Skip to main content
Comply Defense
Category: Controlled Unclassified Information

CUI Cover Sheet

Also known as: CUI Coversheet, SF-901, Controlled Unclassified Information Coversheet
Simply put

A CUI cover sheet is a page placed on top of a document to signal that it contains Controlled Unclassified Information (CUI). It helps people identify CUI from a distance, alerts anyone nearby that protected information is present, and acts as a physical shield against unauthorized viewing. As of the applicable guidance, using a cover sheet is generally optional rather than a strict requirement, so readers should confirm specific obligations against current official sources.

Formal definition

The CUI cover sheet is a standardized form used to identify the presence of Controlled Unclassified Information on a document, to alert observers from a distance that CUI is present, and to serve as a physical shield protecting the document from unauthorized access and observation. According to the National Archives (ISOO) CUI Program guidance, the coversheets were consolidated to a single fillable form provided at no cost, and agencies may use it. The standardized form is identified by the Department of Defense (via DCSA) as SF-901. Per DoD CUI guidance, the cover sheet can be used to protect a document at any time but is generally not required when documents are secured; note that the cover sheet addresses physical identification and observation only and does not itself satisfy broader CUI safeguarding, marking, or handling requirements, which practitioners must verify against current authoritative sources and any applicable agency-specific policy.

Why it matters

Consistent identification of Controlled Unclassified Information is a persistent weak point in CUI programs, because the same document may pass through many hands, storage locations, and reproduction points where marking gaps can lead to inadvertent disclosure. The CUI cover sheet addresses one specific and practical part of that problem: it lets people recognize from a distance that a document contains protected information, alerts anyone nearby that CUI is present, and physically shields the top page from casual observation, such as on a printer tray, a desk in a shared workspace, or a stack of documents in transit.

The cover sheet's value is also its limitation, and experts caution against overstating it. Per DoD CUI guidance, a cover sheet can be used to protect a document from unauthorized access and observation at any time, but it is generally not required when documents are secured. Just as importantly, the cover sheet addresses physical identification and observation only; it does not by itself satisfy the broader CUI marking, safeguarding, and handling obligations that apply to the underlying document. Treating a cover sheet as evidence of compliance would confuse a visual aid with the full set of controls a CUI program must implement.

Because the cover sheet is generally an optional tool rather than a strict requirement, and because specific obligations can vary by agency policy and evolve across guidance revisions, practitioners should confirm their particular requirements against current authoritative sources rather than assuming a uniform rule. The form itself has been standardized to reduce ambiguity, but its use still sits within each organization's tailored CUI handling procedures.

Who it's relevant to

Information System Security Managers and CUI Program Officials
Those responsible for CUI handling procedures use the cover sheet as one element of physical protection and identification. They should document when and how cover sheets are used within their organization's tailored policy, while making clear to staff that a cover sheet supports, but does not substitute for, the full set of CUI marking and safeguarding requirements.
Government Contractors Handling CUI
Contractors managing CUI on behalf of the government may adopt the standardized cover sheet as a low-cost visual aid, particularly in shared or open work environments. DCSA references the CUI Cover Sheet (SF-901) among its industry resources, but contractors should confirm their specific obligations against current DoD and agency guidance rather than assuming cover sheet use satisfies contractual CUI protection requirements.
Compliance Officers and Auditors
Auditors assessing CUI handling should evaluate cover sheet use in context: its presence indicates an intent to identify and shield CUI physically, but its absence does not necessarily indicate non-compliance, since use is generally optional and situational. Reviewers should distinguish this physical identification aid from the broader marking, safeguarding, and handling controls that determine overall CUI compliance.
Personnel Who Print, Reproduce, or Transport CUI Documents
Staff who handle physical CUI benefit most directly from the cover sheet, which helps prevent inadvertent observation at printers, on desks, or during transit. These users should understand that securing the document remains the primary protection and that the cover sheet is a supplementary shield, generally not required once documents are properly stored.

Inside CUI Cover Sheet

CUI Designation Indicator
A marking that identifies the information as Controlled Unclassified Information, generally used to alert handlers that the material is subject to safeguarding and dissemination controls established under the CUI Program. The specific format should be verified against the applicable CUI marking guidance.
CUI Category or Categories
An indication of the type or category of CUI involved (for example, a specified or basic category), which informs the applicable handling and dissemination requirements. The authoritative list of categories is maintained by the National Archives and Records Administration (NARA) as the CUI Executive Agent, and readers should confirm current categories against the official CUI Registry.
Handling and Dissemination Notice
Language directing recipients on permitted access, distribution limits, and safeguarding expectations for the covered material. The precise wording and any limited dissemination controls depend on the applicable category and agency guidance.
Point of Contact or Designating Authority Reference
Information identifying the responsible office or authority for questions about the designation, where included. Whether such information appears depends on agency practice and the applicable marking policy.
Purpose as a Physical Protective Measure
The cover sheet functions primarily as a visual protection aid that conceals CUI content and reminds personnel of handling obligations during physical storage or transit; it is an administrative and physical safeguard rather than a substitute for portion or banner marking of the underlying document.

Common questions

Answers to the questions practitioners most commonly ask about CUI Cover Sheet.

Does using a CUI cover sheet by itself make my document handling compliant with CUI requirements?
No. A cover sheet is a marking and awareness aid, not a substitute for a compliant CUI program. Applying a cover sheet does not satisfy the underlying handling, safeguarding, dissemination, and destruction obligations for Controlled Unclassified Information. Compliance generally depends on properly identifying CUI, applying correct portion and banner markings on the document itself, and implementing the required safeguards. Treating the cover sheet as evidence of compliance is a common mistake; verify your obligations against the governing CUI program guidance and any agency-specific requirements that apply to your systems.
Is a CUI cover sheet the same thing as a classified information cover sheet?
No. CUI and classified national security information are governed by distinct authorities and marking regimes, and their cover sheets are not interchangeable. A CUI cover sheet supports the CUI program, while classified cover sheets support material handled under the rules for classified systems and facilities. Do not assume the presence of a CUI cover sheet indicates the correct protection level, or that a classified cover sheet is appropriate for CUI. Confirm the applicable marking regime and required cover sheet against the relevant official guidance for the information category involved.
When should a CUI cover sheet be applied to a document?
A cover sheet is generally used to alert personnel handling a physical document that it contains CUI, so it is typically applied when the document is printed, transported, stored, or otherwise handled in hard copy where the contents could be exposed. Because usage conventions can vary by agency and program, confirm the specific triggers and required format against your organization's CUI implementation guidance and any applicable agency-specific instructions.
Does applying a cover sheet remove the need to mark the document itself?
No. A cover sheet supplements but does not replace the required markings on the document. In most implementations the document must still carry the appropriate banner and portion markings for CUI, and any applicable category or dissemination control indicators. The cover sheet serves as an at-a-glance notice during handling. Verify the specific marking requirements against the current authoritative CUI marking guidance, as details can change across revisions.
How should a CUI cover sheet be handled when the document is destroyed?
The cover sheet is a handling aid and generally does not itself dictate destruction methods; the underlying CUI must be destroyed in accordance with the applicable safeguarding and destruction requirements. Organizations should follow their program's approved destruction procedures for the CUI content and dispose of the cover sheet consistent with local policy. Confirm the required destruction standards against current official guidance and any agency-specific instructions that apply.
Do CUI cover sheet requirements differ across agencies or between federal and state entities?
They can. While the CUI program provides a governmentwide framework, specific cover sheet formats, usage conventions, and supplemental instructions may be tailored by individual agencies, and state, local, tribal, and territorial obligations may differ from federal requirements. Do not assume one agency's cover sheet practice satisfies another's. Verify the applicable format and usage rules against the guidance issued by the responsible agency or program for your context.

Common misconceptions

A CUI cover sheet by itself makes a document properly marked as CUI.
A cover sheet is generally a supplemental physical protective measure and does not replace required markings on the document itself, such as the CUI designation indicator and any applicable category or dissemination markings. The specific marking requirements should be confirmed against current CUI marking guidance and the applicable agency policy.
The CUI cover sheet is equivalent to a classified information cover sheet and follows the same rules.
CUI is unclassified information subject to the CUI Program administered under the NARA-led Executive Agent framework, which is distinct from the classification and cover sheet requirements applicable to classified national security information under the NISPOM and related authorities. The two regimes should not be conflated, and requirements differ.
Applying a cover sheet satisfies an organization's CUI safeguarding obligations.
A cover sheet is one physical control and does not by itself achieve compliance; safeguarding CUI generally also involves administrative, technical, and other physical controls consistent with applicable requirements, which practitioners must confirm against current authoritative sources.

Best practices

Confirm the exact cover sheet format and required elements against current CUI marking guidance and your agency's or contract's specific policy before adopting a standard template.
Treat the cover sheet as a supplement to, not a replacement for, proper marking of the underlying document, ensuring the CUI designation indicator and any applicable category and dissemination markings appear on the material itself.
Verify the applicable CUI category and any limited dissemination controls against the official CUI Registry maintained by NARA as the Executive Agent, since these determine handling and dissemination language.
Do not conflate CUI cover sheets with classified information cover sheets; keep procedures and templates for the two regimes distinct to avoid mishandling.
Include or reference a responsible point of contact or designating authority where agency practice allows, so recipients can resolve questions about the designation.
Reinforce that the cover sheet is a physical protective measure only and pair it with the broader administrative and technical safeguards required for CUI, confirming those requirements against current authoritative sources.