Controlled Unclassified Information: CUI Marking & Protection Guide
Learn what CUI is, why it matters for defense contractors, and how to mark CUI documents, devices, media, work areas, and facilities.
Controlled Unclassified Information, commonly called CUI, is information that is not classified but still requires safeguarding or dissemination controls under law, regulation, or government-wide policy.
For defense contractors, CUI can appear in contracts, drawings, technical data packages, specifications, manufacturing files, quality records, program communications, printed documents, devices, storage areas, and workspaces.
CUI is not classified information. The DoD CUI Program explains that CUI is a control marking, not a classification marking, and that CUI markings alert recipients that special handling may be required.
That distinction matters. A company may not handle classified information, but it may still handle CUI every day.
What Is Controlled Unclassified Information?
Controlled Unclassified Information is unclassified information that requires safeguarding or dissemination controls.
NARA defines CUI as information that requires safeguarding or dissemination controls pursuant to applicable law, regulations, and government-wide policies, but is not classified under Executive Order 13526 or the Atomic Energy Act.
In simple terms...
CUI is sensitive unclassified information that must be protected.
Examples may include:
- Controlled technical information
- Engineering drawings
- Manufacturing specifications
- Technical data packages
- Export-controlled information
- Program documents
- Inspection records
- Procurement information
- Contract-related information
- Research and development information
- Sensitive government-furnished information
The exact CUI category depends on the information itself, the applicable law or regulation, and the contract or government customer guidance.
CUI FAQs
No. CUI is not classified information.
Classified information includes levels such as Confidential, Secret, and Top Secret. CUI is different. It is still unclassified, but it cannot be treated like public information.
This is one of the most important CUI concepts for contractors to understand:
CUI is not classified, but it is controlled.
That means it requires specific handling, marking, access control, storage, transmission, and disposal procedures.
If your company works with the Department of Defense, prime contractors, subcontractors, aerospace manufacturers, engineering firms, machine shops, IT providers, logistics providers, or other organizations in the Defense Industrial Base, it’s very likely you receive, create, store, process, transmit, or handle CUI.
CUI may show up in:
- Printed contract documents
- Engineering drawings
- Technical specifications
- Quality inspection forms
- Work instructions
- Manufacturing travelers
- Customer files
- Supplier files
- Laptops and desktops
- USB drives and external hard drives
- Servers and network equipment
- Printers and scanners
- File cabinets
- Conference rooms
- Workstations
- Controlled areas
- Shipping and receiving areas
Many organizations think about CUI as only a cybersecurity issue. That is a mistake.
CUI does exist in systems, networks, and cloud environments. But it can also be printed, viewed, discussed, scanned, stored, shipped, transported, destroyed, or left visible in a physical workspace.
A strong CUI program makes it clear:
- Where CUI exists
- Who is allowed to access it
- How it should be handled
- How it should be marked
- Where it can be printed or stored
- How it should be destroyed
- What employees should do when they encounter it
CUI is central to CMMC Level 2 because Level 2 is focused on protecting CUI. Contractors preparing for CMMC must be able to show how CUI is identified, marked, handled, stored, transmitted, and protected.
NIST SP 800-171 provides requirements for protecting the confidentiality of CUI in nonfederal systems and organizations. NIST’s CUI glossary also defines CUI as information that law, regulation, or government-wide policy requires to have safeguarding or dissemination controls, excluding classified information.
For many contractors, this means CUI protection cannot be limited to written policies or IT controls. The physical environment also matters.
A CMMC-ready organization should understand where CUI appears across:
- Systems
- Devices
- Documents
- Printers
- Workstations
- Storage areas
- Controlled spaces
- Visitor-accessible areas
- Disposal points
Physical CUI marking connects the written policy to the real workplace.
CUI Marking: Why Does It Matter?
CUI markings alert people that information requires special handling. The DoD CUI Program explains that CUI policy provides a uniform marking system across the Federal Government and replaced older agency-specific markings such as FOUO, LES, and SBU.
For contractors, marking matters because employees need to recognize CUI before they can protect it.
Without clear CUI markings, employees may not know that a document, device, or area requires special handling. This can lead to common problems such as:
- CUI documents left on desks
- Printed CUI left at shared printers
- USB drives containing CUI left unlabeled
- Visitors entering areas where CUI is visible
- CUI being stored in unmarked cabinets
- CUI being thrown into regular trash or recycling
- Employees not knowing which devices are authorized for CUI
- Controlled areas not being clearly defined
CUI marking is not just a compliance exercise. It is a way to reduce confusion and make correct handling easier for employees.
That being said...
What Needs to Be Marked for CUI?
Every organization must follow its contract, government customer guidance, agency requirements, and internal procedures. But in practical contractor environments, CUI marking applies to more than documents.
Required CUI marking areas include:
- Documents and printed materials
- Laptops and desktops
- Monitors
- USB drives
- External hard drives
- Servers
- Printers and scanners
- File cabinets
- Storage rooms
- Engineering workstations
- Manufacturing areas
- Conference rooms
- Controlled areas
- Visitor badges
- Destruction containers
- Trash and recycling areas
The best approach is to follow the flow of CUI through your facility.
Where does CUI enter?
Where is it viewed?
Where is it printed?
Where is it stored?
Where is it transported?
Where is it destroyed?
Once you know that, you can build a practical CUI marking system.
Common CUI Marking Areas
CUI Documents
Printed CUI documents need to be handled carefully and marked according to applicable requirements.
Many contractors use SF 901 CUI coversheets to help identify and protect printed CUI during review, storage, transport, and internal handling.
Useful products:
- SF 901 CUI Coversheets
- Reusable SF 901 Cover Holders
- SF 901 Folder Cards
- CUI Document Control Folders
CUI documents are common in engineering, quality, contracts, program management, manufacturing, and inspection workflows.
Computers, Devices, and Digital Media
Devices that store, process, display, or transmit CUI may need clear identification.
This can include:
- Laptops
- Desktops
- Monitors
- Tablets
- Servers
- External hard drives
- USB drives
- Removable media
- Shared workstations
- Shop floor terminals
Useful products:
- SF 902 CUI Computer and Digital Media Labels
- SF 903 CUI Flash Drive Labels
- SF 905 Generic CUI Computer and Digital Media Labels
- SF 906 Generic CUI Flash Drive Labels
- CUI Controlled Item Labels
- CUI Authorized Controlled Asset Labels
Device and media labels help employees quickly recognize assets that may require special handling.
Printers, Scanners, and Copiers
Printers and scanners are common CUI risk points.
CUI may begin as a digital file, but once it is printed, it becomes a physical document that can be left in a tray, picked up by the wrong person, or placed in the wrong disposal container.
Useful products:
- CUI Printer Station Signs (Coming Soon) Pre Order Link?
- CUI Scanner Signs
- SF 901 CUI Coversheets
- No CUI in Trash or Recycling Signs
- CUI Authorized Destruction Container Signs
If a printer, scanner, or copier at any point may be used for CUI, it should be included in your marking plan.
Controlled Areas and Workspaces
CUI may be handled in specific rooms, workstations, labs, conference rooms, manufacturing cells, engineering areas, quality rooms, or program offices.
It’s required that these areas be clearly identified when access or handling expectations apply.
Useful products:
- CUI Zone Stop Signs
- CUI Restricted Area Signs
- CUI Authorized Only Floor Tape
- CUI Boundary Stickers
- CUI Workstation Labels
Controlled area marking helps employees and visitors understand when they are entering a CUI-sensitive space.
Storage Areas
CUI may be stored in cabinets, drawers, safes, document control rooms, storage closets, file rooms, or records areas.
Useful products:
- CUI Storage Labels
- CUI Restricted Area Signs
- CUI File Cabinet Labels
- SF 901 Folder Cards
- CUI Document Control Folders
Employees should know when a cabinet, folder, room, or container is used for CUI storage.
Disposal and Destruction Points
CUI cannot be placed into regular trash or recycling under any circumstances.
Disposal points should be clearly marked so employees know where CUI can and cannot go.
Useful products:
- No CUI in Trash or Recycling Signs
- CUI Authorized Destruction Container Signs
This is one of the simplest physical controls to improve, but it is often overlooked.
Visitor Access Points
Visitors, vendors, auditors, delivery drivers, janitorial staff, and other non-employees may enter facilities where CUI is present.
Visual access controls help employees recognize who is approved, who is restricted, and who may need an escort.
Useful products:
- CUI Approved Visitor Badges
- CUI Restricted Visitor Badges
- High-Visibility Lanyards
- CUI Restricted Area Signs
Visitor controls are especially useful in facilities where CUI may be visible in offices, labs, production areas, or conference rooms.
Our Partners
We’re proud to partner with these outstanding organizations that have supported our online events, contributed valuable information to our blog, and inspired the development of our products.
- Choosing a selection results in a full page refresh.
- Opens in a new window.