What DOD Instruction Implements the DOD Cui Program? A Clear, Human Guide to DoDI

There’s something quietly interesting about the way governments protect information. Most people think of secrets in dramatic terms — classified files, Top Secret stamps, locked vaults. But there’s a whole other world of information that sits just below that level. It’s not a national secret, exactly. But it’s not something you’d want floating around on the internet either. That’s the space where the DOD CUI Program lives, and understanding it matters to a lot more people than you might expect.

So, what DOD instruction actually implements the DOD CUI Program? The answer is DoD Instruction 5200.48, signed into effect on March 6, 2020. But to really understand why it exists and what it does, we need to back up a bit and look at the story behind it.

Table of Contents

Key Facts

Topic	Detail
Implementing Instruction	DoD Instruction (DoDI) 5200.48
Effective Date	March 6, 2020
Issued By	Intelligence and Security Office of the Under Secretary of Defense (OUSD I&S)
Based On	32 CFR Part 2002 (2016) and Executive Order 13556 (November 4, 2010)
Replaces	Over 100 legacy labels including “FOUO” (For Official Use Only)
Government Overseer	ISOO through the National Archives and Records Administration (NARA)
CUI Marking Requirement	“CUI” on every page banner and footer
Applies To	All DoD personnel, contractors, and anyone handling DoD-origin sensitive data
Contractor Technical Standard	NIST Special Publication 800-171
Training Requirement	Initial training before access, plus annual refreshers

Why Did This Even Need to Exist?

Picture a giant government with over 100 different agencies, all handling sensitive information. Some of it involves people’s personal records. Some involve technical blueprints for military equipment. Some covers law enforcement investigations or export-controlled technologies.

Now imagine each of those agencies making up their own labels and rules for that information. One agency calls it “For Official Use Only.” Another says “Sensitive But Unclassified.” A third has its own system entirely. When those agencies need to share information — which they often do — nobody speaks the same language. Documents get mishandled. Some get over-protected and never shared when they should be. Others slip through the cracks because nobody knows how to treat them.

That’s exactly what was happening before 2010. The government had more than 100 different markings for unclassified-but-sensitive information. The 9/11 Commission in 2004 actually pointed to this kind of fragmentation as a real security problem. Poor information sharing between agencies had real consequences.

President George W. Bush started addressing this in 2008 with a memorandum. But it took President Barack Obama’s Executive Order 13556, signed on November 4, 2010, to really push for a unified system. That order created the Controlled Unclassified Information (CUI) program and handed oversight to the National Archives and Records Administration (NARA). Then in 2016, a federal regulation — 32 CFR Part 2002 — filled in the details for all government agencies.

But the Department of Defense is enormous. It has its own unique needs, its own contractors, its own categories of sensitive data. A general government-wide rule wasn’t quite enough. DoD needed its own instruction to put all of this into practice for its specific world. That’s what DoDI 5200.48 is for.

What Exactly Is CUI?

Let’s be clear about what CUI genuinely means before moving on.

Controlled Unclassified Information is exactly what it sounds like — information that isn’t classified, but still needs some level of protection. It’s not a state secret. You won’t find it in a locked safe requiring a security clearance to open. But it’s not something you’d post publicly either.

Think about things like a veteran’s medical records. Or the technical specifications for a military drone’s navigation system. Or personal information about Defense Department employees. Or engineering plans for a defense contractor’s specialized equipment. None of that rises to “classified,” but all of it could cause real harm if it ended up in the wrong hands.

Before CUI, the label most people would have recognized was “For Official Use Only,” or FOUO. That label is now being phased out and replaced with the single, clear “CUI” marking across all DoD documents.

How DoDI 5200.48 Works in Real Life

DoDI 5200.48 is the instruction that tells every corner of the Department of Defense — and anyone who works with it — exactly how to handle CUI. It covers everything from how to mark a document to how to destroy one when it’s no longer needed.

Marking documents. Every page of a document containing CUI must show “CUI” in the banner at the top and footer at the bottom. There’s also a CUI Designation Indicator box in the lower right corner of the cover page, which identifies who marked the document and why. Although it may seem insignificant, this is very important. Before this standardization, similar information might have been marked completely differently depending on which branch of the military or which agency created it.

Categories of CUI. Not all CUI is the same. The DoD CUI Registry lists the specific categories. Some examples include Controlled Technical Information (CTI), which covers scientific and technical data with military applications. Others include privacy-related personal information, export-controlled data, nuclear information, and legal records. Each category may have its own handling rules layered on top of the baseline CUI requirements.

Two types: CUI Basic and CUI Specified. CUI Basic has standard handling requirements. CUI Specified is stricter — the underlying law or regulation for that type of information requires specific additional controls. Export-controlled technical data is a good example of CUI Specified. The rules there go beyond the basics because of the International Traffic in Arms Regulations (ITAR) and related frameworks.

Sharing CUI. You can share CUI when there’s a lawful government purpose for doing so — meaning the person receiving it actually needs it to do their job. You can’t send it through personal email accounts like Gmail or Yahoo. DoD employees must use approved government systems.

Storing CUI. Digital systems holding CUI must meet security standards set out by NIST (the National Institute of Standards and Technology). For contractors, the key standard is NIST SP 800-171, which covers 110 specific security requirements from access controls to encryption to how you respond to security incidents.

Destroying CUI. When CUI is no longer needed, it can’t just go in the recycling bin. Paper records must be shredded in ways that make the original information completely unrecoverable. Digital media must be sanitized using methods aligned with NIST SP 800-88.

Training. Everyone who handles CUI must complete initial training before they ever access it, plus annual refresher training afterward. The Defense Counterintelligence and Security Agency (DCSA) even offers a free mandatory training course through their Center for Development of Security Excellence (CDSE).

Who Has to Follow This?

At this moment, many people are shocked.

DoDI 5200.48 doesn’t just apply to uniformed military members. It applies to all DoD civilian employees, defense contractors, subcontractors, research institutions working on defense contracts, and universities that receive DoD funding.

A small engineering firm that makes a specialized component for a military system might receive technical specifications that are CUI. A university research lab studying materials for body armor might handle data marked CUI. Even a mid-sized cybersecurity company working on a government contract can end up holding CUI before a contract is even formally awarded — if they received specifications in a Request for Proposal (RFP), for example.

The obligation to protect it follows the information, not just the original organization. If a prime contractor receives CUI and shares it with a subcontractor to get the work done, that subcontractor now has the same handling obligations. This “flowdown” requirement has caught a lot of smaller defense suppliers off guard.

The Cybersecurity Connection

Here’s something worth understanding: CUI compliance isn’t just a paperwork exercise. It connects directly to cybersecurity requirements that have real teeth.

The Defense Federal Acquisition Regulation Supplement clause 252.204-7012 — known in the defense contracting world simply as “the 7012 clause” — requires contractors handling CUI-adjacent information to maintain cybersecurity controls meeting NIST SP 800-171. That’s 110 security requirements covering things like multi-factor authentication, encrypted storage, access logging, and incident reporting.

Furthermore, compliance with those 110 controls serves as the Level 2 requirement for the Cybersecurity Maturity Model Certification (CMMC) program, which DoD has been implementing since late 2021.standard for any organization handling CUI. By Phase 2, expected to ramp up from late 2026 onward, contractors may need to bring in independent third-party assessors to verify their compliance before they can win certain contracts.

For a small defense supplier, this is a significant undertaking. Industry groups have noted that building the documentation and technical infrastructure needed to meet all 110 controls can easily take six months to a year.

What’s a CUI Category, and Why Does It Matter?

The DoD CUI Registry lists out all the types of information that qualify as CUI within the defense world. Controlled Technical Information (CTI) is one of the most commonly encountered categories. It includes scientific and technical information with military or space applications.

But there are many others. Privacy-related personal information like Social Security numbers and financial records qualifies as CUI. Legal information related to government proceedings does too. Nuclear-related unclassified information has its own special handling requirements. And export-controlled technical data — governed by ITAR and the Export Administration Regulations — is one of the most tightly controlled types.

Each category in the registry identifies what law or regulation makes it sensitive. That legal backing is important. CUI isn’t something an agency invented arbitrarily. The requirement to protect each category comes from somewhere — a statute, a regulation, or a government-wide policy.

Common Misconceptions About CUI

A lot of people, when they first encounter CUI, assume it must be classified information in disguise. It isn’t. CUI is explicitly unclassified. Accessing it doesn’t require a security clearance in the traditional sense, though access is still controlled to those with a legitimate need.

Another misconception is that “FOUO” still works as a marking. It doesn’t — not for new documents. DoDI 5200.48 eliminated FOUO as an authorized new marking. Legacy documents with FOUO markings don’t need to be immediately re-marked, but any new document with similar content should be marked “CUI” instead.

Some contractors assume that if the government didn’t explicitly mark something as CUI when they received it, they’re off the hook. That’s not quite right either. The government’s own marking practices have historically been inconsistent, which means contractors often need to use judgment and ask questions when they’re working with data that feels sensitive.

And one more: many people think CUI only matters once a contract is formally underway. But CUI can show up much earlier — in technical specifications shared during the bidding process, in pre-award data exchanges, even in teaming discussions with partners.

The Human Side of All This

There’s a real human dimension to CUI that official policy documents don’t always capture.

Think about the veterans whose medical records or service histories are held by various defense-adjacent organizations. Those records qualify as CUI. Mishandling them isn’t just a regulatory violation — it’s a breach of trust with people who served their country.

Think about researchers at universities who partner with the DoD on advanced materials or artificial intelligence projects. They suddenly find themselves under compliance obligations that feel foreign to a research environment where open sharing is the norm. Balancing that with CUI requirements has been genuinely difficult for academic institutions.

And think about the engineers at a small 20-person defense supplier who suddenly realize they need to invest in cybersecurity infrastructure they never had before, or risk losing their DoD contracts. That is a significant burden, particularly for businesses with little funding.

The government has acknowledged these challenges. The DCSA has worked to create job aids, training tools, and resources to help smaller organizations figure out how to comply. But the honest truth is that compliance remains harder for smaller organizations than for large prime contractors with dedicated legal and compliance teams.

Some Honest Questions About the Program

Not everyone thinks CUI implementation has gone smoothly. Even within government circles, there have been critics.

In late 2020, the then-Director of National Intelligence, John Ratcliffe, sent a memo requesting that the President rescind the executive order behind CUI altogether — describing the policies as having become “exponentially more complex” and “vastly overcomplicated.” That’s a pretty striking thing to say about a policy designed to simplify things.

The concern is real: creating a standardized system is great in theory, but if the standard itself becomes so complex that agencies and contractors can’t consistently follow it, you’ve traded one problem for another. Inconsistent marking practices — even after DoDI 5200.48 was issued — remain a genuine challenge.

There’s also an ethical question worth sitting with. The power to mark something as CUI is real power. DoDI 5200.48 explicitly says that information should not be designated CUI to conceal violations of law, hide administrative errors, or prevent embarrassment to a person or organization. That’s a good rule. But rules about how not to abuse a system are only as effective as the oversight mechanisms enforcing them.

Where Things Are Heading

The CUI program isn’t standing still. CMMC continues to roll out in phases, and the enforcement around CUI compliance in defense contracting is only getting tighter. NIST published a revised version of SP 800-171 in 2024, though CMMC assessments are still running against the prior version while the government works through the rulemaking to update the certification standard.

For defense contractors especially, the message is clear: CUI compliance is now a prerequisite for doing business with the DoD, and the bar is rising. Organizations that prepare now — building solid documentation, proper system controls, and a genuine culture of information awareness — will be in a much stronger position than those who treat it as a checkbox.

All of this is also motivated by a larger hope. When sensitive information is consistently protected and consistently shared only with those who need it, the defense enterprise works better. Intelligence reaches those who require it. Technical data stays secure. And people whose personal information is caught up in the system can trust it’s being handled with care.

FAQs

1. What DOD Instruction implements the DOD CUI Program?

DoD Instruction 5200.48, “Controlled Unclassified Information (CUI),” was published on March 6, 2020. It’s the definitive DoD-specific instruction for the CUI program.

2. What is CUI in simple terms?

It’s sensitive government information that isn’t classified but still needs protection — things like personal records, technical specs for military equipment, and export-controlled data.

3. What replaced “For Official Use Only” (FOUO)?

The CUI marking did. New documents that would have been marked FOUO should now be marked “CUI” instead.

4. Who has to follow DoDI 5200.48?

Everyone working with DoD information — military members, civilian employees, defense contractors, subcontractors, and in some cases universities and research partners.

5. Does handling CUI require a security clearance?

No. CUI is unclassified. Access is controlled, but not through the traditional classified information clearance process.

6. What distinguishes CUI Basic from CUI Specified?

CUI Basic follows standard handling rules. CUI Specified has additional requirements set by specific laws or regulations — like export-controlled technical data under ITAR.

7. What marking goes on a CUI document?

At a minimum, “CUI” in the banner at the top and footer at the bottom of every page, plus a CUI Designation Indicator on the cover page showing who marked it and why.

8. Can I send CUI through regular email?

Not through personal email accounts like Gmail. DoD employees must use approved government systems. Contractors must use approved and properly secured systems.

9. What is NIST SP 800-171, and how does it relate to CUI?

It’s a publication from the National Institute of Standards and Technology that sets out 110 security requirements for protecting CUI on non-federal (contractor) systems. It’s the technical standard contractors must meet.

10. What is the CUI Registry?

A publicly available database maintained by NARA that lists all authorized CUI categories, their legal basis, and their handling requirements.

11. What happens when CUI is no longer needed?

It must be formally “decontrolled” and, if being disposed of, destroyed in ways that render it completely unreadable — cross-cut shredding for paper, certified sanitization for digital media.

12. What is CMMC, and does it relate to CUI?

The Cybersecurity Maturity Model Certification is DoD’s program for verifying that defense contractors are actually meeting their cybersecurity and CUI protection obligations. CMMC Level 2 requires compliance with all 110 NIST SP 800-171 controls and applies to organizations handling CUI.

13. What’s the CUI Executive Agent?

That’s NARA — the National Archives and Records Administration — which oversees the entire government-wide CUI program through its Information Security Oversight Office (ISOO).

14. What was wrong with the old system before CUI?

Over 100 different agencies used more than 100 different labels and handling procedures for similar sensitive information. It created confusion, inconsistency, and real security gaps.

15. Where can I get free CUI training?

The Defense Counterintelligence and Security Agency (DCSA) offers free mandatory CUI training through their Center for Development of Security Excellence (CDSE) at cdse.edu or securityawareness.dcsa.mil. It’s available to both DoD personnel and contractors.

Empowering curious minds to explore, learn, and think deeper with Fact Aura.