CUI Marking Generator

Overview & Role#

The CUI Marking Generator (slug: cui-marking-generator, CLIN 0003 — Cybersecurity & compliance, template family calculator) is a static, browser-only utility that builds compliant banner lines, first-page Designation Indicator Blocks, and portion-marking legends for Controlled Unclassified Information (CUI). It prevents common marking mistakes—such as inventing categories, omitting Limited Dissemination Controls (LDCs), or applying retired legacy markings—by constraining selections to the bundled NARA CUI Registry.

Scope boundaries:

• Generates text markings for unclassified CUI only.
• Does not cover classified information markings, ITAR/EAR export-control legends beyond CUI Specified categories, or agency-specific Security Classification Guides (SCGs) that supersede general marking rules.
• Does not decide whether information qualifies as CUI; the contracting agency determines what is CUI under the contract.

Governing Regulations & Sources#

• 32 CFR Part 2002 (Controlled Unclassified Information), specifically § 2002.20 (Marking): Establishes government-wide CUI banner, designation indicator, portion marking, and legacy-marking retirement rules.
• NARA CUI Registry (archives.gov/cui): Authoritative list of CUI Basic and CUI Specified categories, category markings, and Limited Dissemination Controls (FEDCON, NOFORN, NOCON, DL ONLY, FED ONLY, REL TO, DISPLAY ONLY).
• DoD Instruction 5200.48 (Controlled Unclassified Information) and dodcui.mil marking guidance: Establishes Department of Defense practice requiring the CUI banner at both the top and bottom of every page and the standardized 5-line Designation Indicator Block.

Inputs, Processing Logic & Outputs#

Inputs

• Marking profile: NARA Standard (32 CFR 2002) (top-of-page banner) or DoD (DoDI 5200.48) (top-and-bottom banner).
• CUI Categories: Multi-select from the bundled NARA CUI Registry lookup table (including category code, full name, and Basic vs Specified flag—e.g., CTI, EXPT, PRVCY, PROCURE, SSEL, PROPIN, CRIT).
• Limited Dissemination Controls (LDCs): Optional multi-select from the bundled NARA LDC table (e.g., FEDCON, NOFORN, NOCON, DL ONLY, REL TO [country list]).
• Designation Indicator fields:
  • controlledByAgency: Department, Agency, or DoD Component name
  • controlledByOffice: Optional originating office or program
  • poc: Point of contact name and phone number or email
  • decontrol: Optional decontrol date or event
• Portion marking toggle: Boolean (includePortionGuidance) for (CUI) / (U) paragraph marking rules.

Deterministic Processing Logic

1. Category & legacy validation:
   • Rejects any category code not present in the bundled NARA CUI Registry.
   • Detects and blocks retired legacy markings (FOUO, For Official Use Only, SBU, LES) with an explanatory notice citing 32 CFR § 2002.20.
2. Banner string construction:
   • Start with CUI.
   • If one or more CUI Specified categories are selected, append //SP-<CAT1>/<CAT2> (category markings sorted deterministically). CUI Basic categories are recorded in the Designation Indicator Block rather than added to the banner unless required by agency policy.
   • If one or more LDCs are selected, append //<LDC1>/<LDC2>.
   • Example: CTI (Specified) + FEDCON → CUI//SP-CTI//FEDCON.
   • If only CUI Basic categories and no LDCs are selected → CUI.
3. Designation Indicator Block construction:
   • Formats the standardized block using the validated inputs:

     Controlled by: <controlledByAgency>
     Controlled by: <controlledByOffice>
     CUI Category: <Registry Category Names / Codes>
     Limited Dissemination Control: <LDCs or None>
     POC: <poc>
     

   • Appends Decontrol on: <decontrol> only when provided.
4. Portion marking rule: When enabled, emits (CUI) and (U) markers with the mandatory rule that if portion marking is used anywhere in a document, it must be applied throughout the entire document.

Outputs

• Banner line with placement guidance (top of every page for NARA; top and bottom of every page for DoD).
• Copy-ready Designation Indicator Block.
• Portion marking legend (when enabled) and compliance reminders (do not over-mark non-CUI; CUI remains CUI until formally decontrolled).

Clean-Room & 5-Condition QA Requirements#

• Browser-only execution: All banner formatting and registry lookups run locally in JavaScript with zero server calls.
• Strict Content Security Policy: Enforces default-src 'self', connect-src 'self', and form-action 'none' so agency, office, and POC details never leave the workstation.
• Zero tracking or accounts: No sign-in, no analytics, no cookies, and no third-party font or script requests.
• Offline operation: The NARA CUI Registry category table and LDC list are bundled statically in the repository; the tool works with the network disconnected.
• Clean-room & data hygiene: Worked examples use synthetic agency and POC values. Includes MIT LICENSE, citations to 32 CFR Part 2002 and DoDI 5200.48, and explicit scope exclusions.

Worked Example & Verification#

Worked Example (DoD CUI Specified + LDC):

• Inputs:
  • Profile: DoD (DoDI 5200.48)
  • Category: CTI (Controlled Technical Information — CUI Specified)
  • LDC: FEDCON
  • Controlled by: Department of the Navy / NAVSEA PMS 400
  • POC: J. Smith, 555-0142 / [email protected]
• Expected Banner: CUI//SP-CTI//FEDCON (top and bottom of every page).
• Expected Designation Indicator Block:

  Controlled by: Department of the Navy
  Controlled by: NAVSEA PMS 400
  CUI Category: Controlled Technical Information (CTI)
  Limited Dissemination Control: FEDCON
  POC: J. Smith, 555-0142 / [email protected]
  

Boundary & Edge-Case Assertions:

• Basic category only (PRVCY), no LDC → banner is CUI.
• Missing controlledByAgency or poc → validation warning highlights required Designation Indicator fields before export.
• Entering FOUO in a category field → rejected with legacy-marking warning.

Related pages#

• Protecting government information
• What happens to what you type
• The pipeline and its ten workers
• Shakedown specification