DoD distribution statements are the standardized markings, lettered A through F, that tell anyone handling a Department of Defense technical document who is allowed to receive it and under what conditions. They are required by DoD Instruction 5230.24, and the letter is only half the marking: statements B through F must also cite a defense category explaining why the restriction exists, along with the date it was applied and the controlling DoD office. Get the combination wrong and you can expose export-controlled data, violate ITAR or the EAR, or lose access to future DoD work.
The Six Letter Codes
Each letter narrows the authorized audience further than the last.
- Statement A — Approved for public release with unlimited distribution. Anyone may access the document.
- Statement B — Distribution limited to U.S. Government agencies only. Everyone else must request a copy from the controlling DoD office.
- Statement C — Distribution authorized to U.S. Government agencies and their contractors. This is the most common marking for technical data a contractor needs to perform on a government contract.
- Statement D — Distribution limited to the Department of Defense and U.S. DoD contractors. Federal agencies outside DoD are excluded.
- Statement E — Distribution authorized to DoD components only. Military personnel and civilian DoD employees are in; even DoD contractors are out unless separately authorized.
- Statement F — No further distribution without explicit direction from the controlling DoD office or a higher DoD authority. This is the most restrictive active category.
You may still see references to a former Statement X, which once covered export-controlled data that did not fit the other restricted categories. Statement X has been cancelled, and documents that carried it are now marked Statement C with “Export Controlled” as the reason.
The Defense Category That Goes With the Letter
The letter code alone is not a complete marking. Statements B through F must include a short defense category, cited by heading only, that names the reason for the restriction. DoDI 5230.24 authorizes a specific set. The ones you will encounter most often are:
- Controlled Technical Information (CTI) — Technical data with military or space applications subject to access and distribution controls. General scientific principles taught in schools do not qualify.
- Critical Technology — Information about technologies that make or could make a significant contribution to any country’s military potential. Always export-controlled.
- Export Controlled — Technical data restricted under the International Traffic in Arms Regulations or the Export Administration Regulations.
- Foreign Government Information — Data supplied by a foreign government or international organization under a written no-further-sharing requirement.
- Operations Security — Information that could reveal vulnerabilities or operational details to adversary intelligence.
- Contractor Performance Evaluation — Records evaluating contractor programs, supplier performance, or product quality.
- Direct Military Support — Export-controlled data of such military significance that releasing it outside approved activities could compromise a U.S. or allied operational advantage.
Not every reason pairs with every letter. Contractor Performance Evaluation can only carry Statements B, E, or F. Critical Technology can carry B, C, D, E, or F. Mismatched combinations are marking errors the controlling office has to fix.
How to Choose the Right Statement
Selecting the right category means working through the document’s content and its legal exposure. Start with export controls. Does the technical data involve items on the United States Munitions List, which triggers ITAR under the State Department? Does it fall under the EAR administered by the Commerce Department’s Bureau of Industry and Security? If either applies, the marking has to reflect it.
The penalties for guessing wrong are severe. ITAR criminal violations carry up to $1 million in fines and 20 years of imprisonment per violation, with civil penalties exceeding $1.27 million per violation. EAR criminal penalties reach the same $1 million and 20-year ceiling, and administrative monetary penalties stood at $374,474 per violation as of January 2025. Anyone tempted to mark a document Statement A when the underlying data is export-controlled should look at those numbers first.
Beyond export controls, evaluators consider whether the data contains contractor-owned proprietary information, whether it describes specific security vulnerabilities, and whether it involves foreign government information shared under a written nondisclosure requirement. Those answers set both the letter and the defense category. A document describing a contractor’s unique manufacturing process for a weapons component would likely carry Statement D with “Controlled Technical Information” as the reason, keeping access to DoD and its contractors and out of broader government circulation.
What the Marking Must Contain
Statements B through E use a standardized four-part format, in this order:
- Authorized audience — the group permitted to receive the document (for example, “U.S. Government agencies and their contractors”).
- Defense category — the reason, cited by heading only (for example, “Critical Technology”).
- Date of determination — when the restriction was applied, which fixes the starting point for later review.
- Controlling DoD office — the full name of the office responsible for the document and the only activity that can change the distribution level or grant exceptions.
Statement A stands alone. It reads “Approved for public release. Distribution is unlimited” and needs no additional fields. Statement F uses a slightly different format, directing all further distribution through the controlling office or higher DoD authority, followed by the date of determination.
The statement must appear on the title page or front cover of any technical document. On Standard Form 298, the Report Documentation Page, it also goes in Block 12. For technical information without a conventional cover — datasets, CAD files, digital packages — the statement must be affixed to all physical and digital items in as obvious a position as possible. Even oral presentations and voice recordings of restricted technical information have to note the distribution statement. When the document also contains Controlled Unclassified Information, the CUI designation indicator goes at the bottom-right of the first page or cover, and the full distribution statement appears directly beneath it.
Who Assigns It and Who Can Change It
DoD Component heads carry ultimate responsibility for correct marking of technical information generated within their organizations. In practice the originator — the engineer, program manager, or technical writer who created the document — performs the initial assessment and proposes the statement. The controlling DoD office, meaning the activity that sponsored the work, makes the final determination.
Only the controlling DoD office or a higher DoD authority can change a statement once it is applied. If the restriction is no longer justified, the controlling office obtains a public-release determination, upgrades the document to Statement A, and notifies the Defense Technical Information Center (DTIC) and all known holders. The same notification process applies when the controlling office’s address changes, the office is redesignated, or a marking is otherwise modified. Unauthorized removal of or tampering with distribution markings is strictly prohibited under the instruction.
The controlling office also has a standing duty to periodically review active technical information under its control and increase availability where conditions allow. Many organizations fall short here. Documents marked Statement D during development sometimes stay restricted years after the underlying technology has been publicly disclosed, simply because no one initiated a review.
The Separate Export Control Warning
A document assigned Statement B through F that also contains export-controlled technical data must carry an additional export control warning. The warning tells the reader the data is restricted under the Arms Export Control Act or the Export Control Reform Act of 2018, that violations carry severe criminal penalties, and that the material must be handled according to DoD Directive 5230.25. It goes on cover pages.
This is a separate marking from the distribution statement itself. A Statement C document marked “Contractor Performance Evaluation” needs no export control warning. A Statement C document marked “Export Controlled” needs both. Missing the warning on an otherwise correctly marked document is a common error, and one that creates real liability if the data crosses a border.
Requesting a Document You Aren’t Cleared For
Every restricted statement from B through E includes a built-in referral: “Other requests for this document must be referred to [controlling DoD office].” If you need a document but sit outside its authorized audience, contact that office directly and explain the need.
Statement F works on a clock. The controlling office must respond to a release request within 30 days. If the office agrees, or simply fails to respond within that window, the document can be released to any DoD component under Statement E, and the release must be documented.
For export-controlled documents marked Statement C or D, there is an additional gate. Before the government can distribute the data to a contractor, it must verify the recipient holds a current, valid DD Form 2345 (Militarily Critical Technical Data Agreement). No valid form on file, no document, regardless of clearance level or contract relationship. If the data carries government-purpose rights under DFARS, the recipient may also need to sign a nondisclosure agreement before receiving anything.
Overlap With CUI
Distribution statements and CUI markings are related but separate systems. The defense categories in DoDI 5230.24 are not the CUI categories, though they overlap. Only two CUI categories, Export Controlled and Controlled Technical Information, require a distribution statement in place of the standard limited dissemination control used for other CUI. A document with a distribution statement is not automatically CUI, and most CUI documents use other dissemination controls.
When both systems apply, the CUI designation indicator block includes the distribution statement letter (for example, “Distribution statement: B”) alongside the CUI category and controlling office information. DoDI 5200.48 governs the broader CUI program; DoDI 5230.24 governs distribution statements. Applying one correctly while ignoring the other still leaves you out of compliance.
Cybersecurity Duties for Holders
Contractors who store or process technical data with restricted distribution statements take on cybersecurity obligations under DFARS 252.204-7012. The clause requires contractors to implement the controls in NIST Special Publication 800-171 on any covered contractor information system that handles covered defense information, and controlled technical information is explicitly included in that definition.
A cloud service provider used to store or transmit restricted technical data must meet security requirements equivalent to the FedRAMP Moderate baseline. Incident-reporting duties come with the territory: cyber incidents affecting covered defense information must be reported to DoD within 72 hours, and the contractor must preserve images of affected systems for 90 days to support forensic analysis. These requirements apply regardless of the letter on the document, as long as the data qualifies as covered defense information.