Markings and data rights
DoD Mandatory CUI Training answers: every knowledge check, explained
Answers to the DoD Mandatory CUI Training knowledge checks, with the DoDI 5200.48 rule behind each one: marking, access, storage, decontrol, destruction.
Nov 13, 202618 questions answered6 sources
The short version
- 1Information is CUI only when a law, regulation, or government-wide policy says so, and access needs a lawful government purpose, not a clearance.
- 2An unclassified CUI document gets CUI in the banner and footer and a designation indicator on the first page. In a classified document, CUI never goes in the banner.
- 3No clearance does not mean no review: public release of CUI still needs a prepublication review.
These are the answers to the six knowledge checks in the DoD Mandatory Controlled Unclassified Information (CUI) Training, the course the Center for Development of Security Excellence (CDSE) runs for the Department of War (DoW). Each answer comes from the course itself, with the rule behind it from DoD Instruction (DoDI) 5200.48, which still carries its Department of Defense title.
The final assessment is a separate exam on the same topics, so the sections after the knowledge checks cover the rest of the course. For the basics, read what CUI is, Basic vs Specified.
Knowledge check answers
Knowledge Check 1: Information may be CUI in accordance with what?
Answer
Law, regulation, or government-wide policy.
Why
CUI is information that a law, regulation, or government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. Executive Order 13526 covers classified information, and the course says agencies must not cite the Freedom of Information Act (FOIA) as a CUI control authority.
Knowledge Check 2: CUI documents should always have a designation indicator in the bottom right corner of the first page. True or false?
Answer
True.
Why
The first page or cover of any document containing CUI, including a classified document with CUI in it, carries a CUI designation indicator. The course places it in the lower right corner. This true-or-false wording is the screen-reader version; the standard version asks you to pick the correctly marked document.
CUI
DEPARTMENT OF GOOD WORKS
(U)Subject: Travel budget review
(CUI)Staff home addresses are listed in Table 1.
(CUI)FY27 travel budget is $40,000.
Designation indicator
Controlled by: Dept of Good Works
Controlled by: Budget Office
CUI Categories: PRVCY, BUDG
LDC: FEDCON
POC: S. Johnson, 703-555-0123
CUI
Illustration only
- 1CUI in the banner, top and bottom
- 2(U) or (CUI) on every portion, if you portion mark
- 3Designation indicator, lower right of the first page
- 4Controlled by: the Component (skip if letterhead names it)
- 5The office that made the call
- 6Every CUI category in the document
- 7Distribution statement or LDC
- 8POC phone or office mailbox
Sources: DoD Mandatory CUI Training, marking screens; DoDI 5200.48, para 3.4.a, 3.4.b and 3.4.f. Mock document, illustration only.
Knowledge Check 3: What is the correct banner marking for UNCLASSIFIED documents with CUI?
Answer
CUI.
Why
The minimum marking is the acronym "CUI" in the banner and footer. Don't add the "U" the way the old U//FOUO marking did. "UNCLASSIFIED//CUI," "CONTROLLED," and "CONTROLLED UNCLASSIFIED INFORMATION" are the wrong choices.
Sources: DoD Mandatory CUI Training, Knowledge Check 3 and Welcome screen; DoDI 5200.48, para 3.4.a-b.
Knowledge Check 4: What is the banner marking for a commingled document containing TOP SECRET, SECRET, and CUI?
Answer
TOP SECRET.
Why
In a classified document, "CUI" does not appear in the banner or footer. Paragraphs that contain only CUI are portion marked "(CUI)," and the warning box on the first page of a multi-page document notes that CUI is present.
Top Secret
(TS)Exercise objectives for the third phase.
(S)Units assigned to the exercise.
(CUI)Contract numbers for range support.
CUI designation indicator
Top Secret
Illustration only
- Banner shows the highest classification: TOP SECRET
- "CUI" never goes in the banner or footer
- CUI-only paragraphs get (CUI)
- First page: CUI note in the warning box (multi-page documents), plus the designation indicator
Sources: DoD Mandatory CUI Training, Knowledge Check 4; DoDI 5200.48, para 3.4.c and 3.4.f. Mock document, illustration only.
Knowledge Check 5: I don't have a security clearance, so I don't have to get a prepublication review. True or false?
Answer
False.
Why
A prepublication and security policy review is required before CUI is approved for public release, including posting to a public website. The course adds that unclassified information needs prepublication review before public release whether or not it was ever controlled.
Your draft
Contains CUI, or unclassified work information
Prepublication and security review
Required with or without a clearance
Public release
Including a public website
Sources: DoD Mandatory CUI Training, Knowledge Check 5; DoDI 5200.48, para 3.3.a(1).
Knowledge Check 6: In order to obtain access to CUI, an individual must first have what?
Answer
A lawful government purpose.
Why
Need-to-know is the test for classified information. For CUI it generally isn't required unless a law, regulation, or government-wide policy says so. The person with authorized possession, knowledge, or control of the CUI decides whether someone has a lawful government purpose. Approval from a supervisor or security manager is not the requirement.
CUI
A lawful government purpose
The person holding the CUI decides. No clearance needed, and need-to-know only where a law or policy requires it.
Classified
- Eligibility (clearance)
- A signed nondisclosure agreement
- A valid need-to-know
Sources: DoD Mandatory CUI Training, Knowledge Check 6 and Access screen; DoDI 5200.48, para 3.1.d and 3.7.b; CDSE Derivative Classification student guide, p. 4 (classified access).
Marking
Who decides whether information is CUI and marks it?
Answer
The authorized holder who creates the document, at the time of creation.
What goes in the CUI designation indicator?
Answer
Five lines: the DoW Component that decided the information is CUI, the office making the determination, every CUI category in the document, the distribution statement or limited dissemination control, and a phone number or office mailbox.
Why
If letterhead or another standard indicator of origin names the Component, that first line can be left off, leaving four. A document with controlled technical information needs the words "Distribution Statement" and the letter, such as Distribution Statement B.
Are portion markings required on CUI?
Answer
Not in an unclassified CUI document. But if you portion mark, every portion is marked: "(CUI)" for CUI and "(U)" for unclassified. In a classified document, CUI portions must be marked "(CUI)."
Can I still mark new documents FOUO?
Answer
No. For Official Use Only (FOUO) is no longer an authorized marking for new DoW documents and materials.
Source
Course, "Welcome" screen. For older FOUO documents, see FOUO and legacy markings.
How do you mark an email with CUI, and what are the cover sheet and SF 902?
Answer
An email needs "CUI" in the banner line and footer plus the designation indicator. A CUI cover page is optional but encouraged. The SF 902 is the label for electronic and other media containing CUI.
Access and dissemination
What are limited dissemination controls?
Answer
Markings that narrow who can receive CUI. DoW uses them for agency-specific CUI it needs to keep within certain audiences.
| Control | Who may receive it |
|---|---|
| NOFORN | No foreign governments, foreign nationals, foreign or international organizations, or non-U.S. citizens |
| FED ONLY | Federal executive branch employees and U.S. armed forces only |
| FEDCON | Federal executive branch employees, U.S. armed forces, and contractors, when sharing furthers the contract's purpose |
| NOCON | No contractors. State, local, and tribal employees may receive it |
| DL ONLY | Only those on an accompanying dissemination list |
Why
Watch for one slip in the course. The narration on its "Limited Dissemination Controls" screen says the indicator "limits dissemination to FED CON, which means Federal only," while the example on screen reads FED ONLY. The CUI Registry defines FEDCON as federal employees and contractors. FED ONLY is the federal-only control.
| Control | Federal staff | Contractors | State, local, tribal | Foreign |
|---|---|---|---|---|
| NOFORN | ✕ | |||
| FED ONLY | ✓ | ✕ | ✕ | ✕ |
| FEDCON | ✓ | ✓ | ✕ | ✕ |
| NOCON | ✕ | ✓ | ||
| DL ONLY | Only the people on the attached dissemination list | |||
Source: CUI Registry, Limited Dissemination Controls (ISOO). A dot means the control itself doesn't limit that group. DL ONLY limits release to a named list.
How can CUI be sent?
Answer
First class mail, parcel post, or bulk shipment. Electronically over approved secure systems or with protections such as PKI or https. Fax is allowed if the sender confirms the receiving machine is protected.
Why
Avoid wireless phone transmission of CUI when other options exist.
First class, parcel post, or bulk
Email and web
Approved systems, PKI, or https
Fax
Only if the receiving end is protected
Wireless phone
Avoid when other options exist
Source: DoD Mandatory CUI Training, CUI Transmission screen.
Safeguarding, decontrol, and destruction
How do you store CUI after hours?
Answer
In unlocked containers, desks, or cabinets if the building provides security for continuous monitoring of access. Otherwise in locked desks, file cabinets, bookcases, or rooms.
Why
During the day, don't read, discuss, or leave CUI where unauthorized people are present. Information systems that hold CUI must meet at least moderate confidentiality, with NIST SP 800-171 for nonfederal systems when the contract requires it.
Does the building provide security that continuously monitors access?
Yes
Unlocked desk, cabinet, or container is fine
No
Locked desk, file cabinet, bookcase, or room
Source: DoDI 5200.48, para 4.1.e(1).
Who decontrols CUI, and when?
Answer
The originator, the original classification authority if a security classification guide names one, or an office designated to decontrol. There is no set timeline unless a law, regulation, or policy sets one.
Why
When CUI is decontrolled, known holders are notified and remove the markings, but they don't have to pull old records just for that. Decontrolled information still needs review before public release.
1
Decide
The originator, the OCA named in an SCG, or a designated office
2
Notify
Known holders are told by email or other means
3
Unmark
Holders remove the CUI markings. No need to pull old records
4
Review
Prepublication review still comes before any public release
Sources: DoDI 5200.48, para 3.3.a(2); DoD Mandatory CUI Training, decontrol screen.
How do you destroy CUI?
Answer
So it is unreadable, indecipherable, and irrecoverable. For paper, the course names cross-cut shredding to 1 mm x 5 mm particles or smaller, or pulverizing.
Why
Process CUI through records management first. If a law or policy sets a destruction method, use that one.
- Cross-cut shred: particles 1 mm x 5 mm or smaller
- Pulverize
- Electronic: unreadable, indecipherable, irrecoverable
- If a law or policy names a method, use that one
Sources: DoD Mandatory CUI Training, Destruction Requirements screen; DoDI 5200.48, para 4.5. Particles drawn at an enlarged scale.
Incidents and training
What do you do if CUI is disclosed without authorization?
Answer
Report it to the Unauthorized Disclosure Program Management Office. The appropriate Military Department counterintelligence organization is notified of all incidents.
Why
No formal inquiry is needed unless someone faces discipline. Sanctions can be administrative, civil, or criminal depending on the category, such as export-controlled technical data.
Report
Unauthorized Disclosure Program Management Office
Notify
The appropriate Military Department counterintelligence organization
Sources: DoD Mandatory CUI Training, Security Incidents screen; DoDI 5200.48, para 3.5.a(4) and 3.9.e.
How often is CUI training required?
Answer
In DoW, initially and then every year.
Why
The governmentwide floor is training at the start and at least once every two years. DoDI 5200.48 sets the stricter annual cycle.
DoW (DoDI 5200.48)
Every year
Initial training, then annual refresher
Governmentwide floor
Every 2 years
At hire, then at least every two years
Sources: DoDI 5200.48, para 2.10.d; 32 CFR 2002.30(c).
What to do next
- Before you mark anything, check the category in the CUI Registry, and in your Component's guidance.
- Put "CUI" top and bottom, and the designation indicator on the first page.
- In a classified document, portion mark CUI and leave it out of the banner.
- Share by lawful government purpose, then check the limited dissemination control.
- Send anything headed for public release through prepublication review.
- Classified information works differently. See the derivative classifier carry-forward guide.
Azcuna's TRACE is one offline viewer for S1000D, MIL-STD-3001 XML, and PDF technical manuals. It keeps the source location and the markings of everything it shows and never modifies the source. It was proposed to NAVAIR under Navy SBIR Phase I topic DON26BZ05-NV078, and the proposal was submitted on September 23, 2026.
Sources
- 1DoD Mandatory Controlled Unclassified Information (CUI) Training · Center for Development of Security Excellence, Defense Counterintelligence and Security Agency
- 2DoD Instruction 5200.48, Controlled Unclassified Information (CUI), March 6, 2020 · Department of Defense
- 332 CFR 2002.4 Definitions · Legal Information Institute, Cornell Law School
- 432 CFR 2002.30 Education and training · Legal Information Institute, Cornell Law School
- 5CUI Registry: Limited Dissemination Controls · Information Security Oversight Office, National Archives
- 6Derivative Classification Student Guide, September 2026 · Center for Development of Security Excellence, Defense Counterintelligence and Security Agency
Where this shows up in our work
- TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.
- BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.