# CUI Marking Checklist for DoD Contractors > Source: https://netray.co/tools/cui-marking-checklist-dod-contractors > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A practical checklist for marking, handling, storing, transmitting and destroying controlled unclassified information in contractor environments. ## Category aerospace-defense ## Industry Defense Contracting ## Region United States ## Audience - Compliance manager - Document control - Program manager ## Tool **Kind:** checklist **Groups:** #### Identify what is CUI **Items:** **Text:** Contract or DD Form 254 guidance names the CUI categories you will receive or create **Critical:** true You have an authorised holder list for each CUI category on the program Each designating agency or prime has confirmed the CUI category and any limited dissemination control Employees know the difference between CUI, FOUO legacy markings and classified information Legacy FOUO documents are reviewed and remarked as CUI where required A named person answers marking questions for the program #### Banner and portion markings **Items:** **Text:** Banner marking at the top of every page uses the required CUI banner format **Critical:** true **Text:** Banner includes category markings and limited dissemination controls when they apply **Critical:** true Banner marking is on the bottom of each page where the program requires it Portion marking is applied consistently if the contract or agency requires it Mixed documents with classified content follow the classified marking rules first Markings use plain text compatible with your document tools and templates #### Designation indicator **Items:** **Text:** Designation indicator block appears on the first page or cover **Critical:** true Block names the controlling organisation (Controlled by) Block lists the CUI category or categories Block lists any limited dissemination controls such as NOFORN or FEDCON Block gives a point of contact for questions Templates in your document system include the indicator block by default #### Handling, storage and access **Items:** **Text:** CUI is stored only on systems inside your assessed NIST SP 800-171 boundary **Critical:** true **Text:** Access is limited to people with a lawful government purpose or contract need **Critical:** true Printed CUI is kept in a controlled location and not left unattended Cover sheets or labels are used on printed CUI where required Removable media holding CUI is encrypted and inventoried Personal email, consumer messaging and unapproved cloud tools are blocked for CUI #### Transmission, sharing and disposal **Items:** **Text:** CUI is sent only with encryption that meets contract requirements **Critical:** true **Text:** Recipients are confirmed as authorised holders before release **Critical:** true Subcontractor flow-down clauses cover CUI handling and incident reporting Email subject lines and file names avoid exposing CUI details Destruction follows approved methods that make CUI unreadable and unrecoverable Destruction or return of CUI at contract end is documented Suspected mishandling is reported through the defined incident path #### Training and oversight **Items:** **Text:** Staff with CUI access complete CUI awareness training on a schedule **Critical:** true Managers review CUI marking quality on sampled documents The CUI policy is part of onboarding and offboarding checklists Corrections to improperly marked documents are tracked to closure **Scoring Note:** Check each item that is true today. Critical items are the ones most likely to cause a finding or a handling incident. Always confirm the exact marking format against current CUI Registry guidance and your contract. ## Content **Intro:** Controlled unclassified information is government-created or government-owned information that law or policy says must be safeguarded. Contractors who receive or create it need consistent marking and handling. Use this checklist to find gaps before a prime or assessor does. **Sections:** #### How to use the checklist **Body:** Walk each group with a sample of real documents and the people who handle them. Tick what you can prove today, not what you intend to do. Start with identification, because you cannot mark information correctly if nobody has confirmed the category. Critical items are flagged so you can fix them first, and the result gives you a percentage you can track from one review to the next. #### The structure of a CUI marking **Body:** A properly marked CUI document has a banner marking at the top, a designation indicator block that says who controls it and which category applies, and any limited dissemination controls that restrict who may receive it. Portion marking may be required by your contract or agency. Together they tell a reader at a glance how to treat the file. The CUI Registry is the authority on categories and formats. **Bullets:** - Banner marking on each page - Designation indicator with controlling organisation, category and contact - Limited dissemination controls where they apply - Portion marks when required #### Connecting marking to system controls **Body:** Marking is only half the job. NIST SP 800-171 requires media protection, access control and system protection around CUI, and DFARS 252.204-7012 expects those safeguards on covered contractor information systems. Make sure documents labelled CUI actually live where the controls apply, including exports from ERP, PLM and email attachments. #### Common mistakes **Body:** Typical problems include marking only the first page, using homemade banners, leaving legacy FOUO labels unreviewed, and emailing CUI through unapproved channels because the file looked harmless. Another is assuming that anything with a part number is CUI; the category must come from the contract or designating agency. Sample documents regularly and fix recurring patterns. **Cta:** If marking relies on staff remembering rules, Netray can help build private, on-prem checks that flag unmarked or misplaced files in your document stores. **Faq:** #### What does CUI stand for? **Answer:** Controlled Unclassified Information. It is unclassified information that law, regulation or government policy requires to be safeguarded or disseminated with controls. It is managed under a government-wide programme with a public registry of categories. #### Is CUI the same as ITAR or export controlled data? **Answer:** Not exactly. Export controlled information can be a CUI category, but CUI is broader. Treat export control requirements and CUI requirements as overlapping obligations and satisfy both when a document is subject to each. #### Do contractors have to portion mark? **Answer:** It depends on your contract, the designating agency and applicable guidance. Some programmes require portion marking and others do not. Confirm with your contracting officer or prime and apply the rule consistently across the program. #### What happens if CUI is marked wrong? **Answer:** Incorrect or missing markings can lead to mishandling, audit findings and, in some cases, reportable incidents. Correct the document, notify the authorised holders, and record the fix. Retrain the author and update templates to stop recurrence. ## Search terms cui marking checklist, controlled unclassified information marking, cui banner marking requirements, cui designation indicator, cui handling checklist contractors, cui document marking guide, cui dissemination controls, dod cui checklist --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json