We Received a Document That Looks Like CUI but Is Not Marked. What Do We Do?

CMMC questions from the field · Unmarked CUI received from DoD, a prime or a contracting officer · Updated September 2026

Treat it as CUI and ask. The CUI rule is explicit that “the lack of a CUI marking on information that qualifies as CUI does not exempt the authorized holder from abiding by applicable handling requirements” (32 CFR 2002.20(a)(7)), and it tells holders to “treat unmarked information that qualifies as CUI” according to the CUI Registry (32 CFR 2002.20(m)). Contractors do not decide the question themselves: “Questions regarding the status of information (marked or unmarked) should be directed back to the government contracting activity” (NARA CUI FAQ). So the answer is a four-step routine: protect it inside your CUI environment, stop onward distribution, ask the contracting officer or originator in writing, and act on the written answer.

Why unmarked documents arrive at all

DoD Instruction 5200.48 places the marking duty on the government side: “Whenever DoD provides information to contractors, it must identify whether any of the information is CUI via the contracting vehicle, in whole or part, and mark such documents, material, or media in accordance with this issuance” (para 5.3.a). The program office “must identify DoD CUI at the time of contract award” (para 5.1.e). In practice that duty is applied unevenly. Legacy documents still carry FOUO, which “became invalid once the DoDI 5200.48 was signed” (DoD CUI Program FAQ). Emails from program staff forward attachments without banners. Primes strip cover pages when they cut a subcontract package. None of that changes what the information is.

DFARS 252.204-7012 anticipates the gap. Covered defense information is information that is “marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DoD,” or that is “collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.” Identification through the contract counts. A banner is evidence of CUI status, not the definition of it.

The four-step routine

1. Contain it

Move the file into the environment you already use for CUI (your enclave, GCC High tenant or FedRAMP Moderate service). Do not forward it to personal mailboxes, general file shares, or vendors. If it arrived in an ordinary mailbox, note where it landed so you can clean up if the answer is “yes, that is CUI.” NIST SP 800-171 requirement 3.1.3, controlling the flow of CUI, applies from the moment you suspect the content qualifies.

2. Check the contract first

Read the statement of work, the CDRLs and any security guidance attached to the award. If the contract identifies the category of information (technical data, drawings, test results, export-controlled material), the document is “otherwise identified in the contract” and the DFARS 7012 obligations apply whether or not the banner exists. DoDI 5200.48 para 5.3.b requires that “protective measures and dissemination controls … will be articulated in the contract, grant, or other legal agreement.”

3. Ask in writing

Send a short query to the contracting officer, or the contracting officer’s representative, copying the originator where known: what you received, when, from whom, why you believe it may qualify (for example, it appears to be technical data with military application), and a request for a properly marked copy or a written confirmation that it is not CUI. This mirrors what the regulation requires of agencies: “An agency receiving an incorrectly marked document should notify either the disseminating entity or the designating agency, and request a properly marked document” (32 CFR 2002.20(a)(3)). Every agency is required to maintain “a mechanism by which authorized holders (both inside and outside the agency) can contact a designated agency representative for instructions when they receive unmarked or improperly marked information” (32 CFR 2002.8(c)(12)). The DoD CUI Program’s own guidance for contractors is “contact your Government Contracting Office Representative.”

4. Record the outcome

Keep the query and the answer with your CUI inventory. If the answer confirms CUI, request the marked version and apply the markings to anything you derived from it. If the answer is “not CUI,” file the confirmation and release the file from the enclave. If no answer comes, keep treating it as CUI: the burden of the missing marking does not shift to you, but the handling duty does not disappear either.

What you must not do

• Do not declare it CUI yourself. “The designating agency determines that the information qualifies for CUI status and applies the appropriate CUI marking when it designates that information as CUI” (32 CFR 2002.20(a)(4)). You may protect it as if it were CUI while the question is open; you may not decide the category, apply a limited dissemination control, or decontrol it. Only the designating agency may apply limited dissemination controls (32 CFR 2002.16(b)(4)(iii)).
• Do not treat every legacy marking as CUI. “DoD legacy information does not automatically become CUI. It must be reviewed by the owner of the information to determine if it meets the CUI requirements” (DoDI 5200.48 para 3.2.b). If legacy markings remain, “the legacy markings are void and no longer indicate that the information is protected or that it is or qualifies as CUI” (32 CFR 2002.20(a)(2)). Ask, do not assume.
• Do not over-control. Marking information as CUI when it does not qualify is listed as misuse of CUI (32 CFR 2002.4(o)). Over-classification inflates your CMMC scope, your enclave costs and your vendor flow-downs.
• Do not ignore it because “it isn’t marked.” The clause above, 2002.20(a)(7), closes that door. In an assessment, an assessor who finds unmarked technical data sitting on an out-of-scope file share will not accept the missing banner as a defence.

Template: query to the contracting officer

Subject: Request for CUI determination, Contract [number], document [title/date]

On [date] we received [document] from [source]. It is not marked, but its content [appears to be technical data with military application / matches the category identified in SOW section X]. We are handling it as CUI pending your determination and have not disseminated it further. Please confirm whether the information is CUI and, if so, provide a properly marked copy with the applicable category and dissemination controls. Our point of contact for CUI matters is [name, role].

How this shows up in a CMMC assessment

Two Level 2 practices sit directly on this scenario. MP.L2-3.8.4 requires you to “mark media with necessary CUI markings and distribution limitations,” which presumes you know what is CUI. AC.L2-3.1.3 requires you to control the flow of CUI, which presumes the same. Assessors look for a written procedure covering unmarked and suspected CUI, a log of determinations, and evidence that staff know who to ask. That procedure is also the cheapest piece of evidence you will ever produce.

Sources and clauses

• 32 CFR 2002.20: (a)(2) legacy markings void, (a)(3) request a properly marked document, (a)(4) designating agency marks, (a)(7) lack of marking does not exempt the holder, (m) treat unmarked CUI as CUI
• 32 CFR 2002.8(c)(12): agencies must provide a contact mechanism for unmarked or improperly marked information
• 32 CFR 2002.16(b)(4)(iii): only the designating agency applies limited dissemination controls
• 32 CFR 2002.4(o): marking information as CUI when it does not qualify is misuse
• DoDI 5200.48, 6 March 2020: para 3.2.b (legacy information), 5.1.e (identify CUI at award), 5.3.a (DoD must identify and mark CUI provided to contractors), 5.3.b (controls articulated in the contract)
• DFARS 252.204-7012(a): definition of covered defense information, “marked or otherwise identified in the contract”
• NARA CUI FAQ: questions on unmarked information and contractor responsibility are directed to the government contracting activity
• DoD CUI Program FAQ, FOUO: FOUO is no longer a valid marking; legacy FOUO is not automatically CUI
• ISOO CUI marking class Q&A, 20 May 2020: “Any questions regarding the status of information should be directed to the originator”
• NIST SP 800-171 Rev 2: 3.1.3 and 3.8.4

This page is general information, not legal advice. ITSECOPS is not affiliated with the Department of Defense. Contract-specific questions belong with your contracting officer.

FAQ

Is an unmarked document from DoD still CUI?

If the information qualifies as CUI, yes. 32 CFR 2002.20(a)(7) states that the lack of a marking does not exempt an authorized holder from the handling requirements. Protect it and ask the contracting officer for a determination and a properly marked copy.

Can I mark a document CUI myself if the government forgot to?

Not as a designation. Only the designating agency determines that information qualifies and applies the marking. You can protect it as CUI while you wait for the answer, and you must mark documents you derive from confirmed CUI when your contract requires it.

Are documents marked FOUO now CUI?

Not automatically. FOUO stopped being a valid marking when DoDI 5200.48 was signed, and legacy information must be reviewed by its owner to decide whether it meets CUI criteria. Handle it per the contract under which you received it and ask the originator.

Who do I contact?

The contracting officer or contracting officer’s representative for the award, copying the originator of the document. DoD’s CUI Program directs contractors to their Government Contracting Office Representative for CUI questions.