CUI Marking Checklist for DoD Contractors
Controlled unclassified information is government-created or government-owned information that law or policy says must be safeguarded. Contractors who receive or create it need consistent marking and handling. Use this checklist to find gaps before a prime or assessor does.
0 of 35 items complete
9 critical items still open - these are the highest-risk gaps.
Identify what is CUI
Banner and portion markings
Designation indicator
Handling, storage and access
Transmission, sharing and disposal
Training and oversight
Check each item that is true today. Critical items are the ones most likely to cause a finding or a handling incident. Always confirm the exact marking format against current CUI Registry guidance and your contract.
Find unmarked CUI in your document stores
We can outline an on-prem scan that flags likely CUI files without sending data outside your network.
Optional. The tool and every export work without this. No spam.
How to use the checklist
Walk each group with a sample of real documents and the people who handle them. Tick what you can prove today, not what you intend to do. Start with identification, because you cannot mark information correctly if nobody has confirmed the category. Critical items are flagged so you can fix them first, and the result gives you a percentage you can track from one review to the next.
The structure of a CUI marking
A properly marked CUI document has a banner marking at the top, a designation indicator block that says who controls it and which category applies, and any limited dissemination controls that restrict who may receive it. Portion marking may be required by your contract or agency. Together they tell a reader at a glance how to treat the file. The CUI Registry is the authority on categories and formats.
- Banner marking on each page
- Designation indicator with controlling organisation, category and contact
- Limited dissemination controls where they apply
- Portion marks when required
Connecting marking to system controls
Marking is only half the job. NIST SP 800-171 requires media protection, access control and system protection around CUI, and DFARS 252.204-7012 expects those safeguards on covered contractor information systems. Make sure documents labelled CUI actually live where the controls apply, including exports from ERP, PLM and email attachments.
Common mistakes
Typical problems include marking only the first page, using homemade banners, leaving legacy FOUO labels unreviewed, and emailing CUI through unapproved channels because the file looked harmless. Another is assuming that anything with a part number is CUI; the category must come from the contract or designating agency. Sample documents regularly and fix recurring patterns.
Frequently Asked Questions
What does CUI stand for?
Controlled Unclassified Information. It is unclassified information that law, regulation or government policy requires to be safeguarded or disseminated with controls. It is managed under a government-wide programme with a public registry of categories.
Is CUI the same as ITAR or export controlled data?
Not exactly. Export controlled information can be a CUI category, but CUI is broader. Treat export control requirements and CUI requirements as overlapping obligations and satisfy both when a document is subject to each.
Do contractors have to portion mark?
It depends on your contract, the designating agency and applicable guidance. Some programmes require portion marking and others do not. Confirm with your contracting officer or prime and apply the rule consistently across the program.
What happens if CUI is marked wrong?
Incorrect or missing markings can lead to mishandling, audit findings and, in some cases, reportable incidents. Correct the document, notify the authorised holders, and record the fix. Retrain the author and update templates to stop recurrence.
If marking relies on staff remembering rules, Netray can help build private, on-prem checks that flag unmarked or misplaced files in your document stores.
Related Tools
NIST 800-171 SPRS Score Calculator
Calculate your SPRS score from the DoD Assessment Methodology: start at 110 and subtract the weight of each unmet NIST SP 800-171 requirement.
Aerospace & DefenseNIST 800-171 POA&M Worksheet
An editable plan of action and milestones for NIST SP 800-171 gaps, with owner, cost, due date, status and the SPRS points each fix recovers.
Compliance & ContractsDFARS 252.204-7012 Cyber Incident Report Template
A fill-in internal record to collect the details you need for a DFARS 7012 cyber incident report: timeline, systems, CUI impact, preservation and notifications.
Compliance & ContractsTechnology Control Plan (TCP) Template
A fill-in technology control plan covering facility access, foreign person controls, IT safeguards, training and recordkeeping for controlled technical data.
More Aerospace & Defense tools
See all- CMMC 2.0 Level 2 Readiness Assessment
- ITAR Compliance Checklist for Manufacturers
- DFARS 252.204-7012 Compliance Self-Assessment
- AS9100 Audit Readiness Checklist
- Export Control Screening Checklist
- Defense Contractor AI Readiness Assessment
- Counterfeit Parts Risk Assessment (AS5553)
- Aerospace Supplier Scorecard
- First Article Inspection (AS9102) Checklist
Keep exploring
Free tools
- CUI Banner and Dissemination Control Marking ReferenceQuick lookup for how to build a CUI banner, which category codes appear most often in manufacturing, and how dissemination controls are written.
- Product Marking and Labeling Compliance ChecklistA checklist to audit the markings and labels on a product and its packaging before release.
- NIST 800-171 SPRS Score CalculatorCalculate your SPRS score from the DoD Assessment Methodology: start at 110 and subtract the weight of each unmet NIST SP 800-171 requirement.
ERP fixes and how-tos
- Costpoint Cloud or On-Prem for a Contractor Handling CUI?Deciding between Deltek Costpoint cloud and self-hosted for a defense contractor with CUI: scope, shared responsibility, cost, control, what to verify.
- Deltek Costpoint On-Prem AI Architecture for Government ContractorsPrivate AI architecture for on-prem Deltek Costpoint: SQL replica, web services and import interfaces, local GPU model, project permissions, audit and CUI.
Guides
- Controlled Unclassified Information in Your ERPWhere CUI hides in a manufacturing ERP: attachments, routings, BOMs, travelers and reports, plus how to scope, permission and audit it for NIST 800-171.
- On-Prem AI for CUI in Small ManufacturersOn-prem AI for CUI: how small defense manufacturers run an LLM on their own GPUs inside the NIST 800-171 boundary, with hardware sizing and real trade-offs.
- DoD AI Adoption in 2026: What Defense Manufacturers Need to Do About ItDoD AI adoption in 2026: what CDAO programs, budget priorities, and new acquisition rules mean for defense manufacturers planning their own AI investments now.
AI on your ERP
- On-prem AI for Costpoint inside a CMMC Level 2 enclaveDeploy AI beside Deltek Costpoint inside a CMMC Level 2 enclave: what to check before adding any AI tool, and how on-prem inference avoids new CUI flows.
- AI for ERP Across the US Defense Supply ChainA CIO's guide to adding AI on top of the ERP defense primes and tier 2-3 suppliers already run, without adding a compliance risk the program cannot absorb.
Manufacturing hubs
- Aerospace and Defense Subcontractors on Long Island, New YorkLong Island aerospace and defense subcontractors: machining, fabrication and electronics shops, anchors, AS9100, ITAR and CMMC needs, and ERP and quoting problems.
- Manufacturing in Dallas-Fort Worth: aerospace, defense and electronicsDallas-Fort Worth aerospace, defense and electronics manufacturing: anchor primes, standards, ecosystem, ERP and quoting problems, and where private AI on ERP helps.
Software
- Microsoft 365 GCC HighMicrosoft 365 GCC High is a US government cloud used by defense contractors for CUI and ITAR data. See services, limits, alternatives and AI considerations.
- PreVeilPreVeil offers end-to-end encrypted email and file sharing used by defense suppliers for CUI. See capabilities, integrations, limits and alternatives.