Where does the CUI banner marking go?

At the top and bottom centre of every page. For CUI Basic the banner is the word CUI. For CUI Specified it extends to name the category and any dissemination controls, in the form CUI//SP-CTI//FEDCON.

Are portion markings required for CUI?

They are optional for CUI Basic, unlike classified material where they are mandatory. An agency may require them by policy, so check the contract and any agency-specific guidance before deciding not to apply them.

Who decides whether something is marked CUI?

The designating agency. A contractor generating derivative material carries the existing marking forward rather than re-evaluating whether the information deserves it.

How do I mark CUI in an email?

Place the banner marking at the top of the body text. Many organisations also prefix the subject line, which helps recipients and mail rules identify it before opening. Attachments carry their own markings independently of the message.

Can CUI be decontrolled?

Yes, but the designating agency decides. Decontrol can happen on a date, on an event, or by agency determination. A contractor does not decontrol CUI on its own initiative.

Who is responsible for applying CUI markings?

The authorized holder who creates or designates the CUI applies the marking, under 32 CFR 2002.20. For a defense contractor that usually means the employee producing a document that contains or is derived from CUI, following the marking instructions in the contract and DoDI 5200.48.

What is the CUI cover sheet?

Standard Form 901 is the government CUI cover sheet. It is optional, but it is a simple way to stop CUI being read over a shoulder or left face-up on a desk, and assessors often look for it as evidence of handling discipline.

What about legacy markings like FOUO?

FOUO and similar legacy markings are no longer valid on new material. Legacy documents do not need re-marking while they sit untouched, but when that information is reused or shared it should be reviewed and re-marked as CUI where it qualifies.

CUI Marking Requirements: Banners, Portions, Email

Marking is where CUI most often goes wrong in practice, because the rules look like classification rules but are not.

The core requirement is the banner marking: the word CUI at the top and bottom centre of every page. Where the material is CUI Specified, the banner extends to name the category and any dissemination controls, in the form CUI//SP-CTI//FEDCON. Portion markings — the bracketed indicators on individual paragraphs that classified documents require — are optional for CUI Basic, though an agency may require them by policy.

The part contractors miss most often: the designating agency decides the marking, not you. If you generate a drawing derived from government-furnished technical data, the marking carries forward. You do not get to re-evaluate whether it deserves to be CUI.

Banner structure

Where markings go, by medium

Documents — banner top and bottom centre on every page. A cover page carries the banner too.
Email — banner at the top of the body. Prefixing the subject line is common practice and helps mail rules and recipients spot it before opening. Attachments are marked independently.
Removable media — a physical label on the media itself, not only on the files it holds. Media leaves the boundary in ways files do not.
Printed material on a shop floor — the same rules apply to a drawing taped beside a machine as to the PDF it came from. This is a common finding in manufacturing environments.
Derivative material — a model, calculation or report built from CUI carries the marking forward.

Decontrolling CUI

CUI does not stay controlled forever, but a contractor does not get to decide when it stops. Decontrol is the designating agency’s call, and it can happen on a specific date, on a defined event, or by agency determination.

When material is decontrolled, the markings are removed or struck through and the change is recorded. The practical trap is partial decontrol: a document decontrolled for one purpose may still be export-controlled, or still covered by a contract clause. Removing a CUI banner does not remove an ITAR obligation.

If you believe something has been over-marked — and it happens — the route is to raise it with the customer, not to re-mark it yourself. An incorrect marking may still carry a contractual obligation even where the Registry does not support the category.

Marking and the controls it makes possible

Marking is often treated as administrative overhead. It is closer to load-bearing infrastructure: several NIST SP 800-171 requirements are difficult to satisfy, and harder to evidence, without it.

Media Protection assumes staff can identify which media holds CUI. Requirement 3.8.4 asks you to mark media with necessary CUI markings and distribution limitations, so this is not an inference — it is explicit.
Access Control around printed output and removable media depends on people recognising what they are holding.
Awareness and Training requires staff to recognise and handle CUI. Training people to handle a category they cannot identify on sight does not work.

The inverse is the failure most often found on a shop floor: a drawing correctly marked in the PDF, printed, and taped beside a machine with the banner cropped off the page. The control existed in the file and evaporated at the printer.

Building marking into a workflow

Marking fails when it depends on individual diligence at the moment of creation. The approaches that hold up put it into the tooling instead:

Document templates that carry the banner in the header and footer by default, so a new file starts marked.
Mail rules that add the banner to the body and a prefix to the subject when a message leaves a defined group or carries an attachment from a controlled library.
Print templates for drawings that keep the banner inside the printable area rather than in a margin that gets trimmed.
Pre-printed labels stocked where removable media is actually used, not in a cupboard in another building.

None of this is exotic. It is the difference between a policy that says “mark CUI” and an environment where marking is the path of least resistance.

Common marking mistakes

Marking only the first page rather than every page.
Inventing a category that does not exist in the Registry — see CUI categories.
Treating a Specified category as Basic and applying only the baseline controls.
Decontrolling on your own initiative because the information looks harmless.
Marking the file but not the removable media it was copied to.

Marking and your controls

Marking is not only an administrative exercise. It is the mechanism that makes media protection workable: staff cannot handle CUI correctly if they cannot identify it. The NIST SP 800-171 Media Protection family assumes marked media, and several of its requirements are difficult to evidence without it.

If you are unsure how much of your environment holds marked material, that is a scoping question rather than a marking one — start with finding CUI in your environment.

How to Mark CUI