Hi, thank you for joining me today.
I am here today to give you a brief introduction to how to mark controlled unclassified information
in documents.
In this video we will review briefly the importance of marking, the various components of marking
documents (both mandatory and suggested practices), as well as some of the trickier parts of the
process, like how to mark multiple pages or how to mark legacy information.
To begin, let’s review why it is so important to follow to the policies which I am about
to outline in this presentation.
Although government agencies have been marking documents and protecting information for decades,
not everyone was using the same acronyms or labels to codify information.
Consider this analogy: one department may have been speaking German while another was
fluent in French.
The purpose of CUI program is to be the Rosetta Stone- to set forth a common language so that
we all may communicate about CUI.
The first step to marking CUI is to include the designation indicator.
Consider this is a sort of return address.
At a minimum, it should include the agency from which the CUI document originated.
A best practice, however, would be to also include the name and contact information of
the point person from the agency from which the document originated.
This step is essential, as it is important for the receiving agency to know who to contact
if they have questions regarding the CUI contained in the document.
The inclusion of a designation indicator ensures open communication between agencies regarding
CUI and the proper handling of Controlled Unclassified Information.
Another mandatory step in the CUI process is creation of a banner marking.
The banner marking is found at the top of the document, and indicates that the document
being received contains Controlled Unclassified Information.
It is mandatory to include this marking because it alerts the recipient that they are in possession
of CUI and therefore must take care to handle it differently than they would any other kind
of information.
Footer markings are optional but must be used identically to the banner marking if used.
To further expand on the uses of a Controlled Unclassified Information banner marking, let’s
discuss category and subcategory markings.
To better clarify for the recipient what category or subcategory of CUI is contained in the
document, you can include the category and subcategory in the CUI banner marking at the
top.
Though this is not mandatory practice, it is a highly suggested one.
To include a category, you must place a double forward slash following the acronym CUI or
word controlled.
Remember, the control marking can be the word Controlled or CUI.
If you are including a subcategory, there is no need to include the main category.
To review, you must have a control marking.
If multiple categories or subcategories are being included in the banner marking they
must be separated using a single forward slash and listed alphabetically.
Markings for all categories and subcategories can be found on the CUI Registry.
Once an agency is trained they will be alerted to what acronyms, categories and subcategories
they tend to use the most in their own document marking.
In the example on the slide, the particular CUI being identified is critical infrastructure
represented by the acronym CRIT, and water assessments which is a subcategory represented
as WATER.
Before we continue, it is prudent to draw an important distinction between CUI basic
and CUI specified.
CUI Basic refers to any category or subcategory of CUI that by law, regulations, or Government
wide policies is identified to be protected but there is no specific information on how
to protect that information.
CUI Specified refers to any category or subcategory of CUI where the underlying law, regulation,
or Government-wide policy not only identified what to protect, but also specified some other
handling required with that CUI.
This can mean that it has dissemination controls, that only certain parties may receive that
CUI.
For instance, in some cases CUI may not be breached by any foreign nationals.
Since CUI specified has slightly different controls than CUI Basic, it must be denoted
in a CUI banner marking.
Therefore, all categories or subcategories that are specified must be listed in the banner
marking with an SP- preceding its acronym.
The categories and subcategories are separated in the banner marking from the Control Marking
with a double forward slash One can find out if CUI is specified using
the CUI Registry.
Additionally, once an agency undergoes training they will often be taught what specific categories
they are most likely to use when marking a document.
If CUI is listed in the Registry as specified, it is mandatory to denote it as such in the
banner marking.
Consider the example on screen.
The CUI being included in the document is Privacy Information.
Since this is specified according to the CUI registry it is listed as being specified in
the banner marking with a sp- preceding its acronym of PRVCY.
To clarify, marking subcategories and categories is not required for CUI basic, but it is still
highly suggested.
Limited dissemination controls, like categories and subcategories, can be added to the CUI
banner marking., They are also not mandatory but a highly, highly suggested practice as
they can be used to convey any limited dissemination controls needed when handling that CUI.
If you choose to include limited dissemination control markings in the banner they must appear
as the last two elements of the banner marking and they are separated from any other elements
by two forward slashes.
If a banner contains multiple limited dissemination control markings, they can be separated from
one another using a single forward slash.
Consider the example on screen.
The specified category here is SP-XXX, and the limited dissemination control is No foreign
dissemination, represented by NOFORN.
See the CUI registry for a list of all approved limited dissemination control markings that
may be used in a CUI document.
Another practice that is highly suggested for the point of clarity is portion marking.
Though it is not mandatory, portion marking is extremely helpful because it clarifies
for the recipient which portions of the document contain Controlled Unclassified Information
and should therefore be handled with care.
Portion markings are placed in parentheses before the paragraph in which information
is contained.
As you can see on screen, U’s are placed in parentheses before any paragraph containing
Uncontrolled Unclassified information.
CUI is placed in parentheses before any paragraph that contains controlled unclassified information.
If portion markings are used in one part of the document, they must be used throughout.
That is to say they must used for every paragraph within the document.
The practice of portion marking can be applied to category or subcategory markings and to
limited dissemination control markings as well.
Again, this is not mandatory but a highly suggested practice as it alerts the recipients
how they should handle with care every different part of the document.
Should you decide to portion mark and include limited dissemination control markings, be
sure to separate them from any other elements with two forward slashes.
Another situation that can be a bit tricky when it comes to marking CUI is when you have
to mark multiple pages that contain different types of CUI.
The way to address this issue is to craft a CUI banner marking on that first page which
contains the CUI contained throughout the entire document.
That is to say, even if a form of CUI is not necessarily on the primary page of the document
it is is still reflected in the banner marking on the top of that first page.
In the example below, notice that certain CUI cannot be found on the first page- like
SP-XXX.
However, SP-XXX is still included in the banner marking.
This banner marking will be reflected on the first page and on every page of the document.
Frequently, agencies will collaborate on documents and forms and will therefore send them to
each other before they are finalized.
However, even in an unfinished state if a document contains Controlled Unclassified
Information, that CUI must be handled with standard protections.
Therefore, if you need to mark a document containing CUI as a draft, you should still
follow the normal procedure of marking CUI within the banner.
However, you may also include the label of DRAFT somewhere on the document so long that
it does not commingle with the CUI banner marking.
That is to say, you may use other administrative markings, like a watermark, to indicate the
draft status of your document.
For the sake of clarity any administrative markings should be clearly distinguished from
the CUI banner.
Consider the example on screen- the example that is crossed out is one in which “draft”
is contained as part of the banner marking.
This is confusing as the draft status of this document is unrelated to the treatment of CUI.
Since the two are unrelated, “draft” should be separated from the banner marking as in
the example to the right.
Thank you again for joining us today.
If you have any further questions regarding how to mark CUI please visit the CUI registry
for further educational materials or reach out to the office of Controlled Unclassified
Information.