CUI Readiness Checklist
Retire Every Legacy CUI Marking Before Your Assessment
FOUO and SBU are no longer authorized. Cross-check every category against the current NARA CUI Registry and get your banner, portion, and dissemination markings assessment-ready.
The problem
You have carried category names for years, and you don’t know which NARA has renamed or retired
Organizations that have run a CUI program for several years frequently carry legacy category names that no longer match current registry entries, and legacy labels like FOUO and SBU that 32 CFR Part 2002 no longer authorizes. An outdated category name creates marking inconsistencies and raises questions about every safeguarding decision tied to that designation. Assessors trace each CUI designation back to its authority source, and weak or missing authority citations are among the most consistent categorization findings in DIB assessments. Gaps an assessor finds, rather than ones you have already documented, undermine confidence in your entire SSP.
Free download
Get instant access to the checklist
What’s inside
What the marking and categorization checks cover
The payoff
What you can do once you have worked through it
Full coverage
The checklist covers the full program, not just marking
Grounded in the authorities
Grounded in the actual authorities
FAQ
Before you download
CUI Basic follows the baseline handling requirements in 32 CFR 2002 and NIST SP 800-171. CUI Specified carries additional or alternative handling requirements set by the authorizing law, regulation, or government-wide policy for that category. The checklist walks you through producing a written determination for each category in scope so you do not default everything to Basic.
No. Legacy markings such as FOUO, SBU, and SSI are no longer authorized under 32 CFR Part 2002 unless a specific transition exception applies. The checklist shows you how to confirm banners use only NARA Registry-approved abbreviations and how to flag legacy labels still in circulation.
No. This is a readiness aid, not an audit. Working through the 41 items does not constitute a formal gap analysis and does not guarantee a passing CMMC or DFARS assessment. It helps you find and document gaps before your assessment window opens so an assessor is not the one to find them.
Program managers and compliance leads preparing for a CMMC or DFARS assessment, particularly those who suspect stale category names and legacy markings are lurking in an established CUI program.
CUI Readiness Checklist