These aren't typographical slips. They're process failures, and they carry real consequences for contractors, subcontractors, and federal partners handling Controlled Unclassified Information.
CUI marking is not the same as classification. It doesn't rank information by secrecy level. Instead, it tells every downstream reader what handling and dissemination rules apply, based on the specific law, regulation, government-wide policy, or contract that governs that particular piece of information.
This article walks through a practical process: confirming CUI status, choosing the correct category and controls, applying banners and designation indicators, marking derivative copies, and catching the mistakes that trip up even experienced teams. Always verify current requirements against your governing contract and agency guidance before finalizing a marking.
Key Takeaways
- A compliant marking generally needs a CUI control marking plus a designation indicator at minimum
- Markings must travel with the information into every email, attachment, screenshot, and derivative file
- Only the NARA CUI Registry and your governing contract define valid categories, never internal substitutes
- Controlled templates and periodic sampling catch unmarked copies before an auditor does
- Legacy labels like FOUO require review, not automatic deletion or automatic relabeling
How to Label CUI Correctly: A Step-by-Step Process
Step 1: Confirm That the Information Qualifies as CUI
Before marking anything, verify the information actually falls within an authorized category or subcategory listed in NARA's CUI Registry or the applicable agency guidance.
Sensitivity alone doesn't make something CUI. Proprietary data, technical specifications, or contract correspondence aren't automatically controlled just because they feel confidential.
To confirm eligibility:
- Identify the originating authority: the statute, regulation, policy, or contract clause that requires protection
- Document that basis in writing, not just in your head
- Note the designating agency responsible for the determination
If you're unsure, stop and ask. Pause further distribution and consult the information owner, contracting officer, Facility Security Officer, or your organization's designated CUI contact. Guessing wrong in either direction creates problems: under-marking risks unauthorized disclosure, while over-marking adds needless handling burden.
Step 2: Identify the Correct Category and Handling Rules
Once eligibility is confirmed, determine whether the information is CUI Basic or CUI Specified. This distinction changes what controls apply.
- CUI Basic follows the standard safeguarding and dissemination rules in 32 CFR 2002.20 when the authorizing law or policy doesn't specify anything different
- CUI Specified carries additional or different requirements set by its underlying authority. Criminal History Records Information, for example, falls under 28 CFR Part 20 and uses the banner CUI//SP-CHRI
Use only the category abbreviations and control markings the Registry or your contract authorizes. Don't invent shorthand, and don't carry forward obsolete labels like FOUO without a documented review first.
Step 3: Apply the Banner and Designation Indicator
The government-wide baseline requires a CUI control marking (either "CUI" or "CONTROLLED") in the banner, plus a designation indicator identifying at least the designating agency. The indicator typically appears only on the first page or cover.
DoD goes further. Under DoDI 5200.48, contractors must place "CUI" at the top and bottom of every page, with a designation indicator on the first page or cover that includes:
- The DoD Component and determining office
- All CUI types contained in the document
- Any applicable distribution statement or dissemination control
- A point of contact (phone number or office mailbox)
A banner that appears correctly on page one but vanishes after a PDF export or print job doesn't meet the requirement. Test your templates across formats before relying on them.
Step 4: Mark Portions and Derivative Materials When Applicable
Portion marking is optional in fully unclassified documents under the government-wide Handbook, but some agencies and DoD components require it. If your organization chooses to portion-mark, apply the convention consistently, marking both CUI portions (CUI) and uncontrolled portions (U) throughout the document.
Markings must carry into:
- Excerpts, copied paragraphs, and quoted sections
- Screenshots, spreadsheets, and data exports
- Tables, drawings, and technical diagrams
- New reports built from the original source
Before transmission, run a final check:
- Is the marking visible?
- Is the category supported by documentation?
- Did any derivative copy lose its label along the way?
What You Need to Know Before Applying a CUI Marking
Correct marking starts with an authoritative determination, not a formatting decision. Before applying any label, review 32 CFR Part 2002, the NARA CUI Registry, current DoD guidance such as DoDI 5200.48 where it applies, and your specific contract instructions.
Authority and Responsibility
The authorized holder (the originator, document owner, or person responsible for first dissemination) typically applies the initial marking. Anyone who later creates a derivative document, an excerpt, a summary report, or a forwarded email inherits responsibility for carrying that marking forward.
Organizations should formalize this in writing:
- Who holds designation authority
- Who to escalate to when status is unclear
- Who reviews and approves markings before release
Minimum Marking Elements
At a government-wide minimum, a compliant document needs the CUI control marking and the designation indicator. That's the floor, not the ceiling.
Additional requirements layer on top depending on category, agency, contract, and format:
- Specified category markings (required when applicable)
- Limited dissemination controls
- Distribution statements
- Point-of-contact fields
Never assume the exact content or placement of these elements without validating against the governing authority for your specific document.
CUI Basic Versus CUI Specified
Don't assume every document in your organization needs identical treatment. CUI Basic follows standard CUI program safeguards. CUI Specified categories carry requirements set by their own underlying law or regulation, which may be stricter, looser, or simply different.
Check the Registry entry and your contract guidance before selecting a category. One document type's rules won't transfer cleanly to another.
Implementation Resources
Controlled templates reduce human error. Build headers, footers, designation fields, and review prompts directly into your Word, PDF, PowerPoint, spreadsheet, and email templates so marking isn't left to memory.
Consistent training and document control infrastructure matter most here. QMS Learning's Aerospace & Defense Audit-Ready pathway covers AS9100D, ITAR, and related compliance areas with role-specific training. Its Document Management System preserves every revision alongside its review and release record, linking documents to the clauses and training they support.
Tools like these support repeatable workflows and audit-evidence collection. Your organization remains responsible for applying the authoritative marking requirements correctly.
Where and When CUI Markings Apply
Marking obligations follow the information itself, not the file extension. The same review standard applies whether the content lives in a Word document, a Teams message, or a printed handout.
Documents, Drawings, Slides, and Spreadsheets
Apply page-level banners, first-page designation information, and markings that stay visible on every slide or worksheet. Technical drawings, tables, and mixed-content documents all need the same scrutiny:
- Does the banner appear on every page, not just the first?
- Is the designation indicator legible after printing or scanning?
- Do embedded tables or diagrams carry their own markings when extracted?
Email, Chat, and Collaboration Tools
Address CUI across these channels:
- Email subjects, bodies, and attachments
- Teams messages and shared links
- Exported chat logs
Validate your approach against your organization's approved communication procedure and technical controls. Informal practices here create some of the most common leaks.
Physical Media and Recordings
Printouts, removable media, labels, photographs, screenshots, audio, video, transcripts, and handwritten notes all need markings that stay attached when content leaves its original container.
A USB drive pulled from a marked folder still needs its own label.
Important: never place CUI markings on the outside of envelopes or packages, or otherwise identify CUI contents externally during mailing.
When Markings Change
Decontrol, authorized release, reclassification, or a change in governing authority requires documented review, not a unilateral decision. A contractor cannot decontrol information independently without the designating agency's authorization. Decontrol itself does not automatically authorize public release.
Key Variables, Common Mistakes, and Troubleshooting
Most marking failures trace back to incorrect designation, missing derivative markings, inconsistent templates, or unclear ownership, not typography.
Variable 1: Source Authority and Category Selection
An unsupported or invented category communicates the wrong handling rule and corrupts your CUI inventory. Compare the information against the current Registry, originating instructions, and contract language. Escalate ambiguity instead of guessing.
Variable 2: Placement and Consistency
A banner that appears only on page one, disappears during PDF conversion, or never makes it onto a slide leaves recipients without a clear signal. Use controlled templates, header and footer locks, conversion testing, and a second-person review for high-risk deliverables.
Variable 3: Derivative Copies and Mixed-Content Documents
Excerpts, screenshots, spreadsheets, and status reports often preserve the sensitive content while losing the original markings. Trace your common workflows—source document to email, export, print, shared drive, archive—and confirm each stop still carries the required label.
Common Mistakes to Watch For
- Treating all sensitive business information as CUI. Proprietary, confidential, or export-controlled data isn't automatically CUI without a documented connection to an authorized category
- Using obsolete labels like FOUO without review. Preserve the record, route it for review, and remark according to current guidance rather than deleting the old label outright
- Omitting required controls or over-marking everything. Both failures undermine trust in your CUI inventory and invite audit findings
Troubleshooting Checklist
When you find an unmarked document, incorrect banner, or uncertain category:
- Stop further distribution immediately
- Preserve the original, unaltered
- Notify the designated contact or security lead
- Assess whether an incident procedure applies
- Correct the record and document the decision
Sample your repositories, email, templates, and print workflows periodically. A template that's correct in isolation doesn't guarantee markings survive real-world use.
Conclusion
Correct CUI labeling takes more than stamping "CUI" on a page header. It requires establishing the information's authority and category, applying the required banner and designation elements, carrying markings into every derivative copy, and following your specific contract or agency controls.
Most preventable failures come from the same root causes:
- Unclear ownership
- Outdated guidance sitting in a shared drive
- Inconsistent templates
- Unmarked copies scattered across email and print workflows
Close those gaps with a simple operating rhythm:
- Assign marking ownership
- Validate your templates against current authoritative sources
- Train every role that touches CUI
- Test the process with real document and communication samples, not just a clean template nobody actually uses
Frequently Asked Questions
What is CUI marking?
CUI marking is the visible identification and designation information applied to Controlled Unclassified Information so authorized holders know it requires safeguarding and controlled dissemination. It's distinct from classification, and exact requirements depend on the governing authority for that specific information.
What are the minimum required markings for CUI?
At minimum, a document needs a CUI control marking and a designation indicator identifying the designating agency. Category, dissemination, portion, placement, and format-specific requirements may be added by the CUI type, DoD or agency guidance, or your contract.
Who is responsible for CUI markings?
The authorized originator or holder responsible for first disseminating the information typically applies the initial marking. Anyone creating a derivative copy must carry forward applicable markings, following their organization's assigned roles and escalation procedure.
Can a contractor decontrol CUI on their own?
No. Decontrol requires authorization from the designating agency or an affirmative decision under the governing authority. A contractor cannot remove markings independently, and decontrol doesn't itself authorize public release.
Is FOUO the same as CUI?
Not automatically. For Official Use Only is a legacy label that doesn't convert to CUI without review. Preserve the original record, assess eligibility against current Registry categories, and remark according to current guidance rather than simply deleting the old label.