How to Fill Out and Use Standard Form 901: CUI Cover Sheet

The SF-901 CUI cover sheet is a one-page notice you place on top of any document containing Controlled Unclassified Information, and filling it out means printing the current GSA version, then writing the CUI category, any limited dissemination controls, and a point of contact into the “ATTENTION” box near the top. Most of the sheet is pre-printed; your job is that one open field and then keeping the sheet with the document whenever it leaves secured storage.

Federal use of the cover sheet is optional at the government-wide level. 32 CFR 2002.32 says agencies “may use” cover sheets for CUI, though many agency policies treat SF-901 as mandatory, and the Center for Development of Security Excellence calls it a best practice even where not required.¹ If your agency does use a cover sheet, it has to be the CUI Executive Agent-approved version. You cannot design your own.

Where to Download SF-901

The General Services Administration hosts the current PDF on its forms page titled “Controlled Unclassified Information (CUI) Coversheet.”² It’s a single page you can print or use as a digital overlay. For bulk physical supplies, pre-printed copies are available through GSA Global Supply at gsaadvantage.gov.³ The CUI Registry, maintained by the National Archives through the Information Security Oversight Office, links to the approved form.⁴

What Is Already Printed on the Sheet

The current edition of SF-901, dated November 2018, has three fixed elements and one field you fill in.⁵ “CUI” is banner-printed at the top and bottom. An ATTENTION box in the middle-upper area gives you space to write in details about the attached document. Pre-printed handling text below the box states that anyone handling the attachment must protect it from unauthorized disclosure under 32 CFR Part 2002 and applicable agency policy, and that access and dissemination are allowed when consistent with a lawful government purpose. The footer identifies the form as “Standard Form 901 (11-18),” prescribed by GSA/ISOO under 32 CFR 2002.

What to Write in the ATTENTION Box

The ATTENTION box is where you tell the next person handling the document exactly what kind of CUI they’re dealing with. At a minimum, include three things.

The CUI category or subcategory. Use the category markings from the CUI Registry. Common ones include TAX (Federal Taxpayer Information), PRVCY (Privacy), CTI (Controlled Technical Information), and INTEL (General Intelligence).⁶ Category markings are mandatory for CUI Specified and optional (though often agency-required) for CUI Basic.⁷ If the document mixes multiple categories, list all of them.

Any limited dissemination controls. If distribution is restricted, note the applicable marking. NOFORN means no sharing with non-U.S. citizens or governments. REL TO indicates the document is releasable to listed foreign partners. DL ONLY limits distribution to a specific list of recipients.⁸

A point of contact. A phone number or email for the office responsible for the designation, so anyone with a question can route it to the right place. Write the agency name out in full rather than internal acronyms that outside handlers might not recognize.

CUI Basic Versus CUI Specified Changes the Marking

The Basic-versus-Specified distinction affects what you write. CUI Basic covers information a law or regulation requires safeguarding without prescribing specific handling procedures. Agencies apply the uniform controls in 32 CFR Part 2002. CUI Specified comes with handling controls written directly into the governing law or policy, and those controls may be stricter or simply different from the baseline.⁹

CUI Specified material must carry its category marking in the banner, for example “CUI//SP-TAX.” CUI Basic can be marked simply “CUI” or “CONTROLLED,” though some agencies require category markings on Basic material too.⁷ If you’re unsure which applies, check the CUI Registry entry for your category; it will say whether the authority is Basic, Specified, or both.

Placing the Sheet on Paper Documents

Put SF-901 as the top page of any paper bundle that contains CUI. The sheet should be visible whenever the material is outside an approved storage location, whether that’s on a desk, in transit between offices, or being carried through common areas. It identifies the content as CUI at a glance and physically shields the first page from casual observation.¹

Under 32 CFR 2002.14, authorized holders must keep CUI under direct control or behind at least one physical barrier when outside a controlled environment.¹⁰ The cover sheet counts as that barrier during active handling. It does not replace locked storage. Leave your desk, and the document goes back into a locked drawer, file cabinet, or room, depending on your agency’s policy and the building’s security posture.

Mailing and Shipping With the Sheet

CUI can move through the U.S. Postal Service, any commercial delivery service, or interoffice and interagency mail. The regulation recommends in-transit tracking, and packages must carry CUI markings on the outside in accordance with 32 CFR 2002.20.¹⁰

Using the Sheet on Digital Files

For electronic documents, insert a digital SF-901 as the first page of a PDF so the CUI notice appears before any substantive content. Some organizations embed the cover sheet image into automated workflows: when a document is tagged as CUI in a records system, the cover page is generated and prepended automatically. On federal information systems, CUI must also be protected in accordance with FIPS Publication 199, FIPS Publication 200, and NIST SP 800-53.¹⁰

SF-901 doesn’t fit on electronic media like USB drives, hard drives, or CDs. That’s the boundary between SF-901 and its two companion forms.

When to Use SF-902 or SF-903 Instead

SF-901 is one of three CUI standard forms. The other two are adhesive labels for physical media where a full cover sheet won’t fit.

SF-902 is a label roughly 2.125 by 1.25 inches, sized for hard drives. Its National Stock Number is 7540-01-679-3318.⁸
SF-903 is smaller, about 2.125 by 0.625 inches, intended for USB drives and similarly compact devices. Its NSN is 7540-01-679-3319.⁸

Both are available through GSA Advantage. Due to size, the labels may not carry full category or dissemination markings; at a minimum they display “CUI.”

Removing the Sheet When CUI Is Decontrolled

The cover sheet stays with the document as long as the underlying information remains designated CUI. Decontrol happens when the law or regulation that required safeguarding no longer applies, when the designating agency affirmatively releases the information, or automatically on a pre-determined date or event set at original designation.¹¹

Only the designating agency, or authorized personnel within it, can decontrol CUI. An authorized holder who thinks a document should be decontrolled can request it, but cannot unilaterally remove the designation. Once decontrolled, the holder must clearly indicate the material is no longer controlled. Agency policy may allow you to remove or strike through only the CUI markings on the first or cover page and on the first page of any attachments, rather than scrubbing every marking on every page.¹¹

One point that trips people up: decontrol doesn’t automatically mean public release. A document can be decontrolled, relieving you of CUI handling requirements, while still not being cleared for publication or FOIA disclosure.

Destroying the Cover Sheet With the Document

When you no longer need a CUI document and NARA-approved records disposition schedules allow destruction, destroy it in a way that makes the content unreadable, indecipherable, and irrecoverable.¹⁰ The regulation doesn’t mandate a single method. It points to two options: the destruction methods in NIST SP 800-53 (for system-based controls) and NIST SP 800-88 (for media sanitization), or any method approved for classified national security information under 32 CFR 2001.47. If a specific law or government-wide policy governing that CUI category requires a particular destruction method, use that one instead.

In practice, most offices shred paper CUI, often with cross-cut shredders, and degauss or physically destroy electronic media. Destroy the cover sheet alongside the document. Intact cover sheets with agency contact details left in general recycling can create the false impression that CUI was improperly discarded.

1
eCFR. 32 CFR 2002.32 – CUI Cover Sheets
2
General Services Administration. Controlled Unclassified Information (CUI) Coversheet
3
General Services Administration. GSA Global Supply
4
National Archives. Information Security Oversight Office (ISOO)
5
General Services Administration. Standard Form 901 (11-2018)
6
National Archives. CUI Markings
7
eCFR. 32 CFR 2002.20 – Marking
8
Center for Development of Security Excellence. CUI Quick Marking Tips
9
eCFR. 32 CFR 2002.4 – Definitions
10
eCFR. 32 CFR 2002.14 – Safeguarding
11
eCFR. 32 CFR Part 2002 – Controlled Unclassified Information