CUI on page one: what 32 CFR 2002 and DoDI 5200.48 ask of an engineering report

A report that holds controlled unclassified information must carry two marks. The banner tells every reader that the document holds CUI, and the designation indicator says who designated it.¹

Portion marks are a third, optional layer. Where each mark goes, and what it holds, differs between the government-wide rule in 32 CFR 2002 and DoD practice under DoDI 5200.48.

This post shows how an engineering team marks its reports, and it is not legal advice. Your contract and your security office pick the category and the controls, and the rules below put them on the page.

The banner: one line, the same on every page

32 CFR 2002.20 lets a banner hold up to three elements.¹ The control marking is mandatory and reads CONTROLLED or CUI. Category markings are mandatory for CUI Specified, and limited dissemination control markings are the third.¹

The banner covers the whole document and reads the same on every page that holds CUI.¹ NARA’s marking handbook puts it at the top of each page and calls a copy at the bottom an optional best practice.² Double slashes separate the groups, and a Specified category takes an SP- prefix.²

The registry lists Export Controlled with the category marking EXPT.³ Some of its authorities are Specified, with the banner CUI//SP-EXPT, and some are Basic, with the banner CUI or the alternative CUI//EXPT.⁴ FEDCON, Federal Employees and Contractors Only, is one of the registry’s limited dissemination controls.⁵

So a government-wide banner for export-controlled data under a Specified authority, limited by FEDCON, reads CUI//SP-EXPT//FEDCON. Any warning or distribution statement that an authority requires still goes on the document, but never inside the banner.¹ Only the designating agency may apply a limited dissemination control, and other holders need its approval.⁵

Retire any report template that still prints FOUO. The part makes legacy markings void and bars any marking that is not in the part or the registry.¹ DoD’s instruction calls FOUO the old marking and says a CUI banner needs no U in front, as U//FOUO did.⁶

The designation indicator: who controls it

Every document with CUI must say who designated it. At minimum that means the designator’s agency, shown by letterhead or by a “Controlled by” line.¹ It must be easy to find, and it may appear on the first page or cover alone.¹

NARA’s handbook asks you to name a point of contact, branch or division where you can, with contact details.² DoDI 5200.48 turns this into a fixed block of five lines on the first page or cover:⁶

Controlled by: [Name of DoD Component] (Only if not on letterhead)
Controlled by: [Name of Office]
CUI Category: (List category or categories of CUI)
Distribution/Dissemination Control:
POC: [Phone or email address]

Line one names the DoD Component that determined the information is CUI, and letterhead can stand in for it. Line two names the office that made the determination, and line three lists every CUI category in the document.⁶

Line four holds the distribution statement or the dissemination controls. Line five holds a phone number or office mailbox for the originating Component or the authorized holder.⁶ DoD’s marking training aid accepts organizational email, and says contractors may create and mark CUI and appear as the point of contact.⁷

Portion marks: optional until you start

In a fully unclassified document, portion marking is optional: 32 CFR permits and encourages it but does not demand it.¹² Once you start, you mark every portion, and portions without CUI get (U).¹²

Two cases make portion marks mandatory. When CUI shares a document with classified information, every CUI portion must be marked.¹ An agency head can also require portion marks on all CUI that the agency creates.²

DoD follows the same pattern: if portion marks are selected, CUI portions get (CUI) and unclassified portions must get (U).⁶ In a classified DoD document, the CUI portions must be marked.⁶ The training aid adds one rule: never portion mark the designation indicator.⁷

What DoD practice changes

• The banner is a generic “CUI” at the top and bottom of each page.⁶ The training aid rules out UNCLASSIFIED in front of it and any category after it, so no SP- prefix appears.⁷
• Basic and Specified CUI need no distinction during DoD’s phased implementation of the program.⁶
• The codes move into the block: the category on line three, and the control or distribution statement on line four.⁶⁷
• Technical information keeps a distribution statement. The instruction uses limited dissemination controls for new CUI, but export-controlled technical information and other scientific, technical and engineering information still take distribution statements.⁶ Export-controlled information also needs an export control warning.⁶
• Table 2 of the instruction lines FEDCON up with Distribution Statement C.⁶ The training aid spells a distribution statement out on page one and puts its letter in the block.⁷
• Public release of a CUI report, including posting on a public website, needs a prepublication and security policy review first.⁶
• The contract states the protective measures and dissemination controls for CUI that a contractor generates.⁶

The example, line by line

This is INC-0142 from the Foxborne example dataset, a telemetry gap on a Q4 quad. It is an example, not a field report. The example’s administrator set one marking, and every report carries it.

1. Banner: CUI at the top and bottom and nothing else, which matches DoD practice as written.⁶⁷
2. Placement: the block sits under the top banner. The instruction asks only for the first page or cover, while the training aid draws the block at the bottom of page one.⁶⁷
3. Line one, Harrow Field Robotics: the company itself. The instruction wants the DoD Component here, and DCSA’s job aid fills the line with the Government Contracting Activity.⁶⁸
4. Line two, Reliability Engineering: the office that created the report, which is what DoD’s marking aids ask for.⁷⁸
5. Line three, EXPT: the registry marking for Export Controlled.³
6. Line four, FEDCON: a valid registry control, printed under the label Dissemination.⁵ For export-controlled technical information, a DoD program puts a distribution statement letter on this line instead.⁶⁷
7. Line five, an office mailbox: allowed as written.⁶⁷
8. Portion marks: none, which an unclassified report allows.¹⁶

Lines two, three and five stand as written. Lines one and four come from the contract, so read them off it before the first report goes out.

Sending the report

An email that carries a CUI report as an attachment serves as a transmittal document.⁷ It needs a CUI marking on its face and an instruction such as “When enclosure is removed, this document is Uncontrolled Unclassified Information.”¹

DoD’s training aid does not require the designation indicator on such an email, but keeps “CUI” as its first and last lines.⁷ It also tells DoD users to encrypt any email that contains CUI whenever that is technically feasible.⁷

What the marking tells a reviewer

A marking is a statement about handling, made by whoever designated the report. The banner does not make information CUI: the law, regulation or government-wide policy behind the category does.¹ Marking information that does not qualify counts as misuse.¹