3.4 Data Handling and Marking Requirements

Data Handling and Marking Requirements

Within the control-selection task, the CGRC blueprint calls out one requirement explicitly: "Specific data handling/marking requirements identified." It sits in Domain 3 rather than in implementation or disposal for a structural reason — markings have to be applied when information is created and must survive every copy, export, and transfer thereafter. Deciding them late means unmarked copies already exist.

---

1. Marking and Access Control Solve Different Problems

These are routinely conflated, and the exam exploits it.

• Access control answers "who is permitted to reach this data?" It is enforced by the system.
• Marking answers "once someone lawfully has this data, how must they handle it?" It is enforced by the human or downstream process that reads the label.

A cleared analyst may be fully authorized to open a document — access control is satisfied. The marking is what tells them the document may not be emailed to a personal account, printed on an uncontrolled printer, or carried outside the facility. Remove markings and the authorized user has no way to know their obligations. This is why marking controls remain necessary in systems with flawless access control.

---

2. The CUI Program

Before 2010, agencies used dozens of incompatible labels — FOUO (For Official Use Only), SBU (Sensitive But Unclassified), LES (Law Enforcement Sensitive) — with no shared definitions, which made inter-agency sharing unreliable. Executive Order 13556 created the Controlled Unclassified Information (CUI) program to replace them with one government-wide scheme, implemented by 32 CFR Part 2002 and administered by the National Archives and Records Administration (NARA), which publishes the authoritative CUI Registry.

The Registry organizes CUI into categories grouped into organizational index groupings, each traceable to a law, regulation, or government-wide policy (LRGWP). This traceability requirement is the program's core discipline: information cannot be designated CUI simply because someone considers it sensitive. There must be a citable authority. Exam items describing a manager who marks a document CUI because it is "internal and embarrassing" are describing a misdesignation, not a control.

CUI Basic versus CUI Specified

The practical rule: for Basic, apply the standard CUI handling controls. For Specified, you must read the underlying authority, because it may impose stricter destruction, dissemination, or access requirements than the CUI baseline. Treating Specified as Basic is a compliance failure.

Marking Mechanics

A CUI banner marking appears at the top and bottom of each page and includes the CUI control marking, category markings where required, and any limited dissemination control (LDC) such as NOFORN or FED ONLY, separated by double forward slashes. The designating agency is identified so recipients know whom to contact about handling questions. Portion marking — labelling individual paragraphs — is permitted and is encouraged when it helps recipients extract releasable content without over-restricting the whole document.

[!IMPORTANT] Derivative products inherit markings. A briefing slide built from a CUI report, a spreadsheet exported from a CUI database, and a backup tape containing CUI records are all CUI and must be marked accordingly. The most common real-world failure is an analytics or reporting layer that reads from a marked source and emits unmarked outputs.

---

3. Implementing Handling and Marking in SP 800-53

AC-16 is the control that makes automated enforcement possible. Once security and privacy attributes are bound to data as machine-readable metadata rather than merely painted onto a rendered page, downstream systems — data loss prevention, email gateways, rights management — can enforce handling rules automatically instead of relying on a human reading a banner.

---

4. Handling Requirements Cross Boundaries

Marking requirements do not stop at the authorization boundary, which is why they surface again in interconnection and contract governance.

• Interconnections. The Interconnection Security Agreement must state what data types traverse the connection and what handling and marking obligations bind the receiving party. A partner who receives CUI over an interconnection is obliged to protect it, and that obligation must be written down rather than assumed.
• Contracts. For contractors, handling obligations arrive through contract clauses. In the defense supply chain, CUI in a contract drives DFARS safeguarding requirements, NIST SP 800-171, and CMMC Level 2. A CGRC professional reviewing a procurement checks whether CUI will flow to the vendor and whether the contract carries the corresponding clauses — a gap here is a governance defect discovered too late to fix cheaply.
• Cloud and multi-tenant environments. Handling requirements may constrain where data may reside, including data-residency and personnel-citizenship restrictions. These constraints must be validated against the provider's authorization before selection, because they can eliminate a provider outright.

Decontrolling

CUI status is not permanent. Information is decontrolled when the underlying authority no longer requires protection, when a specified decontrol date or event arrives, or through a formal decision by the designating agency. Decontrol is a deliberate, documented act — markings are struck through or removed and the decontrol action is recorded. Data does not become uncontrolled merely because it is old, and unilateral removal of markings by a recipient is a violation regardless of how stale the information appears.