Dissemination control markings are labels added to government documents that tell every person handling them who is allowed to see the information and how it may be shared. They appear on both classified national security information and Controlled Unclassified Information (CUI), and they carry legal force. A document’s classification level alone never tells the full story about access; the dissemination controls stacked next to it do.
The Classification Levels Underneath
Dissemination controls sit on top of a classification decision, so the levels are worth naming first. Executive Order 13526 establishes three tiers based on the damage unauthorized disclosure would cause to national security: Confidential (damage), Secret (serious damage), and Top Secret (exceptionally grave damage).1National Archives. Executive Order 13526
The classification level sets the baseline clearance a reader needs. The dissemination control marking then adds a further restriction. A document marked SECRET//NOFORN requires both a Secret clearance and the additional rule that no foreign national may access it, cleared or not.
Dissemination Controls on Classified Documents
On classified documents, dissemination controls appear after the classification level in the banner line, separated by double slashes. Three appear routinely in intelligence and defense work.
NOFORN (No Foreign Dissemination) is the strictest foreign-disclosure marking. It prohibits sharing the information in any form with foreign governments, foreign nationals, or international organizations, regardless of clearance. Only the originating agency can waive it.2Office of the Director of National Intelligence. Foreign Disclosure and Release Markings
REL TO (Authorized for Release To) works in the opposite direction. It lists specific countries or international organizations pre-approved to receive the information. A document marked REL TO USA, GBR, AUS may go to those three countries and no further without the originator’s consent.2Office of the Director of National Intelligence. Foreign Disclosure and Release Markings
ORCON (Originator Controlled) requires anyone who receives the document to get advance permission from the creating agency before sharing it further or taking investigative, operational, or legal action based on it. The requester must submit a written justification explaining the recipient’s mission need, and the originator can deny the request.3Office of the Director of National Intelligence. Application of Dissemination Controls: Originator Control ORCON is where information gets tightly bottlenecked, because every downstream share requires a separate approval.
These controls stack. A document marked TOP SECRET//ORCON/NOFORN is both originator-controlled and barred from foreign disclosure. When ORCON and REL TO appear together, the originator has already approved release to the listed foreign recipients on initial distribution, but no further sharing is permitted without going back to the originator.2Office of the Director of National Intelligence. Foreign Disclosure and Release Markings
Limited Dissemination Controls on CUI
CUI has its own set of dissemination controls, kept in the CUI Registry maintained by the National Archives. They restrict who inside the government and contractor community can access unclassified information that still requires protection under federal law or policy. If a CUI document carries no limited dissemination control, anyone with a lawful government purpose may access it, but that is not authorization for public release.
The CUI Registry lists these limited dissemination controls:4National Archives. CUI Registry: Limited Dissemination Controls
- NOFORN: No sharing with foreign governments, foreign nationals, or international organizations in any form.
- FED ONLY: Only federal executive branch employees and armed forces personnel may access the information.
- FEDCON: Federal employees, armed forces personnel, and contractors working under a federal contract may access it, but contractor access must support that contract.
- NOCON: No contractors may access the information; state, local, and tribal employees may.
- DL ONLY (Dissemination List Controlled): Only individuals or organizations on a specific accompanying list may access the information. This overrides other limited dissemination controls.
- RELIDO: The originator has authorized a Senior Foreign Disclosure and Release Authority to make further sharing decisions. Only agencies eligible to use RELIDO in the classified intelligence context may apply it to CUI.
- REL TO: The designating agency has pre-approved release to specific foreign countries or international organizations through established disclosure channels.
Some of these markings share names with classified controls (NOFORN, REL TO), but the CUI framework is separate. It runs on Executive Order 13556 and 32 CFR Part 2002, not on Executive Order 13526.5National Archives. Controlled Unclassified Information The practical restriction looks similar; the underlying authority and the penalties for violations are not the same.
Where the Markings Appear on the Page
On a classified document, the overall classification level shows conspicuously at the top and bottom of the front cover, title page, first page, and back cover. Every interior page carries the highest classification of information on that page, or the highest overall classification of the document. Portion markings identify the level of each individual segment (usually a paragraph) in parentheses at the start of the portion, so a reader can see exactly which pieces are sensitive.6eCFR. 32 CFR 2001.21 – Original Classification Dissemination controls attach to the banner and, where relevant, to the portion marks alongside the classification level.
The front page also carries a classification authority block. For original classification, it names the classifier, cites the specific category under Section 1.4 of Executive Order 13526 that justified the decision, and states a declassification date or event.6eCFR. 32 CFR 2001.21 – Original Classification For derivative classification, the block names the derivative classifier and identifies the source document or classification guide the marking came from, or lists “Multiple Sources” with an attached listing.7eCFR. 32 CFR 2001.22 – Derivative Classification
CUI marking works differently. Every page containing CUI must display “CUI” (or the word “CONTROLLED”) at the top and bottom, and the banner has to be consistent across pages and inclusive of every CUI category present.8eCFR. 32 CFR 2002.20 – Marking The first page also carries a designation indicator identifying the agency that designated the information. In Department of Defense practice, that block lists the controlling office, the CUI category, any limited dissemination control, and a point of contact.9U.S. Department of Defense CUI. Controlled Unclassified Information Markings A typical block looks like this:
Controlled by: DDI(CL&S)/IAP
CUI Category: NNPI
Limited Dissemination Control: NOFORN
POC: John Brown, 703-555-0123
For CUI Specified categories, the category has to appear in the banner. For CUI Basic, it’s optional unless the agency requires it. The category belongs in the designation block on the first page, not repeated in every banner.8eCFR. 32 CFR 2002.20 – Marking A common error: do not put “UNCLASSIFIED” in front of “CUI.” CUI is its own designation.
Who Is Allowed to Apply These Markings
Original classification authority is legally restricted. Under Executive Order 13526, only the President, the Vice President, agency heads designated by the President, and officials delegated authority by those agency heads may make original classification decisions.1National Archives. Executive Order 13526 These Original Classification Authorities carry personal responsibility for the classification decision, the rationale, and the declassification timeline.
Most classified documents are produced not by OCAs but by derivative classifiers, who reproduce, extract, or summarize already-classified information and carry the appropriate markings forward. Derivative classifiers do not need original classification authority; their job is to read the source markings accurately and transfer them. This is where most marking mistakes happen. Misreading a source’s portion marks can either over-classify (locking out people who need the information) or under-classify (exposing information to people who shouldn’t have it). When only a small portion of a document is classified, a derivative classifier should use a classified addendum where practicable, so the rest can circulate at a lower level.1National Archives. Executive Order 13526
Derivative classification authority is training-gated and time-limited. Executive Order 13526 requires derivative classifiers to complete training in proper application of derivative classification principles at least once every two years, with emphasis on avoiding over-classification. Miss the window and your authority is automatically suspended until you retrain.1National Archives. Executive Order 13526 Some agencies impose tighter cycles. DoD requires derivative classification training annually under a 2019 policy memorandum from the Under Secretary of Defense for Intelligence.10Defense Counterintelligence and Security Agency. Derivative Classification
For CUI, the person who creates or receives information falling within a CUI category is responsible for applying the appropriate markings. Executive Order 13556 established the program to standardize how the executive branch handles unclassified information that must be safeguarded under law, federal regulation, or government-wide policy.5National Archives. Controlled Unclassified Information The CUI Registry lists every recognized category and links each one to the specific law or regulation requiring its protection.11National Archives. Controlled Unclassified Information (CUI) Registry Agency Senior Agency Officials may issue marking waivers for CUI while it remains under agency control under 32 CFR 2002.38.12National Archives. CUI Frequently Asked Questions
Legacy Markings You May Still See
Older documents carry markings that pre-date the CUI program: “For Official Use Only” (FOUO), “Sensitive But Unclassified” (SBU), and “Law Enforcement Sensitive” (LES), among others. As agencies roll out the CUI framework, those legacy labels are being phased out. FOUO is no longer authorized for new documents, though it still appears on older ones.12National Archives. CUI Frequently Asked Questions
The rule for handling a legacy-marked document is straightforward. Protect the information in accordance with the terms of the contract or agreement under which it was received or created.12National Archives. CUI Frequently Asked Questions Don’t strip the old markings, and don’t treat a legacy label as license to release.
Penalties for Getting the Markings Wrong
Consequences scale with what went wrong. Administrative sanctions for marking and handling errors include warnings, reprimands, suspension without pay, termination of classification authority, and removal from position.13eCFR. 32 CFR 2700.44 – Administrative Sanctions Repeated slip-ups (failing to apply proper markings, ignoring dissemination restrictions) can support adverse action on their own, even without a criminal case behind them.
Criminal statutes cover the serious end. Under 18 U.S.C. § 793, gathering, transmitting, or losing national defense information carries up to ten years in prison.14Office of the Law Revision Counsel. 18 USC 793 – Gathering, Transmitting or Losing Defense Information A separate statute, 18 U.S.C. § 1924, covers knowingly removing classified documents and keeping them in an unauthorized location, with a five-year ceiling.15Office of the Law Revision Counsel. 18 USC 1924 – Unauthorized Removal and Retention of Classified Documents or Material Most violations resolve administratively. The statutory ceilings exist for the ones that don’t.