At the time of creation of CUI material the authorized holder is responsible for determining whether information qualifies as controlled unclassified information (CUI), which category applies, and what marking and handling requirements follow. That determination must happen before the material is disseminated, because the creator is the only party who knows the information's origin, sensitivity, and governing legal authority.
The designation mechanism and why creation triggers it
Controlled unclassified information is information the government creates or possesses, or that a contractor receives or possesses, that requires safeguarding or dissemination controls under law, regulation, or government-wide policy. The CUI Program, run by the National Archives and Records Administration (NARA), replaced the old For Official Use Only (FOUO) patchwork in 2016. The core logic: someone must decide, at the moment information comes into being, whether a legal authority requires protection.
The authorized holder is the individual or entity permitted to designate and handle CUI. On creation, that is typically the originator: the analyst drafting the document, the contractor generating the deliverable, the researcher producing the dataset. The determination involves two questions. First, does a law, regulation, or government-wide policy require the information to be protected? Second, if yes, which CUI category and marking apply?
Why creation matters more than receipt: when information arrives already marked, the holder inherits the designation. When information is newly created, no prior marking exists to inherit. The creator holds the context — the contract clause, the statute, the source document — and is therefore the only party positioned to make a defensible call. Deferring the determination leaves material unprotected and untracked during its most vulnerable window.
The practical sequence at creation: identify the governing authority, assign the correct category marking, apply the CUI banner and designation indicator, and record the determination in the system of record. A designation the creator skips is a designation no downstream holder can reliably reconstruct.
Quantified context: what the requirement covers
The scale of the CUI regime explains why creation-time determination is a real operational burden rather than a paperwork formality.
Executive Order 13556 (2010) established the program, and 32 CFR Part 2002 codified the implementing rule in 2016. The CUI Registry contains roughly 20 organizational index groups and hundreds of individual categories and subcategories, each tied to a specific legal authority. A single document can touch multiple categories simultaneously.
The governing standard for contractor systems, NIST Special Publication 800-171, specifies 110 security requirements across 14 control families for protecting CUI in nonfederal systems. Assessment against those requirements, under the Cybersecurity Maturity Model Certification program, now applies to Department of Defense contractors handling CUI — a population exceeding 200,000 entities. Each of those entities depends on accurate creation-time determinations to know which requirements attach.
Numbers that anchor the stakes: a misdesignation that lets CUI leak to an unauthorized system can trigger breach notification obligations, contract remedies, and in national-security contexts, criminal referral. The cost of a wrong call scales with how long the error persists — which is why the determination belongs at creation, not at audit.
Edge cases: where creation-time determination gets hard
Three scenarios break the simple "creator decides" heuristic, and professionals handle each differently.
Derivative material. A new document that quotes or summarizes an already-marked source inherits the source's designation unless the creator documents a lawful reason to change it. Professional caveat: de-designation requires authority and documentation, not judgment. A contractor who strips a marking because the content looks benign has made an unauthorized change.
Aggregation. Individually unclassified items can combine into CUI when compiled, because the aggregate reveals something the pieces do not. The counterintuitive detail: a document containing no single protected fact can still be CUI. Creators must assess the compilation, not just the components.
Foreign or third-party origin. Information received from another party may carry obligations the recipient did not create. The holder's duty is to verify the marking and authority, not to re-derive the sensitivity from scratch. Ambiguity here is the classic failure point, and the safe move is to treat unverified material conservatively until the authority is confirmed.
Red flags that demand escalation before dissemination:
The governing authority is unclear or the source document is unmarked. The compilation plausibly reveals protected information even though each item is unclassified. A prior holder removed or altered a marking without documentation. The material crosses contract boundaries or enters a system not authorized for CUI. The creator cannot name the specific category that applies.
Misconceptions that produce real violations
Four persistent errors account for a large share of CUI mishandling. Each stems from confusing the creator's duty with someone else's.
Misconception one: "The government marks it, so I don't decide." False. For contractor-created deliverables, the contractor determines at creation and marks accordingly; the government validates, it does not pre-mark.
Misconception two: "Unmarked means unrestricted." False. Unmarked means undetermined. The absence of a marking is not a determination of non-CUI status.
Misconception three: "CUI is the same as classified." False. CUI is unclassified by definition. Treating it as classified over-restricts and creates its own compliance problems, including improper withholding from parties with a lawful need to know.
Misconception four: "FOUO is still valid." False for federal executive branch use. FOUO was retired under the CUI Program; legacy markings must be mapped to current CUI categories.
Comparison of designation regimes clarifies why the CUI Program centralized a fragmented system:
| Regime | Scope | Who designates at creation | Current status |
|---|---|---|---|
| CUI Program (32 CFR 2002) | Government-wide, executive branch and contractors | Authorized holder / originator | Active standard |
| FOUO (legacy) | Agency-specific | Originator under agency policy | Retired for federal use |
| Classified national security information | National security | Original classification authority only | Separate regime, unchanged |
| Sensitive but unclassified (SBU) | Agency-specific | Varies by agency | Largely superseded by CUI |
| Contractor proprietary / trade secret | Private | Owner | Separate from CUI, may overlap |
| PII under Privacy Act | Federal records | Agency | Overlaps with CUI Privacy category |
Practical actions at the moment of creation
The determination is only as good as the workflow that captures it. These steps translate the requirement into repeatable practice.
Identify the governing authority before drafting. Know the contract clause, statute, or policy that may require protection; if none applies, document that conclusion. Check the CUI Registry for the matching category and its required marking. The registry, maintained by NARA, is the authoritative lookup. Apply the full marking set: banner, category designation, and dissemination controls. Partial marking is a common audit finding. Record the determination in the system of record with the authority cited. An undocumented designation is unverifiable later. Route ambiguous cases to the designated CUI point of contact before dissemination, not after. Reassess on any change in aggregation, recipient, or system — a new context can change the designation.
Practical threshold: if the creator cannot state the specific legal authority in one sentence, the determination is not complete and the material should not be disseminated until it is.
Limitations and the boundary of self-determination
Creation-time determination is a professional judgment constrained by real limits. The creator can only designate within an authority that exists; inventing a category is as wrong as omitting one. The program assumes training and access to the registry, and an untrained originator will produce unreliable determinations regardless of intent.
Where the article must stop: specific marking requirements vary by agency and contract, and the current state of implementing guidance changes. This article explains stable mechanisms and does not substitute for the governing regulation, your agency's CUI policy, or your contract terms. Verify against the current 32 CFR Part 2002 and the CUI Registry before relying on any marking decision.
This article is general educational information about the CUI Program, not a legal opinion or a compliance determination for your organization. It does not promise any compliance outcome. For decisions about specific documents, contracts, or agency obligations, consult your designated CUI point of contact or a qualified attorney familiar with federal information law.