Training & Education

When should you use an SF 901 Coversheet instead of a CUI Stamp? If you need to protect or identify printed CUI without changing the document, an SF 901 Coversheet is often the better choice. If you need direct banner markings on the document itself, a CUI Stamp is the right fit. This article breaks down the difference, explains common use cases, and helps contractors choose the best option for handling printed Controlled Unclassified Information.

A common misconception is that ITAR or EAR compliance is separate from CUI or CMMC. Export-controlled information that is used, generated, or required for performance of a DoD contract qualifies as CUI. This FAQ answer offers authoritative, cited guidance from key regulations (32 CFR Part 2002, DoD Instructions 5200.48 and 5230.24, NARA CUI Registry) to ensure proper identification, marking, and facility-based protections of this highly regulated technical information. For DoD contractors, export-controlled technical data and technology under ITAR and EAR qualify as Controlled Unclassified Information (CUI) in the Export Control (EXPT) category when provided by or generated during DoD contract performance, requiring proper CUI marking (e.g., DoD marking guidance) on all documents, files, and media to prevent unauthorized disclosure.  This same information demands robust safeguarding through designated CUI Zones—controlled physical and digital areas (such as engineering offices, manufacturing floors, quality/test labs, and visitor access points) equipped with signage, labeling, access controls, and visual/perceptual barriers to protect against inadvertent exposure to unauthorized persons, including foreign nationals restricted under ITAR/EAR. These marking and zoning requirements are integral to DFARS 252.204-7012 and CMMC compliance, combining ITAR/EAR access restrictions with CUI safeguarding obligations; failing to treat them as unified can lead to compliance gaps and contract risks.  On U.S. Department of Defense (DoD) contracts, technical data and technology controlled under the International Traffic in Arms Regulations (ITAR) and the Export Administration Regulations (EAR) qualify as Controlled Unclassified Information (CUI) when they are used, generated, or handled in support of contract performance. This is because DoD policy explicitly requires that export-controlled information be protected as CUI to prevent unauthorized disclosure, including disclosure to unauthorized foreign persons. When implementing DFARS 252.204-7012 and preparing for CMMC certification you must implement DoD policy