Category: Controlled Unclassified Information

Limited Dissemination Controls

Also known as: LDC, Limited Dissemination Control, LDCs

Simply put

Limited Dissemination Controls (LDCs) are optional markings that a government agency can add to Controlled Unclassified Information (CUI) to restrict who may receive it, even among people who otherwise have a lawful government reason to access it. When no LDC is applied, anyone with an authorized lawful government purpose is generally permitted access to the information. LDCs narrow that access to a specific audience.

Formal definition

Limited Dissemination Controls (LDCs) are CUI Executive Agent-approved controls that agencies may apply to further limit or specify the dissemination of CUI beyond the baseline requirement that it be shared only for a lawful government purpose. As described in the CUI Registry maintained by the National Archives and Records Administration (NARA) as the CUI Executive Agent, and reflected in DoD CUI guidance, LDCs identify the specific audience deemed to have an authorized lawful government purpose to be authorized holders of the marked information. The absence of an LDC generally means that any person with an authorized lawful government purpose may access the information. LDC markings constitute one class of CUI markings, distinct from category markings; they should not be conflated with the CUI Basic and CUI Specified designations, which classify the safeguarding/dissemination control level of the CUI rather than the type of marking. Practitioners should note that applying an LDC does not itself authorize decontrol or public release; per the governing CUI regulatory framework (32 CFR Part 2002), only the designating agency, or personnel it specifically delegates, may decontrol CUI and authorize its public release. Readers should verify the current list of approved LDCs and applicable requirements against the official CUI Registry and current agency guidance, as the set of approved controls and their descriptions may be revised.

Why it matters

Limited Dissemination Controls address a gap that the baseline CUI framework leaves open. Without an LDC, Controlled Unclassified Information is generally accessible to anyone who has an authorized lawful government purpose, which can be a broad population across agencies, contractors, and mission partners. LDCs give the designating agency a mechanism to narrow that audience to the specific holders it determines actually need the information, providing a finer level of control than the lawful-government-purpose standard alone. For compliance officers and information system security managers, this means access decisions cannot rely solely on whether a recipient has a general lawful purpose; the presence of an LDC marking changes who counts as an authorized holder.

Getting LDCs right also matters because they are frequently misunderstood in ways that create real compliance exposure. A common and consequential error is assuming that applying or removing an LDC is equivalent to authorizing decontrol or public release. It is not. Under the governing CUI regulatory framework (32 CFR Part 2002), only the designating agency, or personnel it specifically delegates, may decontrol CUI and authorize its public release. Treating LDC decisions as release decisions can lead to improper disclosure of information that remains controlled.

Because LDCs are one of the classes of CUI markings maintained through the CUI Registry, errors in applying them can propagate through document marking, distribution, and downstream handling. Practitioners should treat the CUI Registry and current agency guidance as the authoritative source for which LDCs are approved and how they are applied, since the set of approved controls and their descriptions may be revised over time.

Who it's relevant to

CUI Designating Officials and Agency Program Managers

Personnel who designate CUI decide whether a lawful basis exists to apply an LDC and, if so, which approved control to use. They must draw only from the CUI Executive Agent-approved controls in the CUI Registry and should recognize that applying an LDC is not the same as authorizing decontrol or public release, which under 32 CFR Part 2002 remains the prerogative of the designating agency or its specifically delegated personnel.

Information System Security Managers and Access Control Administrators

Those responsible for enforcing access to CUI cannot rely solely on whether a recipient has an authorized lawful government purpose when an LDC is present. The LDC narrows the authorized-holder audience to a specific group, so access decisions and dissemination controls must account for the marking rather than the baseline standard alone.

Government Contractors and Mission Partners Handling CUI

Contractors and partners who receive or share CUI need to read and honor LDC markings, since the presence of an LDC restricts distribution beyond the default lawful-government-purpose audience. They should not interpret possession of CUI, or the absence or removal of an LDC, as authority to publicly release or decontrol information; that authority rests with the designating agency.

Compliance Officers and Auditors

Reviewers assessing CUI handling should confirm that LDCs are drawn from the current CUI Registry, applied consistently in the designation block, and not conflated with CUI Basic/Specified designations, which describe control level rather than marking type. They should verify requirements against the official CUI Registry and current agency guidance, as approved controls and descriptions may be revised.

Inside LDC

Limited Dissemination Control (LDC) Markings

A class of CUI markings, distinct from category markings, used to limit or restrict access to and dissemination of CUI. LDC markings are applied in addition to the CUI control marking and any applicable category markings, and they do not themselves designate information as CUI; they constrain how already-designated CUI may be shared.

Designating Agency Authority

Under 32 CFR Part 2002, only the agency that originally designated the information as CUI (or personnel it specifically delegates) may decontrol the information and authorize its public release. A recipient holding CUI marked with an LDC generally may not remove controls or release the information publicly on its own authority.

Approved LDC Values

LDCs are drawn from a defined set of approved dissemination control markings maintained under the CUI Program (administered by the CUI Executive Agent). Because the specific approved values and their exact abbreviations are subject to update, practitioners should verify the current authorized list against the official CUI Registry rather than relying on memory or legacy markings.

Relationship to the CUI Banner Marking

When applied, an LDC generally appears in the banner marking after the CUI control marking and category marking(s), separated according to the CUI marking conventions. The LDC portion communicates the additional dissemination restriction to any recipient or handler of the document.

Scope of Application

LDCs apply within the CUI Program framework for Controlled Unclassified Information across federal executive branch agencies and their non-federal information-sharing partners. This concept is distinct from classification-based dissemination controls used for national security information, and state, local, tribal, and territorial handling obligations may differ.

Common questions

Answers to the questions practitioners most commonly ask about LDC.

If I have a lawful government purpose, can I authorize the public release of CUI marked with a limited dissemination control?

No. A lawful government purpose can support sharing CUI with authorized recipients consistent with the applicable LDC, but it does not permit public release. Under 32 CFR §2002.18, only the designating agency (or personnel it specifically delegates) may decontrol CUI and authorize its public release. Possessing or receiving CUI, even for a lawful government purpose, does not confer decontrol or release authority. Confirm the specific decontrol and release procedures with the designating agency before treating any CUI as publicly releasable.

Are limited dissemination controls a category of CUI, like CUI Basic and CUI Specified?

No, and conflating these is a common error. CUI Basic and CUI Specified describe how a category of information is safeguarded and disseminated based on its underlying law, regulation, or government-wide policy. Limited dissemination controls, by contrast, are a type of CUI marking. In the CUI marking scheme, category markings and limited dissemination control markings are generally treated as distinct classes of markings applied to a document; an LDC is not itself a CUI category. Refer to the CUI Registry maintained by the National Archives Information Security Oversight Office for the authoritative treatment of categories and markings.

Where do the approved limited dissemination control markings come from, and can an agency create its own?

The approved set of limited dissemination controls is published in the CUI Registry maintained by the National Archives Information Security Oversight Office. Agencies are generally expected to use LDCs from this approved list rather than inventing their own dissemination markings, which helps preserve consistency across the government-wide CUI program. If an agency believes it needs a control not on the approved list, that is typically handled through the ISOO process rather than through local improvisation. Verify the current approved LDCs against the CUI Registry, as its contents can change.

How should a limited dissemination control be displayed on a CUI document?

In most implementations, LDC markings appear in the CUI banner marking alongside the CUI control marking and any applicable category markings, typically set off in a way that indicates the dissemination limitation (for example, following the category portion). The precise placement, separators, and abbreviations follow the CUI marking guidance issued under the government-wide program. Because agency implementation guides and templates can vary in formatting details, confirm the exact banner construction against the current CUI Registry marking guidance and your agency's marking policy before finalizing documents.

Can I apply a limited dissemination control to CUI that I did not originally designate?

This is scope-sensitive and depends on the designating agency's policy. As a general matter, LDCs are tied to decisions about how the CUI may be disseminated, and authority to make or change those decisions typically rests with the designating agency or personnel it delegates. Downstream holders generally must honor the LDCs already applied and should not remove them, but adding or altering dissemination controls on someone else's CUI is not something a recipient should assume they may do. Confirm the specific authority and procedures with the designating agency.

If a document carries a limited dissemination control, does that change how it must be safeguarded?

An LDC primarily governs who may receive or access the information rather than replacing the baseline safeguarding requirements that apply to CUI generally. In practice, an LDC narrows the population of authorized recipients, so it affects distribution, access decisions, and need-to-know determinations, but the underlying handling, storage, and protection obligations for CUI still apply. Note that this entry does not cover system-level implementation, contractual flow-down, or agency-specific handling procedures; verify safeguarding requirements against the applicable CUI policy and your agency's guidance.

Common misconceptions

LDCs are a category of CUI, comparable to CUI Basic and CUI Specified.

CUI Basic and CUI Specified describe how the underlying authority controls a given category of information, and category markings identify the type of CUI. LDC markings are a separate class of CUI markings that restrict dissemination. The distinction is between marking types (category markings versus limited dissemination control markings), not between categories of CUI. Conflating them is a common and consequential error.

Any authorized holder with a lawful government purpose can decontrol CUI marked with an LDC and release it publicly.

A lawful government purpose may permit certain authorized sharing consistent with the LDC, but it does not confer decontrol or public-release authority. Under 32 CFR §2002.18, only the designating agency (or personnel it specifically delegates) may decontrol CUI and authorize its public release.

Applying an LDC is what makes information CUI or is required on all CUI.

An LDC does not designate information as CUI; the information must already qualify as CUI under an authorizing law, regulation, or government-wide policy. LDCs are optional additional restrictions applied when the designating agency determines dissemination should be further limited, and they are not present on all CUI documents.

Best practices

Treat category markings and limited dissemination control markings as separate classes of CUI markings, and place any LDC after the CUI control and category markings in the banner in accordance with current CUI marking conventions.

Before removing controls or releasing CUI marked with an LDC, confirm the request with the designating agency, since only that agency or its specifically delegated personnel may decontrol and authorize public release under 32 CFR §2002.18.

Verify the specific LDC value and its authorized abbreviation against the current official CUI Registry rather than relying on legacy or remembered markings, as approved values may change.

Do not assume an LDC by itself designates information as CUI; confirm that a valid CUI authority applies before treating the marking as controlling.

Document the designating agency and any delegated decontrol authority in your handling procedures so that recipients know whom to contact for sharing, decontrol, or release decisions.

Where information is shared with non-federal partners, ensure agreements and handling instructions reflect the LDC restrictions, and confirm whether differing state, local, tribal, or territorial obligations affect handling.