How is Controlled Unclassified Information (CUI) Marked?

At a minimum, CUI markings for unclassified DoD documents are to include the acronym “CUI” in the banner and footer of the document. Furthermore, marking requirements apply to documents, emails and forms of media that are designated as CUI. Furthermore, marking labels are available for physical media - specifically - USB sticks, hard drives, and CD ROMs, etc. so as to alert holders to the presence of CUI stored on the device in accordance with CUI Notice 2019-01. 

Controlled Unclassified Information (CUI) is a category of sensitive but unclassified information that the U.S. federal government and its contractors handle and protect to ensure national security and safeguard other important interests. CUI encompasses a wide range of information types, including technical data, financial records, proprietary business information, legal documents, and other sensitive data that may not be classified but still requires protection due to its importance to national security, privacy, or the functioning of government programs. CUI can originate from various government agencies and is shared with external organizations as part of contracts, partnerships, or other collaborative efforts.

The protection of CUI is governed by a set of federal regulations and guidelines, including the Controlled Unclassified Information Program (32 CFR Part 2002) and the National Institute of Standards and Technology (NIST) Special Publication 800-171, which outlines specific security requirements for the protection of CUI in non-federal systems and organizations.

Organizations handling CUI must implement appropriate security controls, access restrictions, and data protection measures to prevent unauthorized access, disclosure, or compromise of this sensitive information. CUI plays a crucial role in ensuring the security, integrity, and confidentiality of data that is vital to the nation's interests, and compliance with CUI regulations is essential for both government agencies and their partners.

Please refer to the Controlled Unclassified Markings Guide (September 3, 2020) for more information:https://www.dodcui.mil/Portals/109/Documents/Desktop%20Aid%20Docs/20-S-2093%20cleared%20training%20guide-13_oct-20.pdf 

Need to Implement a DoD CUI Program? Talk to Arlington

DoD contractors - and other contractors providing services to federal agencies - need to have in place established policies, procedures, and processes regarding CUI that’s resident within their information systems. What federal contractors need is a CUI Program. Arlington can help, as we offer the following CUI services and solutions:

• CUI Scoping & Gap Assessments
• CUI Policy Development
• CUI Identification
• CUI Contractual Language Review
• CUI Marking (Digital)
• CUI Marking (Physical)