What is NOFORN?

NOFORN, short for Not Releasable to Foreign Nationals, is a dissemination control marking. It tells the holder that the information may not be given in any form to foreign governments, international organizations, or foreign nationals. The marking lives in two systems at once. On classified documents it follows the classification level in the banner line, as in SECRET//NOFORN, under 32 CFR 2001.24 and the Department of Defense (DoD) marking manual. On Controlled Unclassified Information (CUI) it is one of the limited dissemination controls the CUI Registry lists, as in CUI//SP-CTI//NOFORN. This page covers both uses, the REL TO marking that is the usual alternative, the other dissemination controls, and what public documents say about foreign disclosure decisions under National Disclosure Policy.

NOFORN meaning: a dissemination control, not a classification

The classified system allows only three classification levels. Section 1.2 of Executive Order 13526, signed December 29, 2009, names them as Top Secret, Secret, and Confidential. Everything else on a banner line is a control marking. Paragraph (j) of 32 CFR 2001.24, the Information Security Oversight Office (ISOO) implementing directive, says dissemination control and handling markings identify the expansion or limitation on the distribution of the information, and that they are in addition to, and separate from, the level of classification. Paragraph (j)(2) allows only markings approved by ISOO or, for intelligence, by the Director of National Intelligence (DNI), and requires them to be uniform, binding on all agencies, and available in a central registry. Paragraph (j)(3) puts them at the top and bottom of each page, after the classification level.

So a document can be Confidential and NOFORN, or Top Secret and releasable to several allies. The classification says how much damage unauthorized disclosure could do; the dissemination control says who may receive the information. Section 4.1(a) of the order sets the baseline for any access to classified information: a favorable eligibility determination, a signed nondisclosure agreement, and a need to know. Section 4.1(i)(2) adds that classified information originating in one agency may be disseminated by another agency to a foreign government in accordance with statute, the order, its implementing directives, the direction of the President, or with the consent of the originating agency. NOFORN records an originator's decision to withhold that consent in advance.

The CUI system draws the same line. Paragraph (dd) of 32 CFR 2002.4 defines a limited dissemination control as any control approved by the CUI Executive Agent that agencies may use to limit or specify CUI dissemination. The CUI control marking says the information is controlled; the category marking says why; the limited dissemination control says to whom it may go.

NOFORN on classified documents

The ISOO training booklet Marking Classified National Security Information, Revision 4 of January 2018, covers the required elements of a classified marking and notes that some agencies require additional dissemination and control markings alongside the overall classification. The booklet does not define NOFORN; its Section 5 covers the related Foreign Government Information (FGI) marking. The detailed rules for DoD documents are in DoD Manual 5200.01, Volume 2, dated February 24, 2012 and incorporating Change 4 effective July 28, 2020.

Enclosure 4 of the manual gives the banner syntax for a classified U.S. document as CLASSIFICATION//SCI//SAP//AEA//FGI//DISSEM//OTHER DISSEM. Double forward slashes separate the marking categories and single slashes separate items within a category. Figure 25 lists the dissemination controls in the eighth position, Not Releasable to Foreign Nationals among them, and when more than one applies they appear in the order of the figure. Control markings must appear in both the banner line and the portion markings, and the unclassified portions of such a document are marked (U).

Section 2 of Enclosure 4 is the NOFORN rule. The manual calls NOFORN an intelligence control marking for intelligence that the originator has determined meets the criteria of Intelligence Community Directive (ICD) 710 and that may not be provided in any form to foreign governments, including coalition partners, international organizations, foreign nationals, or immigrant aliens without the originator's approval. Within the DoD, NOFORN is authorized only on intelligence and intelligence-related information under the purview of the DNI, with three exceptions: Naval Nuclear Propulsion Information (NNPI), the National Disclosure Policy document (NDP-1), and cover and cover support information. The manual states that "there is no authorized DoD use for the NOFORN caveat on non-intelligence information" beyond those exceptions, requires training so the marking is not applied elsewhere, and encourages classification challenges when misuse is detected. The reference list shows that Directive-Type Memorandum 05-008 of May 17, 2005, on the NOFORN caveat on DoD information, was cancelled by this volume.

Appendix 1 to Enclosure 4 gives the form. NOFORN may be used only with Top Secret, Secret, Confidential, or CUI. The banner reads TOP SECRET//NOFORN and the portion mark is (TS//NF). Figure 58 shows a SECRET//NOFORN banner on a document with one NOFORN portion and one REL TO USA, JPN portion. Paragraph 2.g of the enclosure adds that all existing requirements for a positive foreign disclosure decision before release to a foreign government still apply under DoD Directives 5230.11 and 5230.20, so a document without NOFORN is not automatically releasable.

ICD 710, dated June 21, 2013, is the DNI side of the rule. Section D.1.b says the Intelligence Community (IC) markings system is implemented through the Controlled Access Program Coordination Office (CAPCO) Register and Manual, and Section E.2 lists ORCON, IMCON, PROPIN, REL TO, RELIDO, and NOFORN as dissemination control markings. Section E.5 requires originators to mark classified analytic products explicitly with one of NOFORN, REL TO, RELIDO, or DISPLAY ONLY; an unmarked product created on or after June 28, 2010 is handled as if marked RELIDO.

NOFORN on CUI

The CUI Registry's Limited Dissemination Controls page lists NOFORN with the portion marking NF and defines it as information that may not be disseminated in any form to foreign governments, foreign nationals, foreign or international organizations, or non-U.S. citizens. The page states that only the designating agency may apply limited dissemination controls to CUI, either when it designates the information or by approving a later request from an authorized holder, and that using them to restrict access unnecessarily runs against the goals of the CUI Program.

Paragraph (b)(4) of 32 CFR 2002.16 is the regulation behind that page. Agencies may limit dissemination only through controls the CUI Executive Agent lists in the Registry, only when a control furthers a lawful Government purpose or an authority requires or permits it, and an authorized holder should not apply one when significant doubt remains after consulting the designating agency's policy. Paragraph (b)(3) of 32 CFR 2002.20 makes these markings the third element of the CUI banner, after the control marking and any category markings.

Inside the DoD, DoD Instruction 5200.48, effective March 6, 2020, narrows the field. Paragraph 3.4.d calls NOFORN or NF an intelligence control marking under ICD 710 and Intelligence Community Policy Guidance 403.1, requires it on controlled unclassified intelligence information that is properly CUI, and says such CUI will not be provided in any form to foreign governments, including coalition partners, international organizations, foreign nationals, or other non-U.S. persons without the originator's approval. The marking is applied only when warranted, after a Foreign Disclosure Officer confirms that no international agreement prohibits its use. Paragraph 3.4.d(2) names the non-intelligence information that carries it: NNPI, Unclassified Controlled Nuclear Information (UCNI), NDP-1 information, and cover and cover support information, plus, when warranted, CUI with a licensing or export control requirement. Paragraph 3.9 adds that CUI not controlled as NOFORN may be released to foreign governments, coalitions, or allied personnel in accordance with a law, regulation, or Government-wide policy, and to non-U.S. citizens employed by the DoD when access is within their duties, would help accomplish a lawful DoD mission, and is not barred by a contract restriction.

The DoD CUI Program's NOFORN FAQ answers the questions people type. It lists the information to which NOFORN can be applied on CUI (unclassified intelligence, NNPI, DoD UCNI, and NDP-1), asks designators to consider whether REL TO would serve information sharing better, and says permanent residents and green card holders are U.S. persons but cannot have access to NOFORN information. A dual citizen can, provided one citizenship is U.S. and the person is working for or on behalf of the U.S. Government.

The CUI limited dissemination controls

The Registry page lists ten controls. The DoD CUI Program's version adds a row for the absence of any control, which means anyone with a lawful Government purpose may have access but does not authorize public release. The table below draws on both pages and on Table 2 of DoDI 5200.48, which aligns the controls with distribution statements.

The SP- prefix in a banner such as CUI//SP-CTI is not a dissemination control. The CUI Marking Handbook, Version 1.1 of December 6, 2016, puts category markings, including Specified ones with the SP- prefix, in the second banner element and limited dissemination controls in the third, each element behind a double forward slash, with multiple controls alphabetized and separated by single slashes. Only controls found in the Registry may be used with CUI.

Table 2 matters for technical data. Paragraph 4.3 of DoDI 5200.48 says that as of March 6, 2020, DoD personnel use limited dissemination controls on new CUI, except export-controlled technical information, which must still carry the export control warning and a distribution statement under DoDI 5230.24. The wording of a distribution statement may not be modified to add distribution to foreign governments, but REL TO or NATO markings may be added to inform distribution decisions. Paragraph 4.2 adds that neither controls nor distribution statements may restrict CUI access unnecessarily.

REL TO and how a release list is written

REL TO, short for Authorized for Release To, is the positive marking. The Registry defines REL TO USA, LIST as information the designating agency has predetermined to be releasable, or has released, only to the foreign countries or international organizations indicated, through established foreign disclosure procedures and channels. The DoD CUI Program page adds the practical reading: the information is NOFORN to every country and organization not on the list.

The list has a fixed order. The Registry says USA appears first, then trigraph country codes in alphabetical order, then tetragraph codes for coalitions or international organizations in alphabetical order. Paragraph 10.d(4) of Enclosure 4 of DoDM 5200.01 Volume 2 gives the same rule for classified documents, with each code separated from the next by a comma and a space, so a banner reads SECRET//REL TO USA, AUS, CAN, GBR or TOP SECRET//REL TO USA, EGY, ISR. The codes come from two lists the Registry links. The trigraph list follows ISO 3166 and runs alphabetically by country name from AFG for Afghanistan to ZWE for Zimbabwe, with USA for the United States of America. The tetragraph taxonomy, published by the Office of the Director of National Intelligence on December 1, 2022, maps each four-letter code to its members; FVEY stands for Five Eyes and decomposes to USA, AUS, CAN, GBR, and NZL, and NATO has its own entry.

The DoD manual adds rules that catch people out:

• USA attached to REL TO means the information is U.S.-originated and may go to U.S. citizens who meet the access standards and have a need to know. "REL TO USA" with no other country is not an approved marking.
• The portion mark (S//REL) may be used when the portion's country list matches the banner's. If the lists differ, the portion must spell out all applicable countries.
• REL TO and NOFORN never share a banner line. When a document contains both NOFORN and REL TO portions, the banner carries NOFORN.
• REL TO goes in the banner only when the entire document is releasable to the listed countries. In a DoD document outside the Defense Intelligence Components, a mix of REL TO portions and uncaveated portions gives a banner with only the U.S. classification. The IC marks the same mix NOFORN in the banner, because ICD 710 requires intelligence to be explicitly marked for foreign release; the manual says DoD organizations outside the IC may not follow that practice.
• Release to the listed nations needs no further originator approval. Release to any nation not listed requires the originator's permission.

For CUI, paragraph 3.4.d(3) of DoDI 5200.48 allows REL TO on export-controlled CUI only when a foreign disclosure agreement is in place, and on DoD operational CUI not related to intelligence.

DISPLAY ONLY and RELIDO

DISPLAY ONLY is the middle ground between NOFORN and REL TO. Paragraph 10.e of Enclosure 4 of the DoD manual describes it as classified information authorized for disclosure without providing the recipient a copy for retention, regardless of medium, through foreign disclosure channels to the named country or organization. The information must remain under U.S. control at all times. The format is classification//DISPLAY ONLY followed by country codes, as in SECRET//DISPLAY ONLY AFG. DISPLAY ONLY may not be used with RELIDO or NOFORN and appears in the banner only if every portion is authorized for display to the same list. The Registry gives the CUI form as DISPLAY ONLY USA, LIST with the same ordering rule as REL TO.

RELIDO, Releasable by Information Disclosure Official, is a permissive marking for national intelligence. The manual says it tells the holder that the originator has authorized Designated Intelligence Disclosure Officials, or their designees, to make further release determinations. It may stand alone, as in SECRET//RELIDO, or follow a REL TO list, as in (S//REL TO USA, AUS, CAN/RELIDO). When NOFORN and RELIDO portions share a document, NOFORN takes the banner.

NOFORN on classified versus NOFORN on CUI

The marking means the same thing in both systems. The rules around it differ.

The CUI Marking Handbook covers the case where the two systems meet: a commingled document, where CUI sits inside a classified document. The banner lists the classification first and the CUI elements after, as in SECRET//CUI//SP-AAAA/SP-BBBB//DISSEM in the handbook's placeholder form, and the dissemination control applies to the whole document and appears in every portion to which it applies.

Foreign disclosure and NDP-1

A marking records a disclosure decision; it does not make one. The DoD manual's reference list cites National Disclosure Policy-1, the National Policy and Procedures for the Disclosure of Classified Military Information to Foreign Governments and International Organizations, dated October 2, 2000. The Defense Security Cooperation Agency manual cited below marks the implementing directive, DoDD 5230.11, Not for Public Release. What follows is limited to what public sources say.

Chapter 3 of the Defense Security Cooperation Agency's Security Assistance Management Manual is the fullest public account. Section C3.2.1 says DoDD 5230.11 implements NDP-1 and that classified military information may be shared with foreign governments only when there is a clearly defined benefit to the United States. Section C3.2.3 names the National Disclosure Policy Committee as the central authority for national disclosure policy. Each DoD component headquarters appoints a Principal Disclosure Authority and subordinate commands appoint Designated Disclosure Authorities; a commitment to disclose controlled information must be authorized by one of them. Most exceptions to NDP-1 are granted or denied by the committee. Section C3.2.4 says proposals are evaluated case by case, that an affirmative decision needs consent from the originating component's disclosure authority and, if the information is not already marked for disclosure, written consent from the original classification authority, and that authorizations are recorded in the National Disclosure Policy System. Section C3.5.4.2 extends the review to CUI, which must go through foreign disclosure channels before release to a foreign government or international organization.

DoDI 5200.48 ties this back to markings. Paragraph 3.7.c(2) says controlled technical information under DFARS 252.204-7012, a clause DoD now applies in the deviation text of Class Deviation 2026-O0025, Revision 3, is subject to NDP-1 and can become classified by compilation. Paragraph 3.4.d(3)(a) requires a positive foreign disclosure decision under DoDDs 5230.11 and 5230.20 before CUI is released to a foreign entity, on top of the Arms Export Control Act and export regulations. In the intelligence system, ICD 710 section E.5.e says foreign disclosure and release decisions must be consistent with ICD 403. The pattern is the same everywhere: the disclosure official decides, and REL TO, DISPLAY ONLY, or RELIDO records the decision on the page.

What to check

• Does the banner carry NOFORN, REL TO, DISPLAY ONLY, or RELIDO, and does every portion that needs the control carry it too?
• Is the REL TO list in order: USA first, trigraphs alphabetically, then tetragraphs alphabetically, each separated by a comma and a space?
• If a portion is marked (S//REL), does its country list match the banner's list?
• On a DoD classified document, is the information intelligence, NNPI, NDP-1, or cover information? If not, DoDM 5200.01 Volume 2 does not authorize NOFORN on it.
• On a CUI document, did the designating agency apply the control, and does a DoD technical document also carry the distribution statement or export control warning DoDI 5200.48 still requires?
• Before showing anything to a foreign national, including a green card holder or a coalition partner, has a disclosure authority made a positive decision, or does the marking already record one?

Azcuna's TRACE is one offline viewer for S1000D, MIL-STD-3001 XML, and PDF technical manuals. It keeps the source location and the markings of everything it shows and never modifies the source. It was proposed to NAVAIR under Navy SBIR Phase I topic DON26BZ05-NV078, and the proposal was submitted on September 23, 2026.

Questions people ask

What does NOFORN mean?

NOFORN stands for Not Releasable to Foreign Nationals. The CUI Registry defines it as information that may not be disseminated in any form to foreign governments, foreign nationals, foreign or international organizations, or non-U.S. citizens. DoD Manual 5200.01 Volume 2 gives the same meaning for classified documents and adds that release needs the originator's approval. NOFORN is a dissemination control, so it limits who may see the information; it is not a classification level.

Is NOFORN a classification level?

No. 32 CFR 2001.24(j) says dissemination control and handling markings are in addition to, and separate from, the level of classification, which under Executive Order 13526 can only be Top Secret, Secret, or Confidential. NOFORN appears after the classification in the banner line, as in SECRET//NOFORN, and it also appears on unclassified CUI, as in CUI//SP-CTI//NOFORN. A document can be Confidential and NOFORN or Top Secret and releasable to allies.

What is the difference between NOFORN and REL TO?

NOFORN bars release to any foreign government, organization, or national. REL TO USA, LIST means the originator has already decided the information is releasable to the countries and organizations named, through foreign disclosure channels. DoDM 5200.01 Volume 2 says release to the listed nations needs no further originator approval, release to anyone else does, and the two markings never share a banner line: when a document has both NOFORN and REL TO portions, the banner carries NOFORN.

How is a REL TO country list written?

DoDM 5200.01 Volume 2 gives the format as classification//REL TO followed by country codes. USA is listed first, then other countries by their three-letter trigraph in alphabetical order, then coalition or international organization tetragraphs such as FVEY or NATO in alphabetical order, each separated by a comma and a space. The CUI Registry uses the same order for CUI. REL TO USA with no other country is not an approved marking.

Can NOFORN be used on CUI?

Yes. The CUI Registry lists NOFORN as a limited dissemination control, with the portion marking NF, and only the designating agency may apply it. DoD Instruction 5200.48 limits DoD use to unclassified intelligence information that is properly CUI, Naval Nuclear Propulsion Information, Unclassified Controlled Nuclear Information, National Disclosure Policy information, cover and cover support information, and, when warranted, CUI with a licensing or export control requirement, each after review by a Foreign Disclosure Officer.

Can a green card holder see NOFORN information?

The DoD CUI Program's NOFORN FAQ says permanent residents and green card holders are U.S. persons but cannot have access to NOFORN information. The same page says a dual citizen can have access provided one citizenship is U.S. and the person is working for or on behalf of the U.S. Government. The CUI Registry's definition of NOFORN also bars dissemination to non-U.S. citizens.

What are limited dissemination controls?

32 CFR 2002.4 defines a limited dissemination control as any CUI Executive Agent-approved control that agencies may use to limit or specify CUI dissemination. The Registry lists ten: NOFORN, FED ONLY, FEDCON, NOCON, DL ONLY, RELIDO, REL TO USA LIST, DISPLAY ONLY USA LIST, Attorney-Client, and Attorney-WP. Under 32 CFR 2002.16(b)(4), only the designating agency may apply them, they may be combined, and unnecessary use is contrary to the goals of the CUI Program.

What do FED ONLY and FEDCON mean?

Both are CUI limited dissemination controls. The CUI Registry says FED ONLY limits dissemination to employees of executive branch agencies and to armed forces personnel, including Active Guard and Reserve. FEDCON covers the same people plus individuals or employers who hold a contract with the U.S. Government, as long as dissemination furthers the contract. Table 2 of DoD Instruction 5200.48 aligns FED ONLY with Distribution Statement B and FEDCON with Distribution Statement C.

What is DISPLAY ONLY?

DISPLAY ONLY USA, LIST is a dissemination control for information that may be shown to the named foreign countries or organizations without giving them a copy to keep, in any medium. The CUI Registry lists it for CUI, and DoDM 5200.01 Volume 2 describes it for classified information, adding that the information must stay under U.S. control at all times and that DISPLAY ONLY may not be used with RELIDO or NOFORN.

What is NDP-1?

NDP-1 is the National Policy and Procedures for the Disclosure of Classified Military Information to Foreign Governments and International Organizations. DoDM 5200.01 Volume 2 cites the October 2, 2000 edition. The Defense Security Cooperation Agency's Security Assistance Management Manual says the National Disclosure Policy Committee administers it, that disclosure authorities evaluate each proposal case by case, and that DoD Directive 5230.11 implements it. The directive itself is not public.

Sources

1. 132 CFR 2001.24 Additional requirements · U.S. Government Publishing Office (GovInfo)
2. 2Executive Order 13526, Classified National Security Information · National Archives and Records Administration (Information Security Oversight Office)
3. 3Marking Classified National Security Information, Revision 4, January 2018 · National Archives and Records Administration (Information Security Oversight Office)
4. 4DoD Manual 5200.01, Volume 2, DoD Information Security Program: Marking of Information, February 24, 2012, Incorporating Change 4, July 28, 2020 · Office of the Under Secretary of Defense for Intelligence and Security
5. 5Intelligence Community Directive 710, Classification Management and Control Markings System, June 21, 2013 · Office of the Director of National Intelligence
6. 632 CFR 2002.4 Definitions · U.S. Government Publishing Office (GovInfo)
7. 732 CFR 2002.16 Accessing and disseminating · U.S. Government Publishing Office (GovInfo)
8. 832 CFR 2002.20 Marking · U.S. Government Publishing Office (GovInfo)
9. 9CUI Registry: Limited Dissemination Controls · National Archives and Records Administration
10. 10Trigraph Country Codes for Use with Limited Dissemination Controls for CUI · National Archives and Records Administration
11. 11Tetragraph Taxonomy for ISMCAT, Version 2022-NOV, December 1, 2022 · Office of the Director of National Intelligence (hosted by the National Archives CUI Registry)
12. 12CUI Marking Handbook, Version 1.1, December 6, 2016 · National Archives and Records Administration (Information Security Oversight Office)
13. 13DoD Instruction 5200.48, Controlled Unclassified Information (CUI), March 6, 2020 · Office of the Under Secretary of Defense for Intelligence and Security
14. 14CUI Limited Dissemination Controls · DoD CUI Program
15. 15Not Releasable to Foreign Nationals (NOFORN) FAQ · DoD CUI Program
16. 16Security Assistance Management Manual, Chapter 3, Technology Transfer and Disclosure · Defense Security Cooperation Agency
17. 17Class Deviation 2026-O0025, Revision 3, Revolutionary FAR Overhaul Part 40, DFARS Part 240 (September 3, 2026) · Defense Pricing, Contracting, and Acquisition Policy (acq.osd.mil)

Where this shows up in our work

• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.