CMMCpedia
Work with me

Terms / What you protect

CUI marking

The banner and designation block an agency applies to CUI. Marking is the Government's job, and an unmarked document can still be CUI.

Also called CUI markings, banner marking, CUI banner marking, CUI designation indicator.

Official Source Material

CUI markings listed in the CUI Registry are the only markings authorized to designate unclassified information requiring safeguarding or dissemination controls.

Source: 32 CFR 2002.20(a)(1), eCFR text current as of September 17, 2026

Practitioner Guidance

What it means in practice

The Government marks CUI. You do not designate it.

Under 32 CFR 2002.20 the designating agency decides that information qualifies and applies the marking. A contractor is an authorized holder, not a designator. That division matters when you receive something unmarked, because the answer is to ask the agency, not to invent a marking of your own. Carry the markings on what you receive forward unchanged. Mark your own output as CUI only when the contract directs you to. A distribution statement already printed on an incoming drawing meets the marking objective in MP.L2-3.8.4 without a new step.

A DoD document carries two things: the CUI banner and a designation block.

The banner reads CUI, those three letters only, at the top and bottom of every page. 32 CFR 2002.20 also allows CONTROLLED, but the DoD marking guide rejects it. The guide also rejects CONTROLLED UNCLASSIFIED INFORMATION, U//CUI, and a category added to the banner, such as CUI//BUDG. The designation block sits at the bottom of the first page and has four lines. Line 1 is Controlled by, the office that designated the information. Line 2 is the category from the CUI Registry, such as CTI. Line 3 is the limited dissemination control or the distribution statement letter. Line 4 is a point of contact. Reading those lines tells you what handling the document demands.

An unmarked document can still be CUI, and a marked one can be wrong.

Marking is how the Government communicates the decision. It is not the decision. Compare the content of what you receive to the categories your contract names, and handle a match as Controlled Unclassified Information whether or not a banner appears. In the other direction, agencies overmark routinely, and entire packages arrive stamped when a small fraction is actually controlled.

Pushing back on overmarking is normal, and it is worth real money.

When a large document arrives marked in full, ask the originating agency or your prime contractor to identify which portions are genuinely controlled. Asking works. A package marked in full often comes back marked on a small fraction of its pages. Every page you remove from scope is a page you do not have to protect, so ask before you build an environment sized for the marked version.

What falls short

  • A marking your own company invented. Only markings listed in the Registry are authorized, and a homemade banner communicates nothing to an assessor or a customer.
  • A banner with no designation block. Every document containing CUI must show who designated it, so a missing block is a question for the originator.
  • A banner reading CONTROLLED, or CUI followed by a category. The DoD marking guide lists both as wrong, and the category belongs on line 2 of the designation block.
  • A claim that you hold nothing because nothing arrived marked. The content and your contract decide, and the missing marking is the agency's failure rather than your exemption.

Edge cases

  • You receive a document marked FOUO or For Official Use Only. Legacy markings are void under 32 CFR 2002.20(a)(2) and no longer indicate that information qualifies as CUI. Judge the content against your contract, and ask the originator.
  • You create a document that combines controlled and uncontrolled material. The banner applies to the whole document and must appear the same on every page that contains CUI.
  • The document carries a decontrolling date that has passed. Authorized holders may treat it as decontrolled as of that date without going back to the designator.

Over-engineering

  • An automatic classification and labeling deployment bought to find CUI. Your contract and the Registry tell you what is controlled, and a written list of what you receive is enough for scoping.
  • A marking policy that recreates the Government's marking rules for a company that only receives CUI. Write down that you carry received markings forward and mark your own output when the contract directs it, and cite 32 CFR 2002.20 for the rest.