1
MARKING JOB AID
CUI
2
CUI MARKING JOB AID
WHAT IS
CUI?
Controlled Unclassified Information
(CUI) is unclassified information that
requires safeguarding or dissemination
controls pursuant to and consistent
with applicable laws, regulations, and
government-wide policies.
CUI SHOULD NOT
BE USED TO:
• Conceal violations of the law,
inefficiency, or administrative errors
• Prevent embarrassment to a
person, organization, or agency
• Prevent open competition
• Control information that does not
require protection under a law or
regulation
3
C
ontrolled Unclassified Information is
similar to For Official Use Only (FOUO) as it is
handled, stored, transmitted, and destroyed in
basically the same manner as the legacy FOUO
program.
• All media that contains CUI must be
marked as CUI in order to alert the user
to the presence of CUI. When the option
is available, CUI should be processed on
Government Furnished Equipment (GFE)
• CUI must be encrypted if sent via email
• Access to CUI should be limited to those
with a lawful government purpose
• CUI should be destroyed by means approved
for destroying classified or in a manner
making it unreadable, indecipherable, and
irrecoverable.
• After working hours, CUI may be stored in
unlocked containers, desks, or cabinets if
the facility provides security for continuous
monitoring of access. Otherwise, the
information must be stored in locked desks,
file cabinets, bookcases, locked rooms, or
similarly secured areas.
• CUI will be formally reviewed in accordance
with DoDI 5230.09, Clearance of DoD
Information for Public Release, before being
decontrolled or released to the public.
COVERSHEET AND
CUI MEDIA LABELS
• Coversheets are optional except when
required by agency policy, but can
replace banner markings.
• A CUI coversheet can also include
categories/dissemination controls or
list/originator designation
• Sample coversheets can be found in
the CUI Registry at: www.archives.gov/
cui/additional-tools and can be printed
in black and white.
• Every page does not have to be
marked if you are using a coversheet.
SF 901, CUI Cover Sheet
SF 902, CUI Label
CUI MARKING JOB AID
4
ALTERNATE MARKING METHODS
CUI CONTROL
MARKING
CUI Handbook – NARA
Storing CUI
Authorized holders
should mark the
container to indicate
that it contains CUI.
Systems marking or
identifying CUI in
databases
Agencies may authorize or
require the use of alternate
CUI indicators on IT systems,
websites, browsers, or
databases through agency
CUI policy.
These may be used to alert
users of the presence of CUI
where use of markings has
been waived by the agency
head.
Shipping/Mailing CUI
Address packages that
contain CUI for delivery
only to a specific recipient.
DO NOT put CUI markings
on the outside of an
envelope or package for
mailing/shipping.
Remember to track the
package.
1
Version 1.1 – December 6, 2016
As required by Executive Order 13556, Controlled UnclassifiedInformation, November 4, 2010, and 32 CFR Part 2002,
Controlled Unclassified Information, effective November 14, 2016.
CUI HANDBOOK 2016-12-06: This guidance document does not have the force and effect of law and is not meant to bind the public, except as authorized by law or
regulation or as incorporated into a contract. Accordingly, with regard to the public, this document only provides clarity regarding existing requirements under the
law or agency policies. This guidance document is binding on agency actions as authorized under applicable statute, executive order, regulation, or similar authority.is
CONTAINS
CONTROLLED
UNCLASSIFIED
INFORMATION
THIS SYSTEM CONTAINS CUI
THIS SYSTEM CONTAINS CUI
I accept the agreement
I do not accept the agreement
You must accept the license agreement before connuing
You are accessing a U.S. Government (USG)
informaon system (IS) (which includes any device
aached to this informaon system) that is
provided for U.S. Government authorized use only.
This system contains CUI. I acknowledge that
failure to abide by these terms and the other parts
of the user agreement may result in revoked or
suspended access privileges.
DELIVER ONLY TO:
Angela Moss
5
MANDATORY CUI BANNER MARKING
I
t is mandatory to include a banner marking at the
top of each page denoting Controlled Unclassified
Information.
It is optional, but a best practice to include the
banner marking on the bottom in addition to the top.
The content of the CUI banner marking must be
inclusive of all CUI within the document and must be
the same on each page.
There are two kinds of CUI: Basic and Specified.
If the laws or regulations, or Government-wide policy
that pertains to your information is listed in the CUI
Registry as a Specified Authority, then you must mark
the CUI based in that authority as “CUI Specified” on
the banner. Information marked as “CUI Basic” does
not require specific protection.
The CUI banner marking may include up to three
elements:
1. The CUI Control Marking (mandatory) may
consist of either the word “CONTROLLED” or the
acronym “CUI.”
2. CUI Category or Subcategory Markings
(mandatory for CUI Specified). These are
separated from the CUI Control marking by a
double forward slash (//). When including multiple
categories or subcategories in a banner marking,
they must be alphabetized and are separated by a
single forward slash (/).
3. Limited Dissemination Control Markings.
These are preceded by a double forward slash (//)
to separate them from the rest of the CUI banner
marking. When a document contains multiple
Limited Dissemination control markings, those
Limited Dissemination control markings must be
alphabetized and separated from each other with
a single forward slash (/).
CUI CONTROL
MARKING
CUI
CUI CATEGORY
MARKING
(If required)
CUI CATEGORY
MARKING
(If required)
Limited
Dissemination
LIMITED
DISSEM
CUI OR CONTROLLED//CATEGORIES//SUBCATEGORIES//DISSEM
CUI//SP-SPECFIED-A/SP-SPECIFIED-B//DISSEM
Example of CUI
banner marking
Example of CUI banner
marking includes
all Specified and
Dissemination markings
from throughout document
THE DOD CUI REGISTRY
The DoD CUI Registry provides an official list of the Indexes and Categories used to identify the various types
of CUI used within DoD. Contractors performing on DOD classified contracts with CUI requirements should
consult the DOD Registry.
• Mirrors the National CUI Registry www.archives.gov/cui.
• The DoD CUI Registry is located at https://www.dodcui.mil.
CUI MARKING JOB AID
6
COMMINGLING PORTION MARKING
In a commingled document, when a portion
contains both CUI and classified information,
the portion marking for the classified information
must precede the CUI portion marking. Keep
the CUI and classified portions separate to the
greatest extent possible to allow for maximum
information-sharing.
(S//CUI//SP-AAAA/BBBB//DISSEM)
U.S.
Classi-
cation
Category
Markings
Dissemination
Control
Marking
CUI
Control
Marking
All categories relating to
specified information MUST
have “SP-” precede the
category marking
Example of
markings on a
CUI document
with portion
markings
DESIGNATION INDICATOR
• All documents containing CUI must indicate the agency of designation (a letterhead, signature block, or
“Controlled By” line) on the first page or cover of all documents containing CUI.
• Include the contact information of the designating agency, and identify a point of contact or division within
the organization.
Header
CUI
Designation
Indicator
Footer
(Optional)
Portion
Marking
7
MARK OR IDENTIFY CUI IN SPREADSHEETS & FORMS
• If working in a spreadsheet, the header and/or footer should clearly be marked.
• Forms that contain CUI, must be marked accordingly, when filled in.
Example
of email
markings
MARKING EMAILS
• It is mandatory to include banner markings to
indicate that an email contains CUI.
• If an email is forwarded, the banner marking
must be carried forward.
• If sending an attachment that contains
CUI, the name of the file can contain a CUI
indicator.
• If an attachment is removed, and the email
no longer contains CUI, add the following
statement below the banner marking
“Uncontrolled Unclassified Information.”
• Emails that contain CUI must be encrypted.
N
ote: Once you begin marking a document,
every page in the document must also be
marked.
Optional
subject line
Indicator
marking
Optional
attachment
indicator
marking
Mandatory
banner
marking
Mandatory
CUI control
marking
CUI MARKING JOB AID
8
CUI LIMITED DISSEMINATION CONTROL (LDC)
• LDC markings are used to limit and/or control who can or cannot access CUI based on a specific law,
regulation, or policy.
• LDC markings cannot unnecessarily restrict CUI access. (e.g., do not mark a document as “No
Dissemination to Contractors” or “NOCON” unless there is a law, regulation, or policy that prohibits
dissemination to a contractor).
• Individuals must have a lawful government purpose to access and disseminate CUI.
• Personnel who receive CUI from another Executive branch agency must comply with the LCD markings
annotated on their document.
• All legacy information is not automatically CUI. Legacy material that is being re-used and incorporated
into another document of any kind needs to be marked CUI.
• When a document contains multiple LDC markings, those LDC markings are separated by a single
slash (/).
• For a complete list LDC markings visit https://www.dodcui.mil.
LD CONTROL MARKING
No Foreign Dissemination NOFORN
Federal Employees Only FED ONLY
Federal Employees and Contractors Only FEDCON
No Dissemination to Contractors NOCON
*Dissemination List Controlled DL ONLY
** Authorized for release to REL TO [USA], LIST
Display Only DISPLAY ONLY
*The dissemination list limits access to the specified individuals, groups, or agencies and must accompany
the document.
** For a complete a list of approved Tri-graph Country Codes, go to https://www.dod.dodcui.mil.
9
FLOWCHART FOR CUI DETERMINATION
START
Does the
information meet
the standards for
classication in
accordance with
DoDM 5200.01
Volume 1?
Does the
information fall
within a law,
regulation, or
government-
wide policy?
Identify the
category(ies)
the information
falls within:
DoD CUI
Registry
https://www.
dodcui.mil
The CUI
category is
annotated on
the document
in the CUI
Designation
Indicator block
Controlled by: OUSD(I&S)
Controlled by: CL&S INFOSEC
CUI Category(ies): PRVCY
Limited Dissemination Control: FEDCON
POC: John Brown, 703-555-0123
Go to DoDM
5200.01
Volume 1 for
guidance on
processing
classied
information
This information
cannot be
marked as CUI
YES
YES
Example
NO NO
CUI MARKING JOB AID
10
EXAMPLE OF DISTRIBUTION STATEMENT:
Controlled by: Insert the name of the Government
Contracting Activity (not required if identified in the letterhead).
Controlled by: Insert the name of the office creating the
document.
CUI Category: Identify all types of CUI contained in the
document.
Distribution/Limited Dissemination Control: Insert
applicable distribution statement or LDC.
Distribution Statement C: Used for distribution authorized to
U.S. Government agencies and their contractors: “Document
created using [insert SCG name] in coordination with Contract
#123 for [name of USG]. Other requests for this document
shall be referred to [insert controlling DoD office].”
POC: Include the name and phone number or office mailbox
for the originating DoD (GCA/IO) component or authorized
holder of CUI.
Note on the POC: DoDI 5200.48 Section 3.4(f).5 states
that the fifth line must contain the phone number or office
mailbox (email address) for the originating DoD Component or
Authorized CUI Holder. Minimally, you may be able to add the
Authorized Holder’s name and number and/or IDA Document
control number.
EXAMPLE OF DESIGNATION INDICATOR:
Controlled by: Insert the name of the Government
Contracting Activity (not required if identified in the letterhead).
Controlled by: Insert the name of the office creating the
document.
CUI Category: Identify all types of CUI contained in the
document (you may reference an additional sheet when
dealing with multiple categories).
Distribution/Limited Dissemination Control: Insert
applicable distribution statement or LDC.
POC: Include the name and phone number or office mailbox
(email address) for the originating DoD component or
authorized CUI designated Holder.
CATEGORIES OF CUI
For information to be considered CUI,
it must fall within a category, such as:
• Critical Infrastructure
• Defense
• Export Control
• Financial and Tax
• Immigration
• Intelligence
• International Agreements
• Law Enforcement
• Legal
• Natural and Cultural Resources
• NATO
• Nuclear
• Patent
• Privacy
• Procurement and Acquisition
• Proprietary Business Information
• Provisional (for DHS use only)
• Statistical
• Transportation