FOUO and other legacy markings: what replaced them

Legacy markings are the labels agencies put on sensitive unclassified information before the Controlled Unclassified Information (CUI) program, such as For Official Use Only (FOUO). Under the CUI program, markings apply only to information types on the CUI Registry that are tied to a law, regulation, or government-wide policy. The National Archives (NARA) CUI frequently asked questions (FAQ) page says that once agencies implement the program, legacy markings such as FOUO or Sensitive But Unclassified (SBU) "will no longer be used." Inside the Department of Defense (DoD), the change came with DoD Instruction (DoDI) 5200.48, effective March 6, 2020.

What the old markings were

A June 6, 2018 records schedule review package from NARA's Office of the Chief Records Officer gives the history. A Presidential memorandum of May 9, 2008 introduced the CUI designation to replace overlapping and sometimes idiosyncratic categories. The package names FOUO, SBU, and Law Enforcement Sensitive (LES) as examples. Executive Order 13556 superseded the memorandum on November 4, 2010.

The CUI Marking Handbook, Version 1.1 of December 6, 2016, defines legacy information as unclassified information that was restricted or otherwise controlled before the CUI program. The handbook uses "LEGACY MARKING" as a stand-in for any ad hoc agency marking of that kind.

DoD's own definition of FOUO survives in DoD Manual 5200.01, Volume 2. Paragraph 10.b of Enclosure 4 describes FOUO as a control marking for unclassified information that may be withheld from the public if disclosure would reasonably be expected to cause a foreseeable harm to an interest the Freedom of Information Act protects. In a classified document, the manual marks FOUO portions (U//FOUO) and keeps FOUO out of the banner line, except where page markings are used.

What DoD Instruction 5200.48 changed

DoDI 5200.48 cancels DoD Manual 5200.01, Volume 4, the February 24, 2012 CUI manual. Paragraph 1.2.a ties the instruction to a phased implementation endorsed in an August 21, 2019 Information Security Oversight Office (ISOO) memorandum.

Paragraph 3.4 sets the minimum marking. An unclassified DoD document with CUI carries "CUI" in the banner and footer. If portion marks are used, CUI portions are marked (CUI) and unclassified portions (U). Paragraph 3.4.b.(1) adds that there is no requirement to add the "U" to the banner and footer, as the old U//FOUO form required.

The NARA FAQ explains why FOUO does not convert automatically. NARA describes U//FOUO as a legacy marking based on agency policy or practice, not on the CUI Registry. In some cases, NARA says, former FOUO information aligns with CUI and is marked as CUI.

One DoD legacy marking was kept. Paragraph 3.4.l says DoD will continue to use Limited Distribution, marked LIMDIS, for geospatial intelligence information, instead of the Geodetic Product Information designation.

Where the old wording lingers

The DoD marking manual still carries FOUO language. The Volume 2 text, incorporating Change 4 of July 28, 2020, says FOUO markings remain in effect "until the revised Volume 4 of this Manual is published." The same volume's banner examples include UNCLASSIFIED//FOR OFFICIAL USE ONLY. DoDI 5200.48, effective March 6, 2020, cancelled Volume 4. Both texts were read from copies of the DoD issuances site captured in 2026, and the two conflict on their face.

Legacy distribution statements are handled separately. Paragraph 4.3 of DoDI 5200.48 says legacy CUI technical documents requiring export control used distribution statements under DoDI 5230.24. From the effective date, new CUI uses limited dissemination controls, except export-controlled technical information, which must carry an export control warning under DoDI 5230.24.

Classified holdings carry a rule of their own. Paragraph 3.4.e says all classified documents, including legacy documents, are reviewed for CUI when their classification level changes, particularly on full declassification.

Legacy material that is reused

The national rule is section 2002.36 of Title 32 of the Code of Federal Regulations (CFR). Paragraph (a) requires agencies to review documents created before November 14, 2016 and re-mark any that contain CUI. When they do not re-mark individually, they use an alternate method under section 2002.20(a)(8), such as user access agreements, a system splash screen, or signs on storage areas. Paragraph (c) says that when an agency reuses CUI from legacy documents, the new document is designated and marked as CUI.

Waivers do not survive reuse. Under section 2002.38(b), an agency's CUI senior agency official may waive re-marking of large stores of legacy material as excessively burdensome. On reuse, the holder must still remove or redact the legacy markings and mark the information as CUI. The NARA FAQ defines reuse as incorporating, restating, or paraphrasing information into a newly created document.

DoDI 5200.48 states the DoD version in paragraph 3.2. Legacy documents need not be re-marked while they remain under DoD control, including on DoD access-controlled websites. They must be marked as CUI if they qualify and are shared outside DoD. Legacy information does not automatically become CUI, and its owner reviews it. Under paragraph 3.2.d, legacy information incorporated into or cited in another document is reviewed for CUI and marked.

What to check

• Was a document marked FOUO, SBU, or LES created before its originator implemented the CUI program?
• Does a new document that reuses legacy text carry CUI markings where the information type is on the CUI Registry?
• Were the legacy markings removed or redacted from the reused material, as section 2002.38(b)(2) requires?
• Is a DoD legacy document being shared outside DoD, the point at which DoDI 5200.48 requires CUI marking if it qualifies?
• Does guidance on FOUO cite DoD Manual 5200.01, Volume 4, which DoDI 5200.48 cancelled?

Azcuna's TRACE is one offline viewer for S1000D, MIL-STD-3001 XML, and PDF technical manuals. It keeps the source location and the markings of everything it shows and never modifies the source. It was proposed to NAVAIR under Navy SBIR Phase I topic DON26BZ05-NV078, and the proposal was submitted on September 23, 2026.

Sources

1. 1DoD Instruction 5200.48, Controlled Unclassified Information (CUI), March 6, 2020 · Office of the Under Secretary of Defense for Intelligence and Security (esd.whs.mil copy captured May 31, 2026, Internet Archive)
2. 232 CFR 2002.36 Legacy materials · Electronic Code of Federal Regulations
3. 332 CFR 2002.38 Waivers of CUI requirements · Electronic Code of Federal Regulations
4. 432 CFR 2002.20 Marking · Electronic Code of Federal Regulations
5. 5CUI Frequently Asked Questions · National Archives and Records Administration
6. 6Marking Controlled Unclassified Information, Version 1.1 (CUI Marking Handbook), December 6, 2016 · Information Security Oversight Office
7. 7Agency Review Package: Additions to Information Access and Protection Records (GRS 4.2) · National Archives, Office of the Chief Records Officer (June 6, 2018)
8. 8DoD Manual 5200.01, Volume 2, DoD Information Security Program: Marking of Information (February 24, 2012, incorporating Change 4, July 28, 2020) · Office of the Under Secretary of Defense for Intelligence and Security (esd.whs.mil copy captured February 2, 2026, Internet Archive)

Where this shows up in our work

• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.