Who Is Responsible for CUI Markings and Dissemination?

Responsibility for CUI markings and dissemination rests with the authorized holder — the federal employee, service member, or contractor who creates, receives, or otherwise comes into possession of Controlled Unclassified Information. The person who generates the information marks it at the moment of creation, and every holder who later shares it is responsible for confirming the recipient has a lawful government purpose to receive it. Agencies and the National Archives set the rules, but the day-to-day duty sits with the individual handling the document.

The Creator Marks It

When an authorized holder produces information that falls into a CUI category listed on the National Archives CUI Registry, that holder must designate it as CUI and apply the required markings at the time of creation.¹ This is not delegated upward to a supervisor, a security office, or a review board. It is the creator’s job.

The required markings include a banner on every page using either “CONTROLLED” or “CUI,” a designation indicator identifying who designated the information (which may appear only on the first page or cover), and, where the holder is permitted to designate CUI, portion markings on both CUI and uncontrolled portions of the document.² The banner content must be identical on every page and must reflect all the CUI anywhere in the document.

For CUI Specified — information whose authorizing law or policy prescribes handling beyond the baseline in 32 CFR Part 2002 — the banner must include an “SP-” prefix followed by the category abbreviation. CUI Basic documents may optionally include the category abbreviation but do not use the “SP-” prefix.³

Digital material carries the same obligations. Emails with CUI in the body must be encrypted and marked at both the top and bottom, attachments containing CUI must be identified and encrypted, and file names should indicate the presence of CUI. Presentations and spreadsheets need the designation indicator on the first slide or page.³

Receiving Unmarked or Legacy-Marked Information

Holders who receive CUI from someone else also carry marking duties. When a holder incorporates received CUI into a new document, appropriate markings must be applied to that new material. If a holder discovers unmarked information that qualifies as CUI, the agency must mark it before disseminating it further.²

Older labels such as “For Official Use Only” (FOUO) and “Sensitive But Unclassified” (SBU) are legacy designations. Holders must discontinue any legacy markings not permitted by 32 CFR Part 2002 or included in the CUI Registry. Legacy markings still appearing on older documents are void and do not by themselves establish that the information is protected. If the information still qualifies as CUI, the agency must mark it as CUI before further dissemination.²

Who Counts as an Authorized Holder

An authorized holder is anyone who creates, receives, or gains possession of CUI and is permitted to designate or handle it. That includes federal civilian employees, military personnel, and contractors performing work under a federal contract. Being a holder does not require special seniority; it follows from lawful possession of the information in the course of authorized work.

Not every authorized holder has every authority. The designating agency — meaning the agency whose personnel first designated the information as CUI — retains exclusive powers over that specific information. Only the designating agency may apply limited dissemination controls or decontrol the information, though other authorized holders may request those actions or apply controls with the designating agency’s approval.¹⁴

The Dissemination Decision

Before sending CUI to anyone, the authorized holder must reasonably expect that every intended recipient has a lawful government purpose to receive it. A lawful government purpose is any activity, mission, or function that the U.S. government authorizes or recognizes as within the scope of its legal authorities.⁵ That judgment sits with the holder each time information moves.

Limited Dissemination Controls

When the designating agency needs to narrow distribution further, it applies a limited dissemination control. The recipient holder must then honor that control. The approved controls are:

NOFORN: no dissemination to foreign governments, foreign nationals, or international organizations.
FED ONLY: dissemination limited to federal executive branch employees and armed forces personnel.
FEDCON: dissemination limited to federal employees and contractors performing work under a U.S. government contract.
NOCON: no dissemination to contractors, though sharing with state, local, or tribal employees is permitted.
DL ONLY: dissemination authorized only to individuals or entities named on an accompanying dissemination list.

Sharing Outside the Executive Branch

When an agency shares CUI with a non-executive-branch entity such as a state or local government, it should enter a formal written agreement whenever feasible. At minimum the agreement must require the recipient to handle CUI in accordance with Executive Order 13556 and 32 CFR Part 2002, state that misuse is subject to applicable penalties, and require the recipient to report any non-compliance back to the disseminating agency.⁵ Written agreements are not required when sharing CUI with Congress, courts, or the Comptroller General.

Agency-Level Accountability

Above the individual holder, each federal agency must designate a CUI Senior Agency Official (SAO) who directs and oversees the agency’s CUI program, ensures implementing policies and plans are in place, establishes the training program, and sets up processes for reporting and investigating misuse.⁶ The SAO is the single point of accountability inside the agency.

Program-wide policy sits above that. Executive Order 13556, signed in November 2010, designated the National Archives and Records Administration as the Executive Agent for CUI. Within NARA, the Information Security Oversight Office sets government-wide policy for designating, safeguarding, marking, disseminating, decontrolling, and disposing of CUI, and NARA maintains the CUI Registry that lists every approved category and the law, regulation, or policy behind it.⁷⁶

Agencies also must train employees on CUI designation, categories and subcategories, the CUI Registry, markings, and safeguarding and dissemination procedures at initial onboarding and at least once every two years thereafter.⁸

Contractors: Same Duties Plus Contract Security Requirements

Contractor employees who possess CUI are authorized holders and follow the same marking and dissemination rules as federal personnel. Their companies also carry system-level obligations that federal employees do not personally shoulder. Defense contractors handling CUI on their own systems must implement the security requirements in NIST SP 800-171, and DFARS clause 252.204-7012 makes those requirements contractually binding and adds a 72-hour cyber incident reporting requirement to the Department of Defense.⁹¹⁰

The Cybersecurity Maturity Model Certification program adds assessed verification. Level 2 requires compliance with the 110 requirements in NIST SP 800-171 Revision 2 and either self-assessment or independent third-party assessment every three years, depending on the solicitation. Level 3 requires Level 2 certification plus 24 additional requirements from NIST SP 800-172, assessed by the Defense Contract Management Agency.¹¹

Non-executive-branch authorized holders must report any non-compliance with handling requirements to the disseminating agency, using methods the agency’s SAO approves.⁵

What Happens When a Holder Gets It Wrong

Misuse means handling CUI in a manner that violates Executive Order 13556, 32 CFR Part 2002, the CUI Registry, or agency CUI policy. It covers both intentional violations and unintentional errors.⁸

For federal employees, agency heads have authority to take administrative action, and agency CUI policies should reflect that authority. Where the laws governing specific CUI categories establish their own sanctions, agencies must follow those sanctions.¹² Some categories carry criminal penalties: willful disclosure of tax return information is a felony punishable by up to five years of imprisonment and a $5,000 fine, and a convicted federal employee must be dismissed from federal service.

For contractors, non-compliance can trigger contract termination — termination for default in defense contracts, termination for cause in commercial contracts — and the government may pursue reprocurement costs and other damages.

The regulation does not set a single government-wide timeline for reporting CUI misuse the way DFARS sets 72 hours for defense cyber incidents. Each agency’s SAO establishes the reporting and investigation process, and timelines vary by agency. When a non-executive-branch entity reports non-compliance to a disseminating agency that is not the designating agency, the disseminating agency must notify the designating agency as well.⁵

1
National Archives. CUI Registry – Limited Dissemination Controls
2
eCFR. 32 CFR 2002.20 – Marking
3
CDSE. CUI Quick Marking Tips
4
eCFR. 32 CFR 2002.18 – Decontrolling
5
eCFR. 32 CFR 2002.16 – Accessing and Disseminating
6
eCFR. 32 CFR 2002.8 – Roles and Responsibilities
7
National Archives. CUI Registry – Controlled Unclassified Information
8
eCFR. 32 CFR Part 2002 – Controlled Unclassified Information
9
NIST. SP 800-171 Rev 2 – Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
10
Acquisition.GOV. 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting
11
Chief Information Officer U.S. Department of Defense. About CMMC
12
eCFR. 32 CFR 2002.56 – Sanctions for Misuse of CUI