Which Markings Are Required for Sharing CUI Through Email: A Deep-Dive Guide to Controlled Unclassified Information

The markings required for sharing CUI through email are the CUI banner marking, a category marking, a CUI designation indicator, and, when required, limited dissemination controls, all placed where each recipient can see them before reading the content. For Controlled Unclassified Information sent by email, those four elements usually appear in the body of the message and on any attached documents; the subject line carries the banner and, often, the category. Getting the placement and the inheritance rules right is where most organizations fail audits.

This guide explains the marking mechanics at a level deeper than a checklist. It covers why each element exists, how markings propagate through replies and forwards, where practitioners disagree about subject-line shorthand, and what a defensible email-marking procedure looks like.

The four required marking elements and why each exists

The CUI program, run by the National Archives and Records Administration, replaced a patchwork of agency-specific labels such as FOUO, LES, and SBU. The uniform scheme exists so that a recipient who has never handled a document from your agency can still recognize it as controlled and know who designated it. Each required element serves a distinct function, and removing any one of them breaks a link in that chain.

The banner marking is the top-level label, typically "CUI," that signals the presence of controlled information. Its function is triage: it tells every handler, including mail servers, help desks, and records managers, that the content is not public. A banner without a category tells a reader the information is controlled but not why, which limits correct handling.

The category marking identifies the specific authority under which the information is controlled, such as Privacy, Law Enforcement, or Critical Infrastructure. Categories are the "why," and they drive dissemination decisions. A Privacy category, for example, invokes different sharing rules than an export-controlled category.

The CUI designation indicator (sometimes called the limited dissemination control or source indicator) identifies the designating agency and often a point of contact. It answers the question "who says this is CUI, and whom do I call?" Without it, a recipient cannot verify authority or resolve a marking dispute.

Limited dissemination controls (LDCs), such as NOFORN, FEDONLY, or EXDIS, restrict sharing further when the underlying authority requires it. Not every email needs an LDC, but when the source authority imposes one, omitting it is a disclosure error.

Plain-language version: the banner says "controlled," the category says "why," the indicator says "who designated it," and the LDC says "who may not see it."

Why markings propagate through replies and forwards

Email is not a static document; it is a thread that mutates. A CUI email that gets a one-line reply, then a forward to a contractor, then a reply-all to a distribution list, can lose its markings at any hop. The program's inheritance principle addresses this: markings attach to the content and travel with it, so a reply that quotes CUI content must itself carry the CUI marking, even if the reply adds only "thanks."

This matters mechanically because most email clients do not propagate markings automatically. The banner lives in the body text of the original message; a reply generated by the client typically quotes that body, which preserves the banner inside the quoted block. But the new message's own header area, where recipients look first, may show nothing. Personnel must therefore re-apply the banner at the top of every reply and forward that contains or references CUI. A forward that strips the original body to save space removes the only visible marking.

Attachments carry their own markings independent of the email body. A CUI-marked spreadsheet attached to an unmarked email is still CUI; the email should carry the banner so the attachment is not separated from its context. Conversely, an unmarked attachment to a marked email inherits the email's context but not necessarily its formal marking, which is why practitioners recommend marking every attachment that contains CUI.

The counterintuitive detail: the most common marking failure in email is not a missing banner on the original message. It is a missing banner on a reply that quotes CUI content, because the sender believes the quoted text below already carries the marking. Reviewers who scan only the top of the message body miss it.

Marking placement in email versus documents

Documents and emails are marked differently because they are read differently. A document has a cover page, a header, and a footer, which is where the banner, category, and indicator conventionally sit. An email has a subject line and a body, and recipients scan the subject line and first lines before opening. That is why subject lines typically carry the banner, often followed by the category in brackets, while the body repeats the banner and carries the indicator and any LDC.

There is no single universal format etched into email for the indicator and LDC placement. Agencies publish implementation guidance, and the consistent professional practice is to place the full marking block at the top of the message body and repeat the banner in the subject line. If your agency's guidance prescribes a specific subject-line syntax, follow it; consistency within an organization is what makes markings recognizable.

Where recipients include a signature block, the marking block should precede the signature, not follow it. A marking placed at the very bottom of a long email, after a signature and a confidentiality boilerplate, is easy to miss and easy to strip in a reply. Top-of-body placement solves both problems.

Banner, category, indicator, and LDC: what each marking must contain

Portion marking deserves a note for emails. A message that mixes CUI paragraphs with non-CUI administrative text can mark only the controlled portions, but this is difficult to do cleanly in email and error-prone in threads. Many organizations simplify by marking the whole message CUI when any controlled content is present, which is conservative and acceptable.

Red-flag warnings that indicate a marking failure

A reply or forward that contains quoted CUI but carries no banner at the top of its own body. A subject line with no marking on an email whose body is marked CUI, which breaks triage at the inbox level. An attachment containing CUI sent with no marking in the email body, separating the content from its context. A marking block placed only at the bottom of a long thread, after signatures and boilerplate, where it is easily stripped. A category marking without an authority or indicator, leaving the recipient unable to verify the designation. An unfamiliar label such as FOUO or SBU applied alongside or instead of CUI, which signals the organization has not migrated to the current scheme.

Where practitioners disagree: subject-line shorthand and whole-message marking

Two debates recur in implementation. The first is whether the subject line must contain the category, or whether "CUI" alone suffices. The conservative practice is to include the category when the subject line can accommodate it, because the category drives handling and helps recipients route the message correctly. The minimal practice is banner-only in the subject with the full marking block in the body. Choose one, document it, and apply it consistently; inconsistency is the real risk.

The second debate is whole-message versus portion marking in email. Some practitioners argue that whole-message marking over-classifies and dilutes the signal. Others argue that portion marking in email threads is unworkable because replies scramble the boundaries. The defensible middle ground is whole-message marking for emails containing any CUI, paired with clear portion marking for the underlying attachments, where boundaries are stable and auditable.

Practical actions for a defensible email-marking procedure

Draft a one-page marking standard for email that specifies the exact subject-line syntax, the body marking block layout, and the attachment rule. Require the banner, category, indicator, and any LDC in every message that contains CUI. Configure email client signatures or templates so that the marking block and banner are inserted automatically at the top of the body. Automating placement removes the reply-and-forward failure mode. Train personnel on the reply rule specifically: any reply or forward that quotes CUI content must carry a fresh banner at the top of the new message body. Test this with a short quiz before granting CUI access. Audit a sample of sent CUI emails each quarter. Check subject-line marking, top-of-body placement, attachment marking, and thread inheritance across at least one reply and one forward per sample. Reconcile your organization's guidance with any agency-specific requirements before rollout. Where agency syntax and internal syntax conflict, adopt the stricter placement and document the deviation.

Reconciling the thresholds: the banner, category, and indicator are baseline requirements for every CUI email; the LDC is conditional on the underlying authority; portion marking applies to mixed-content documents and is optional but conservative in email. One unit system: all examples here use US federal terminology, and no pricing or licensing data is presented because it is not stable enough to state without a current authoritative source.

Limitations: what markings cannot do, and where guidance is thin

Markings are a control on handling behavior, not a technical control. They do not encrypt email, prevent forwarding, or stop a determined recipient from copying content. Organizations that rely on markings alone, without transport encryption and access management, have a false sense of protection.

Implementation guidance also varies by agency. This article describes the stable program structure and widely used practices, not a substitute for your agency's current published marking instructions, which may prescribe specific syntax. Where this guide and your agency's guidance differ, follow your agency. For legal questions about disclosure obligations, liability, or records retention, consult a qualified local professional; this article is general educational information, not a legal opinion, and it does not promise any particular audit or compliance outcome.