Category: Controlled Unclassified Information

Legacy Markings (FOUO/SBU)

Also known as: FOUO, SBU, For Official Use Only, Sensitive But Unclassified

Simply put

Legacy markings such as For Official Use Only (FOUO) and Sensitive But Unclassified (SBU) are older labels that agencies used to identify sensitive unclassified information before the government-wide Controlled Unclassified Information (CUI) program was adopted. Under the CUI program, these legacy markings are being phased out and generally replaced by CUI markings. Importantly, the presence of a legacy marking does not automatically mean the information qualifies as CUI; that determination must be based on current CUI authorities.

Formal definition

Legacy markings refer to pre-CUI sensitivity labels, most commonly FOUO and SBU, and in the DoD context also Law Enforcement Sensitive (LES), applied to unclassified information under agency-specific practices prior to implementation of the CUI program. Per referenced guidance, once agencies implement the CUI program these legacy markings are no longer to be used going forward, and CUI marking replaces them for newly designated information. However, a legacy marking is not, by itself, a determination that the information is CUI; whether such material constitutes CUI must be assessed against applicable CUI categories and authorities. Handling of previously marked material is governed by DoDI 5200.48 in the DoD context; practitioners should consult the current instruction directly for the specific treatment of legacy-marked documents rather than assuming automatic remarking or redaction, and should verify agency-specific implementation and any state, local, tribal, or territorial variations against current authoritative sources.

Why it matters

Legacy markings like FOUO and SBU are still found on large volumes of existing documents across the federal government, yet they no longer represent the government-wide standard for identifying sensitive unclassified information. Under the CUI program, these labels are being phased out and are generally replaced by CUI markings for newly designated information. For compliance officers and information system security managers, the critical point is that a legacy marking on a document does not, by itself, establish that the information qualifies as CUI. That determination must be made against current CUI categories and authorities, not inferred from the presence of an older label.

A common and consequential mistake is assuming that legacy-marked material is automatically CUI or that agencies are required to go back and redact or re-mark existing documents. In the DoD context, handling of legacy-marked material is governed by DoDI 5200.48, and practitioners should consult that instruction directly rather than relying on secondary summaries, several of which circulate incorrect claims about mandatory remarking. Treating a legacy marking as an automatic CUI determination, or as no marking at all, can lead to either over-restriction or improper disclosure of sensitive information.

Because the transition from legacy markings to CUI is an implementation matter that varies by agency and evolves over time, organizations should anchor their practices to current authoritative guidance. This entry describes the concept and its scope; it does not substitute for the specific procedural requirements in the applicable instruction, which readers must verify against the current official text.

Who it's relevant to

Information System Security Managers and Security Officers

Personnel responsible for information marking and handling need to recognize that legacy FOUO, SBU, and (in the DoD context) LES markings predate the CUI program and are being phased out. They should apply CUI determinations based on current authorities rather than treating a legacy label as an automatic CUI designation, and should consult the governing instruction, DoDI 5200.48 in the DoD context, for how existing legacy-marked documents are to be handled.

Compliance Officers and Auditors

Those assessing marking practices should confirm that organizations are not conflating the presence of a legacy marking with a CUI determination, and should be alert to common misconceptions, such as assuming legacy documents must be redacted or re-marked, that circulate in unofficial guidance. Verification should be anchored to the current authoritative instruction and agency implementation policy.

Government Contractors Handling Sensitive Unclassified Information

Contractors may encounter documents bearing legacy FOUO or SBU markings alongside CUI-marked material. They should not assume legacy-marked information is automatically CUI, nor assume it is uncontrolled; the correct handling depends on a CUI determination under applicable authorities and on the specific instruction governing the material, which should be confirmed against current official sources.

Records and Document Management Staff

Personnel managing legacy document collections should understand that legacy markings will no longer be used once the CUI program is implemented, but that the treatment of previously marked documents is dictated by the applicable instruction rather than by an assumption of automatic remarking. They should verify procedures directly rather than relying on secondary summaries.

Inside Legacy Markings (FOUO/SBU)

For Official Use Only (FOUO)

A legacy dissemination control marking historically used by the Department of Defense to identify unclassified information that was withheld from public release under exemptions such as those in the Freedom of Information Act. FOUO was applied before the government-wide transition to the Controlled Unclassified Information (CUI) program and is not a classification level.

Sensitive But Unclassified (SBU)

A legacy category of markings used across various federal agencies, particularly in the civilian and diplomatic communities, to designate unclassified information requiring protection or limited dissemination. Like FOUO, SBU predates the standardized CUI framework and lacked a consistent, government-wide definition.

Legacy Marking Status

The general condition of documents bearing pre-CUI markings such as FOUO or SBU. Under the DoD CUI program guidance in DoDI 5200.48, information previously marked under legacy schemes continues to warrant protection, but the presence of a legacy marking does not by itself establish current CUI status.

Relationship to the CUI Program

The CUI program, established government-wide by Executive Order 13556 and implemented for federal agencies through 32 CFR Part 2002 and for DoD through DoDI 5200.48, was intended to replace the patchwork of legacy markings including FOUO and SBU with a standardized system of designation, marking, and handling.

Re-marking Posture

Per DoDI 5200.48, the DoD CUI program does not require the redacting or re-marking of documents that bear legacy markings such as FOUO. Legacy-marked documents may continue in use, and information determined to be CUI is generally marked as CUI when it is newly created or when documents are otherwise reviewed or reissued, as directed by applicable agency guidance.

Common questions

Answers to the questions practitioners most commonly ask about Legacy Markings (FOUO/SBU).

Does a document marked FOUO automatically qualify as Controlled Unclassified Information (CUI)?

Not automatically. FOUO (For Official Use Only) and SBU (Sensitive But Unclassified) were dissemination control markings used before the establishment of the CUI program. A legacy FOUO marking does not, by itself, establish that the underlying information qualifies as CUI. Whether the information is CUI must be determined by reference to an authorized CUI category tied to a law, regulation, or Government-wide policy, generally as reflected in the CUI Registry maintained by the National Archives and Records Administration (NARA). In practice, some information previously marked FOUO qualifies as CUI and some does not, so the legacy marking should be treated as an indicator that a CUI determination may be warranted rather than as proof of CUI status. Readers should confirm categorization against the current CUI Registry and their agency's implementing guidance.

Do legacy FOUO or SBU documents have to be re-marked or redacted to comply with the CUI program?

Generally no. DoDI 5200.48, which implements the CUI program within the Department of Defense, does not require the redacting or re-marking of documents that already bear legacy markings such as FOUO or SBU. Legacy-marked documents may typically continue to be handled and safeguarded under the applicable protections. Re-marking generally becomes relevant when a legacy document is re-used, incorporated into a new document, or otherwise reprocessed, at which point current CUI marking requirements would apply to the newly created material. Because agency-specific interpretations exist, readers should verify the treatment of legacy markings against the current text of DoDI 5200.48 and their component's guidance.

How should an organization handle a legacy FOUO document it must incorporate into a newly created record?

When information from a legacy FOUO or SBU document is incorporated into a new document, the general practice is to make a fresh CUI determination for the resulting record and apply current CUI marking conventions if the information qualifies. The new document should be marked according to the applicable CUI marking guidance rather than by carrying forward the legacy marking. This entry does not cover the specific marking format, banner, or portion-marking mechanics, which the reader should confirm against current DoD and NARA CUI marking guidance.

What safeguarding requirements apply to a document that still carries a legacy FOUO marking?

Legacy-marked documents are generally safeguarded consistent with the protections applicable to their underlying sensitivity. Where the information qualifies as CUI, the safeguarding, dissemination, and handling requirements associated with CUI would generally apply. Where it does not, other applicable handling rules may govern. Because impact levels, handling requirements, and agency tailoring vary, organizations should confirm the specific safeguarding obligations against current authoritative sources and their own implementing policy.

Should staff be trained to stop applying FOUO markings to new documents?

In DoD contexts operating under the CUI program, new documents that meet a CUI category are generally to be marked using current CUI conventions rather than legacy FOUO or SBU markings. Training programs commonly emphasize that legacy markings should no longer be applied to newly created material, while acknowledging that existing legacy-marked documents need not be re-marked solely because of the marking. Readers should confirm the current training and marking expectations against their component's CUI implementation guidance.

How should legacy markings be treated when responding to a records request or transferring documents to another organization?

When legacy-marked documents are shared, transferred, or produced in response to a request, the sending organization generally continues to protect the underlying information according to its actual sensitivity and any applicable CUI requirements, rather than relying on the legacy marking alone. Determinations about releasability, redaction for disclosure purposes, and any re-marking obligations depend on the specific request authority and the underlying information category. This entry does not address disclosure, litigation, or Freedom of Information Act specifics, which the reader must confirm against the governing legal and policy authorities.

Common misconceptions

A FOUO or SBU marking is a classification level comparable to Confidential or Secret.

FOUO and SBU are legacy control or dissemination markings for unclassified information, not classification levels. Classified information is governed by separate authorities such as Executive Order 13526 and, for the industrial base, the NISPOM. Conflating the two can lead to incorrect handling and safeguarding decisions.

The DoD CUI program requires that all existing FOUO and SBU documents be redacted or re-marked as CUI.

DoDI 5200.48 states that the CUI program does not require the redacting or re-marking of documents bearing legacy markings. Legacy-marked material may remain in use; practitioners should verify the current text of DoDI 5200.48 and applicable component guidance for the specific handling and marking expectations.

Because FOUO and SBU are no longer the standard markings, the underlying information no longer needs protection.

The transition to CUI standardizes marking practices but does not remove protection obligations. Information that previously warranted safeguarding as FOUO or SBU may qualify as CUI under current criteria and should be evaluated against the applicable CUI category and safeguarding requirements rather than assumed to be releasable.

Best practices

Do not assume a legacy FOUO or SBU marking must be redacted or re-marked; consult the current text of DoDI 5200.48 and your component's CUI guidance, which as of the applicable revision does not require re-marking of legacy-marked documents.

Evaluate legacy-marked information against current CUI designation criteria rather than treating the legacy marking as either a classification level or a guarantee of releasability.

When newly creating documents or reissuing content, apply CUI markings in accordance with 32 CFR Part 2002 and DoDI 5200.48 rather than continuing to originate FOUO or SBU markings.

Preserve protection and safeguarding of legacy-marked material until a proper review determines its current status, since removal of a marking does not by itself remove handling obligations.

Verify agency-specific interpretations, because SBU in particular had varying meanings across federal agencies and civilian, defense, and diplomatic communities may treat legacy markings differently.

Confirm current authoritative sources before making handling, dissemination, or release decisions, as CUI implementation guidance and marking expectations may change across revisions and component tailoring.