What to Do When CUI Is Missing or Incorrectly Marked: A Defense Contractor Guide

What Should a Defense Contractor Do When CUI Is Missing, Inconsistent, or Incorrectly Marked?

A defense contractor receives an engineering drawing from a government customer.

The drawing appears to contain sensitive technical information. It relates directly to a military system. Your team expected it to be Controlled Unclassified Information.

But there is no obvious CUI banner marking.

Or perhaps the opposite happens.

A document arrives covered in markings your employees do not recognize:

CUI//SP-CTI

CUI

Distribution Statement D

NOFORN

Maybe one page is marked while another is not. Maybe an email attachment is marked differently from the email that delivered it.

What should your organization do?

The wrong answer is to simply guess.

For contractors in the Defense Industrial Base, inconsistent CUI designation and marking is more than a theoretical problem. In September 2026, the Department of War Chief Information Officer⁠ said that feedback received during the Department’s ongoing CMMC reform effort has identified inconsistent government CUI designation and portion markings as a source of friction across the industrial base. 

That makes this an important moment to understand the distinction between three separate activities:

• Determining whether information qualifies as CUI.
• Applying the correct CUI markings.
• Physically safeguarding information once it is being handled as CUI.

They are related, but they are not the same thing.

First: What actually makes information CUI?

A purple sticker does not make information CUI.

Neither does a contractor deciding that something “looks sensitive.”

Controlled Unclassified Information is defined under 32 CFR § 2002.4 (h)

(h) Controlled Unclassified Information (CUI) is information the Government creates or
possesses, or that an entity creates or possesses for or on behalf of the Government, that a
law, regulation, or Government-wide policy requires or permits an agency to handle using
safeguarding or dissemination controls.

A bit clearer definition comes from The National Archives CUI Program⁠ which defines Controlled Unclassified Information as information requiring safeguarding or dissemination controls pursuant to and consistent with applicable law, regulation or government-wide policy. 

But all told, the government’s authoritative repository for these categories is the CUI Registry⁠.

The Registry identifies approved CUI categories, their underlying authorities, applicable markings and handling guidance. NARA specifically recommends that agency personnel and contractors consult their agency’s CUI implementing policies and program management in addition to the Registry. 

This leads to one of the most important rules in physical CUI implementation:

Do not invent CUI categories or markings because information seems important.

CUI designation must have an actual basis.

Who/what determines that information is CUI?

Designating CUI is a primary responsibility of an authorized holder and occurs when an
authorized holder, consistent with 32 CFR § 2002 and the CUI Registry, determines that a
specific item of information falls into a CUI category or subcategory. 32 CFR § 2002 standardizes the definition of CUI into 24 categories and almost 100 subcategories. It codifies the identification, sharing, safeguarding, marking, storage, distribution, transmission, decontrol,
destruction, training, monitoring, and reporting requirements across the Executive branch of
government.

The bottom line: If information or an item meets the definition of CUI, then it is CUI.

Furthermore, according to DoD policy, all DoD CUI “should” be marked, but may unmarked, especially when developed in performance of the contract. Designating and marking CUI are prerequisites to meeting all CUI security and handling requirements, but because of the practical challenges, the definition of DoD CUI provides for both marked and unmarked information to qualify as CUI when collected, developed, received, transmitted, used, or stored during the performance of the contract.

DoDi 5200.48 3.6(a) requires DoD personnel (which includes contractors and subcontractors by definition) as authorized holders of the document or material to be responsible for designating at the time of creation, when information in a document or material falls into a CUI category.

NARA defines an authorized holder as an individual, agency, organization or group permitted to designate or handle CUI in accordance with 32 CFR Part 2002. NARA separately defines the designating agency as the executive-branch agency that designates or approves the designation of a particular item of information as CUI. 

For contractors, the exact authority and responsibilities should therefore be determined from:

• the contract;
• agency guidance;
• applicable CUI category;
• government-provided instructions;
• organizational CUI procedures;
• the CUI Registry.

A contractor should not casually create a new CUI designation merely because an employee believes information might be sensitive.

What if government-provided information looks like CUI but is not marked?

This is where organizations need a repeatable escalation process.

Suppose an engineer receives an unmarked drawing that appears to contain military technical information.

The engineer should not be expected to independently become the final authority on its CUI status.

A better workflow is:

Identify → isolate if appropriate → verify → clarify → mark/handle according to confirmed requirements.

The organization should determine whether the information falls under its applicable contract, agency instructions and CUI procedures and elevate uncertainty to the appropriate security, compliance, contract or government point of contact.

Until the issue is resolved, organizations may choose to apply protective handling based on their internal risk-management procedures.

That is different from permanently redesignating the information yourself.

Safeguarding something while its status is clarified does not necessarily mean your organization has formally designated it as CUI.

That distinction prevents both under-protection and uncontrolled overmarking.

What if a document is marked CUI but the marking looks wrong?

Do not automatically remove the marking. There are strict rules and procedures that must be followed to "decontrol" CUI.

Start by determining what the marking is attempting to communicate.

The NARA CUI Markings Registry⁠ provides the approved markings associated with CUI categories. 

For example, one category particularly relevant to defense manufacturers is Controlled Technical Information (CTI).

NARA describes CTI as technical information with military or space application that is subject to controls on access, use, reproduction, modification, performance, display, release, disclosure or dissemination. Examples include engineering drawings, specifications, process sheets, manuals, technical reports, technical orders, data sets and computer software. 

The Registry identifies its specified banner marking as:

CUI//SP-CTI

That is very different from an employee improvising something like:

CONFIDENTIAL MILITARY DATA

The latter is not an approved substitute for the CUI marking system.

When markings appear inconsistent, consult the applicable Registry entry and your contract or agency guidance rather than “fixing” the document based on intuition.

CUI Basic vs. CUI Specified matters

Another source of confusion is the difference between CUI Basic and CUI Specified.

NARA defines CUI Specified as the subset of CUI where the underlying law, regulation or government-wide policy contains specific handling controls that differ from the general controls applicable to CUI Basic. 

That matters because two documents can both contain CUI while having different marking or safeguarding requirements.

A facility should therefore avoid reducing its CUI program to:

“Anything purple gets handled the same way.”

Instead, personnel responsible for CUI should know how to determine whether additional category-specific requirements apply.

What is a CUI banner marking?

A CUI banner marking appears prominently at the top of a document and communicates its controlled status.

NARA’s CUI Marking Handbook explains that the CUI control marking is mandatory within CUI banner markings and may use CUI or CONTROLLED as appropriate under the guidance. 

For documents involving CUI Specified or limited dissemination controls, additional information may need to appear in the banner.

For example:

CUI

is not necessarily equivalent to:

CUI//SP-CTI

and neither should be casually substituted for the other.

The correct marking depends on the information involved and its applicable authority.

What are CUI portion markings?

Portion markings identify the status of individual portions of a document.

NARA’s Marking Handbook provides examples where controlled paragraphs carry appropriate CUI markings while uncontrolled portions can be identified separately. When CUI Specified information is present, applicable specified category or subcategory markings must also be reflected in the overall banner marking. 

This is especially relevant given the Department’s current CMMC reform discussions.

As of September 2026, the DoW CIO says feedback from the industrial base has specifically identified inconsistent government CUI designation and portion markings as creating friction. 

Organizations therefore need processes capable of handling imperfect incoming information rather than assuming every document will arrive perfectly marked.

Does missing a marking mean the information is automatically not CUI?

Do not use the absence of a sticker, stamp or banner as your sole decision criterion.

CUI status is based on the underlying safeguarding or dissemination authority—not on the physical existence of a purple label.

Conversely, putting a CUI sticker on ordinary information does not magically create a federal safeguarding authority.

This is why organizations should train employees to distinguish:

• CUI status — what the information actually is.
• CUI marking — how that status is communicated.
• CUI safeguarding — how the information is protected.

Confusing those three concepts creates unnecessary risk.

Once CUI status is established, make physical handling obvious

Once information is known to be CUI, physical implementation becomes much easier when employees have standardized tools and workflows.

For paper documents, organizations may use the Standard Form 901 CUI Cover Sheet.

NARA explains that a coversheet can identify CUI, alert observers that CUI is present and act as a shield against inadvertent disclosure. If an executive-branch agency chooses to use a coversheet, the approved form is SF 901. 

CUI Supply provides SF 901 and physical CUI document solutions⁠ for organizations standardizing paper-document handling.

An SF 901 can be especially useful when employees routinely move drawings, travelers, inspection records or other physical documents between work areas.

NARA’s FAQ also states that an SF 901 may be used in lieu of marking every page in appropriate circumstances, while applicable specified categories, limited dissemination controls and other requirements still need to be listed. 

The cover sheet therefore helps communicate that CUI is present.

It does not determine whether the underlying information qualifies as CUI.

What about engineering travelers and manufacturing paperwork?

Physical manufacturing environments create a particularly difficult CUI-marking problem.

A controlled engineering drawing may leave the engineering department and travel with a work order through:

• machining;
• fabrication;
• welding;
• inspection;
• quality assurance;
• assembly;
• testing;
• packaging.

Now CUI is no longer confined to a computer or filing cabinet.

It may be attached to a clipboard or traveler moving through thousands of square feet of production space.

For these environments, CUI Supply offers a Reusable Metal SF 901 Coversheet for Travelers⁠ designed to provide durable, reusable identification and physical shielding for manufacturing travelers and oversized CUI documents.

The product supports the physical handling workflow; the underlying designation and marking requirements still come from the applicable government authority and organizational procedure.

What about digital media?

Paper documents are only part of the marking problem.

NARA identifies standardized media labels for electronic media containing CUI.

The government’s CUI resources identify:

• SF 902 as a CUI media label used to identify media containing CUI, such as hard drives.
• SF 903 as the smaller CUI media label intended for media such as USB drives. 

Organizations can use the appropriate media identification within their established procedures to make controlled devices easier for employees to recognize.

CUI Supply carries physical CUI media and asset identification products⁠ including SF 902, SF 903 and other asset-labeling options.

Again, the label is the visual indicator.

The security program still needs to control who may access the media, where it may go and how the CUI on it is protected.

Do not confuse SF 902 and SF 903 with the old OF forms

This is an easy source of search confusion.

NARA notes that OF 901, OF 902 and OF 903 were rescinded on December 14, 2018, although agencies could use existing supplies until depleted.

The current standardized CUI tools include:

• SF 901 — CUI Cover Sheet
• SF 902 — CUI Media Label
• SF 903 — CUI Media Label, USB size 

That distinction is useful for procurement teams because searches for “CUI 902” or “CUI 903” can otherwise surface outdated terminology.

Physical marking should extend beyond the document when necessary

Once an organization has identified where CUI actually exists, it can build physical controls around the workflow.

For example, suppose engineering drawings containing CUI are routinely handled at three inspection stations.

The organization might combine:

• access-control procedures;
• employee authorization;
• visitor escort procedures;
• marked CUI documents;
• controlled workstations;
• visible restricted-area signage;
• physical work-zone boundaries.

CUI Supply’s CUI Restricted Area Signs⁠ can help identify entrances to spaces where special CUI handling procedures apply.

For manufacturing cells, inspection areas or temporary controlled zones, CUI Authorized Only Marking Tape⁠ can provide a visible boundary.

Those products do not create a controlled environment by themselves.

NARA defines a controlled environment as an area or space an authorized holder considers to have adequate physical or procedural controls—such as barriers or managed access controls—to protect CUI from unauthorized access or disclosure. 

The visual marking reinforces the real control.

It is not the control itself.

What if visitors enter areas where questionable CUI is present?

If the CUI status of information is being clarified, organizations should avoid creating unnecessary exposure in the meantime.

That becomes particularly important when visitors, vendors, maintenance personnel or other non-authorized individuals enter the area.

NIST SP 800-171 Revision 3 requires organizations to develop and maintain physical access authorizations for facilities containing systems that process, store or transmit CUI. Its discussion specifically says physical access authorization applies to employees and visitors. 

Visible visitor identification can reinforce those procedures.

CUI Supply’s CUI Visitor and Personnel Badges⁠ provide visual differentiation between people authorized under an organization’s procedures and individuals whose access should be restricted or escorted.

Badges do not grant authorization.

Your organization’s access-control process does.

A practical workflow for questionable CUI markings

When an employee encounters information that appears to have missing, inconsistent or questionable CUI markings, a mature organization should have a procedure resembling this:

1. Stop and identify the issue

Do not casually distribute questionable information further simply because its marking is unclear.

Determine what triggered the concern.

Is the banner missing?

Is the category unfamiliar?

Is one page marked differently?

Did the government customer call the material CUI while the file itself appears unmarked?

2. Check the authoritative sources

Consult the NARA CUI Registry⁠ and applicable agency CUI guidance.

Determine whether the category and marking actually exist.

3. Check the contract and government instructions

The contract, security requirements and agency implementation guidance may provide information that a generic internet search cannot.

4. Escalate uncertainty

Route the issue through the organization’s designated security, compliance, contracts or CUI personnel and, where appropriate, seek clarification from the government customer or contracting authority.

5. Protect the information while the issue is being resolved

Follow your organization’s established procedures for questionable or potentially controlled information.

Do not use uncertainty as justification for unnecessarily exposing potentially sensitive information.

6. Correct the workflow—not just the document

If the same marking problem keeps appearing, document the recurring issue.

The real fix may involve:

• supplier instructions;
• customer clarification;
• employee training;
• document templates;
• print procedures;
• physical labeling;
• controlled-area design;
• contract interpretation.

7. Standardize the confirmed handling process

Once the status is clear, make the correct procedure easy for employees to follow every time.

That is where standardized coversheets, labels, signs, badges and physical boundaries become valuable.

CUI marking mistakes to avoid

Several common responses can make the problem worse.

Mistake #1: “If it isn’t marked, it isn’t CUI.”

Markings communicate status; they are not necessarily the sole source of that status.

Mistake #2: “If we’re unsure, we’ll just mark everything CUI.”

Overmarking creates operational friction and undermines the purpose of a standardized information-control system.

Mistake #3: Inventing your own category.

Use the authoritative CUI Registry and applicable agency guidance.

Mistake #4: Treating a sticker as a security control.

A label identifies. Physical and technical safeguards protect.

Mistake #5: Removing questionable government markings without clarification.

Investigate before altering the handling status of information.

Mistake #6: Training employees to memorize markings without teaching escalation.

Employees do not need to personally resolve every edge case. They need to know when and how to escalate one.

Why this matters even during the CMMC Phase II suspension

The timing of this issue matters.

On July 13, 2026, the Department of War suspended CMMC Phase II requirements that had been scheduled to begin November 10, 2026 and launched a broader review of the program. Phase I remains in effect. 

The Department currently says CMMC implementation is paused in Phase I and that, during this period, it will enforce NIST SP 800-171 Revision 2 compliance through self-assessments and selected government-led assessments. Most importantly, DoW explicitly states that the CMMC pause does not eliminate contractors’ responsibility to protect information under DFARS 252.204-7012. 

DFARS policy likewise makes clear that CMMC provisions do not eliminate other contractor physical, personnel, information, technical or administrative security requirements for protecting unclassified information. 

So contractors should not interpret the current reform period as a reason to stop improving CUI handling.

The Department itself is now publicly discussing friction around inconsistent CUI designation and portion markings. 

That makes this an excellent time to fix the internal process.

The goal: employees should never have to guess

A mature physical CUI program does not depend on every machinist, receptionist, engineer, inspector and visitor memorizing the entire CUI Registry.

Instead, it creates a system where the correct action is obvious.

Employees should know:

• What known CUI looks like.
• Where CUI may be handled.
• Which devices and workstations are authorized.
• How physical documents are covered and identified.
• How visitors are managed.
• Where CUI can be stored.
• How unwanted CUI is destroyed.
• Who to contact when a marking does not make sense.

That last point is critical.

Because even a very good physical CUI program will eventually encounter a document that does not fit neatly into the procedure.

The organization that handles that situation correctly is not necessarily the organization with the most stickers.

It is the organization whose people know how to recognize uncertainty, protect the information and get the right answer.

Frequently Asked Questions

Is unmarked information automatically not CUI?

No. CUI status is based on applicable law, regulation or government-wide policy and the relevant government designation process—not simply whether a physical CUI label is present. When status is unclear, contractors should consult applicable contract requirements, agency guidance, the CUI Registry and appropriate government or organizational authorities. 

Can a contractor decide that any sensitive information is CUI?

Not simply because the contractor considers the information sensitive. CUI must have an applicable safeguarding or dissemination authority. The CUI Registry is the government-wide repository for approved categories and authorities. 

What should I do if a government drawing appears to be CUI but has no marking?

Follow your organization’s procedures for questionable information, review the applicable contract and agency guidance, check the CUI Registry, restrict unnecessary exposure while the issue is being resolved, and escalate the question to the appropriate organizational or government authority rather than guessing.

What is CUI//SP-CTI?

It is the specified banner marking identified by NARA for Controlled Technical Information. CTI can include military- or space-related engineering drawings, specifications, process sheets, manuals, technical reports, data sets and certain software subject to applicable controls. 

Is an SF 901 required on every CUI document?

No universal rule requires an SF 901 on every CUI document. NARA describes SF 901 as the approved CUI cover sheet and states that agencies may use it to identify CUI, alert observers and shield information from inadvertent disclosure. 

What is the difference between SF 901, SF 902 and SF 903?

SF 901 is the CUI cover sheet. SF 902 is a CUI media label for media such as hard drives. SF 903 is a smaller CUI media label designed for items such as USB drives. 

Do CUI signs make a room a controlled environment?

No. Signs can communicate the boundary and handling rules, but NARA defines a controlled environment in terms of adequate physical or procedural controls protecting CUI from unauthorized access or disclosure. 

Did the 2026 CMMC Phase II suspension eliminate CUI safeguarding requirements?

No. DoW explicitly says the suspension does not eliminate requirements to protect applicable information under DFARS 252.204-7012.