Who Is Responsible for Applying CUI Markings: The Real Accountability Chain

The person responsible for applying controlled unclassified information (CUI) markings is the authorized holder who creates or possesses the document, operating under the direction of the designated CUI senior official for that agency. In practice, that means the original creator marks it at the moment of creation, and every subsequent holder who incorporates CUI into a new document must re-mark the derivative. Responsibility is personal, delegable only through formal training and authorization, and never transfers automatically with the file.

That answer sounds tidy. The mechanism behind it is not. CUI marking accountability runs through an executive order, a government-wide registry, agency-level policy, contract clauses, and individual training records. Most thin explainers stop at "the creator marks it." This one goes deeper into why the chain works the way it does, where it breaks, and what to do when you are the one holding an unmarked document.

The marking authority chain

Executive Order 13556, signed in 2010, established the CUI program and made the National Archives and Records Administration (NARA) the executive agent. NARA's Information Security Oversight Office (ISOO) publishes the government-wide CUI Registry and the implementing directive, 32 CFR Part 2002. That directive is the load-bearing document. It defines who may designate information as CUI, who may mark it, and what happens when marking is wrong.

The chain has four links. First, the agency head designates a CUI senior official. Second, that senior official builds the agency's CUI program, including marking procedures and training. Third, supervisors and contracting officers authorize specific employees or contractors to handle CUI. Fourth, the individual holder applies the marking.

Each link carries a different kind of accountability. The senior official is accountable for program design. The supervisor is accountable for authorization. The individual is accountable for the physical act of marking and for protecting what they hold. When an investigation asks "who failed," the answer depends on which link broke. A missing banner on a document usually points to the individual. A missing category code across an entire office usually points to program design.

The counterintuitive part: the senior official does not mark documents. The directive assigns marking execution to holders precisely because designation authority is centralized but marking happens thousands of times a day at the desk level. Centralizing the act would be unworkable. Centralizing the rules is the control.

Why marking sits with the holder, not the classifier

Traditional classified marking follows a different logic. An original classification authority decides what is classified, and that authority is narrow and documented. CUI deliberately inverts this. The 32 CFR Part 2002 framework allows any authorized holder to designate information as CUI if it falls within a category listed in the CUI Registry and the applicable agency policy permits it.

The reason is volume and speed. CUI covers more than 100 categories spread across dozens of agencies, from export-controlled technical data to privacy information to critical infrastructure details. Waiting for a designated classifier would stall ordinary business. Instead, the system pushes designation to the point of creation and relies on training, the registry, and supervision as controls.

This creates a specific duty. The holder must check three things before applying a marking: whether the information fits a registry category, whether the agency's CUI policy covers it, and whether a law, regulation, or government-wide policy actually requires protection. If any answer is no, the information is not CUI and should not be marked. Over-marking is a real violation, not a safe default.

A second duty follows immediately. The holder must mark at the time of creation, not later. Marking retroactively is one of the most common findings in agency inspections, because unmarked CUI in circulation is functionally uncontrolled.

Quantified context: the scale of the problem

Precise government-wide CUI marking error rates are not publicly published in a form that supports citation, so treat any specific percentage with suspicion. What can be stated with confidence is structural scale. The CUI Registry lists over 100 distinct categories. 32 CFR Part 2002 imposes marking, dissemination, decontrol, and self-inspection requirements on every agency that handles CUI, and the requirement flows to contractors through the Federal Acquisition Regulation.

The Defense Counterintelligence and Security Agency (DCSA) administers the National Industrial Security Program and conducts assessments of contractor handling. Contractors storing CUI on non-federal systems face the 110 security requirements in NIST SP 800-171, and the Department of Defense's Cybersecurity Maturity Model Certification program adds assessment tiers on top. Marking is the entry point for all of it: an unmarked document on a contractor network is a compliance failure before it is a security failure.

Timelines matter too. Under the directive, agencies must decontrol CUI when the underlying authority expires or when the information no longer requires protection. Decontrol is not automatic. Someone must review and act. That someone is the holder or the office of record, depending on agency procedure.

Edge cases that break the simple answer

Derivative documents are the sharpest edge. When you paste a paragraph of CUI into a briefing slide, you become the marker for that slide. The original author's marking does not follow the text automatically. You must carry forward the category, the designation authority, and the dissemination controls. If you blend CUI from two categories, the resulting document generally takes the more restrictive handling, and the marking must reflect both sources.

Email is another. The directive expects CUI in email to be marked, typically with a banner and a category indicator, though agencies differ on implementation. Attachments must be marked independently. A marked email carrying an unmarked attachment is a common and serious gap.

Legacy information is a third. Documents created before the CUI program replaced the old Sensitive But Unclassified patchwork may carry obsolete markings like FOUO or SBU. The current holder is responsible for recognizing the obsolete marking, determining whether the information maps to a current CUI category, and re-marking or decontrolling accordingly. Nobody is coming to do it for you.

Oral communications and presentations form a fourth edge. CUI conveyed verbally or displayed on a slide still requires protection, and the person disclosing it is responsible for conveying the handling requirement. Marking is not limited to paper.

Red flag: A document marked CUI with no category code or designation authority cited. Red flag: A derivative that carries a banner but omits the source authority. Red flag: An attachment unmarked while its covering email is marked. Red flag: Obsolete markings like FOUO left in place after program transition. Red flag: CUI pasted into a personal note, chat tool, or unapproved cloud drive. Red flag: Decontrol performed without a documented authority review.

Misconceptions that shift blame to the wrong person

The most persistent misconception is that the security officer or records manager owns marking. They own the program, the training, and the audit trail. The marking duty stays with the holder. When an inspector finds an unmarked document, the finding names the holder and, separately, the supervisor who authorized access.

A second misconception is that marking is optional if the document is internal. Dissemination controls exist precisely because internal circulation is still circulation. An unmarked internal memo containing privacy CUI can be forwarded outside the intended audience in one click.

A third is that over-marking is harmless. It is not. Over-marking degrades information sharing, inflates decontrol backlogs, and can violate the Paperwork Reduction Act's information-sharing intent embedded in the CUI framework. Agencies have been directed to reduce over-marking, not tolerate it.

A fourth is that contractor personnel follow different rules. They do not. Contractors authorized to handle CUI carry the same marking duty as federal employees, enforced through contract clauses and assessed by DCSA and, increasingly, through CMMC assessments.

A fifth, subtler misconception: people assume the senior official can retroactively bless an unmarked document. Designation authority can confirm a category, but it cannot erase the period during which CUI circulated unprotected. The compliance record stands.

Practical actions for holders and supervisors

The steps below apply whether you are a federal employee, a contractor, or a supervisor verifying someone else's work.

Before marking, verify the category in the current CUI Registry and confirm your agency's policy covers it. If either check fails, do not mark. Mark at creation. Apply the banner, the category code, the designation authority, and any dissemination control in the same sitting. When creating a derivative, carry forward source markings and update them. Document where the CUI came from. Mark every attachment and every slide independently. Do not rely on the covering message. On discovering unmarked CUI, protect it first, then report it through your agency's incident channel, then re-mark or escalate. Supervisors should sample 5 to 10 documents per quarter per authorized holder. Small samples catch systemic training gaps before audits do.

Threshold guidance: if you cannot name the registry category and the designating authority for a document within about a minute, stop and consult your agency CUI office before marking or disseminating. If you discover CUI on an unapproved system, treat it as a potential incident and report within your agency's required window rather than quietly deleting it.

Limitations and what this explanation cannot settle

Agency implementation varies widely. Some agencies require centralized review before marking; others push full authority to trained holders. The numbers in this article reflect structural requirements, not measured error rates, because public marking-error data is not available in a citable form. Specific training intervals, incident reporting windows, and decontrol review cycles are set by each agency's policy and should be confirmed locally.

Contractor obligations also shift with contract clauses and the current status of CMMC rollout, which is evolving. Do not treat any single source, including this one, as a substitute for your agency's or company's current CUI policy and your contracting officer's direction.

This article is general educational information about how the CUI marking framework allocates responsibility. It is not a legal opinion, a compliance determination, or a substitute for your agency's or employer's official CUI policy, and it promises no particular audit or assessment outcome. For decisions about specific documents, contracts, or incidents, consult your organization's designated CUI official, legal counsel, or contracting authority.