Training & Education

Defense contractors preparing for CMMC Phase 2 should not wait until the last minute to evaluate the physical side of their environment. Now is the time to walk the facility, examine workflows, identify ambiguity, and ask whether the environment itself supports compliant behavior. Because in the end, physical safeguarding is not just about having rules. It is about creating an environment where the right actions are obvious, repeatable, and defensible. That is what assessment-ready physical CUI protection looks like.

When employees handle Controlled Unclassified Information in paper form, the risk is not limited to cybersecurity. Printed documents, binders, folders, travelers, drawings, and work packets can all expose CUI if they are left uncovered, misplaced, casually observed, or mixed into normal paperwork. That is where the SF 901 CUI Cover Sheet becomes useful. The SF 901 Cover Sheet is designed to sit on top of physical CUI documents and help alert personnel that the attached material requires safeguarding. It creates a clear visual indicator that the document packet contains CUI and should be handled according to the organization’s CUI procedures. For defense contractors, manufacturers, engineering firms, program offices, and other organizations supporting federal contracts, SF 901 Cover Sheets are one of the simplest ways to improve physical CUI handling. What Is an SF 901 CUI Cover Sheet? An SF 901 CUI Cover Sheet is the standard cover sheet used to identify and help protect physical documents containing Controlled Unclassified Information. It is commonly placed on top of printed CUI documents, document packets, folders, binders, clipboards, travelers, and other physical paperwork. The purpose is to make it immediately clear that the material underneath requires proper handling. The cover sheet can also provide space for additional handling details, such as: CUI categories Limited dissemination controls Special instructions Points of contact Internal handling notes The SF 901 is an acceptable alternative to marking a document as long it stays attached to the document. This works as an additional visual layer to help employees recognize, cover, and protect CUI during normal operations. When Should You Use SF 901 Cover Sheets? Use SF 901 Cover Sheets any time printed CUI documents need to be handled, reviewed, moved, staged, or stored. Common use cases include: Printed CUI documents on desks or workstations Engineering drawings or technical data Manufacturing travelers Quality inspection packets Contract files Program management binders Meeting handouts Documents being transported between departments CUI stored in folders, cabinets, or bins Printed documents waiting to be scanned, filed, shredded, or reviewed They are especially helpful in environments where CUI moves between people, departments, or physical work areas. For example, a manufacturing company may use SF 901 Cover Sheets on traveler packets that move from engineering to production to inspection. A program office may use them on printed contract documents. An FSO or ISSO may use them during internal audits, employee training, or CUI handling reviews. Where Should the Cover Sheet Be Placed? The SF 901 Cover Sheet should be placed on top of the CUI document packet so it is immediately visible. For best results, use it in a consistent way across your organization: Place it as the first page of printed CUI packets. Keep it facing outward when documents are in folders or binders. Use it on clipboards or packets moving through production areas. Keep it attached while the document still requires protection. Store covered documents in approved cabinets, folders, or controlled areas when not in use. The goal is simple: when someone sees the document packet, they should immediately understand that the material requires CUI handling procedures. Step-by-Step: How to Use SF 901 Cover Sheets Step 1: Identify the CUI Document Before applying a cover sheet, determine whether the document contains Controlled Unclassified Information. This may include contract information, technical data, export-controlled information, drawings, specifications, program details, inspection records, or other controlled information provided by or created for a federal contract. Step 2: Make Sure the Document Is Properly Marked The SF 901 Cover Sheet is not a replacement for proper CUI markings on the document itself. If the document requires CUI markings, make sure the underlying document is marked according to your organization’s CUI marking procedures and applicable contract requirements. Step 3: Place the SF 901 Cover Sheet on Top Place the cover sheet on top of the document packet, folder, binder, clipboard, or traveler. The CUI cover sheet should be clearly visible. Step 4: Fill In Handling Details in the Designation Indicator Block Use the available space on the cover sheet to add relevant details such as CUI category, limited dissemination control, special handling instructions, or a point of contact. Not every organization will fill in every field every time. Your internal SOP should define what is required. Step 5: Keep the Cover Sheet Attached Keep the SF 901 Cover Sheet attached while the document requires protection, is being actively used, or is being transported, stored, reviewed, or staged. Step 6: Store or Destroy the Document Properly When CUI documents are not in active use, store them in an approved location. When they are no longer needed, dispose of them using your approved CUI destruction process. Do not place CUI documents in normal trash or recycling. Common Mistakes to Avoid Mistake 1: Treating the Cover Sheet as the Only Required Marking A cover sheet helps identify and protect CUI, but it does not automatically make the underlying document properly marked. The document itself may still need required CUI markings. Mistake 2: Leaving Covered CUI in Public Areas A cover sheet helps reduce casual observation, but it does not make it acceptable to leave CUI in uncontrolled spaces. Covered documents should still be handled, stored, and protected according to your CUI procedures. Mistake 3: Using Cover Sheets Inconsistently If some employees use cover sheets and others do not, your process becomes harder to follow and harder to audit. The best practice is to define when SF 901 Cover Sheets are required in your SOP for consistent marking.  Mistake 4: Forgetting About Manufacturing and Production Areas CUI is not only found in offices. Printed work instructions, drawings, travelers, inspection documents, and technical packets may contain CUI in production environments. SF 901 Cover Sheets can help make these documents easier to identify on the floor. Mistake 5: Throwing CUI Documents in Normal Trash Once a CUI document is printed, it needs to be controlled through its full lifecycle. That includes destruction. You are required to properly destroy any CUI once it has reached the end of its lifecycle. Pair SF 901 Cover Sheets with CUI authorized destruction container signs to remind employees where CUI documents should go when they are ready for disposal.  Where SF 901 Cover Sheets Fit in a Complete CUI Marking System SF 901 Cover Sheets are one part of a broader physical CUI protection system. They work best when paired with other visual controls, including: CUI folders for organizing and identifying document packets CUI restricted area signs for rooms or areas where CUI is handled CUI authorized-only floor tape for controlled work zones CUI media labels for devices and removable media CUI destruction container signs for approved disposal points CUI visitor badges for access control and visitor awareness CUI awareness posters for employee reminders and training reinforcement The cover sheet identifies the document. The surrounding signs, labels, badges, and floor markings help define the environment where that document is handled. Together, they create a more consistent and visible CUI handling process. Example Use Cases by Environment Office Environment Use SF 901 Cover Sheets on printed contracts, program binders, meeting packets, review documents, and files containing CUI. Keep covered documents in approved folders, drawers, or storage cabinets when not in use. Manufacturing Floor Use SF 901 Cover Sheets on travelers, work instructions, inspection packets, drawings, and technical documents that move between workstations. Pair with CUI restricted area signs and CUI floor markings to identify controlled production zones. Engineering Department Use SF 901 Cover Sheets on printed drawings, design reviews, technical data packages, prototype documentation, and customer-provided CUI that is not or cannot be properly marked. Pair with CUI media labels for engineering workstations and removable storage devices. Conference Rooms Use SF 901 Cover Sheets on CUI meeting packets, agenda attachments, program documentation, and technical review materials. Remove or secure all CUI documents after the meeting ends. Reception or Visitor Areas Avoid staging exposed CUI documents in reception areas. If CUI documents must move through visitor-facing spaces, use a cover sheet and follow your organization’s escort and handling procedures. Suggested SOP Language Here is a simple paragraph you can adapt for your internal procedure: “Employees must use SF 901 CUI Cover Sheets on physical document packets containing Controlled Unclassified Information when unmarked CUI documents are printed, reviewed, stored, or staged. The cover sheet must be placed on top of the document packet and remain attached while the document requires protection. SF 901 Cover Sheets do not replace required CUI markings on the underlying document. CUI documents must be stored, transported, reproduced, and destroyed according to the organization’s CUI handling procedures.” Quick Buyer Recommendation If your team prints, reviews, files, transports, or stores CUI documents, SF 901 Cover Sheets should be part of your physical CUI handling process. They are especially important for organizations preparing for CMMC, internal audits, supplier reviews, CUI training, or facility standardization. Start by placing SF 901 Cover Sheets in the areas where CUI documents are most often printed, handled, transported, or stored. Then build outward by adding folders, signage, media labels, destruction container signs, and controlled area markings. FAQ Are SF 901 Cover Sheets required? CUI is required to be marked. However, when a CUI cover sheet is used, the official SF 901 is the standard CUI cover sheet. Do SF 901 Cover Sheets replace CUI markings? Yes. This is an alternate marking method for when editing the CUI document is not permitted.  Can SF 901 Cover Sheets be used in manufacturing environments? Yes. They are useful for travelers, drawings, work instructions, quality packets, technical documents, and other printed materials that may move through production, inspection, engineering, or program areas. Should the cover sheet stay attached to the document? Yes. Absolutely, the cover sheet should remain attached while the document requires protection, is being handled, or is being stored. What products should be used with SF 901 Cover Sheets? Common pairings include CUI folders, CUI restricted area signs, CUI destruction container signs, CUI media labels, CUI authorized-only floor tape, and visitor/personnel badges.

Not sure if your documents contain CUI? Use this exact 8-step checklist based on DoDI 5200.48 and dodcui.mil. Perfect for DoD contractors and CMMC compliance in 2026.

Printers, copiers, scanners, monitors, and shared workspaces can all become physical CUI exposure points if they are not properly controlled. NIST SP 800-171 Rev. 3 explicitly requires organizations to restrict physical access to output devices so unauthorized individuals cannot obtain Controlled Unclassified Information. This article breaks down what that means in practice, why shared office equipment creates real compliance risk, and how physical safeguards like coversheets, signs, labels, and controlled workspaces help protect CUI during everyday handling.

What is the ROI of proper CUI marking for CMMC compliance? For most defense contractors, the cost of implementing CUI signs, labels, coversheets, stamps, and basic visual controls is relatively low, while the benefits can be significant. Proper CUI marking helps reduce audit findings, prevent mishandling, improve operational clarity, and build customer confidence. This article explains the true cost vs. benefit of a professional CUI marking program and why it is one of the smartest low-cost investments an organization can make for CMMC readiness.

Controlled Unclassified Information (CUI) can be confusing, especially for organizations trying to understand what it is, who must protect it, and how physical marking fits into compliance. This FAQ answers common questions about CUI, including safeguarding requirements, physical CUI risks, marking practices, controlled environments, visitor access, and the practical steps organizations can take to improve compliance readiness.

What is the difference between SF 902 and SF 905 CUI labels? Both are used to mark computers, monitors, hard drives, and digital media that contain Controlled Unclassified Information, but SF 902 includes “U.S. Government Property” and SF 905 does not. This guide breaks down SF 902 vs. SF 905, explains when to use each label, and helps defense contractors and other organizations choose the right CUI device label for computers, digital media, and equipment.

How do you properly mark Controlled Unclassified Information? This guide explains how to identify, label, and protect CUI across documents, computers, digital media, manufacturing areas, and controlled workspaces. It covers core CUI marking requirements, best practices by media type, common audit-failure mistakes, and a simple step-by-step framework for building a consistent CUI marking program aligned with NIST SP 800-171, DFARS 252.204-7012, and CMMC.

If you work with the Department of Defense (DoD) or support the Defense Industrial Base (DIB), you’ve almost certainly heard the term CUI—but it’s also one of the most misunderstood concepts in compliance. Understanding Controlled Unclassified Information (CUI) is foundational to DFARS, NIST SP 800-171, and CMMC compliance. This guide breaks it down clearly and practically.

Does ITAR or EAR-controlled technical data count as CUI under a DoD contract? In many cases, yes. When export-controlled technical data or technology is provided by the government or generated during DoD contract performance, it may qualify as CUI and require proper marking, access controls, and physical safeguarding. This guide explains how ITAR, EAR, DFARS 252.204-7012, and CUI requirements intersect, what manufacturers need to protect, and how to reduce compliance risk in engineering, production, quality, and visitor-access areas.

CMMC Mythbusters is BACK December 2025! The popular CMMC 2.0/ DFARS training and education series CMMC Mythbusters returns December 15th- 19th, 2025! Once a six-part series, we have now condensed down to three parts, jam-packed with the latest updates and info you need to know to be compliant.  Join us live for the highly anticipated return of CMMC Mythbusters, led by the Chairman of the CMMC Industry Standards Council (CISC) and Chief Transformation Officer of DTC Global, Regan Edens. Sign up for each part via the links below:  Part 1: "What Exactly Is CUI (Controlled Unclassified Information)?" Part 2: "Commercial-Off-the-Shelf (COTS) vs CUI?" Part 3: "Identifying & Properly Marking CUI" This complimentary series is brought to by CUI Supply, DTC Global, and the University of Texas- Arlington. 

CMMC Phase I is officially HERE! Are you ready to go? Read more about the Final Rule below: Prepare with CUI Supplies HERE: https://cuisupply.com/

❗❗ATTENTION ❗ ❗CMMC Phase I officially begins NOVEMBER 10TH, 2025! If you haven't started preparing already, the time is NOW! We want to help you get ready. Get 10% off your order total, automatically applied at checkout, at CUISupply.com.DO NOT WAIT! Get ready NOW. To read more about the Final Rule, click HERE:

Important clarifications provided by the DoD were recently released on the CMMC Phase I timeline and the impact on contracts after the effective date. The deadline is September 2025... Are you ready?