Ever stared at a blank header and wondered, “Do I really need a banner on this unclassified file?”
Turns out, when Controlled Unclassified Information (CUI) is involved, the answer is a resounding yes. Skipping the banner isn’t just a formatting faux‑pas—it can mean the difference between staying compliant and getting a nasty audit notice The details matter here..
Below I’ll walk through everything you need to know about the correct banner marking for unclassified documents that contain CUI. Think of it as a cheat‑sheet you can paste into your SOPs, train new hires with, and actually use without pulling your hair out.
What Is a CUI Banner Marking?
When the federal government says “CUI,” it’s talking about information that isn’t classified but still needs protection—think contracts, engineering drawings, or even a spreadsheet of supplier prices. The banner is the visual cue that sits at the top (and sometimes bottom) of a document, shouting “handle with care” to anyone who opens it.
In practice, a banner is a block of text formatted in a specific way:
- Label – “UNCLASSIFIED” or “FOR OFFICIAL USE ONLY” (depending on policy).
- CUI Designator – the category or subcategory (e.g., “CUI – PROTECTED TECHNICAL INFORMATION”).
- Authority – the law, regulation, or agency directive that requires the protection.
All of that is wrapped in a rectangle or a line of asterisks so it stands out on the page. The National Archives and Records Administration (NARA) and the Department of Defense (DoD) both publish templates, but the core idea is the same: a clear, consistent banner that tells the reader exactly what they’re looking at Most people skip this — try not to. Turns out it matters..
Why It Matters / Why People Care
Real‑world stakes
Imagine you’re a subcontractor on a defense contract. That's why you send a PDF of a parts list to a partner, but you forget the CUI banner. The partner’s IT scanner flags the file as “unmarked.” Suddenly you’re in a compliance audit, your contract could be suspended, and you might owe the government a hefty fine. All because a few lines of text were missing.
Legal and contractual obligations
Most federal contracts now include the CUI Program clause (DFARS 252.So 204‑7012, FAR 52. Still, 204‑21). That clause explicitly requires “appropriate markings” on all CUI‑containing documents. Miss a banner, and you’re technically breaching the contract That's the whole idea..
Trust and reputation
Clients trust you to protect their sensitive data. A sloppy banner—or none at all—signals a lack of rigor. In industries where “security culture” is a selling point, that perception can win or lose business.
How It Works (or How to Do It)
Below is the step‑by‑step process I use whenever I have to mark a document that contains CUI but isn’t classified. Follow it, and you’ll be on the safe side of NARA and DoD guidance.
1. Identify the CUI Category
First, figure out which CUI category applies. g.NARA publishes a CUI Registry that lists every category (e., Critical Infrastructure, Export Controlled Information, Privacy‑Related Information).
- Tip: Keep a one‑page cheat sheet of the most common categories for your organization. It saves time and reduces the chance of mislabeling.
2. Choose the Correct Header Text
The banner must contain three pieces of information in this order:
- Classification Level – always “UNCLASSIFIED” for CUI.
- CUI Designator – the exact category/subcategory from the registry.
- Authority – the statutory or regulatory citation (e.g., “Controlled Unclassified Information – 32 CFR 2002”).
A typical header looks like this:
UNCLASSIFIED // CUI – PROTECTED TECHNICAL INFORMATION // Controlled Unclassified Information – 32 CFR 2002
If you’re using a DoD template, you might see slashes replaced by double‑asterisks or a line break. The key is order and completeness.
3. Apply the Banner Consistently
Where to place it
- Top of the first page – mandatory.
- Bottom of every page – highly recommended, especially for multi‑page PDFs.
- Header/footer – many agencies require the banner in the document header/footer so it repeats automatically.
Formatting rules
- All caps – makes it unmistakable.
- Bold the entire banner (but not the heading itself).
- Font size – at least 10 pt, but many use 12 pt for readability.
- Spacing – leave a blank line before and after the banner to avoid crowding.
Example in Microsoft Word
- Open the Header view.
- Insert a three‑column table (no borders).
- Populate the cells with “UNCLASSIFIED,” the CUI designator, and the authority.
- Highlight the row, set All Caps, Bold, and 12 pt.
- Close the header.
Now every page automatically inherits the banner—no copy‑pasting required.
4. Mark Individual Pages (if needed)
Some agencies ask for a page‑level marking that repeats the CUI category on each page. If that’s the case, add a small footer line like:
CUI – PROTECTED TECHNICAL INFORMATION – PAGE 3 OF 7
That way, if a page gets detached, it still carries the protection notice.
5. Save in a Secure Format
When you’re done, export the file as a PDF/A (archival PDF). This format locks the banner in place and prevents accidental edits. If you need to share a Word file, use the “Restrict Editing” feature and set a password—just make sure the password policy aligns with your agency’s guidelines Turns out it matters..
Easier said than done, but still worth knowing Easy to understand, harder to ignore..
Common Mistakes / What Most People Get Wrong
“I’m only sending a draft, so I can skip the banner.”
Wrong. Drafts that contain CUI are still CUI. The banner is required regardless of the document’s lifecycle stage.
“Just put ‘CUI’ somewhere in the footer and we’re good.”
Half‑right, half‑wrong. The footer alone isn’t enough; the top‑of‑page banner is the official marking. Some contracts even specify the exact wording, so a vague “CUI” won’t cut it.
“I’ll use the old ‘FOR OFFICIAL USE ONLY’ label because that’s what we’ve always done.”
That label predates the CUI program. While “FOR OFFICIAL USE ONLY” can still appear, it must be accompanied by the CUI designator and authority. Mixing old and new markings creates confusion and can be non‑compliant Not complicated — just consistent..
“I’ll just copy‑paste the banner from an old file.”
If the old file had a different CUI category or authority, you’ll be spreading the wrong label. Always verify the category before reusing a banner.
“I’m using a 9‑point font to save space.”
The regulations say at least 10 pt, and most agencies push for 12 pt for readability. Small fonts are a common audit trigger.
Practical Tips / What Actually Works
- Create a macro. In Word, record a macro that inserts the banner with placeholders for the category and authority. One click, and you’re done.
- Use a style template. Define a “CUI‑Banner” style (all caps, bold, 12 pt, spacing). Apply it to the header/footer and you’ll never forget the formatting.
- Automate with PowerShell. For large batches of PDFs, a short PowerShell script can prepend a banner page to each file. Great for nightly builds.
- Train the “front‑line” staff. The people who generate the documents (engineers, analysts) need a quick reference card. A laminated cheat sheet on the desk works wonders.
- Version control matters. Keep a log of which CUI category was used on each document version. If you need to de‑classify or downgrade, you’ll know exactly what to strip out.
- Audit yourself quarterly. Pull a random sample of CUI documents and verify the banner matches the registry entry. Spot‑checking catches drift before an external audit does.
FAQ
Q: Do I need a banner on a CUI email?
A: Yes. The email subject line should include “CUI” and the category, and the body should start with a banner line similar to the document format. If you attach a file, the file itself still needs its own banner Simple as that..
Q: What if a document contains both CUI and public information?
A: Mark the entire document with the CUI banner. If you can separate the public portion into a different file, do that. Mixing unprotected data with CUI in the same file is risky Practical, not theoretical..
Q: Can I use a different color for the banner?
A: Regulations don’t forbid color, but they do require the banner to be legible and prominent. Black on white is safest; if you use color, make sure contrast meets accessibility standards.
Q: How do I handle CUI in spreadsheets?
A: Add the banner as the first row, merge the cells across the width, and apply the same formatting rules (all caps, bold, 12 pt). Freeze that row so it stays visible when scrolling Most people skip this — try not to..
Q: Is the banner required on printed copies?
A: Absolutely. The same marking rules apply to hard copies. Print the header on the first page and a footer on each subsequent page Simple, but easy to overlook. That alone is useful..
When you get down to the nitty‑gritty of protecting unclassified but sensitive data, the banner isn’t just a decorative box—it’s a compliance checkpoint. Get the wording right, stick it in the right place, and make it impossible to miss That's the part that actually makes a difference. That alone is useful..
That’s the short version: a clear banner, consistent formatting, and a little automation go a long way toward keeping your CUI safe and your contracts intact Less friction, more output..
Now go ahead and update those templates—you’ll thank yourself when the next audit rolls around.
