(a) General marking policy.
(1) CUI markings listed in the CUI Registry are the only markings authorized to designate unclassified information requiring safeguarding or dissemination controls. Agencies and authorized holders must, in accordance with the implementation timelines established for the agency by the CUI EA:
(i) Discontinue all use of legacy or other markings not permitted by this part or included in the CUI Registry; and
(ii) Uniformly and conspicuously apply CUI markings to all CUI exclusively in accordance with the part and the CUI Registry, unless this part or the CUI EA otherwise specifically permits. See paragraph (a)(6) of this section and §§ 2002.38, Waivers of CUI requirements, and 2002.36, Legacy materials, for more information.
(2) Agencies may not modify CUI Program markings or deviate from the method of use prescribed by the CUI EA (in this part and the CUI Registry) in an effort to accommodate existing agency marking practices, except in circumstances approved by the CUI EA. The CUI Program prohibits using markings or practices not included in this part or the CUI Registry. If legacy markings remain on information, the legacy markings are void and no longer indicate that the information is protected or that it is or qualifies as CUI.
(3) An agency receiving an incorrectly marked document should notify either the disseminating entity or the designating agency, and request a properly marked document.
(4) The designating agency determines that the information qualifies for CUI status and applies the appropriate CUI marking when it designates that information as CUI.
(5) If an agency has information within its control that qualifies as CUI but has not been previously marked as CUI for any reason (for example, pursuant to an agency internal marking waiver as referenced in § 2002.38 (a)), the agency must mark it as CUI prior to disseminating it.
(6) Agencies must not mark information as CUI to conceal illegality, negligence, ineptitude, or other disreputable circumstances embarrassing to any person, any agency, the Federal Government, or any of their partners, or for any purpose other than to adhere to the law, regulation, or Government-wide policy authorizing the control.
(7) The lack of a CUI marking on information that qualifies as CUI does not exempt the authorized holder from abiding by applicable handling requirements as described in the Order, this part, and the CUI Registry.
(8) When it is impractical for an agency to individually mark CUI due to quantity or nature of the information, or when an agency has issued a limited CUI marking waiver, authorized holders must make recipients aware of the information's CUI status using an alternate marking method that is readily apparent (for example, through user access agreements, a computer system digital splash screen (e.g., alerts that flash up when accessing the system), or signs in storage areas or on containers).
(b) The CUI banner marking. Designators of CUI must mark all CUI with a CUI banner marking, which may include up to three elements:
(1) The CUI control marking (mandatory).
(i) The CUI control marking may consist of either the word “CONTROLLED” or the acronym “CUI,” at the designator's discretion. Agencies may specify in their CUI policy that employees must use one or the other.
(ii) The CUI Registry contains additional, specific guidance and instructions for using the CUI control marking.
(iii) Authorized holders who designate CUI may not use alternative markings to identify or mark items as CUI.
(2) CUI category or subcategory markings (mandatory for CUI Specified).
(i) The CUI Registry lists the category and subcategory markings, which align with the CUI's governing category or subcategory.
(ii) Although the CUI Program does not require agencies to use category or subcategory markings on CUI Basic, an agency's CUI SAO may establish agency policy that mandates use of CUI category or subcategory markings on CUI Basic.
(iii) However, authorized holders must include in the CUI banner marking all CUI Specified category or subcategory markings that pertain to the information in the document. If law, regulation, or Government-wide policy requires specific marking, disseminating, informing, distribution limitation, or warning statements, agencies must use those indicators as those authorities require or permit. However, agencies must not include these additional indicators in the CUI banner marking or CUI portion markings.
(iv) The CUI Registry contains additional, specific guidance and instructions for using CUI category and subcategory markings.
(3) Limited dissemination control markings.
(i) CUI limited dissemination control markings align with limited dissemination controls established by the CUI EA under § 2002.16(b)(4).
(ii) Agency policy should include specific criteria establishing which authorized holders may apply limited dissemination controls and their corresponding markings, and when. Such agency policy must align with the requirements in § 2002.16(b)(4).
(iii) The CUI Registry contains additional, specific guidance and instructions for using limited dissemination control markings.
(c) Using the CUI banner marking.
(1) The content of the CUI banner marking must apply to the whole document (i.e., inclusive of all CUI within the document) and must be the same on each page of the document that includes CUI.
(2) The CUI Registry contains additional, specific guidelines and instructions for using the CUI banner marking.
(d) CUI designation indicator (mandatory).
(1) All documents containing CUI must carry an indicator of who designated the CUI within it. This must include the designator's agency (at a minimum) and may take any form that identifies the designating agency, including letterhead or other standard agency indicators, or adding a “Controlled by” line (for example, “Controlled by: Division 5, Department of Good Works.”).
(2) The designation indicator must be readily apparent to authorized holders and may appear only on the first page or cover. The CUI Registry contains additional, specific guidance and requirements for using CUI designation indicators.
(e) CUI decontrolling indicators.
(1) Where feasible, designating agencies must include a specific decontrolling date or event with all CUI. Agencies may do so in any manner that makes the decontrolling schedule readily apparent to an authorized holder.
(2) Authorized holders may consider specific items of CUI as decontrolled as of the date indicated, requiring no further review by, or communication with, the designator.
(3) If using a specific event after which the CUI is considered decontrolled:
(i) The event must be foreseeable and verifiable by any authorized holder (e.g., not based on or requiring special access or knowledge); and
(ii) The designator should include point of contact and preferred method of contact information in the decontrol indicator when using this method, to allow authorized holders to verify that a specified event has occurred.
(4) The CUI Registry contains additional, specific guidance and instructions for using limited dissemination control markings.
(f) Portion marking CUI.
(1) Agencies are permitted and encouraged to portion mark all CUI, to facilitate information sharing and proper handling.
(2) Authorized holders who designate CUI may mark CUI only with portion markings approved by the CUI EA and listed in the CUI Registry.
(3) CUI portion markings consist of the following elements:
(i) The CUI control marking, which must be the acronym “CUI”;
(ii) CUI category/subcategory portion markings (if required or permitted); and
(iii) CUI limited dissemination control portion markings (if required).
(4) When using portion markings:
(i) CUI category and subcategory portion markings are optional for CUI Basic. Agencies may manage their use by means of agency policy.
(ii) Authorized holders permitted to designate CUI must portion mark both CUI and uncontrolled unclassified portions.
(5) In cases where portions consist of several segments, such as paragraphs, sub-paragraphs, bullets, and sub-bullets, and the control level is the same throughout, designators of CUI may place a single portion marking at the beginning of the primary paragraph or bullet. However, if the portion includes different CUI categories or subcategories, or if the portion includes some CUI and some uncontrolled unclassified information, authorized holders should portion mark all segments separately to avoid improper control of any one segment.
(6) Each portion must reflect the control level of only that individual portion. If the information contained in a sub-paragraph or sub-bullet is a different CUI category or subcategory from its parent paragraph or parent bullet, this does not make the parent paragraph or parent bullet controlled at that same level.
(7) The CUI Registry contains additional, specific guidance and instructions for using CUI portion markings and uncontrolled unclassified portion markings.
(g) Commingling CUI markings with Classified National Security Information (CNSI). When authorized holders include CUI in documents that also contain CNSI, the decontrolling provisions of the Order and this part apply only to portions marked as CUI. In addition, authorized holders must:
(1) Portion mark all CUI to ensure that authorized holders can distinguish CUI portions from portions containing classified and uncontrolled unclassified information;
(2) Include the CUI control marking, CUI Specified category and subcategory markings, and limited dissemination control markings in an overall banner marking; and
(3) Follow the requirements of the Order and this part, and instructions in the CUI Registry on marking CUI when commingled with CNSI.
(h) Commingling restricted data (RD) and formerly restricted data (FRD) with CUI.
(1) To the extent possible, avoid commingling RD or FRD with CUI in the same document. When it is not practicable to avoid such commingling, follow the marking requirements in the Order and this part, and instructions in the CUI Registry, as well as the marking requirements in 10 CFR part 1045, Nuclear Classification and Declassification.
(2) Follow the requirements of 10 CFR part 1045 when extracting an RD or FRD portion for use in a new document.
(3) Follow the requirements of the Order and this part, and instructions in the CUI Registry if extracting a CUI portion for use in a new document.
(4) The lack of declassification instructions for RD or FRD portions does not eliminate the requirement to process commingled documents for declassification in accordance with the Atomic Energy Act, or 10 CFR part 1045.
(i) Packages and parcels containing CUI.
(1) Address packages that contain CUI for delivery only to a specific recipient.
(2) Do not put CUI markings on the outside of an envelope or package, or otherwise indicate on the outside that the item contains CUI.
(j) Transmittal document marking requirements.
(1) When a transmittal document accompanies CUI, the transmittal document must include a CUI marking on its face (“CONTROLLED” or “CUI”), indicating that CUI is attached or enclosed.
(2) The transmittal document must also include conspicuously on its face the following or similar instructions, as appropriate:
(i) “When enclosure is removed, this document is Uncontrolled Unclassified Information”; or
(ii) “When enclosure is removed, this document is (control level); upon removal, this document does not contain CUI.”
(k) Working papers. Mark working papers containing CUI the same way as the finished product containing CUI would be marked and as required for any CUI contained within them. Handle them in accordance with this part and the CUI Registry.
(l) Using supplemental administrative markings with CUI.
(1) Agency heads may authorize the use of supplemental administrative markings (e.g. “Pre-decisional,” “Deliberative,” “Draft”) for use with CUI.
(2) Agency heads may not authorize the use of supplemental administrative markings to establish safeguarding requirements or disseminating restrictions, or to designate the information as CUI. However, agencies may use these markings to inform recipients of the non-final status of documents under development to avoid confusion and maintain the integrity of an agency's decision-making process.
(3) Agencies must detail requirements for using supplemental administrative markings with CUI in agency policy that is available to anyone who may come into possession of CUI with these markings.
(4) Authorized holders must not incorporate or include supplemental administrative markings in the CUI marking scheme detailed in this part and the CUI Registry.
(5) Supplemental administrative markings must not duplicate any CUI marking described in this part or the CUI Registry.
(m) Unmarked CUI. Treat unmarked information that qualifies as CUI as described in the Order, § 2002.8(c), and the CUI Registry.