What CUI marking requirements apply to a contractor's documents?
When a contract or a prime's flow-down requires CUI handling, every document, file and message that holds CUI must carry the authorized banner marking under 32 CFR 2002.20(b). The banner has up to three elements: the CUI control marking (the word CONTROLLED or the acronym CUI, which is mandatory), category or subcategory markings (mandatory for CUI Specified), and any limited dissemination control markings. As a contractor, you apply those markings to the material you handle, and you do not invent your own labels, because legacy markings left on information are void under 32 CFR 2002.20(a).
The contracting agency and the CUI Registry define which markings apply. The Registry is the authoritative list of categories, subcategories and dissemination controls, and the contract or agency guidance tells you which of them attach to the work. Your organization owns its marking process: who applies markings, how reviewers check them, what happens when a document arrives unmarked, and where the records are kept. An implementation partner can design that procedure, build the templates and document-marking checks, and collect the evidence an assessor will ask for. The partner cannot decide what counts as CUI, and a contracting officer or the agency's designating official must make that call. Confirm the category list and any limited dissemination controls in writing before you build the procedure.
Start with an inventory of the document types your contract touches, such as drawings, reports, email, and exported spreadsheets, and confirm with the agency which of them carry CUI and which markings each one needs. Then check how your systems produce banners and portion markings, since a template that omits the control marking will fail on every page. Ask the contracting officer how mismarked or unmarked documents received from the Government should be handled, and write that answer into your procedure. Under 32 CFR 2002.20(a)(3), the agency's practice is to notify the disseminating entity and request a properly marked document, so your own process should show how you would do the same. Keep the procedure current as the FAR CUI rules develop, because the FAR overhaul proposed rule changes how unmarked CUI is treated.
What to do with unmarked or mismarked documents
This sequence turns a suspect document into a documented decision: what it is, what rules govern it, who has been asked to correct it, and what the organization did next. Each step leaves a record that an assessor or contracting officer can review.
Quarantine and identify the document
Stop further distribution of the document and confirm what it is: its title, version, originator, date, and where it came from. The person who found it, usually a records or contracts lead, records these facts in the handling log and restricts access to people who need it to make the decision. The output is a log entry with the document identifier and a note that it is held pending review. Nothing is considered closed until this entry exists.
Check the contract and agency guidance
Review the contract, task order, or agreement that governs the material, along with any agency guidance on CUI markings, to determine whether the information is CUI at all and which categories and limited dissemination controls it may carry. Decide whether the content looks like CUI on its face, falls under a category the contract names, or is information the organization created in performance. The output is a short written determination that cites the contract clause or guidance relied on and states whether the document is treated as CUI, as unmarked CUI, or as not CUI for now.
Apply interim safeguards while the question is open
Until the determination is final, handle the document as CUI if the review indicates it likely is, so that it stays encrypted in transit and at rest, is shared only with authorized personnel, and is not moved to unapproved systems or cloud services. Apply the same access and media controls that the organization's SP 800-171 implementation already requires for CUI. The output is a confirmation in the handling log that the interim controls were applied and by whom.
Identify the disseminating entity or designating agency
Determine who sent the document or who designated the information as CUI. For a document received from the government, this is usually the disseminating agency or the contracting officer named in the contract. For a document created by the organization in performance, the contract usually identifies the entity to consult. The output is a named contact and channel of communication recorded in the log, along with the contract number or agreement reference that supports the contact.
Notify the entity and request a properly marked copy
Under 32 CFR 2002.20(a)(3), an agency that receives an incorrectly marked document should notify the disseminating entity or designating agency and request a properly marked version. Send that notice in writing, identify the document, describe the marking problem, and ask for a corrected copy that uses only markings listed in the CUI Registry. Coordinate this step through the contracting officer where the contract requires it. The output is the sent notice and the response or the record of the request.
Handle the re-marked or unresolved document
When a corrected copy arrives, verify that its banner and portion markings use only authorized CUI markings and that any legacy markings are removed or treated as void. Replace the original in the document repository and retire the copy with the wrong markings through approved sanitization or destruction steps. If no correction arrives, keep the document under interim safeguards and escalate through the contracting officer. The output is the re-marked file, a record of retired copies, or a documented escalation with no closure yet.
Record the decision and close the review
Write a final entry that summarizes the determination, the notices sent, the corrected version or escalation path, and the people who approved the outcome. Note any lessons for intake, such as a template or training gap, and assign a follow-up owner for them. The output is a closed review record that an assessor can trace from discovery to resolution. Keep the record with the other CUI handling records covered by the system security plan.
Marking media under NIST SP 800-171 03.08.04
Requirement 03.08.04 asks the organization to mark system media that contain CUI so that anyone handling it can see the distribution limits, handling caveats and applicable CUI markings. The cards below cover the media types most contractors hold, and the evidence an assessor will look for on each. The organization decides the labeling method, but it must be documented and applied consistently across every medium.
Digital media and file objects
Digital media includes drives, exported reports and document files that carry CUI. The marking should appear in the file itself, such as a banner in the header and footer, and the media label or file system path should reflect the same designation. Check that a template or document property sets the marking by default, so that new files are not created unmarked. An assessor will typically sample files and compare their banners with the media record.
Paper and printed output
Printed CUI needs the banner marking on every page, including cover sheets and attachments, with portion markings where the organization uses them. Printers and copiers are a common gap, because jobs printed from shared queues may leave the originating template behind. Confirm that a labeling procedure covers printing workflows and that custodians know how to mark handwritten or scanned pages. Approved CUI cover sheets from the CUI Registry are one option for paper.
Removable drives and portable media
USB drives, external disks and optical discs are easy to lose and often move between systems. Each device holding CUI should carry a physical label that states the CUI designation and handling limits, and the label should match the inventory record. Ask who authorizes removable media and how the organization ties a label to a serial number. Assessors often interview media custodians to confirm that labels are applied when media are issued, not only when they are reviewed.
Backup tapes and archive sets
Backup tapes, snapshots and archive sets are often overlooked because no one opens them day to day. Each tape, cartridge or archive set that contains CUI needs a label that survives rotation and offsite storage, and the backup catalog should record the designation. Confirm how labels are maintained when a tape is re-labeled, duplicated or sent to a vendor for recovery. Backup media are also in scope for encryption of backups under 03.08.09.
Cloud storage objects and shared folders
Cloud buckets, shared drives and collaboration spaces hold CUI as objects rather than physical media, so the marking must travel with the object. Use object metadata, a folder naming convention or a document label that the platform can display and search, and document which one the organization uses. Review whether automated exports or sync tools strip the marking. An assessor will usually test a sample of objects and the access settings that govern them.
How the proposed FAR rules change marking and reporting
The January 2025 FAR CUI proposed rule would have put marking duties directly on contractors. Under it, a contractor that submits CUI to the Government would have to mark that CUI, and a contractor that discovers unmarked or mismarked CUI would have to notify the Government. The proposal also said that restrictions on using Government-provided information apply whether or not that information carries a CUI marking. For a contractor, the practical lesson is that a missing banner does not remove an obligation. Your team should confirm, with the contracting officer, which of your deliverables are CUI, and keep a record of who decided their marking. Because the proposal is not final, treat it as a signal of where the rules are heading, not as a requirement you can rely on for a specific contract.
The June 2026 FAR overhaul proposed rule takes a different approach to reporting. It narrows a CUI incident to four outcomes: unauthorized disclosure of CUI, improper modification or destruction of CUI, or unauthorized access to the system that holds it. It also states that unmarked or mismarked CUI is not an incident unless it led to one of those outcomes. Reporting of unmarked or mismarked CUI would move to 72 hours. A contractor's incident response plan should therefore separate two questions: whether a marking error occurred, and whether the error produced an actual exposure. The first question triggers a notice and marking correction. Only the second triggers incident handling. Ask your contracting officer which reporting clock applies to each contract you hold.
Both rules are proposals. The FAR overhaul proposed rule was published on 23 June 2026, and the rule was not final as of October 2026. Until a final rule is issued and incorporated into your contract, the terms in the contract and the current DFARS clauses govern your obligations. Confirm the status of each rule in the Federal Register and with your contracting officer before you change procedures, and document which version you are following for each agreement.
What to have in place before marking is assessed
An assessor will not accept good intentions for CUI marking. Each card below names a readiness item a contractor should have on paper and in practice, and how an assessor checks it using the examine and interview methods in SP 800-171A Rev. 3. The organization owns these controls; an implementation partner can help prepare the records, but only an independent assessor issues findings.
Written marking procedure
A documented procedure says who applies CUI banner and portion markings, which markings the organization uses, and where the CUI Registry is the reference. It should also say that legacy markings are void and how staff handle a document that arrives unmarked or mismarked. An assessor examines the procedure for these elements and interviews staff who create documents to confirm they know it. Check that the procedure matches what the people in the interview actually do.
Current list of CUI categories
Contractors need a register of the CUI categories and any Specified categories that appear in each contract, with the contract number and the place where the marking requirement is stated. Without this list, staff cannot tell which banner markings apply. An assessor examines the register against the contract and interviews the contracts or program lead to confirm the list is kept up to date when a contract changes.
Marking templates with examples
Templates for documents, slides, spreadsheets and email should show a banner marking at the top and bottom and portion markings on each paragraph or section. Illustrative examples help reviewers spot errors quickly. An assessor examines the templates for the required elements and interviews a sample of authors to see whether they use them. Confirm the templates use only markings from the CUI Registry, not older labels.
Labels for each media type
Media protection requires that system media holding CUI carry distribution limitations, handling caveats and the applicable CUI markings. That means labels for removable drives, backup tapes, printed pages and shipping containers, not only for documents on screen. An assessor examines a sample of media and the labeling procedure under the media marking requirement and interviews personnel who handle media to confirm they apply labels consistently.
Training for document creators
Staff who create or release documents with CUI need instruction on the marking rules, and that instruction should be recorded. Training covers banner and portion syntax, when a category marking is mandatory, and how to escalate uncertainty. An assessor examines training records and interviews staff, including people who joined recently, to see whether they can explain the markings they apply.
Log of mismarked material
A log records each unmarked or mismarked document the organization finds, who found it, what was done, and whether the disseminating entity or designating agency was asked for a correctly marked copy. Under 32 CFR 2002.20(a)(3), receiving agencies are expected to make that request. An assessor examines the log for completed entries and interviews the people who run it to confirm the process is followed, and to check whether the log shows patterns that point to training gaps.
Who owns marking, who helps, and who assesses it
Your organization owns its marking decisions. Only you can read the contract, identify which information is CUI, decide which category and limited dissemination control markings apply, and ask the agency or prime contractor to clarify anything ambiguous. The people who create and release documents are accountable for applying the right banner and portion markings before information leaves your control.
- Contract interpretation: Your contracts, contracting officer and prime contractor determine what is CUI and which markings the agency expects, so questions go to them in writing.
- Marking decisions: Designate who decides whether a document is CUI, which category applies and whether a limited dissemination control is needed.
- Accountability for labels: Staff who create or release CUI apply the banner and portion markings, and managers confirm they do.
- Handling of unmarked or mismarked material: Your team decides whether to request a corrected document from the disseminating entity and records that request.
- Authorized markings only: Confirm with the CUI Registry that every marking in use is current and that legacy markings are no longer treated as protection.
Before relying on any marking practice, confirm with your contracting officer which markings your contract requires.
An implementation partner such as DeployOpen can help prepare the procedures, templates and labeling standards that your staff use, and can configure the systems where marking happens. The partner works inside your environment and produces documentation and evidence, but does not decide what your information is or how your contracts apply to it.
- Marking procedures: Drafting written procedures that cover banner markings, portion markings, media marking and the handling of unmarked documents.
- Templates and labeling standards: Preparing document templates, header and footer configurations and labeling standards for the open-source platforms you run.
- Media marking support: Setting up labeling conventions for removable media and system media that contain CUI, in line with SP 800-171 requirement 03.08.04.
- Evidence preparation: Collecting samples of marked documents, configuration exports and training records that show the marking process operates.
- Scope of work: Agree the deliverables, environments and timelines in a written, fixed-scope agreement before work begins.
Ask any partner to name the deliverables in writing and to confirm that it will not issue reports, attestations or certifications.
An independent auditor, assessor or certification body examines your marking practice and tests whether it works as described. The assessor reviews documents, interviews staff and inspects samples, then reports findings. It does not determine how your documents should be marked, and it does not issue a marking approval or a certificate for your CUI handling.
- Examination: Reviewing procedures, templates and marked samples against the requirement and the assessment procedure in SP 800-171A Rev. 3.
- Interviews and testing: Asking staff how they mark and handle CUI and checking whether their answers match the written process.
- Findings: Reporting where the evidence supports the requirement and where it does not, which is the output your organization acts on.
- Independence: The assessor must remain independent of the team that prepared the procedures, so confirm the separation before engagement.
- Limits of authority: Marking decisions remain yours and the contracting agency's, so an assessor's silence on a marking question is not approval.
Confirm with your contracting agency which assessment body, if any, it accepts for your requirement.
Questions contractors ask about CUI marking
Who decides what counts as CUI on a contract?
The federal agency that designates the information decides whether it is CUI, using the categories in the CUI Registry. Under 32 CFR Part 2002, designators must mark CUI they release, so a contractor should not have to guess from content alone. Your contract, task order or data rights clause may identify CUI categories or name the designating agency, and that is the first document to check. Where the contract is silent, ask the contracting officer in writing rather than deciding internally. Confirm agency-specific marking expectations in the contract itself, because agencies may add instructions beyond the baseline rules.
Is portion marking required for CUI documents?
Portion marking is permitted and encouraged, but the rules differ by category. Under 32 CFR 2002.20(f), portion markings use the acronym CUI plus any required category, subcategory or limited dissemination control markings. Category portion markings are optional for CUI Basic, while CUI Specified requires its category markings to appear. Contractors should plan for portion marking in documents that mix CUI with uncontrolled content, because a banner alone may not show which paragraphs need protection. Confirm with the designating agency whether it expects portion marking on deliverables you produce.
Does a legacy marked document need to be re-marked?
Legacy markings are void, so a document carrying an old label does not indicate protection or CUI status by itself. Under 32 CFR 2002.20(a), only markings in the CUI Registry are authorized, so you should determine whether the content is still CUI and, if so, apply the current banner and portion markings. Do not simply remove an old label without deciding what it protects. If the information is CUI, it must be handled as CUI regardless of how it is marked, and any re-marking should be tracked in your document inventory. Ask the agency whether it wants a re-issued copy or will accept your re-marking under its own process.
What happens to unmarked CUI received from the Government?
Under 32 CFR 2002.20(a)(3), a receiving entity that gets an incorrectly marked document should notify the disseminating entity or designating agency and request a properly marked document. The January 2025 FAR CUI proposed rule would have required contractors to notify the Government of unmarked or mismarked CUI they discover, and it said restrictions on using Government-provided information apply whether or not it is marked. The June 2026 FAR overhaul proposal instead says unmarked or mismarked CUI is not an incident unless it led to unauthorized disclosure, improper modification or destruction, or unauthorized system access, and would move reporting to 72 hours. Because these proposals are not final, handle the information as protected, notify the contracting officer, and confirm the current reporting rule in your contract.
Is CUI marking part of a DFARS 7012 or SP 800-171 assessment?
Marking is not a standalone assessment objective, but it is connected to the media protection family. Requirement 03.08.04 in NIST SP 800-171 Rev. 3 calls for system media containing CUI to indicate distribution limitations, handling caveats and applicable CUI markings. Assessors check this through the SP 800-171A procedures for 03.08.04, so a documented media marking process with evidence of use is what they will look for. Marking of documents and emails is typically handled through your procedures and training, not a separate scored item. Confirm with your assessor and the CUI Registry how your environment's marking practice maps to the requirement, and note that the assessed framework version depends on your contract, as the current DoD guidance names Revision 2 explicitly.
How much internal effort does CUI marking take, and what drives it?
The effort is driven mainly by volume and by how much of your output is CUI. The main work is building a marking procedure, training authors to apply the correct banner and portion markings, configuring templates and labels in your document systems, and re-marking legacy holdings. Costs recur as new documents are created and as staff turn over, while the one-time work is the template and procedure build. Effort rises when a team produces mixed documents, when category rules differ across contracts, or when many legacy files need review. Ask any consultant for a written scope that names the systems, document types and number of templates covered, since no standard effort figure for this work has been supplied for this page.
Can an implementation partner set up CUI marking for us?
An implementation partner can help prepare the systems and evidence for marking, such as document templates, labeling configuration, procedures and training materials, within a written scope. DeployOpen plans, implements and documents self-hosted open-source platforms in your own infrastructure, and it can build the supporting workflows for those platforms. It does not decide what is CUI for your contracts, and it does not issue assessment reports or certifications. Your organization owns the marking decisions, and an independent assessor reviews the evidence. Confirm with the designating agency and your contracting officer which marking decisions remain yours before scoping the work.
How DeployOpen helps prepare marking evidence
DeployOpen is a Chainscore Labs company that plans, implements and documents self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, and prepares systems and evidence for compliance assessments. For CUI marking, that help usually means configuring the document management, collaboration and media handling tools so that marking rules are applied consistently, then documenting how they work. The organization still owns its marking decisions, its designation of CUI and its procedures. DeployOpen does not issue audit reports, attestations or certifications, and it does not guarantee that an assessor or contracting officer will accept the result. Only an independent assessor or the relevant government body makes that call.
Work starts with a written scope that names the systems, repositories, templates and media types in play, the marking elements each one must carry, and the evidence each deliverable will produce. Before any configuration begins, you should confirm with your contracting officer or prime which CUI categories you hold, whether any of them are CUI Specified, and which FAR or DFARS version governs your contract. DeployOpen will not set marking values that the contract or the CUI Registry has not established. Scoping in writing also makes clear what your staff must still do, such as applying banner markings to documents they author and reviewing inbound material for legacy markings.
At handoff, the deliverables typically include marking procedures, banner and portion marking templates, media labeling standards, and a record of how each control was implemented and tested. Ask for these in a form your team can maintain after the engagement ends, and confirm who will update them when the CUI Registry or your contract changes. Before any assessment, your own staff should walk through a sample of marked documents and media to confirm the evidence matches the procedures. A fixed-scope engagement gives you a defined set of deliverables, but the outcome of any external review depends on the organization's operations and on the independent assessor's judgment.
