Controlled Unclassified Information: Non-Traditional Markings

Hi, thank you for joining us today. Today, we are going to addressing the non-traditional
markings of Controlled Unclassified Information, like how to use cover sheets and forms, as
well as marking emails or storage containers. To begin, let’s consider when a form must
be marked as Controlled Unclassified Information. If a form is going to be filled in with information
that falls under the definition of CUI, it must be labeled to reflect as much. In this example, the application or form calls
for a social security number to be filled in by the applicant. This is information that qualifies as CUI,
and therefore that information must be protected. The control marking on the form can say “Controlled”
or “CUI” when filled in. If space is limited on the form, consider
using a cover sheet. On that note, there are situations in which
it is more convenient to use a cover sheet to mark CUI. Though it is not a mandatory practice, it
is often the most practical and therefore worthwhile to learn. Coversheets are available to be downloaded
and used from the CUI Registry online. On screen for reference are three available
templates, which you can use and fill in if you choose to use a CUI coversheet. Optional Forms 902 and 903 can be used to
convey any categories or subcategories as well as any special handling information. Frequently documents are shared between two
parties that will contain CUI. To ensure that the receiving party properly
handles the CUI, transmittal documents must be marked to reflect as much. The document must have a clear and conspicuous
message along the lines of “When enclosure is removed, this document becomes Uncontrolled
Unclassified Information”. As you can see in the example on screen, a
fax is being sent that contains CUI. However, the first page of the fax also indicates
the presence of CUI in an obvious manner. In our modern workplaces, it is often most
convenient to store CUI by electronic means, such as a flash drive or CD rom. However, In these cases, there must still
be a marking that clearly and conspicuously denotes the presence of CUI. Though it may not always be practical to include
category, subcategory, etc. at a minimum there must be a clear label of “Controlled”
or “CUI” on the outside of media objects such as a flash drive. In the electronic environment, there are often
situations in which the CUI cannot be marked. If a file is stored and accessed on a computer
system, it cannot be marked physically as a CD-Rom or flash drive could. In these cases, an access banner or splash
screen can be used to alert users to the presence of CUI contained within the system or application. Much like electronic forms of storage, physical
storage spaces such as file cabinets or boxes may also have a label which clearly denotes
the presence of CUI. Again, it isn’t always possible to include
the subcategory or dissemination controls; however it is permissible to place signage
conspicuously on the outside of the storage area that indicates the presence of CUI. If there exists a bulk of CUI material falling
under the same controls, they do not need to be marked individually but rather can be
marked in the aggregate. Therefore, the control marking on the outside
of a filing cabinet, should it contain a large bulk of information all falling under the
same controls of CUI, will be sufficient if that marking is appropriate for the entire
group When sharing CUI by physical means, that is
to say by shipping or mailing, it is important to take steps to ensure that only authorized
users will receive the CUI package. This means that it should be very clearly
marked for the recipient and only the recipient, by the individual name if applicable. Furthermore, since the delivery will be handled
by several non-authorized holders, do not place any CUI markings on the outer wrapper. This is absolutely mandatory. Similarly, it is important to train any mailroom
staff who will be handling CUI on the proper protections they should be taking with that
package. Thank you for joining us today, and for taking
the time to learn how to properly handle your CUI. If you have any further questions please visit
the CUI registry or contact the office of controlled unclassified information.

Leave a Reply