The text of the CUI Marking Procedure
Approval #
The Controlled Unclassified Information (CUI) Program Manager approves this document for the CUI Senior Agency Official. The Chief Information Security Officer (CISO) concurs on its security content.
| Role | Name | Signature |
|---|---|---|
| CUI Program Manager | ||
| Chief Information Security Officer (CISO), concurring |
Revision History #
| Date | Version | Description | Reviewer |
|---|---|---|---|
| 2026-10-31 | 1.0 | Initial issuance | [Reviewer name] |
Review cycle: Every year, under the Policy and Procedure Management Policy, and after a change to 32 CFR Part 2002 or the CUI Registry.
Mandate. The CUI Program Manager issues this procedure for the CUI Senior Agency Official (CUI SAO), to carry out the Controlled Unclassified Information (CUI) Policy (POL-CUI-001). It follows 32 CFR 2002.20, 2002.32, and 2002.36, the CUI Marking Handbook, Information Security Oversight Office (ISOO) Notice 2026-07, and CUI Notices 2018-05, 2018-07, and 2019-01. The CUI Program Manager runs this procedure, and the Chief Information Security Officer (CISO) concurs on its security steps.
1. Purpose and Scope #
Use this procedure to designate information as CUI, mark it, re-mark legacy documents, and fix markings that are wrong or missing. It covers every document, email, file, system screen, and container that holds CUI the Organization designates.
2. Roles #
The roles are defined in the CUI Policy. In the step tables below, each step names the person who acts. The CUI Program Manager coordinates the steps and keeps their records. A step with no citation is the Organization’s own practice.
3. Definitions #
| Term | Meaning in this procedure |
|---|---|
| CUI Basic | CUI whose authority sets no specific handling rules. CUI Basic is the default (32 CFR 2002.14(b)(1)). |
| CUI Specified | CUI whose law, regulation, or government-wide policy sets specific handling rules. The CUI Registry marks these categories (32 CFR 2002.14(b)(2)). |
| Banner marking | The marking at the top of each page that holds CUI. It holds the control marking “CUI,” any CUI Specified category markings, and any limited dissemination control (32 CFR 2002.20(b)). |
| Designation indicator | The line that names the agency that designated the CUI, such as “Controlled by: [office name]” (32 CFR 2002.20(d)). |
| Limited dissemination control | A limit on who may receive CUI, chosen from the list in the CUI Registry (32 CFR 2002.16(b)(4); CUI Notice 2018-07). |
| Portion marking | A marking at the start of a paragraph, bullet, or table cell that shows whether that part holds CUI (32 CFR 2002.20(f)). |
| Legacy marking | A marking used before the CUI program, such as “For Official Use Only” (FOUO) or “Sensitive But Unclassified” (SBU) (32 CFR 2002.4). |
4. Tools and Systems of Record #
| Tool or system | Use in this procedure | Records it holds |
|---|---|---|
| The document management system | Storing CUI documents in folders limited to authorized holders, and publishing CUI guidance | Documents, access lists, guidance |
| The ticketing system | Questions, requests, challenges, and reports sent to the CUI Program Manager | Request and case records |
| The governance, risk, and compliance (GRC) system | System categorization, System Security and Privacy Plans (SSPPs), and plans of action and milestones (POA&M) | Authorization records |
| The learning management system (LMS) | CUI training and its completion records | Training records |
5. Designate Information as CUI #
The author of a document, or the owner of a data set, follows these steps before the information is shared.
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| Author | 1. Check the CUI Registry for a category or subcategory that covers the information, and note the law or policy behind it (32 CFR 2002.12). | The document management system | Category noted in the document | MP-03 |
| Author | 2. If no category fits, treat the information as uncontrolled. Ask the CUI Program Manager when unsure. | The ticketing system | Question and answer | MP-03 |
| Author | 3. Decide whether the category is CUI Basic or CUI Specified, and note any handling rule its authority sets (32 CFR 2002.14(b)). | The document management system | Category and handling note | MP-03 |
| Author | 4. Decide whether a limited dissemination control is needed, using the criteria the CUI SAO set. Leave it off when significant doubt remains (32 CFR 2002.16(b)(4)(ii)). | The document management system | Control chosen or not | AC-21 |
| CUI Program Manager | 5. Answer a question about a category within 5 business days. Ask the Office of the General Counsel (OGC) when the authority is unclear. | The ticketing system | Answer on the request | MP-03 |
| CUI Program Manager | 6. When a law calls for CUI controls the CUI Registry does not list, prepare the CUI SAO’s letter to ISOO (CUI Notice 2018-06). | The document management system | Letter to ISOO | MP-03 |
Evidence: the category and handling note in each document, the answered questions, and any letters to ISOO.
6. Mark a Document, Email, or File #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| Author | 1. Put the banner marking at the top of each page that holds CUI. The banner is the same on every page and covers the whole document (32 CFR 2002.20(c)). | The document management system | Marked document | MP-03 |
| Author | 2. Add every CUI Specified category marking that applies, and any limited dissemination control, to the banner (32 CFR 2002.20(b)). | The document management system | Marked document | MP-03 |
| Author | 3. Add the designation indicator on the first page or cover, with the office name (32 CFR 2002.20(d)). | The document management system | Marked document | MP-03 |
| Author | 4. Add a decontrol date or event (ISOO Notice 2026-07). An event must be one any authorized holder can foresee and verify. Give a contact who can confirm it (32 CFR 2002.20(e)(3)). | The document management system | Marked document | MP-03 |
| Author | 5. Portion mark where it helps readers share the document. If you portion mark, mark every portion, controlled or not (32 CFR 2002.20(f)). | The document management system | Marked document | MP-03 |
| Author | 6. Put the banner marking at the top of the body of an email that holds CUI. Mark each attachment that holds CUI. | The document management system | Marked email | MP-03 |
| Author | 7. Set the file’s sensitivity label, where the system has one, to match the banner (ISOO Notice 2026-07). | The document management system | File label | MP-03 |
| Author | 8. Mark a transmittal letter “CUI” and add the line “When enclosure is removed, this document is Uncontrolled Unclassified Information” (32 CFR 2002.20(j)). | The document management system | Marked transmittal | MP-03 |
| Author | 9. Mark working papers the way the finished product will be marked (32 CFR 2002.20(k)). | The document management system | Marked drafts | MP-03 |
| Author | 10. In a classified document, portion mark all CUI and follow the commingling rules (32 CFR 2002.20(g); CUI Notice 2018-05). | The document management system | Marked document | MP-03 |
Evidence: marked documents, emails, files, and transmittals, checked during the yearly self-inspection.
7. Mark Systems, Media, and Storage Areas #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| System Owner | 1. Show a banner or sign-in notice that tells users the system holds CUI, when marking each record is not practical (32 CFR 2002.20(a)(8)). | The GRC system | Screen capture in the SSPP | AC-08, MP-03 |
| System Owner | 2. Mark reports and exports the system produces with the banner marking. | The GRC system | Sample report | MP-03 |
| Media Custodian | 3. Label removable media that holds CUI with the Standard Form (SF) 902 label, or the SF 903 label for a thumb drive (CUI Notice 2019-01). | The ticketing system | Media label record | MP-03 |
| Authorized holder | 4. Where a cover sheet is used, put the SF 901 cover sheet on top of a paper document that holds CUI (32 CFR 2002.32; CUI Notice 2019-01). | The document management system | Cover sheet in use | MP-03 |
| Facility Manager | 5. Post a sign on a room or container where CUI is stored, when items inside are not marked one by one (32 CFR 2002.20(a)(8)). | The ticketing system | Photo of the sign | PE-03 |
| CUI Program Manager | 6. Approve each alternate marking method in writing before anyone uses it. | The document management system | Approval record | MP-03 |
Evidence: the screen captures, sample reports, media labels, sign photos, and approvals.
8. Re-mark Legacy Documents #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| Information Owner | 1. List the documents in your holdings created before November 14, 2016 (32 CFR 2002.36(a)). | The document management system | Legacy inventory | MP-03 |
| Information Owner | 2. Review each one. Re-mark each document that holds CUI, or use an approved alternate marking method (32 CFR 2002.36(a)). | The document management system | Re-marked document | MP-03 |
| Information Owner | 3. Where re-marking a large store is too costly, ask the CUI SAO for a legacy marking waiver (32 CFR 2002.36(b); 32 CFR 2002.38(b)). | The ticketing system | Waiver request | MP-03 |
| Author | 4. When reusing legacy CUI in a new document, remove the legacy marking and mark the new document as CUI, even under a waiver (32 CFR 2002.38(b)(2)). | The document management system | Marked new document | MP-03 |
Evidence: the legacy inventory, the re-marked documents, and any waiver.
9. Fix a Missing or Wrong Marking #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| Authorized holder | 1. Report a document that is unmarked or marked wrongly to the CUI Program Manager. Keep protecting it at the level its content needs (32 CFR 2002.20(a)(3), (a)(7)). | The ticketing system | Report | MP-03 |
| CUI Program Manager | 2. If the Organization designated it, ask the author to fix the marking within 5 business days. If another agency did, ask that agency for a correctly marked copy. | The ticketing system | Request record | MP-03 |
| Author | 3. Send the corrected document to everyone who received the wrong one. | The document management system | Corrected copy and distribution | MP-03 |
| CUI Program Manager | 4. Answer outside holders who ask for help with unmarked CUI through the contact the CUI SAO named (32 CFR 2002.8(c)(12)). | The ticketing system | Answer | MP-03 |
Evidence: each report with its correction and distribution.
10. Recurring Schedule #
| Activity | When | Owner |
|---|---|---|
| Check a sample of marked documents | Every year, in the self-inspection | CUI Program Manager |
| Review the limited dissemination control criteria | Every year | CUI SAO |
| Check system banners, media labels, and storage signs | Every year | System Owners and Facility Manager |
| Review the legacy inventory | Every year until it is empty | Information Owners |
11. Records #
The CUI Program Manager keeps marking questions, approvals of alternate methods, and correction requests in the ticketing system. Authors keep marked documents in the document management system. Each record is kept under the records schedule that applies to it.
12. Related Documents #
13. References #
These are the sources this document cites, with a link to each official text.
- 32 CFR Part 2002: Controlled Unclassified Information, September 14, 2016.
- CUI Notice 2018-05: Implementation Guidance when CUI is commingled with CNSI, October 24, 2018.
- CUI Notice 2018-06: Establishing, Eliminating or Modifying Categories of CUI, November 16, 2018.
- CUI Notice 2018-07: CUI Limited Dissemination Controls, November 16, 2018.
- CUI Notice 2019-01: CUI Coversheet and Media Labels, February 22, 2019.
- CUI Registry.
- ISOO Notice 2026-07: Executive Agent Guidance for Implementation of the Controlled Unclassified Information Program, September 2, 2026.