Contractors handling federal contract information rarely fail compliance audits because they misunderstand what Controlled Unclassified Information (CUI) is. Failures happen at the operational layer: incorrect banner markings, missing dissemination controls, and confusion over who actually owns the marking decision on a given document. The National Archives and Records Administration, through its Information Security Oversight Office, built a detailed regulatory structure around these mechanics because inconsistent marking creates real security gaps, not just paperwork problems.
This article addresses the procedural questions that come after a contractor already understands the basic definition of CUI: who applies markings, what the CUI Basic and CUI Specified distinction means in practice, and how the CUI Registry functions as the authoritative reference point. The short answer to the central question is that the authorized holder of the information at the time of its creation carries responsibility for applying CUI markings and dissemination instructions. That single principle drives most of the marking mechanics described below.
Who Applies CUI Markings and Dissemination Instructions?
The authorized holder is responsible for applying CUI markings and dissemination instructions. An authorized holder is not a specific job title but a role defined by relationship to the government contract. The authorized holder includes Department of Defense civilian and military personnel, Department of Defense components and agencies, and contractors providing support pursuant to contractual requirements.
Determining who created or first possessed a piece of information matters because that determination governs marking timing. Federal guidance frames the responsibility around the point of creation rather than the point of review. Under 32 CFR § 2002.20, the designating agency determines that the information qualifies for CUI status and applies the appropriate CUI marking when it designates that information as CUI. A contractor receiving already-marked government material inherits an obligation to maintain those markings, not to reinvent them.
That distinction matters for subcontractors and downstream partners. Markings do not travel automatically once information leaves the originating hands. Authorized holders who designate CUI may not use alternative markings to identify or mark items as CUI, which forecloses the temptation to substitute a company's own labeling scheme for the government-approved marking language.
What CUI Basic Means for Marking and Handling
CUI Basic represents the default handling tier for most contractor-held CUI. It is the subset of CUI for which the authorizing law, regulation, or government-wide policy does not set out specific handling or dissemination controls. Agencies handle CUI Basic according to the uniform set of controls set forth in the CUI regulation and the CUI Registry. CUI Basic controls apply whenever CUI Specified controls do not cover the information involved.
CUI Specified sits above that baseline. It is the subset of CUI in which the authorizing law, regulation, or government-wide policy contains specific handling controls that differ from those for CUI Basic. The CUI Registry indicates which laws include such specific requirements. The distinction is that the underlying authority spells out the controls for CUI Specified information and does not for CUI Basic information. Export-controlled technical data is a common example, since it carries statutory handling rules that layer on top of the general CUI baseline.
This distinction shapes marking format directly. A document containing only CUI Basic may use a simple banner. Agency guidance from the General Services Administration confirms that a document containing only CUI Basic may use a banner consisting of just the letters CUI. A document containing CUI Specified requires the full marking to indicate the type of CUI and any dissemination instructions. Contractors who default to the minimal "CUI" banner on every document risk under-marking anything that falls into a Specified category.
Information May Be CUI in Accordance With Which Authorities?
Information qualifies as CUI only when a specific authority says so. Information may be CUI in accordance with a law, regulation, or government-wide policy. That phrase is not filler language; it reflects a legal requirement. Nothing becomes CUI simply because a business or program manager decides it feels sensitive.
CUI is defined in Executive Order 13556 and 32 CFR § 2002.4(h) as information the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, that a law, regulation, or government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. Every category has to trace back to one of those three sources. This is why a document's designation indicator matters: it identifies the legal basis for the control, not just the fact that control exists.
What Is the Purpose of the ISOO CUI Registry?
The CUI Registry functions as the single reference source for every approved CUI category, marking, and handling rule across the federal government. The Information Security Oversight Office CUI Registry is the authoritative online repository that identifies all approved CUI categories and subcategories, the laws and regulations that authorize each category, and the handling requirements that apply to each.
The Registry exists because agency-specific labeling created years of inconsistency before the current program took hold. The goal was straightforward: replace the patchwork of agency-specific labels and handling procedures with a single, government-wide framework. The regulatory foundation for that framework sits in 32 CFR Part 2002, which the National Archives and Records Administration, through its Information Security Oversight Office, issued to establish policy for agencies on designating, safeguarding, disseminating, marking, decontrolling, and disposing of CUI, along with self-inspection and oversight requirements.
Contractors sit squarely inside that rule's scope. The rule affects federal executive branch agencies that handle CUI and all organizations that handle, possess, use, share, or receive CUI, or that operate, use, or have access to federal information and information systems on behalf of an agency. Consulting the Registry directly, rather than relying on a subcontractor's interpretation of a marking, remains the most reliable way to confirm current requirements. The CUI Registry publishes category definitions, approved markings, and limited dissemination control language that agencies and contractors alike must use without modification.
Building a Marking and Dissemination Process That Holds Up
Marking discipline connects directly to the control frameworks contractors already track for Cybersecurity Maturity Model Certification and National Institute of Standards and Technology SP 800-171 compliance. Media protection control 3.8.4 requires that organizations mark system media containing CUI with the necessary markings and distribution limitations, covering both digital and non-digital formats. That single control connects the marking discipline described above to the broader system security plan an assessor will review.
A workable process for a small or midsize contractor generally includes:
- Confirming, at intake, whether received material already carries government markings and preserving them unchanged
- Checking the CUI Registry when creating new CUI to identify the correct category and any limited dissemination controls
- Applying banner markings consistently across headers, footers, email subject lines, and file names
- Training staff to recognize the difference between CUI Basic and CUI Specified before a document leaves the building
- Logging where marked CUI travels, particularly when it moves to subcontractors or cloud storage
None of these steps requires elaborate technology. Most failures trace back to inconsistent habits rather than missing tools: a document marked correctly in one department and left blank in another, or a subcontractor agreement that never specifies who holds marking responsibility once information changes hands.
Getting Marking and Handling Right the First Time
CUI marking and dissemination rules exist to close a specific gap: unclassified information that still requires protection but historically lacked a consistent labeling system across agencies and contractors. Getting the mechanics right protects contract eligibility and reduces the risk of unauthorized disclosure that can trigger contractual or legal consequences. Contractors who build marking discipline into daily document handling, rather than treating it as a one-time training exercise, tend to move through Cybersecurity Maturity Model Certification assessments with far fewer findings.
Planet 9 is a Bay Area cybersecurity consulting firm specializing in Cybersecurity Maturity Model Certification (CMMC) readiness for small and midsize businesses in defense contracting and government suppliers. Our virtual Chief Information Security Officers and compliance managers help organizations choose the right approach, configure governance, risk, and compliance tools if needed, and get audit-ready without wasted time.
