What are the CUI marking requirements I must apply?

CUI marking is governed by 32 CFR Part 2002, the DoD CUI Program in DoDI 5200.48, and the January 10, 2025 revision of DoDI 5230.24, which establishes the unified marking framework for DoD technical documents. Markings are how the rest of the system (assessors, downstream contractors, automated systems) recognizes that CUI handling rules apply.

The three required marking elements

Banner format

• CUI Basic: CUI
• CUI Specified: CUI//[category]. For example, CUI//SP-CTI for Controlled Technical Information.
• With limited dissemination control: CUI//[category]//[dissemination control]. For example, CUI//SP-CTI//FED ONLY.
• Multiple categories: separated by a forward slash. CUI//SP-CTI/SP-EXPT indicates both Controlled Technical Information and Export Controlled.

Portion marking format

• CUI Basic portion: (CUI) before the paragraph.
• CUI Specified portion: (CUI//[category]) before the paragraph.
• Portions that are not CUI in an otherwise mixed document should be marked (U).

The CUI Designation Indicator (CDI)

Under the unified framework in DoDI 5230.24, a CDI for a DoD technical document carries information that maps to what previously appeared in a legacy Distribution Statement:

Sample CDI block:

Controlled by: [Office name]
Controlled by: [Individual name]
CUI Category: [Category]
Distribution Statement: [B/C/D/E/F]
Limited Dissemination Control: [Control if applicable]
POC: [Email/phone]

Distribution Statement letter codes under the unified framework

The Jan 2025 revision of DoDI 5230.24 makes the Distribution Statement letter code part of the CDI for DoD documents:

• A. Approved for public release. Not CUI.
• B. Distribution authorized to U.S. government agencies only. CUI.
• C. Distribution authorized to U.S. government agencies and their contractors only. CUI; common for technical data flowed to contractors.
• D. Distribution authorized to DoD and DoD contractors only. CUI; common for defense-specific technical data.
• E. Distribution authorized to DoD components only. CUI.
• F. Further dissemination only as directed by the controlling DoD office. CUI.

Who is authorized to mark

Recent DoD CUI marking training (December 2024) clarified that contractors are authorized to mark documents. The full picture:

• Agencies mark documents they originate based on the underlying authorities and any security classification guide that applies to the program.
• Contractors are authorized to mark documents based on their marking instructions. Those instructions normally come through Contract Data Requirements Lists (CDRLs) for primes or Subcontract Data Requirements Lists (SDRLs) for suppliers.
• Contractors are authorized and expected to apply markings on documents they originate when those documents fall within categories of CUI that the contract identifies. The contractor is often the person with the first opportunity to mark.

Presumptive marking

If you are delivering a document and you can identify CUI categories that clearly apply (beyond what the customer enumerated), apply them. A drawing flowed to the government might be CTI per the customer's instruction, but if it also contains ITAR-controlled technical data the EXP category applies, and if it contains contractor-owned proprietary information PROPIN may apply. Most contracting officers are versed in the FAR and DFARS rather than the underlying CUI authorities; a competent CUI practitioner at the contractor may have a deeper understanding of the relevant authorities than the contracting officer receiving the deliverable. Becoming a student of the authorities is what makes presumptive marking defensible. If you can point to the law or regulation that establishes a category and demonstrate that your information falls within its definition, you are not overstepping.

The marking discipline

A defensible marking practice has three elements:

1. Authority-grounded. Every category you apply is one you can defend by pointing to the underlying law or regulation, not just because a customer used the term.
2. CDRL or SDRL-aware. Where the customer has specified categories, you apply those. Where the customer's list is incomplete and additional categories clearly apply, you add them and document why.
3. Documented in your SSP. Your marking decisions, including the authority basis for any presumptive marking, belong in your SSP or supporting procedures. Marking decisions made informally are marking decisions waiting to be challenged in an assessment.

Portion marking matters more than most teams realize

Portion marking is the highest-resolution form of CUI marking and the most useful enabler of supply-chain efficiency. Without portion marking, the entire document carries the strictest CUI category that applies anywhere within it; the supplier inherits the full safeguarding scope for all content. With portion marking, the supplier can scope safeguarding precisely and may have a clear decontrol path for portions that are not CUI. If you are a prime generating flow-down documents, portion marking is high-leverage: it shapes the safeguarding scope inherited by every downstream supplier.

When you generate CUI yourself

If you create CUI in the course of performing a contract (for example, generating technical specifications based on government-furnished information), you are the originator for the new document and must apply the markings. The original government source's controlling body should be referenced in your CDI.

Special cases

• Email. Subject line should reflect the highest CUI category in the body. Body should carry banner and portion markings.
• Spreadsheets. Banner on each worksheet; portion-mark cells or ranges containing CUI.
• Drawings and diagrams. Banner on the drawing, with CUI portions identified where the document permits.
• Mixed-classification documents. The highest applicable marking governs the banner; portions are marked at their individual level.

Legacy documents

There is no project to retroactively remark every legacy DoD document with the new CUI banner and CDI. Practically, contractors will work with a mix of legacy distribution-statement-marked documents and newly CUI-marked documents for years. A DoD document carrying a Distribution Statement of B through F is, under the new guidance, properly CUI even if it has not yet been formally remarked. Treat it accordingly.

Common errors

• Banner without CDI. The banner alone does not satisfy 32 CFR 2002.
• Portion markings missing on individual paragraphs. A document with only a banner does not tell downstream readers which paragraphs are CUI and forces the worst-case category onto the whole.
• Generic markings on Specified categories. CTI requires the SP-CTI marker, not just CUI.
• Failing to mark contractor-generated CUI. The contractor is the originator for what it creates and must mark accordingly.
• Treating Distribution Statement A as needing CUI marking. A is public release; public information cannot be CUI.
• Hesitating to mark out of fear of overstepping. If you have done the authority reading and can defend the category, marking is the right move. Hesitation is often itself a signal that the team has not done the authority work.