CUI Labels: Banner, Portion Marking, and Designation Indicators

Controlled Unclassified Information carries a standardized set of labels that tell anyone handling the document exactly what protections it requires. CUI labels have three core pieces: a banner marking at the top of every page, a designation indicator block identifying who controlled the information, and, when applicable, category and limited dissemination markings that ride inside the banner. The formatting rules live in 32 CFR Part 2002, and the approved abbreviations live in the CUI Registry maintained by the National Archives.1National Archives. Controlled Unclassified Information (CUI)

The Banner Marking

The banner is the primary label. It goes at the top of every page that contains CUI, and the same banner text appears consistently across every page of the document. Placing it at the bottom as well is a best practice, not a requirement.2National Archives. CUI Marking Handbook

A banner has up to three elements, and the order is fixed:

  • The control marking, which is mandatory. Use either the word CONTROLLED or the acronym CUI. Both are acceptable under the regulation, and agencies can require one form in their internal policies.3eCFR. 32 CFR 2002.20 – Marking
  • Category or subcategory markings. These are mandatory for CUI Specified and optional for CUI Basic unless agency policy says otherwise. A double forward slash (//) separates them from the control marking.
  • Limited dissemination control markings, when applicable. Another double forward slash separates these from the categories.

Within a single element, multiple entries are listed alphabetically and separated by a single forward slash (/). Specified categories come before Basic categories in the list. A fully loaded banner looks like this: CUI//SP-CTI/SP-PRVCY//NOFORN.2National Archives. CUI Marking Handbook

How the Banner Should Look

The ISOO Marking Handbook specifies bold, capitalized, black text, centered when feasible.2National Archives. CUI Marking Handbook Purple appears on CUI coversheets and media labels, but the banner text on a document itself is not required to be purple. Black is the standard.4DoD CUI. Color Requirements

Category and Subcategory Markings

The CUI Registry is the authoritative source for every approved category, subcategory, and abbreviation. Categories are grouped into families such as Critical Infrastructure, Defense, Export Control, Financial, Immigration, Intelligence, Law Enforcement, Legal, and Natural and Cultural Resources.5National Archives. CUI Registry

Whether a category is Basic or Specified changes what goes in the banner. Specified categories carry an SP- prefix. Controlled technical information, a Specified category, appears in the banner as CUI//SP-CTI. Critical infrastructure information, a Basic category, appears as CUI//CRIT with no prefix.6CDSE. CUI Quick Marking Tips The Registry’s marking list publishes the exact banner format for each authorized category.7National Archives. CUI Markings

The Basic-versus-Specified split is not a hierarchy of sensitivity. Basic covers information where the authorizing law, regulation, or government-wide policy does not prescribe handling controls beyond the baseline in 32 CFR 2002.14(c). Specified covers information where the underlying authority does prescribe additional or different controls.8eCFR. 32 CFR 2002.16 – Accessing and Disseminating CUI Choosing the right category matters because the category determines what laws govern the information, what safeguards apply, and who can access it.

Limited Dissemination Controls

Limited dissemination controls restrict who can receive a CUI document beyond the baseline rule that anyone with a lawful government purpose may access CUI Basic. Only the designating agency can apply them, and they should be used only when a lawful government purpose actually requires the restriction. Using them to narrow access without cause runs against the program’s goals.8eCFR. 32 CFR 2002.16 – Accessing and Disseminating CUI

The approved controls are:9National Archives. CUI Registry: Limited Dissemination Controls

  • FED ONLY. Access is limited to federal executive branch employees and armed forces personnel.
  • FEDCON. Federal employees and contractors supporting the relevant contract may access it.
  • NOCON. Contractors are excluded, though state, local, or tribal employees may receive it.
  • DL ONLY. Access is limited to individuals or organizations on a specific dissemination list.
  • NOFORN. The information may not be shared with foreign governments, foreign nationals, or international organizations in any form.
  • REL TO. Pre-approved for release to the listed foreign countries or organizations through established disclosure channels.
  • DISPLAY ONLY. A foreign recipient may view the information but may not retain a physical copy.
  • ATTORNEY-CLIENT. Distribution beyond the attorney, the attorney’s agents, or the client is prohibited.
  • ATTORNEY-WP. Attorney work product; no distribution beyond the attorney, agents, or client without the originating attorney’s permission.

If no limited dissemination control appears on the document, anyone with an authorized lawful government purpose can access the CUI. That does not authorize public release.10DoD CUI. CUI Limited Dissemination Controls Multiple controls can be combined, listed alphabetically and separated by a single forward slash.

The Designation Indicator Block

Every CUI document must identify the agency or organization that designated the information. The designation indicator block goes on the first page or cover, typically in the lower-right area. If a letterhead or signature block already identifies the designating agency, that can satisfy part of the requirement. Otherwise, the block contains four lines:11DoD CUI. CUI Designation Indicator Block

  • Controlled by. The organization and specific office or division that controls the information.
  • CUI Category. All CUI categories present in the document, using approved Registry abbreviations.
  • Distribution/LDC. The applicable distribution statement or the limited dissemination control. You use one or the other on a given document, not both.
  • POC. The name and phone or email of the person who created the document, or the originating office’s mailbox.

The banner and the indicator block do different work. The banner tells the handler what kind of CUI the document contains and how distribution is restricted. The indicator block tells them who put it there and who to contact. Both are required.

Portion Marking

Portion marking identifies the CUI status of individual sections. A paragraph containing CUI gets a (CUI) at the start; a paragraph with only unclassified content gets (U). Portions include paragraphs, sub-paragraphs, titles, subject lines, bullet points, headings, figures, charts, and tables.12DoD CUI. Portion Marking

Portion marking is encouraged but not required for unclassified documents containing CUI.3eCFR. 32 CFR 2002.20 – Marking One rule is firm: if you portion mark any part of a document, you must portion mark every part. Selective marking is not allowed.12DoD CUI. Portion Marking

Marking Emails

Emails containing CUI need a banner marking, and the banner travels with the message when it is forwarded. A subject line indicator is optional but useful before anyone opens the body. Attachments trigger a specific rule: if the attachment contains CUI but the email body does not, the email still needs the banner because the CUI is traveling with it. If the attachment is later removed and the email no longer contains CUI, add a statement such as “Uncontrolled Unclassified Information” below the banner.13DCSA. CUI Marking Job Aid Emails containing CUI must also be encrypted; the banner tells the recipient what they are handling, and encryption keeps it from being intercepted along the way.

Physical Media and Coversheets

Portable storage devices and hard-copy documents use standard forms published by the General Services Administration:14National Archives. CUI Resources

  • SF 901 is a coversheet that goes over physical documents. It identifies the contents as CUI and shields them from casual observation.
  • SF 902 is a media label roughly 2.125 by 1.25 inches, sized for items like hard drives.
  • SF 903 is a smaller media label, roughly 2.125 by 0.625 inches, sized for USB drives.

SF 902 and SF 903 are adhesive labels rather than coversheets, and their dimensions reflect what fits on the device. If a device is too small even for the SF 903, apply the most prominent CUI identifier possible. Adding agency contact information helps get lost media back to the right office.

When Markings Come Off

CUI labels are not permanent. Information can be decontrolled when it no longer requires safeguarding, whether because the designating agency releases it publicly, a statutory trigger removes the need for control, or a date or event specified on the document has passed. Decontrolling means striking through or removing the CUI markings on the first page, cover page, or first page of any attachment, following agency policy. One prohibition is absolute: CUI cannot be decontrolled to conceal an unauthorized disclosure.15National Archives. Decontrolling CUI