How to Mark Controlled Unclassified Information (CUI)

To mark Controlled Unclassified Information, place a CUI banner centered at the top and bottom of every page, add a designation indicator block on the first page or cover that identifies the originating agency and the CUI categories involved, and, if you choose to portion mark, label every paragraph in the document. The format follows a strict syntax set out in 32 CFR Part 2002 and administered through the CUI Registry at the National Archives.¹ The details below walk through each required element, plus the rules that change when the document is an email, sits alongside classified material, or was created under an older marking regime.

The CUI Banner

The banner is the marking anyone sees first, and it must appear at the top and bottom of every page. It has up to three elements separated by double forward slashes.

The first element is the CUI control marking, always either CUI or CONTROLLED. This element is mandatory.² The second element lists any CUI category or subcategory markings, alphabetized and separated by single forward slashes. This is mandatory for CUI Specified categories and optional for CUI Basic. The third element lists any limited dissemination controls, also alphabetized and separated by single forward slashes.³

Worked examples:

CUI Basic with no restrictions: CUI
CUI Basic with a dissemination control: CUI//FEDCON
CUI Specified, Privacy, no restrictions: CUI//SP-PRVCY
Two CUI Specified categories with a dissemination control: CUI//SP-CTI/SP-EXPT//NOFORN

The banner must reflect the highest level of control present anywhere in the document. If a single paragraph contains CUI Specified information, the banner for the entire document must name that category.

The Designation Indicator Block

Every CUI document must include a designation indicator (DI) block, typically on the first page or cover. At a minimum, the block must identify the agency that designated the information as CUI. Agency letterhead can satisfy this, or a simple “Controlled by” line such as “Controlled by: Division 5, Department of Good Works.”¹

Most agencies require more. The Department of Defense specifies four lines:

Line 1: The DoD component name (if not already on the letterhead) and the originating office.
Line 2: The CUI categories contained in the document.
Line 3: Any applicable limited dissemination controls or distribution statement.
Line 4: A point of contact with phone number or email address; organizational emails are acceptable.

⁴

Where feasible, the DI block should also include a decontrolling date or event so anyone handling the document can tell when the CUI protections end. If an event triggers decontrol instead of a date, that event must be one any authorized holder can independently verify.⁵

Portion Marking

Portion marking labels individual paragraphs, sections, or images so a reader can see exactly which parts are CUI and which are not. Federal regulation encourages portion marking but does not require it for most documents; agencies can mandate it through their own policies.¹

Once you decide to portion mark, every portion has to be marked, including the uncontrolled ones. CUI portions get (CUI) at the beginning. Uncontrolled unclassified portions get (U). CUI Specified portions include the category abbreviation, like (CUI//SP-PRVCY).²

When a paragraph contains sub-bullets all at the same control level, a single marking on the primary paragraph is enough. Where sub-sections mix control levels or categories, each segment needs its own marking to avoid over- or under-controlling any part of the document.

Picking the Right Category and Dissemination Controls

You cannot invent a CUI category. Only categories and subcategories approved by the CUI Executive Agent and published in the CUI Registry are valid, and old ad hoc labels like “For Official Use Only” or “Sensitive But Unclassified” are no longer authorized.¹ The Registry organizes CUI into groupings such as Critical Infrastructure, Defense, Export Control, Financial, Immigration, Intelligence, Law Enforcement, Legal, and Privacy.⁶

Every category is either CUI Basic or CUI Specified. Basic categories follow the baseline handling controls in 32 CFR Part 2002 and can be listed in the banner but do not have to be. Specified categories have handling requirements set by the authorizing law or regulation that go beyond or differ from the baseline, and they must be named in the banner.²

Limited dissemination controls (LDCs) go in the third element of the banner and restrict who can access the information:

FED ONLY: access limited to U.S. executive branch employees and armed forces personnel.
FEDCON: access extended to FED ONLY recipients plus individuals under federal contracts, when sharing serves the contractual purpose.
NOCON: no sharing with federal contractors, but sharing with state, local, or tribal employees is permitted.
DL ONLY: access restricted to individuals or organizations on an accompanying dissemination list.
NOFORN: no dissemination to foreign governments, foreign nationals, or international organizations.
REL TO USA, [list]: releasable only to specified foreign countries or international organizations through established disclosure channels.

If no LDC appears, anyone with a lawful government purpose can access the information. The absence of an LDC does not authorize public release.⁷

Email and Electronic Files

Word documents, PDFs, and spreadsheets follow the same banner and DI block rules as paper: the banner on every page, the DI block on the first page. File names should carry a CUI indicator so the presence of controlled information is obvious before anyone opens the file. Examples: CUI_Budget_FY2026.xlsx, CUI_Program_Brief.pptx.⁸

Email has its own conventions. When the email body itself contains CUI, “CUI” must appear as the first and last line of the message, and the email must include a DI block. When the body has no CUI but carries CUI attachments, “CUI” still appears as the first and last line, along with a statement that the email is unclassified once the attachments are removed. In that scenario the email itself does not need a DI block, but every attachment must be properly marked.⁹

Do not add a blanket disclaimer stating that an email “may contain CUI.” The program explicitly prohibits that kind of hedge-language because it dilutes the marking system and tells the recipient nothing useful.⁹ CUI transmitted electronically must be encrypted, whether by email or on removable media.²

Physical Documents and Media

For printed or handwritten documents, the banner sits centered at the top and bottom of every page, the DI block goes on the first page or cover, and any portion markings appear inline at the start of the relevant paragraph or image.

A CUI cover sheet, Standard Form 901, can substitute for individual page banners. When you use one, you do not need to mark every internal page with the banner, but the cover sheet itself should list the CUI categories and any dissemination controls.³ The SF 901 instructs recipients that handling, storage, reproduction, and disposition follow 32 CFR Part 2002 and applicable agency policy.¹⁰

For physical electronic media, the National Archives provides adhesive labels: SF 902 sized for hard drives and similar media, and the smaller SF 903 sized for USB drives. Both are available through GSA.¹¹

Documents That Contain Both CUI and Classified Information

When a document combines classified information with CUI, classification marking rules take precedence. The banner and footer reflect the highest classification level in the document, not the CUI designation. Portion marking becomes mandatory, and CUI portions are marked (CUI) at the paragraph level. If CUI cannot be isolated into its own portions, the portion marking reflects the highest classification level in that portion, and the CUI marking drops out of the banner entirely.¹²

Both the classification authority block and the CUI designation indicator block should appear at the bottom of the first page, with the classification authority block on the lower left and the DI block on the lower right.

Old Documents With Legacy Markings

Legacy labels like FOUO, SBU, and LES are void under 32 CFR Part 2002. They no longer indicate that information is protected or that it qualifies as CUI.¹

Agencies do not have to re-mark every old document in a filing cabinet. Legacy material that stays within the agency and is not reused or repurposed can keep its existing markings. The re-marking obligation kicks in when legacy information is reused in a new document or transmitted outside the originating agency; the new product must carry proper CUI markings.⁵

When marking is impractical because of the volume or nature of the information, authorized holders can put recipients on notice through alternatives like access agreements, digital splash screens at system login, or signs posted in storage areas.¹

What Not to Do

Only an authorized holder working for the designating agency can decide that information qualifies as CUI and apply the initial markings, based on whether a law, regulation, or government-wide policy requires or permits safeguarding or dissemination controls.¹ A few boundaries follow from that:

Do not mark information as CUI to conceal illegality, negligence, or embarrassing circumstances. CUI designation exists to comply with the authorizing authority, not to shield anyone from accountability.¹
Do not invent categories or reuse retired labels like FOUO or SBU.
Do not add a blanket “may contain CUI” disclaimer to email.⁹
Do not assume unmarked information is unprotected. If you receive material you believe qualifies as CUI, notify the designating agency and request properly marked material; the missing marking does not excuse an authorized holder from the required handling.¹

Misuse includes marking information as CUI when it does not qualify, failing to mark information that does, and any handling that violates the program’s requirements. The regulation treats intentional violations and unintentional errors alike as misuse, and agency heads have authority to take administrative action against personnel responsible. Where the authorizing law or regulation for a specific CUI category sets its own sanctions, those sanctions govern. Agreements with non-executive-branch entities, including contractors, must state that misuse of CUI is subject to penalties in applicable laws and regulations.¹³

Defense contractors take on these marking obligations through DFARS clause 252.204-7012, which requires adequate security for covered defense information and, at a minimum, the controls in NIST SP 800-171. DoD must mark or identify any CUI it provides, and the contract must require the contractor to mark any CUI the contractor develops during performance.¹⁴ The same banner, DI block, portion marking, and email rules apply.

1
eCFR. 32 CFR 2002.20 – Marking
2
eCFR. 32 CFR 2002.20 – Marking
3
Defense Counterintelligence and Security Agency. CUI Marking Job Aid
4
DoD CUI Program. CUI Designation Indicator Block
5
eCFR. 32 CFR Part 2002 Subpart B
6
National Archives. CUI Registry Category List
7
DoD CUI Program. CUI Limited Dissemination Controls
8
CDSE. CUI Quick Marking Tips
9
DoD CUI Program. Email – DoD CUI Program
10
GSA. Standard Form 901 Cover Sheet
11
National Archives. CUI Resources
12
CDSE. Controlled Unclassified Information Toolkit
13
eCFR. 32 CFR Part 2002
14
Department of Defense. Guidance for Selected Elements of DFARS Clause 252.204-7012