Marking is how a control obligation travels with a piece of information. Done right, anyone who opens the document knows instantly that it is CUI, what kind, and who to ask about it. Done wrong, or not at all, and CUI moves through your business invisible and unprotected. This guide covers how to read a marking and how to build one correctly.
Why marking matters
Unlike classified information, CUI has no cover sheet culture by default. The marking is the only thing that signals the obligation. If a document of yours contains CUI and carries no banner, the next person to handle it has no way to know it needs protection. That is exactly the failure mode marking exists to prevent.
The anatomy of a CUI marking
A properly marked CUI document has three parts:
- The banner marking, top center of every page.
- The designation indicator, a block on the first page identifying who controlled it.
- Portion markings (optional but common), labeling individual sections.
The banner: Basic vs Specified
| Type | Banner reads | Meaning |
|---|---|---|
| CUI Basic | CUI | Default control level, safeguarded to the uniform baseline |
| CUI Specified | CUI//SP-[code] | A specific law or policy adds handling rules, e.g. CUI//SP-CTI |
The banner is centered at the top of each page. If you also apply limited dissemination controls, they appear after the category, separated by a double slash. The Basic versus Specified distinction changes the banner and the handling, but not your CMMC level: either one is Level 2.
The designation indicator
On the first page, a designation indicator block tells a holder where the control came from. At minimum it names the controlling office and a point of contact, and it identifies the CUI category or categories. This is the block a holder reads to answer, who do I ask about handling or decontrol.
Portion markings
In documents that mix CUI and non-CUI content, portion markings label individual paragraphs or sections, for example a (CUI) tag at the start of a paragraph. They let a reader see exactly which parts carry the obligation, which is useful when only some of a document is controlled.
Common marking mistakes
- No banner at all on CUI a contractor generated under the contract.
- Banner on the first page only, not on every page.
- Missing designation indicator, so no one knows who controlled it.
- Guessing a category code instead of using the government's designation.
- Marking information CUI that the government never designated.
Frequently asked questions
What is the correct banner marking for a document with CUI?
The banner marking is centered at the top of each page and reads CUI for CUI Basic, or CUI//SP- followed by the category code for CUI Specified (for example CUI//SP-CTI). The document must also carry a designation indicator identifying the office that designated the CUI and a point of contact. Portion markings may be applied to individual sections.
Where does the CUI banner go?
The banner marking is placed at the top center of each page that contains CUI. It makes the control obligation visible immediately, so any holder knows the page must be safeguarded before they read further. A designation indicator block appears on the first page.
What is a CUI designation indicator?
A designation indicator is the block that identifies who designated the information as CUI: the controlling office, the applicable category or categories, and a point of contact. It tells a holder where the control came from and who to ask about handling or decontrol.
What is the difference between a CUI Basic and CUI Specified banner?
A CUI Basic banner reads simply CUI. A CUI Specified banner reads CUI//SP- plus the category code, signaling that a specific law or policy adds handling rules beyond the baseline. Both require safeguarding to NIST SP 800-171 on nonfederal systems, so both put a contractor at CMMC Level 2.
Does incorrect CUI marking fail a CMMC assessment?
Marking issues can contribute to findings. CMMC Level 2 includes media protection and marking expectations from NIST SP 800-171, and an assessor looks for a documented, followed marking process. Inconsistent or missing markings on CUI you generate are a common, avoidable weakness.