We were told to put a distribution statement on a document, but there is no CUI in the document.  Can a document have a distribution statement and not be CUI?
The application of a distribution statement does not automatically mean the document is CUI.  Do not confuse the two issues.  Pursuant to DoDI 5230.24, “Distribution Statements on DoD Technical Information,” distribution statements are applied to technical documents, regardless of whether the document is classified, unclassified, or CUI.  Certain CUI categories require a distribution statement because of the technical nature of the information.  Not every document containing CUI requires a distribution statement.

Are all legacy marked FOUO documents now CUI?
No. It is not an automatic one-to-one swap. Some information previously marked as FOUO will qualify as CUI.  FOUO information must be assessed against the CUI Registry to determine if it is now CUI.

Information previously marked as FOUO does not need to be re-marked as long it remains under DoD control or is accessed online and downloaded for use within the DoD.

However, if the same information is put in a new document or is shared outside the Department, it needs to be assessed to see if it meets the criteria for CUI and marked appropriately.

Not every Executive branch agency has implemented CUI, so you may still receive documents marked as FOUO.  Documents with other markings should be handled in accordance with guidance from those agencies.

Can we share CUI with Congress?
Yes.  It is DoD policy to provide Congress with all the information it needs to conduct effective oversight.  Any Member of Congress and their personal or professional staff are authorized to receive and share CUI from DoD.

Can I share CUI with foreign allies and partners?
Yes, you may share CUI with our foreign allies and partners unless sharing with that country is specifically restricted.  However, DoD Components and sub-Components still have the latitude to restrict sharing in accordance with their specific policies. 

Is my CAC CUI because it contains the DoD ID number (EDIPI)?

I have a document that contains PII.  Do I have to mark it as CUI?

• Full SSN or truncated SSN (such as last four digits)
• Date of birth (month, day, and year)
• Passport number
• Driver's license number
• Patient identification number
• Financial account or credit care number
• Personal address
• Biometric records
• Citizenship or immigration status
• Ethnic or religious affiliation
• Sexual orientation
• Criminal history
• Medical information
• System authentication information such as mother's maiden name, account passwords, or personal identification numbers

When do I need to put a Privacy Act Statement (PAS) on a document?

Can I take CUI home with me?
Yes, personnel can take CUI home.  CUI materials hand-carried out of the office or approved telework location must have a CUI cover sheet (Standard Form 901) on top of the documents, with all materials placed in an opaque envelope, without CUI markings or indications on the outermost layer.  In personal residences, secure CUI documents in desks, file cabinets, bookcases, or similarly-secured areas when not actively in use.  Disconnect devices such as Alexa when discussing CUI.