The correct banner marking for an unclassified document containing CUI is "CUI" in bold, capitalized text, centered at the top and bottom of every page. That's the mandatory DoD standard. Every document containing CUI must carry the banner marking plus a designation indicator block on the first page.

Mismarked documents are one of the most common findings in CMMC assessments. This article covers what the required markings are, how they're structured, and where DoD rules differ from the government-wide baseline.

The purpose of CUI marking

Markings are how protection requirements travel with controlled unclassified information (CUI). A properly marked document tells every person who touches it three things at a glance: this information is controlled, this is the category of control it falls under, and these are the limits on who can see it. 

Without markings, safeguarding obligations depend on every handler independently recognizing sensitive information, which is exactly the inconsistency the CUI Program was created to eliminate.

Marking requirements come from two sources: 32 CFR 2002.20, which sets the marking rules for all executive branch agencies, and DoDI 5200.48, which implements them for the DoD and its contractors. 

For defense contractors, marking is also a contractual security requirement: NIST SP 800-171 requirement 3.8.4 (CMMC practice MP.L2-3.8.4) requires marking media with necessary CUI markings and distribution limitations.

The CUI banner marking

The banner marking is the most visible element. Under 32 CFR 2002.20, it has up to three parts, separated by double forward slashes:

CUI Control Marking // Category Marking // Limited Dissemination Control

The control marking is mandatory on every document. The government-wide rule allows either "CUI" or "CONTROLLED." The DoD only authorizes "CUI."

Category markings identify the type of CUI in the document, using approved abbreviations from the CUI Registry (for example, SP-CTI for Controlled Technical Information). Category markings are mandatory in the banner for CUI Specified and optional for CUI Basic under the government-wide rule. DoD practice differs here: per DoD guidance, the top and bottom of each page carry only "CUI," and categories are listed in the designation indicator block instead. Multiple categories are separated by single forward slashes.

Limited dissemination controls (LDCs) restrict who can access the information. Common examples include NOFORN (no foreign nationals), FED ONLY, and FEDCON (federal employees and contractors).

The banner must reflect all CUI in the document and must be identical on every page that contains CUI. If one paragraph on page 12 contains CUI Specified, the whole document is marked accordingly.

The designation indicator block

In addition to the banner marking, every document containing CUI must also carry a designation indicator identifying who designated the information as CUI. It appears on the first page or cover only, and DoD places it in the bottom right corner. For DoD documents, the block contains four lines:

• Controlled by: the DoD component or company and the originating office
• CUI Category: all categories present, using approved abbreviations
• Distribution/Dissemination: the applicable distribution statement or LDC (one or the other, not both)
• POC: the document creator or originating office contact

If your organization creates a document containing CUI, your company name goes on the "Controlled by" line. Skipping the designation indicator is one of the most common marking mistakes: many organizations apply the only banner, but both elements are required.

Portion markings

Portion markings label individual paragraphs, titles, bullets, and figures, the way classified documents are marked. In unclassified documents containing CUI, portion marking is optional. But the choice is all or nothing: if you portion mark anything in a document, you must portion mark everything in it, including the uncontrolled portions. CUI portions are marked "(CUI)" and uncontrolled unclassified portions are marked "(U)."

What markings are required when sharing CUI through email?

Three markings: the subject line begins with "CUI", the body of the email carries the "CUI" banner at the top and bottom, and a designation indicator block appears within the body, typically at the bottom. 

Any attachments containing CUI must be marked in their own right as complete documents. If the email body itself contains no CUI but an attachment does, the subject line and body markings still apply so the recipient knows controlled information is attached. 

Marking the email is only half the requirement, though: CUI sent by email must also be protected in transit, which in most environments means encryption. 

What about FOUO and other legacy markings?

For Official Use Only (FOUO), Sensitive But Unclassified (SBU), and similar agency-specific labels were replaced by the CUI Program. Legacy markings are void: they no longer indicate that information is protected or that it qualifies as CUI. 

The CUI Program also prohibits inventing alternative markings. If you're still generating documents marked FOUO, a C3PAO or federal assessor will flag it. Existing legacy documents generally don't need to be re-marked until their information is reused in a new document, at which point the new document must be marked under current CUI rules.

Is the CUI banner mandatory?

Yes. If a document contains CUI, the banner marking is required, along with the designation indicator. There is no informal or optional tier of CUI marking. 

This is clearly stated in the terms DoD training uses: the minimum marking requirements for CUI in accordance with DoDI 5200.48 are the "CUI" banner at the top and bottom of each page and a designation indicator block on the first page or cover.

The inverse also applies: if a document doesn't contain CUI, it should not be marked CUI. Overmarking creates its own problems, restricting information that should flow freely and diluting the meaning of the markings on documents that genuinely need protection.

The key question for contractors is usually not whether to mark, but who marks. The designating agency determines that information qualifies as CUI and applies markings when it designates it. 

When your organization creates new documents containing CUI in the course of contract performance, you're responsible for marking them properly before they move anywhere, whether to the government or to a subcontractor. If you receive an incorrectly marked or unmarked document that appears to contain CUI, notify the sender or the designating agency and request a properly marked version.

Establishing proper CUI marking in your organization

Marking failures rarely come from not knowing the rules. They come from relying on individuals to remember them. The organizations that pass assessments cleanly build the markings into templates for every document type that touches CUI, train everyone who creates those documents, and spot-check periodically. The DoD publishes a CUI Marking Job Aid with approved formats and examples, which is the authoritative reference for building your templates. You can also find a free CUI Marking Procedure Template at cmmc.com.