TL;DR: A CUI cover sheet is a physical or electronic sheet placed over Controlled Unclassified Information to flag it before anyone opens the document — similar in purpose to a classified-document cover sheet, but for the “unclassified but still restricted” tier. It is not the same thing as the CUI banner marking (the “CUI” or “CUI//Category” line printed on the document itself) or the CUI designation indicator (the block that names who controls the information and why). This guide covers all three, with the actual format rules from 32 CFR Part 2002 and the National Archives and Records Administration (NARA) CUI Registry, plus where DD Form 2923 fits for DoD-sponsored research.
This page assumes you already know what CUI is and who owns compliance for it at your institution. If not, start with the CUI dictionary definition and Who Is Responsible for CUI Compliance at a University?. For the difference between the two CUI protection tiers referenced throughout this guide, see CUI Basic vs. CUI Specified: Marking and Safeguarding — this page does not re-argue that distinction; it is the marking and cover-sheet mechanics that sit downstream of it.
Three different things, one keyword
“CUI cover sheet” gets used loosely to mean at least three distinct artifacts. Getting them straight is the actual point of this guide:
| Term | What it is | Where it appears |
|---|---|---|
| Banner marking | The “CUI” or “CUI//<Category>” text line required at the top (and, per agency policy, bottom) of the first page of a CUI document | Printed or displayed directly on the document itself |
| Designation indicator | The block identifying who designated the information as CUI, under what category/authority, and any distribution limits — sometimes folded into the banner, sometimes a separate block on the first page | First page of the document, near the banner marking |
| Cover sheet | A separate physical or electronic sheet placed on top of a CUI document to flag it before it’s opened — used mainly for print/physical handling, faxing, or hand-carrying between offices | Sits on top of, not part of, the underlying document |
All three exist to satisfy the same requirement: 32 CFR Part 2002.20, the implementing regulation for Executive Order 13556 (2010), which requires agencies (and, through contract and grant terms, their non-federal partners) to mark CUI so that anyone handling it recognizes the safeguarding obligation. NARA’s Information Security Oversight Office (ISOO) administers the CUI Program and maintains the CUI Registry, the authoritative list of CUI categories and their associated markings.
Quick reference: the CUI banner marking format
The banner marking is a text string built from up to four parts, separated by double forward slashes. Not every document uses every part — CUI Basic information often carries only the first.
| Part | Format | Required when | Example |
|---|---|---|---|
| 1. Base marking | CUI |
Always, on every CUI document | CUI |
| 2. Category marking | CUI//<CATEGORY CODE> |
CUI Specified only — the category has its own handling controls beyond CUI Basic’s baseline (e.g., Privacy, Export Control, Controlled Technical Information) | CUI//SP-CTI |
| 3. Limited Dissemination Control (LDC) | CUI//<CATEGORY>//<LDC> |
When the designating agency restricts further dissemination (e.g., no foreign nationals, federal employees only) | CUI//SP-CTI//NOFORN |
| 4. Multiple categories | Categories separated by a single slash inside the double-slash structure | Document contains more than one CUI category | CUI//SP-PRVCY/SP-CTI |
Category codes and LDC abbreviations are not invented per-institution — they come directly from NARA’s CUI Registry, which is the single controlled vocabulary every agency and downstream contractor/grantee is required to use. If your institution is inventing its own category codes rather than pulling them from the Registry, that is a marking error, not a stylistic choice.
Worked examples
Illustrative examples only, built to match the Registry’s published format — always confirm the exact category code and any LDC against the sponsoring agency’s guidance and the current CUI Registry before applying it to a real document.
- CUI Basic, no category or LDC (the most common case for routine CUI, e.g. certain unclassified but sensitive budget or personnel data with no agency-specified handling controls beyond the baseline): banner reads simply
CUI. - CUI Specified, single category (e.g., export-controlled technical data on a DoD-funded engineering project, which carries handling controls beyond CUI Basic): banner reads
CUI//SP-CTI(Controlled Technical Information). - CUI Specified with a dissemination limit (e.g., proprietary information submitted to a federal agency that the agency restricts from further release): banner reads
CUI//SP-PROPIN//NOFORN. - Portion marking — inside the body of a mixed-content document, individual paragraphs or sections may carry a short parenthetical prefix, e.g.
(CUI)before a CUI paragraph and(U)before an uncontrolled one, so a reader can tell at a glance which portions carry the obligation without re-reading the whole document. Portion marking is required by some agencies and optional (agency discretion) for others — check the specific contract, grant terms, or agency CUI policy that applies to your award.
What belongs on the designation indicator
Separate from (but usually adjacent to) the banner marking, the first page of a CUI document should identify who is accountable for the designation. NARA’s guidance calls for this information to be present, typically in a block near the banner:
| Element | What it captures |
|---|---|
| Controlled by | The organization (federal agency, or the university/lab designated as the CUI-generating authority under the award) responsible for the CUI designation |
| Category | The specific CUI category or categories from the Registry that apply |
| Distribution/Limited Dissemination Control | Any LDC restricting further sharing |
| POC | A point of contact who can answer questions about the designation — typically the PI, sponsored-programs office, or empowered official, depending on institutional structure |
Exact placement and required fields vary slightly by issuing agency (DoD components, DOE, NASA, HHS and others each publish their own CUI implementing guidance layered on top of 32 CFR Part 2002), so treat this table as the baseline and confirm against the specific award’s CUI guidance or the sponsoring agency’s CUI program office before finalizing a template.
When you actually need a physical cover sheet
A cover sheet is a safeguarding control, not a marking requirement — its job is to prevent an unauthorized person from seeing CUI content at a glance when the document isn’t actively being worked on. It matters most in scenarios where the underlying banner marking on the document itself isn’t visible to someone who might handle it in passing:
- Printed documents left on a desk, in an outbox, or at a shared printer — a cover sheet keeps the content from being visible to anyone walking past.
- Faxing or physically transmitting CUI — a cover sheet on the transmitted set flags the contents before the recipient (or anyone else who might see the fax tray) opens it.
- Hand-carrying documents between offices or buildings — especially where the document will pass through common areas.
You generally do not need a separate cover sheet for:
- Electronic files stored in an access-controlled system where the banner marking is embedded in the document itself and access is already restricted to authorized users.
- Documents that stay within a controlled, access-limited workspace the entire time (though many institutions still require one as a matter of consistent practice).
The determining question is always the same: could someone without a need to know see the content before it’s clear the document is protected? If yes, a cover sheet (or an equivalent physical control, such as a locked container) is the fix.
DD Form 2923 and other cover sheet options
There is no single, government-wide standard form that every federal agency and every downstream university mandates for CUI cover sheets. In practice:
- DD Form 2923, “Controlled Unclassified Information (CUI) Cover Sheet,” is the Department of Defense’s own form for this purpose, used across DoD components and by many DoD contractors and grantees who handle CUI on DoD-sponsored work. If your institution holds a DoD contract, cooperative agreement, or Other Transaction that generates or receives CUI, check whether the sponsoring component’s CUI guidance specifies DD 2923 or an equivalent — this is the most commonly referenced federal cover-sheet form in research-security compliance guidance.
- Other agencies (DOE, NASA, HHS, and others) generally do not mandate a single numbered form; many either point institutions to DD 2923 as a reasonable model or allow an institution to design its own cover sheet, provided it clearly identifies the document as CUI and carries the same core elements as the designation indicator above (controlled-by, category, dissemination limits, POC).
- Institution-designed cover sheets are common and acceptable where no specific form is mandated by the award. A compliant cover sheet should, at minimum, display the word “CUI” prominently, the applicable category if known, and instructions for safeguarding and destruction consistent with 32 CFR Part 2002.
Because the specific requirement depends on the sponsoring agency and the individual award’s terms, the reliable move for a research administrator is to check the award’s CUI-handling clause or contact the sponsoring agency’s CUI program office before assuming a single template covers every project on campus.
Common marking mistakes at research institutions
| Mistake | Why it’s a problem |
|---|---|
| Treating “CUI” as a security classification and applying classified-marking conventions (e.g., classification banners, “SECRET”-style stamps) | CUI is explicitly not classified information; using classified-style markings both misrepresents the sensitivity level and can conflict with the actual CUI Program rules |
| Inventing local category codes instead of pulling them from the NARA CUI Registry | Category codes are a controlled vocabulary; a non-Registry code is meaningless to anyone outside the institution and breaks interoperability with the sponsoring agency’s own systems |
| Assuming CUI marking rules are the same across every sponsor | DoD, DOE, NASA, and HHS each layer their own implementing guidance on top of 32 CFR Part 2002; a marking convention correct for one award can be incomplete for another |
| Marking a document CUI only because it touches export-controlled or dual-use research, without checking whether the fundamental research exclusion actually applies | Fundamental research status (an export-control test under 15 CFR 734.8) and a contract’s CUI-safeguarding obligation are independent questions — a project can be fundamental research and still carry a CUI marking/handling clause from contract language. See Who Is Responsible for CUI Compliance at a University? for the full explanation of this specific, commonly-conflated distinction. |
| Skipping the cover sheet because the document is “only going next door” | The safeguarding requirement is about exposure risk, not distance traveled — any point where an unauthorized person could glimpse the content calls for a cover sheet or equivalent control |
Frequently asked questions
What is a CUI cover sheet?
A CUI cover sheet is a physical or electronic sheet placed on top of a Controlled Unclassified Information document to prevent unauthorized viewing when the document isn’t actively in use — for example, on a desk, at a shared printer, in a fax tray, or while being hand-carried. It is a safeguarding control required under 32 CFR Part 2002, separate from the banner marking printed on the document itself.
What is a CUI banner marking?
The banner marking is the text line — at minimum the word “CUI,” and for CUI Specified information, “CUI//” followed by the applicable category code(s) and any Limited Dissemination Control — placed at the top of the first page of a CUI document. Category codes and LDC abbreviations come from the NARA CUI Registry.
What is a CUI designation indicator?
The designation indicator is the block, usually on the first page near the banner, that identifies who designated the document as CUI, under what category, any dissemination limits, and a point of contact. It answers “who is accountable for this marking,” which the banner marking alone does not.
Is there a standard CUI cover sheet form?
Not government-wide. DD Form 2923 is the Department of Defense’s cover sheet and is the most commonly referenced federal template, used widely by DoD contractors and grantees. Other agencies typically either point to DD 2923 as a model or allow an institution to use its own compliant cover sheet. Always confirm against the specific award’s CUI-handling requirements.
Do I need a cover sheet for CUI stored electronically?
Generally no, provided the file is stored in an access-controlled system limited to authorized users and the banner marking is embedded in the document. Cover sheets exist mainly to protect physical or in-transit documents from being seen by someone without a need to know.
Is a CUI cover sheet the same as a classified-document cover sheet?
No. Classified cover sheets (e.g., for SECRET or TOP SECRET material) exist under a different legal framework entirely and use different colors/markings tied to classification level. CUI is, by definition, not classified information, and CUI markings must not borrow classified-marking conventions.
Related CASRAI resources
- Controlled Unclassified Information (CUI) — dictionary definition
- CUI Basic vs. CUI Specified: Marking and Safeguarding
- Who Is Responsible for CUI Compliance at a University?
- NIST SP 800-171 and CUI in University Research
- ITAR/EAR Compliance for University Research
- Fundamental research exemption
- NSPM-33
- Deemed export
Last verified 16 August 2026 against 32 CFR Part 2002 and the NARA CUI Registry (archives.gov/cui). Agency-specific implementing guidance (DoD, DOE, NASA, HHS and others) and the exact cover-sheet form your award requires should be confirmed directly with the sponsoring agency’s CUI program office, since these details are layered on top of the government-wide baseline and vary by sponsor.
