CUI Marking Checklist for Contractors (Free)

0%

0 of 35 items complete

9 critical items still open - these are the highest-risk gaps.

Download checklist:

Identify what is CUI

Contract or DD Form 254 guidance names the CUI categories you will receive or createCRITICALYou have an authorised holder list for each CUI category on the programEach designating agency or prime has confirmed the CUI category and any limited dissemination controlEmployees know the difference between CUI, FOUO legacy markings and classified informationLegacy FOUO documents are reviewed and remarked as CUI where requiredA named person answers marking questions for the program

Banner and portion markings

Banner marking at the top of every page uses the required CUI banner formatCRITICALBanner includes category markings and limited dissemination controls when they applyCRITICALBanner marking is on the bottom of each page where the program requires itPortion marking is applied consistently if the contract or agency requires itMixed documents with classified content follow the classified marking rules firstMarkings use plain text compatible with your document tools and templates

Designation indicator

Designation indicator block appears on the first page or coverCRITICALBlock names the controlling organisation (Controlled by)Block lists the CUI category or categoriesBlock lists any limited dissemination controls such as NOFORN or FEDCONBlock gives a point of contact for questionsTemplates in your document system include the indicator block by default

Handling, storage and access

CUI is stored only on systems inside your assessed NIST SP 800-171 boundaryCRITICALAccess is limited to people with a lawful government purpose or contract needCRITICALPrinted CUI is kept in a controlled location and not left unattendedCover sheets or labels are used on printed CUI where requiredRemovable media holding CUI is encrypted and inventoriedPersonal email, consumer messaging and unapproved cloud tools are blocked for CUI

Transmission, sharing and disposal

CUI is sent only with encryption that meets contract requirementsCRITICALRecipients are confirmed as authorised holders before releaseCRITICALSubcontractor flow-down clauses cover CUI handling and incident reportingEmail subject lines and file names avoid exposing CUI detailsDestruction follows approved methods that make CUI unreadable and unrecoverableDestruction or return of CUI at contract end is documentedSuspected mishandling is reported through the defined incident path

Training and oversight

Staff with CUI access complete CUI awareness training on a scheduleCRITICALManagers review CUI marking quality on sampled documentsThe CUI policy is part of onboarding and offboarding checklistsCorrections to improperly marked documents are tracked to closure

Check each item that is true today. Critical items are the ones most likely to cause a finding or a handling incident. Always confirm the exact marking format against current CUI Registry guidance and your contract.

Find unmarked CUI in your document stores

We can outline an on-prem scan that flags likely CUI files without sending data outside your network.

Optional. The tool and every export work without this. No spam.

How to use the checklist

Walk each group with a sample of real documents and the people who handle them. Tick what you can prove today, not what you intend to do. Start with identification, because you cannot mark information correctly if nobody has confirmed the category. Critical items are flagged so you can fix them first, and the result gives you a percentage you can track from one review to the next.

The structure of a CUI marking

A properly marked CUI document has a banner marking at the top, a designation indicator block that says who controls it and which category applies, and any limited dissemination controls that restrict who may receive it. Portion marking may be required by your contract or agency. Together they tell a reader at a glance how to treat the file. The CUI Registry is the authority on categories and formats.

Banner marking on each page
Designation indicator with controlling organisation, category and contact
Limited dissemination controls where they apply
Portion marks when required

Connecting marking to system controls

Marking is only half the job. NIST SP 800-171 requires media protection, access control and system protection around CUI, and DFARS 252.204-7012 expects those safeguards on covered contractor information systems. Make sure documents labelled CUI actually live where the controls apply, including exports from ERP, PLM and email attachments.

Common mistakes

Typical problems include marking only the first page, using homemade banners, leaving legacy FOUO labels unreviewed, and emailing CUI through unapproved channels because the file looked harmless. Another is assuming that anything with a part number is CUI; the category must come from the contract or designating agency. Sample documents regularly and fix recurring patterns.

Frequently Asked Questions

What does CUI stand for?

Controlled Unclassified Information. It is unclassified information that law, regulation or government policy requires to be safeguarded or disseminated with controls. It is managed under a government-wide programme with a public registry of categories.

Is CUI the same as ITAR or export controlled data?

Not exactly. Export controlled information can be a CUI category, but CUI is broader. Treat export control requirements and CUI requirements as overlapping obligations and satisfy both when a document is subject to each.

Do contractors have to portion mark?

It depends on your contract, the designating agency and applicable guidance. Some programmes require portion marking and others do not. Confirm with your contracting officer or prime and apply the rule consistently across the program.

What happens if CUI is marked wrong?

Incorrect or missing markings can lead to mishandling, audit findings and, in some cases, reportable incidents. Correct the document, notify the authorised holders, and record the fix. Retrain the author and update templates to stop recurrence.

If marking relies on staff remembering rules, Netray can help build private, on-prem checks that flag unmarked or misplaced files in your document stores.

Talk to an Expert Explore More Free Tools

Related Tools

Aerospace & Defense

More Aerospace & Defense tools

See all

CUI Marking Checklist for DoD Contractors