The person who authors or creates a Controlled Unclassified Information (CUI) document is the one who applies the markings and dissemination instructions at the point of creation. Under the National Archives and Records Administration's CUI Program regulation at 32 CFR Part 2002, and the Department of Defense's implementing instruction (DoDI 5200.48), the responsibility starts with the originator, who must mark any document containing CUI before it moves anywhere else. The information owner sets those rules, the originator applies them, and the receiving organization is obligated to preserve and carry forward whatever markings and instructions arrive with the document.

The Originator Is the First Person on the Hook for CUI Markings

The term "originator" carries a specific meaning in the CUI Program: it's the individual or organization that creates or receives a document and is the first to place CUI markings on it. NARA's CUI regulation, 32 CFR 2002.20, requires agencies to mark CUI at the time of creation or when it's received from another source without proper markings. In DoD terms, that duty lands on whoever is drafting the document — the action officer, analyst, contracting specialist, or intelligence professional putting the content together. Nobody downstream can mark a document correctly if the person who created it skipped that step.

The practical consequence is a rule many people miss: the originator cannot simply pass the buck to an information owner, security manager, or classification authority. Those roles set policy and resolve hard cases, but the day-to-day marking action belongs to the author. A common misreading spreads the responsibility across an entire office, which blurs accountability until something leaks and no one can say who was supposed to mark the document. Naming a single responsible originator per document closes that gap.

Originators do not invent designation decisions on the fly. They apply markings for information already designated as CUI by an authorized holder or the designated CUI Registry category that fits the content. When the correct category isn't obvious, the originator escalates rather than guessing. Escalation is a normal part of the job, not a failure of it.

Military and civilian organizations that produce high volumes of CUI often assign a marking review step before release. That review checks the originator's work but does not transfer legal responsibility away from the originator. The originator signs off as the party who knew what the document contained.

Information Owners Set the Rules That Markings Must Follow

An information owner is the official with program or policy responsibility for a category of information. In DoD, that's typically a functional proponent — the office that manages a records series, a personnel system, or a technical program. Owners decide that a given category is CUI, identify which CUI Registry category applies, and publish marking and handling guidance for their community. They are the closest thing to an authority of record for the designation itself, which is why originators should always check owner guidance first.

Owner guidance covers details originators can't safely infer: the required CUI banner, the correct category abbreviation, the limited dissemination controls (such as NOFORN, FEDCON, or FOUO remapped to CUI), and whether the information requires special handling like encryption at rest or restricted storage. DoDI 5200.48 directs DoD components to implement the CUI program through their own issuances, and those issuances typically name the functional owners. Getting owner guidance right prevents the most common originator error: applying a plausible-looking banner with the wrong category or an obsolete control marking.

Information owners are also accountable for the classification-equivalent decisions that pairing CUI categories sometimes requires. When information spans both CUI and classified material, the owner coordinates with the original classification authority so the two marking sets don't contradict each other. That coordination matters because a document with a misapplied CUI and classified mix can be handled at the wrong level by people who trust the banner.

Owners can't make the problem disappear by publishing guidance alone. They are expected to train their communities, audit how their information is marked, and resolve disputes about designation. If an originator applies a marking the owner never authorized, the owner's office is the one that corrects the record and the marking standard going forward.

Authors and Creators Apply Markings Before the Document Leaves Their Hands

The authoring step is where markings actually get applied to a page, a file, an email, or a briefing slide, and the standard is "before the document is disseminated," not "as soon as convenient." When a document was created without proper markings and is discovered later, the originator or a knowledgeable reviewer must apply corrective markings and note the correction without hiding the original problem. Backdating a marking or quietly reissuing a document as if it had always been marked is a records-integrity failure, not a fix.

What an originator actually has to place on the document is specific, and 32 CFR 2002.20 spells out the elements. Each page carries a CUI banner at the top, and documents typically also carry a banner at the bottom and a designation indicator block on the first page or in the header or footer. The designation indicator names the designating agency and the CUI category, and it may name the office of origin and the point of contact. The dissemination instructions — the "who may receive this" portion — sit with that indicator or in the document's handling block, depending on the agency's format guidance.

This is the step where a CUI marking mistake most often first appears, because authors tend to copy an old template rather than build markings from the current category guidance. A document that carries a legacy "For Official Use Only" line where the CUI program now requires a CUI banner is improperly marked even if everyone agrees it's sensitive. Correcting that pattern is part of the originator's job, not a formatting nicety.

For electronic documents, the marking obligation travels with the file. Format guidance generally requires the banner in the document's visible body, and the metadata or distribution controls must reflect the same designation. An author who applies a banner but leaves the file's sharing settings open has created a mismatch between what the document says and what the system permits.

Receivers Must Preserve and Carry Forward Markings They Inherit

A receiving office inherits obligations the moment it accepts a CUI document, and one of those obligations is to leave the markings intact. If a document arrives without markings but content clearly belongs to a known CUI category, the receiving office is expected to mark it and notify the originator or the information owner rather than handle it as ordinary unclassified material. NARA's program guidance treats this containment duty as part of the receiving organization's role, and DoD components typically build it into their own implementing instructions.

Forwarding creates a common failure point. When an employee forwards a CUI email, replies with a file attached, or folds a CUI page into a new briefing deck, the new document is itself a CUI document and must carry the markings and dissemination instructions of the underlying content. This matters most in email because forwarding is frictionless. A dissemination instruction like a NOFORN or FEDCON control still applies when the content is reformatted, and a covering memo doesn't magically convert restricted content into unrestricted content.

Receivers also cannot strip or soften markings simply because a recipient inside their own organization has a need to know. Need-to-know and authorization to receive are different questions, and the dissemination instructions on the document answer the second one. If a receiving office believes the marking is wrong, the correct move is to flag it upstream, not to remove it locally.

Declassification-equivalent action matters here too. A receiver who believes CUI content has lost its underlying authority should route that question to the information owner, who is accountable for designation changes. The receiver's job is preserve, protect, and escalate — not unilaterally re-designate.

The Data Owner, System Owner, and Security Officer Split

In DoD and agency privacy and security regimes, the term "data owner" often gets used where "information owner" is meant. The privacy and records world usually defines the data owner as the official responsible for the data's content, purpose, and handling policy. In practice, the data owner and the information owner are frequently the same person for a given system, but the titles are not interchangeable across every component. When you see guidance that says "the data owner is responsible for marking," that usually means the functional owner who sets designation policy — not every originator who types a document.

System owners are a separate layer. They own the information system, network, or platform where CUI gets stored and transmitted, and they're responsible for enforcing markings at the technical level — configuration, encryption, access control, and audit. A system owner can be faulted for letting CUI sit on an unapproved cloud platform, but the system owner cannot be responsible for whether an individual document carries the right banner. Expecting the information system to catch authoring-level marking mistakes inverts the responsibility chain.

Security officers and CUI program managers act as the enforcement and guidance layer. They run training, respond to incidents, and help resolve ambiguities in markings. They can block an improperly marked document from being released and refer the originator for retraining. What they can't reasonably do is mark every document themselves, and organizations that try to route all marking through a security office create bottlenecks that push originators into unmarked quick-send habits.

The clean way to think about the split is by what each role sees. The information owner sees policy and category. The originator sees the actual content. The system owner sees the platform and configurations. The receiver sees what arrived. Each has a job that the others cannot perform, and no single role covers all of them.

Dissemination Instructions Belong to the Designating Official

Dissemination instructions answer a different question than the CUI category: given that this is CUI, who is allowed to receive it and under what conditions. The designating official — the individual with authority to decide the information is CUI and specify its handling — authorizes the dissemination controls. In DoD, that authority is normally vested in the information owner for a given category, with the originator applying it at the document level.

The most common controls bear recalling. FEDCON restricts dissemination to federal employees and contractors with the appropriate access. NOFORN bars release to foreign nationals, foreign governments, or international organizations. FOUO has been superseded by CUI but still appears in legacy documents, and back-converting a FOUO document to CUI requires applying the current banner and category, not just a text substitution. The CUI Registry maintained by NARA is the authoritative list of categories and their controls, and the dissemination instructions flow from whatever the registry and the owner's implementing guidance say.

Originators sometimes add restrictive language they've seen on similar documents, which creates a real failure. Adding "NOFORN" to a document that the owner never designated NOFORN can effectively deny access the content was meant to have, and the mistake is hard to detect later because the marking looks authoritative. The rule is to place only the dissemination instructions authorized for the specific designation, not to embellish.

Designating officials also decide when dissemination instructions change, such as when a program matures or a partner relationship ends. Those changes flow down to documents as they're created or reviewed, not retroactively unless the owner says so. A document marked FEDCON that later becomes releasable to a multinational partner remains FEDCON on its face until the owner authorizes a change and the markings are corrected.

Training, Audits, and the Enforcement Chain

Responsibility means little without a way to enforce it, and DoD's CUI program sets training and audit obligations that tie the roles together. DoDI 5200.48 and the associated CUI training requirements in DoD Directive 5200.48 (and its predecessors) call for role-appropriate training. NARA's CUI training requirements under 32 CFR 2002.16 specify training for all personnel who handle CUI, with more specific training for those who designate, mark, and decontrol CUI. The training record is what an inspector general or command inspection looks for when asking whether an organization's originators were actually equipped to mark.

Audits usually target failure patterns rather than individual documents. Inspectors pull a sample and check for missing banners, mismatched indicators, forward-and-strip leakage in email, and dissemination controls that no longer match current guidance. The pattern that turns up most often is originators relying on old templates or copying markings forward from legacy FOUO documents. That finding is what drives corrective training requirements and template changes, not individual discipline — although an incident involving actual unauthorized release can trigger administrative action.

The enforcement chain matters to readers trying to figure out who gets blamed when a CUI document is mis-marked. Internally, the originator is first in line. Their supervisor and the command's CUI program manager come next. If a systemic template or tool problem caused the error, the information owner and system owner share responsibility for fixing it. That sequencing is deliberate: it keeps the person closest to the content accountable while turning repeated patterns into a policy remediation task rather than a person-by-person hunt.

Training is also where one edge case usually gets explained. A person can be a receiver today and an originator tomorrow the moment they take CUI content and repackage it into their own product. That switch in role doesn't reset the obligations — it stacks them. The repackaged product inherits the markings and dissemination instructions of the source content, and the person doing the repackaging becomes the originator of the new document.

What the Marking Responsibility Is Not

Not every employee has marking duties, and treating marking as universal accountability causes as many errors as it prevents. A clerk who files a properly marked document isn't the originator of it. A person who overhears a CUI conversation and repeats it isn't applying a marking, because conversation-level control is a separate discipline. Anyone who touches CUI has a general protection duty, but the specific act of applying the correct banner and dissemination instructions belongs to the author of the document, with the owner setting the standard.

Three quick checks help originators apply this in real work. First, place the designation indicator at the point of creation with the category name and originating office. Second, apply dissemination instructions only as authorized by the designating official, not copied from similar documents. Third, when content arrives from another organization, compare the markings against current owner guidance before re-sending, because misapplied markings propagate quickly through forwarding chains.

The safe operating rule, if you only remember one, is this: whoever creates the document is the responsible marking party, whoever owns the information supplies the rule, and whoever receives the document cannot weaken it. That covers the great majority of cases without the originator needing to track every nuance of the CUI Registry on the spot.

If you're unsure whether a specific document requires markings, the answer is almost always contained in the information owner's published guidance, the CUI Registry entry for the relevant category, or your component's CUI program manager. Guessing at a banner is worse than asking, because a wrong marking can be trusted by everyone who sees it last.

The information in this article is general educational information about the CUI Program, not a legal opinion and not a substitute for your agency's or component's official implementing guidance. Applicable requirements can change and can vary by jurisdiction, agency, and contract. Consult your organization's CUI program manager, information owner, or a qualified legal professional for decisions on specific documents or incidents, and follow your organization's reporting procedures for any suspected unauthorized disclosure.

FAQ

Does the person who forwards a CUI email become responsible for marking it?

Yes. Forwarding creates a new act of dissemination, and the forwarder is responsible for keeping the markings and dissemination instructions intact. The forwarder also becomes responsible for ensuring recipients are authorized under the original dissemination instruction. Stripping a banner or forwarding to a broader list without authorization is a reportable CUI incident under most component guidance.

Can I mark a document CUI if my agency's guidance is unclear?

No. If you can't identify the correct category and dissemination instruction from the information owner's guidance or the CUI Registry, escalate before sending. Applying an invented banner can be worse than delay because others trust the marking. Your component CUI program manager is the designated path for resolving ambiguity.

Who has authority to authorize dissemination, such as NOFORN or FEDCON?

The designating official designated by the information owner for that category. Originators do not create dissemination controls on their own authority, and unauthorized controls can improperly deny access. The CUI Registry entry for the category and the owner's implementing guidance are the authoritative sources.

Does the system owner share responsibility for CUI markings?

Only for the technical enforcement of handling requirements, such as encryption, access control, and audit. The system owner isn't responsible for authoring-level banners or dissemination instructions. If a system's template or default configuration produces bad markings, the system owner and information owner share responsibility for fixing the platform.

What happens if a document is mis-marked and later discovered?

The finding is treated as a CUI incident under most component guidance. The originator or reviewing office applies corrective markings without backdating, notifies the information owner, and the incident is evaluated for possible unauthorized disclosure. Repeated template or tool problems usually trigger a policy or configuration fix rather than individual discipline.

Is marking CUI the security officer's job?

No. Security officers and CUI program managers enforce, train, and help resolve ambiguity. They don't mark every document themselves, and routing everything through a security office typically produces bottlenecks and backlogs. The originator remains the responsible marking party.

Do I need to mark a document if the person I'm sending it to should already recognize what it is?

Yes. Markings are what make a document's handling standard visible to everyone who touches it, including people who handle it long after the current recipient forgets the conversation. Originator responsibility exists because need-to-know and mark-to-know are separate obligations.

Does training alone make an originator accountable for correct markings?

Not by itself. Training satisfies the prerequisite, but a documented training record does not excuse a mis-marked document. Accountability typically attaches to the act of creating or disseminating the document with incorrect markings, regardless of whether the person completed their annual training.