which markings are required for sharing of cui through e-mail?

Emails that contain Controlled Unclassified Information (CUI) must include specific markings so that every recipient immediately understands the sensitivity and handling requirements of the information.

Core required markings

For a typical U.S. federal or DoD context, an email with CUI generally must include:

• Banner markings in the body
  • Place the applicable CUI banner (for example, “CUI” or “CUI//SP-PRVCY” depending on the category) at the top and bottom of the email body.

* These banners signal that the entire message content is CUI and must be protected accordingly.

• Subject line indicator
  • Many agency and contractor policies require the subject line to start with an indicator such as CUI or to include an indicator like [Contains CUI] at the end of the subject.

* Example: `CUI – Request for Quote: XYZ Subsystem Design`.

• Designation Indicator / DI block
  • Include a CUI designation indicator block (often called “DI block”) after your signature block in the email.

* This typically identifies: controlling agency/organization, contact information/POC, and any applicable CUI categories or dissemination controls.

• Attachment markings
  • Any attached files that contain CUI must be individually marked with CUI banner/footer markings and a CUI designation indicator, as if they were stand‑alone documents.

* File names may include a CUI indicator (for example, “Report_Q4_2025_[Contains CUI].pdf”).

Protection and transmission notes

• If the body of the email contains CUI, the email itself must be sent over an approved secure channel and encrypted (for example, using TLS and/or FIPS‑validated encryption as required by your environment).

• If the CUI is only in attachments , those attachments must be identified and encrypted, and the email body should still contain the appropriate CUI markings.

• Some agencies specify that, when CUI attachments are removed and the email no longer contains CUI, a line such as “When attachment is removed, this email is Uncontrolled Unclassified Information” be added beneath the banner.

Simple example layout

• Subject: CUI – Personnel Data Update

• Top of body:
  CUI (or specific category banner such as CUI//SP-PRVCY)

• Body text:
  Your message, ensuring any CUI remains within the protected and encrypted context.

• Bottom of body:
  CUI (same banner as top)

• After signature block:
  CUI designation indicator block with controlling organization, POC, and applicable categories/controls.

Always follow your organization’s specific CUI policy and training, since local requirements can be stricter or have prescribed wording and formats beyond these general federal‑level practices.

Information gathered from public forums or data available on the internet and portrayed here.