CUI Banner and Dissemination Control Marking Reference
CUI marking looks simple until you have to write the banner for a drawing that is both export controlled and controlled technical information, with a distribution limit. This reference gives the syntax rules and the markings that appear most often at defense suppliers.
| Element | Marking or example | Where it goes | Rule of thumb |
|---|---|---|---|
Banner (basic) | CUI | Top and bottom of every page | Minimum marking when no category is added; CONTROLLED is an allowed alternative |
Banner with category | CUI//SP-CTI | Top and bottom of every page | Double slash separates CUI from category markings |
Specified category prefix | SP- | Before the category code | Used for specified categories, which carry extra handling rules in law or regulation |
Basic category | CUI//EXPT | Banner | Basic categories are written without the SP- prefix |
Multiple categories | CUI//EXPT/SP-CTI | Banner | Separate by a single slash; basic categories come first, then specified, each in alphabetical order |
Controlled Technical Information | CTI | Category code, written SP-CTI | Technical information with military or space application subject to distribution controls |
Export Controlled | EXPT | Category code | Items subject to the ITAR or EAR; the CUI marking does not replace export control marking |
Proprietary Business Information | PROPIN | Category code | Commercially sensitive information provided to the government |
Privacy | PRVCY | Category code | Personally identifiable information protected by law |
Dissemination control separator | CUI//SP-CTI//NOFORN | Banner | A second double slash precedes limited dissemination controls |
Multiple dissemination controls | FEDCON/NOFORN | Banner | Separate several controls with a single slash |
No foreign dissemination | NOFORN | Limited dissemination control | Not releasable to foreign nationals |
Federal employees and contractors only | FEDCON | Limited dissemination control | Restricts to federal employees and contractors |
Federal employees only | FED ONLY | Limited dissemination control | Restricts to federal employees |
No contractor dissemination | NOCON | Limited dissemination control | Do not release to contractors |
Authorized list only | DL ONLY | Limited dissemination control | Dissemination list controlled; the list must be named |
Release to named countries | REL TO USA, [country codes] | Limited dissemination control | Lists countries that may receive the information |
Display only | DISPLAY ONLY [country] | Limited dissemination control | Foreign recipient may view but not retain |
Portion marking (optional) | (CUI) or (U) | Start of paragraph or figure | Optional in the DoD unless the contract or originator requires it; if used, use it throughout a document |
Designation indicator: controlled by | Controlled by: [office or agency] | First page or cover, lower area | Identifies the designating agency, not your company |
Designation indicator: category | CUI Category: [full names] | First page or cover | Spell out category names, not codes |
Designation indicator: dissemination | Distribution/Dissemination Control: [control] | First page or cover | Required when a limited dissemination control applies |
Designation indicator: point of contact | POC: [name and phone or email] | First page or cover | Person who can answer questions about the CUI |
Email subject and body | Banner text in the body; note CUI in subject if policy requires | Email | Follow your CUI policy and encrypt in transit |
Removable media | Apply a CUI label | External surface of media | Label the device so users can tell it holds CUI |
Decontrol | Remove markings when the originator decontrols | All copies | Only the designating authority can decontrol |
Syntax follows the National Archives CUI marking guidance under 32 CFR Part 2002 and DoD implementation guidance. Contract language, originator instructions and the CUI Registry take precedence. Always confirm with the contracting officer or the document originator.
Automate banners on ERP output
Optional: see how marking could be applied to travelers and reports generated from your ERP.
Optional. The tool and every export work without this. No spam.
How to use it
Search the table by category code such as CTI or EXPT, by control such as NOFORN, or by field name. Read the Where column to know where the marking is placed, and the rule of thumb to avoid common errors. Copy examples as a starting point and then check the originator's marking instructions and the contract. If the customer gave you a document already marked, keep their markings; do not re-mark or remove them. If you create CUI from controlled source information, mark it as the contract directs.
Banner syntax in plain terms
A banner starts with CUI, then double slashes before the category list, then double slashes before limited dissemination controls. Within a group, items are separated by a single slash. Specified categories use an SP- prefix, and basic categories do not. The banner goes at the top and bottom of every page. A designation indicator on the first page tells readers who designated it and who to ask. Portion marking is optional in many DoD cases, but once used it should be consistent.
- CUI//SP-CTI for controlled technical information
- CUI//EXPT/SP-CTI when both categories apply
- CUI//SP-CTI//NOFORN adds a dissemination control
- Designation indicator: Controlled by, Category, Distribution, POC
Common mistakes
The usual errors are using export control language instead of CUI banners, or the reverse. CUI marking does not replace ITAR or EAR statements. Others include marking only the first page, writing category codes in the designation indicator where full names belong, and adding a company name as the controlling office. Make sure templates for drawings, travelers and emails carry the right banner by default, and that the title block and header or footer fields survive PDF export.
Frequently Asked Questions
Is CUI the same as ITAR?
No. CUI is a government wide category of information that needs safeguarding. ITAR controlled technical data is often also CUI, in the EXPT category, but the export control rules still apply separately and your ITAR procedures still govern access by foreign persons.
Do I have to portion mark?
Not in every case. DoD guidance makes portion marking optional for CUI unless the contract or originator says otherwise, but if you start portion marking a document you should do it throughout.
Who decides the category?
The designating agency or the contract does. Use the markings supplied by the customer, and ask the contracting officer if a deliverable's marking is unclear.
Do I mark internal working copies?
Yes. CUI you create or hold under a contract should be marked as the contract requires, including drafts and extracts, and protected in the same way as the original.
If you want ERP printouts, travelers and work instructions to carry the right banner automatically, we can help design that with your document control rules.
Related Tools
CUI Marking Checklist for DoD Contractors
A practical checklist for marking, handling, storing, transmitting and destroying controlled unclassified information in contractor environments.
Compliance & ContractsITAR Technical Data Handling Procedure Template
A procedure document with fields for roles, repositories, access control, transmission rules, foreign person screening, records and incident handling.
Compliance & ContractsCMMC Asset Scoping and Categorization Worksheet
Build your in scope asset inventory by CMMC category, with quantities, documentation effort and annual tool cost so you can see what scope reduction would save.
Compliance & ContractsCMMC C3PAO Assessment Day Prep Checklist
A four part checklist covering documents, evidence, people and logistics before a third party assessor arrives, with the items that sink assessments marked critical.
More Compliance & Contracts tools
See all- SPRS Score Recovery Timeline Calculator
- CMMC Practice Evidence Tracker Worksheet
- CMMC Shared Responsibility Matrix Worksheet for MSPs and Cloud Providers
- CMMC Level 2 Checklist Worksheet
- CMMC Level 1 Checklist (15 Practices) with Evidence Tracker
- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
- IBM i (AS/400) User Profile Access Review Worksheet
- SyteLine Security and User Access Audit Checklist
Keep exploring
Free tools
- CUI Marking Checklist for DoD ContractorsA practical checklist for marking, handling, storing, transmitting and destroying controlled unclassified information in contractor environments.
- Product Marking and Labeling Compliance ChecklistA checklist to audit the markings and labels on a product and its packaging before release.
- EU CE Marking Directives and Regulations ReferenceA reference table of the main EU CE marking directives and regulations with their references and what they cover.
Guides
- On-Prem AI for CUI in Small ManufacturersOn-prem AI for CUI: how small defense manufacturers run an LLM on their own GPUs inside the NIST 800-171 boundary, with hardware sizing and real trade-offs.
- Building a CUI Enclave for Defense ManufacturingHow to build a CUI enclave for defense manufacturing: scope NIST SP 800-171 and CMMC boundaries, isolate ERP and engineering data, and cut assessment cost.
- Controlled Unclassified Information in Your ERPWhere CUI hides in a manufacturing ERP: attachments, routings, BOMs, travelers and reports, plus how to scope, permission and audit it for NIST 800-171.
Software
- Microsoft 365 GCC HighMicrosoft 365 GCC High is a US government cloud used by defense contractors for CUI and ITAR data. See services, limits, alternatives and AI considerations.
- PreVeilPreVeil offers end-to-end encrypted email and file sharing used by defense suppliers for CUI. See capabilities, integrations, limits and alternatives.