Marking Controlled Unclassified Information (CUI)

1. Introduction

   Controlled Unclassified Information (CUI) must be properly marked to ensure its protection and compliance with applicable laws, regulations, and policies. This guide provides the necessary procedures and examples for marking CUI in documents, emails, and digital files.

2. Mandatory CUI Marking Elements
   • Banner Marking (Header & Footer) – Each document containing CUI must have a banner at the top and bottom of the page with the appropriate CUI designation. The standard format is:
     • CUI
     • If the CUI belongs to a specific category, include the category designation:
       • CUI//PRIVACY
       • CUI//EXPORT CONTROL
     • If the document has restricted dissemination, include the dissemination control statement:
       • CUI//NOFORN (Not Releasable to Foreign Nationals)
       • CUI//FED ONLY (Federal Employees Only)
     • Example of a full banner marking:
       • CUI//PRIVACY//NOFORN
   • Portion Marking (Recommended but Optional) – Each section, paragraph, table, or figure that contains CUI should be marked accordingly:
     • (CUI) This paragraph contains sensitive personal data.
   • CUI Designation Indicator (Required) – At the bottom of the first page, a CUI Designation Indicator block must be included:
     • Controlled by: [Department/Agency Name]
     • Controlled by: Office of [Department/Agency]
     • CUI Category: Privacy
     • Distribution: Authorized personnel only
     • Contact: [Name], [Email], [Phone]
3. Email Marking Requirements
   • Subject Line – [CUI] Subject of the Email
   • Body of Email
     • ***CUI***
     • This email contains Controlled Unclassified Information (CUI). Handle in accordance with applicable laws and regulations.
   • Attachments
     • All attachments containing CUI must be marked accordingly.
     • The document must contain banner markings, portion markings, and a designation indicator.
4. Additional CUI Handling & Marking Requirements
   • Physical Documents
     • Printed documents must retain header, footer, and designation markings.
     • Must be stored in locked cabinets when not in use.
   • Digital Files (PDF, Word, Excel, etc.)
     • Include a CUI banner on each page.
     • File names should indicate CUI status: Example: CUI_EmployeeData_Report.pdf
   • Removable Media (USB, CDs, External Drives)
     • Must be encrypted and labeled as CUI.
     • Example label: CUI - Authorized Use Only
5. Decontrolling & Removing CUI Markings
   • CUI markings must be removed before public release.
   • Use approved decontrol procedures and obtain authorization before removing markings.

For further guidance, contact your organization's CUI Program Manager or Security Office.