The Correct Banner Marking for Commingled Documents with CUI
Controlled Unclassified Information (CUI) represents sensitive information that requires safeguarding but isn't classified national security information. When documents containing CUI are commingled with non-CUI materials, proper banner marking becomes essential to maintain security protocols and regulatory compliance. This full breakdown explains the correct procedures for marking commingled documents containing CUI to ensure proper handling, storage, and dissemination.
Understanding CUI and Its Importance
Controlled Unclassified Information encompasses a wide range of sensitive information that the government creates or possesses. Unlike classified information, CUI is not subject to the Uniform Classification Marking System (UCMS), but it still requires specific handling procedures. The CUI Program, established by Executive Order 13556 in 2010, created a uniform system for managing this information across federal agencies.
Some disagree here. Fair enough.
CUI is divided into multiple categories, including:
- Law Enforcement Sensitive (LES)
- Privacy Act (PAI)
- Critical Infrastructure (CI)
- Financial (FI)
- Controlled Nuclear Information (CNI)
- Unclassified Controlled Technical Information (UCTI)
Each category has specific handling requirements, and when documents containing CUI are commingled with non-CUI materials, proper identification becomes crucial to prevent unauthorized disclosure No workaround needed..
What Are Commingled Documents?
Commingled documents refer to materials that contain both CUI and non-CUI information. This can occur in various scenarios:
- Reports containing both public and sensitive information
- Presentations with marked and unmarked
Presentations with marked and unmarked slides, emails that forward CUI attachments alongside routine correspondence, or binders that interleave CUI pages with public records. Also, in each case, the commingled document as a whole must be handled according to the highest classification level present—unless the CUI portions are clearly and consistently segregated. This principle, known as “overall marking,” ensures that anyone who encounters the document immediately knows that sensitive information is contained within Surprisingly effective..
The Core Principle of Banner Marking
The banner marking is the prominent line of text placed at the top and bottom of each page (or at the beginning and end of a digital file) that indicates the document’s overall sensitivity. For commingled documents containing CUI, the banner must reflect the presence of CUI. According to the National Archives and Records Administration (NARA) CUI Marking Guide, the standard banner marking for a commingled document is:
CONTROLLED INFORMATION
This marking appears at the top and bottom of the first page, and optionally on subsequent pages if the document is long or the content changes. Even so, if the commingled document also contains classified information (e.Plus, if the document contains only CUI and no classified information, the banner must not include classification markings. g., CONFIDENTIAL), the highest classification takes precedence, and the CUI marking is subordinate.
Portion Marking: Distinguishing CUI from Non-CUI
To prevent confusion and make sure users know which specific sections contain sensitive material, portion marking is required within commingled documents. Non-CUI portions should be marked with “(U)” for Unclassified. Each paragraph, bullet point, table cell, or graphic that contains CUI must be marked with the appropriate CUI category (e.g., “(LES)” for Law Enforcement Sensitive, “(PAI)” for Privacy Act Information). This granular approach allows recipients to extract or share non-CUI parts without inadvertently exposing CUI Most people skip this — try not to..
Example of a portion-marked page:
CONTROLLED INFORMATION
1. The public budget report shows a 5% increase in funding. (U)
2. The following individuals are under investigation: John Doe, Jane Smith. (LES)
3. Financial transactions from Q3 are attached. (FI)
CONTROLLED INFORMATION
Notice that the overall banner remains “CONTROLLED INFORMATION” even though the page contains both unclassified and CUI portions. The portion marks give users the ability to identify and handle each segment appropriately.
Handling Oversized or Bound Documents
For binders, folders, or multi-page reports that cannot be easily marked on every page, the banner marking must appear on the front cover, back cover, and on any page that begins a new section containing CUI. Day to day, additionally, a header or footer may be used on every page to remind handlers of the overall sensitivity. Because of that, if the document is dynamic (e. g., a continuously updated log), the marking should be updated whenever new CUI is added.
Digital Commingling: Emails and Attachments
In email communications, the entire email thread and all attachments are considered a single commingled document. So, the subject line of an email containing CUI must include the marking “CUI” (e.g.Which means , “Re: Quarterly Review [CUI]”). Practically speaking, the body of the email should have a banner marking at the top and bottom. Attachments should be individually marked, but the overall email envelope takes the highest marking. If an email contains both CUI and non-CUI attachments, the email itself must be treated as CUI.
Common Pitfalls to Avoid
- Using classification markings for CUI: Never use “CONFIDENTIAL,” “SECRET,” or “TOP SECRET” unless the document actually contains classified information. CUI is unclassified and must use “CONTROLLED INFORMATION” or the specific category.
- Inconsistent portion marking: Forgetting to mark a CUI paragraph can lead to accidental disclosure. Always review the document before dissemination.
- Over-marking non-CUI content: Marking everything as CUI when only a small portion is sensitive creates unnecessary handling burdens. Use portion marks accurately.
- Failing to update markings after redaction: If CUI portions are removed, the overall banner should be changed to “UNCLASSIFIED” or removed entirely.
Conclusion
Proper banner marking for commingled documents with CUI is not merely a bureaucratic formality—it is a critical safeguard that protects sensitive information while enabling the efficient sharing of non-sensitive content. Whether in print or digital form, a well-marked document empowers handlers to make informed decisions about storage, transmission, and access. By applying the overall banner “CONTROLLED INFORMATION” and using diligent portion marking with category indicators, organizations ensure compliance with NARA standards and mitigate the risk of unauthorized disclosure. In an era where information moves rapidly across agencies and contractors, clear and consistent markings remain the first line of defense in managing Controlled Unclassified Information responsibly.
Implementing a strong Marking Workflow
To embed the marking conventions described above into everyday practice, organizations should adopt a standardized workflow that can be automated wherever possible. First, configure document‑creation templates to embed the “CONTROLLED INFORMATION” banner automatically when a CUI tag is applied. On top of that, most modern word‑processing and PDF‑authoring suites support macro‑driven header/footer insertion, allowing the banner to appear on every page without manual effort. In real terms, second, integrate a metadata‑driven tagging engine that scans the file for CUI identifiers—such as “CUI‑13” or “CUI‑14”—and automatically generates portion marks for any highlighted text. This eliminates the risk of human error and ensures consistency across large batches of documents That's the part that actually makes a difference..
Third, establish a review checkpoint before a document leaves the author’s desk. And the checkpoint can be a quick checklist that verifies: (1) the presence of the overall banner, (2) the correct category code on each portion mark, and (3) that no stray “CONFIDENTIAL” or “SECRET” markings appear. Plus, finally, log each marking decision in a centralized audit trail. By recording who applied the marks, when, and which CUI category was involved, agencies create an immutable record that supports compliance audits and forensic investigations.
People argue about this. Here's where I land on it.
Leveraging Digital Rights Management (DRM) for Dynamic Documents
For documents that evolve over time—such as live logs, collaborative wikis, or continuously updated research datasets—the static banner approach must be supplemented with adaptive controls. DRM platforms can attach persistent, cryptographically signed labels to each file version. When a new CUI element is introduced, the label’s scope expands, and the system automatically updates the banner on all subsequent pages. Conversely, when a CUI portion is redacted or removed, the label can be downgraded to “UNCLASSIFIED,” and the banner disappears, preventing lingering sensitivity flags.
Worth pausing on this one.
These dynamic labels also support fine‑grained access controls: a user with “CUI‑Read” clearance can open the file, but only those with “CUI‑Write” can modify portion marks. Integration with identity‑and‑access‑management (IAM) systems ensures that the right people see the right markings without relying on manual enforcement And that's really what it comes down to..
Training and Cultural Adoption
Even the most sophisticated technical controls fail without a workforce that understands the rationale behind each mark. Conduct regular, scenario‑based training sessions that walk participants through real‑world examples of commingled documents—such as a joint briefing that contains both a public press release and a classified appendix. Beyond formal training, embed marking awareness into everyday communication channels. Role‑play exercises can illustrate the consequences of missed portion marks, such as an inadvertent leak during a routine email forward. Encourage team leads to ask, “Is this portion CUI‑marked?” during peer‑review meetings, and make the banner a visible part of shared folder structures. When marking becomes a habitual part of the writing process, the risk of accidental exposure diminishes dramatically.
Continuous Improvement Through Feedback Loops
Finally, establish a feedback mechanism that captures lessons learned from incidents, audits, and routine usage reports. And a simple ticketing system can log cases where a marking was missed or incorrectly applied, and the resulting corrective actions can be fed back into template updates and training modules. Over time, this iterative loop refines the marking schema, ensuring it stays aligned with evolving mission requirements, legal interpretations, and technological capabilities.
This is the bit that actually matters in practice.
Final Thoughts
Mastering banner marking for commingled CUI documents transforms a procedural checkbox into a strategic safeguard. In practice, by coupling static and dynamic marking techniques, automating routine tasks, and fostering a culture of vigilance, organizations can protect sensitive information without sacrificing the agility needed in today’s interconnected environment. The end result is not merely compliance with NARA guidance—it is a resilient information‑handling ecosystem where every stakeholder knows exactly how to treat, store, and share data, ensuring that controlled unclassified information remains controlled, and unclassified information stays unclassified That's the part that actually makes a difference..
