Can a Contractor Mark the Documents It Creates as CUI?

CMMC questions from the field · Can a contractor mark the documents it creates as CUI? · Updated September 2026

You do not designate CUI, but you often have to mark it. Designation is a government act: “The designating agency determines that the information qualifies for CUI status and applies the appropriate CUI marking when it designates that information as CUI” (32 CFR 2002.20(a)(4)). Marking derivative material is a contractor duty when the contract says so: “Does Industry ever have to mark CUI? Yes, but only when instructed to do so in the contract or supporting documentation, and have a lawful government purpose to do so” (NARA CUI FAQ). So when you produce a drawing, test report, SSP extract or deliverable that contains, restates or is derived from CUI the government identified, you apply the CUI banner, the category and the designation indicator that ties it back to the DoD component. What you cannot do is invent a category, mark your own proprietary information as CUI, add dissemination controls, or decontrol.

Designating versus marking

The CUI rule separates two acts that contractors often merge.

• Designating “occurs when an authorized holder, consistent with this part and the CUI Registry, determines that a specific item of information falls into a CUI category or subcategory” (32 CFR 2002.4(l)), and the designating agency “is the executive branch agency that designates or approves the designation” (2002.4(m)). Inside DoD, the designation indicator “must contain, at minimum, the name of the DoD Component determining that the information is CUI” (DoDI 5200.48 para 3.4.f(1)).
• Marking is the mechanical application of the banner, portion marks and designation indicator to a document. Under DoDI 5200.48 para 3.6.a, “The authorized holder of a document or material is responsible for determining, at the time of creation, whether information in a document or material falls into a CUI category. If so, the authorized holder is responsible for applying CUI markings and dissemination instructions accordingly.” A contractor working under a DoD contract that incorporates the CUI requirements is an authorized holder for the information the contract covers.

The practical test: does the document contain information the government has already identified as CUI, either by marking or through the contract? If yes, you mark it. If the information is new and yours, it is not CUI unless the contract says that category of information, when created for the government, is CUI. Controlled Technical Information is the usual example: a drawing you create under the contract with “military or space application that is subject to controls” is CUI under DFARS 252.204-7012 whether or not anyone has stamped it yet.

What a contractor-applied marking looks like

32 CFR 2002.20(d)(1) requires that “All documents containing CUI must carry an indicator of who designated the CUI within it. This must include the designator’s agency (at a minimum).” ISOO’s marking guidance for contractors adds that “The designation indicator can be the company name and also the agency associated with the contract.” A defensible block for a contractor-created technical document looks like this:

Get the category and the distribution statement from the contract or the contracting officer. If your contract is silent on both, that is the first question to ask, and the answer becomes part of your CUI inventory.

Four things a contractor cannot do

1. Create a category or an alternative marking. “Authorized holders who designate CUI may not use alternative markings to identify or mark items as CUI” (32 CFR 2002.20(b)(1)(iii)). “Agencies may use only those categories or subcategories approved by the CUI EA and published in the CUI Registry” (2002.12(b)). “Company Confidential” or “Proprietary” is not a CUI marking and should never share a banner line with one.
2. Mark your own business information as CUI. CUI excludes “information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency” (32 CFR 2002.4(h)). Your pricing, HR files and internal IT designs are yours to protect, but not as CUI. Marking them CUI is misuse under 2002.4(o) and it drags them into your CMMC scope.
3. Add a limited dissemination control. “Only the designating agency may apply limited dissemination controls to CUI. Other entities that receive CUI and seek to apply additional controls must request permission to do so from the designating agency” (32 CFR 2002.16(b)(4)(iii)). NOFORN, FED ONLY and the distribution statements are the government’s to assign. You reproduce them; you do not choose them.
4. Decontrol. Decontrol is performed by “the originator of the information, the original classification authority (OCA) if identified in a security classification guide, or designated offices for decontrolling CUI” (DoDI 5200.48 para 3.3.a(2)). A contractor who removes CUI markings because “the project is over” has not decontrolled anything.

Why marking correctly matters for CMMC and for liability

MP.L2-3.8.4 requires marking media “with necessary CUI markings and distribution limitations.” An assessor will sample your deliverables and your file shares and expect consistent banners on contractor-created CUI. Beyond the assessment, DoDI 5200.48 para 1.2.c lists what information must never be designated CUI: to “conceal violations of law,” to “prevent embarrassment,” to “prevent open competition,” or to control information “not requiring protection under a law, regulation, or government-wide policy.” Over-marking your own material to look careful is not a neutral act.

The reverse failure is the expensive one. If you create CTI and ship it unmarked to a machine shop or a cloud service, you have transmitted CUI outside your assessed boundary. That is a DFARS 7012 issue, a CMMC scoping issue and, if you affirmed compliance in SPRS, a False Claims Act exposure. The marking is how the next person knows to protect it.

A simple procedure that works

1. Maintain a CUI inventory listing, per contract, the categories the government identified and the distribution statement to apply.
2. Train authors on the “at the time of creation” test in DoDI 5200.48 para 3.6.a.
3. Use document templates with the banner and designation block pre-filled per contract.
4. Route anything unclear to a named CUI point of contact who queries the contracting officer, and log the answer.
5. Review a sample of outgoing deliverables monthly for missing or improvised markings.

Sources and clauses

• 32 CFR 2002.4: (h) definition of CUI, (l) designating CUI, (m) designating agency, (o) misuse of CUI
• 32 CFR 2002.12(b): only Registry categories may be used
• 32 CFR 2002.16(b)(4)(iii): only the designating agency applies limited dissemination controls
• 32 CFR 2002.20: (a)(4) designating agency marks, (b)(1)(iii) no alternative markings, (d)(1) designation indicator on all CUI documents, (f) portion marking
• DoDI 5200.48, 6 March 2020: para 1.2.c (prohibited reasons to designate), 3.3.a(2) (decontrol authority), 3.4.b (portion marking), 3.4.f (designation indicator), 3.6.a (authorized holder marks at creation), 5.1 (shared responsibility with industry), 5.3.b (controls articulated in the contract)
• DFARS 252.204-7012(a): definitions of covered defense information and controlled technical information, distribution statements B through F
• DoD CUI Registry, Controlled Technical Information: category description and required dissemination control
• NARA CUI FAQ: “Does Industry ever have to mark CUI?”, “Do Industry personnel have the authority to generate original CUI?”, “Do contractors have to mark CUI if their contract requires it?”
• ISOO CUI marking class Q&A, 20 May 2020: designation indicator can be the company name and the agency associated with the contract
• NIST SP 800-171 Rev 2: 3.8.4 media marking

This page is general information, not legal advice. ITSECOPS is not affiliated with the Department of Defense. Contract-specific questions belong with your contracting officer.

FAQ

Can a contractor create CUI?

Yes, when the contract provides for it. NARA’s FAQ says industry “may have the authority to generate CUI on behalf of the USG” depending on the terms of the contract. Technical data you develop under a DoD contract with military application is the common case.

Whose name goes in the “Controlled by” line on a document my company wrote?

The designating DoD component at a minimum, because 32 CFR 2002.20(d)(1) requires the designator’s agency. ISOO guidance allows the company name to appear alongside the agency associated with the contract.

Can I mark my proposal or pricing as CUI so competitors cannot see it?

No. Your own business information is excluded from the CUI definition, and marking non-qualifying information as CUI is misuse under 32 CFR 2002.4(o). Protect it as proprietary information under FAR 52.215-1 and your NDAs instead.

Can I add NOFORN to a drawing because we have foreign staff?

No. Only the designating agency may apply limited dissemination controls. Ask the contracting officer; export control (ITAR/EAR) is a separate regime and may already restrict foreign-national access regardless of the CUI marking.