a copy or a working paper made from a customer's CUI. This is the whole guide on one page for that job.
CUI marking cheat sheet, cuideck.com
| On your copy | Rule | Where it says so |
|---|---|---|
| Banner | Copy the source's banner exactly. Several sources: the banner sums them all, the same on every page. | 2002.20(c)(1) |
| Footer | On DoD work, CUI at the bottom of every page too. | DoDI 3.4.f |
| First page | The designation block, naming who designated the CUI inside. | 2002.20(d) |
| Statements | Distribution statement and export warning copied word for word, outside the banner. | 2002.20(b)(2)(iii) |
| Portions | Only if the source or the contract uses them; then every portion, (U) included. | 2002.20(f); DoDI 3.4.b |
| Controls | Keep every dissemination control on the source; add none of your own. | Registry |
| Old stamps | No FOUO on anything new. It is void. | 2002.20(a)(2) |
| Banner at the top of the body; carry it into every reply and forward. | NARA tip | |
| Media | At least CUI and the designating agency on the label. | Handbook p. 23; 3.8.4 |
| Packages | To a named recipient; no CUI marking on the outside. | 2002.20(i) |
Questions shops ask about marking
Does every page of a CUI document need the banner?
Yes. The banner covers all the CUI in the document and reads the same on each page that holds CUI. NARA calls a copy at the bottom a best practice; DoD requires CUI at both the top and the bottom.
Is it CUI or CONTROLLED?
Either. The rule leaves the word to the designator, and an agency may require one of them. DoD uses CUI, and portion marks always use CUI.
Do we have to portion mark?
Not under the federal rule, which permits and encourages it. Your agency or contract can require it. If a DoD document is portion marked, every portion carries (CUI) or (U).
Can our shop mark its own information as CUI?
Designating CUI is the Government's job: the designating agency decides and applies the marking. Information your company holds on its own systems that did not come from, or was not made for, an executive branch agency is outside the CUI definition.
What you do mark is what you make from CUI you were given: a traveler, a report, a copy. Those carry the source's markings. To check whether something qualifies at all, use Is it CUI?
Should the box we ship drawings in say CUI?
No. The rule forbids CUI markings on the outside of an envelope or package. Address it to a named recipient; the documents inside stay marked.
Does NIST SP 800-171 say anything about marking?
One requirement does: 3.8.4, “Mark media with necessary CUI markings and distribution limitations.” Marking also belongs in your CUI awareness training; DoD's training standard names it. See CUI training and what NIST SP 800-171 is.