Frequently Asked Questions

CUI Cover Sheets
Distribution Statements
FOUO
Information Sharing
Privacy/PII
Telework
Training Certificates



Is a CUI cover sheet mandatory?
CUI materials hand-carried out of the office or approved telework location will be placed in an opaque envelope with a CUI cover sheet (SF 901) on top of the documents.  In addition, the cover sheet can be used to protect the document from unauthorized access and observation at any time, but it is not a requirement if the documents are at your desk or in your office.  If using a cover sheet, you must use the official form (SF 901), with one exception.  The Privacy Act cover sheet can be used in place of the CUI cover sheet when protecting documents containing Privacy Act information.

Distribution Statements

We were told to put a distribution statement on a document, but there is no CUI in the document.  Can a document have a distribution statement and not be CUI?
The application of a distribution statement does not automatically mean the document is CUI.  Do not confuse the two issues.  Pursuant to DoDI 5230.24, “Distribution Statements on DoD Technical Information,” distribution statements are applied to technical documents, regardless of whether the document is classified, unclassified, or CUI.  Certain CUI categories require a distribution statement because of the technical nature of the information.  Not every document containing CUI requires a distribution statement.

Back to Top

FOUO

Are all legacy marked FOUO documents now CUI?
No. It is not an automatic one-to-one swap. Some information previously marked as FOUO will qualify as CUI.  FOUO information must be assessed against the CUI Registry to determine if it is now CUI.

Information previously marked as FOUO does not need to be re-marked as long it remains under DoD control or is accessed online and downloaded for use within the DoD.

However, if the same information is put in a new document or is shared outside the Department, it needs to be assessed to see if it meets the criteria for CUI and marked appropriately.

Not every Executive branch agency has implemented CUI, so you may still receive documents marked as FOUO.  Documents with other markings should be handled in accordance with guidance from those agencies
.

Back to Top

Information Sharing

Can we share CUI with Congress?
Yes.  It is DoD policy to provide Congress with all the information it needs to conduct effective oversight.  Any Member of Congress and their personal or professional staff are authorized to receive and share CUI from DoD.

Can I share CUI with foreign allies and partners?
Yes, you may share CUI with our foreign allies and partners unless sharing with that country is specifically restricted.  However, DoD Components and sub-Components still have the latitude to restrict sharing in accordance with their specific policies. 

Back to Top

Privacy/PII

Is my CAC CUI because it contains the DoD ID number (EDIPI)?
No, your CAC is not CUI; however, it is a controlled item.  
I have a document that contains PII.  Do I have to mark it as CUI?
Not necessarily.  It depends on what PII is on the document.  The document becomes CUI when individual pieces of PII are combined which can then be used collaboratively to identify a specific individual.  Examples of PII include:
 
  • Full SSN or truncated SSN (such as last four digits)
  • Date of birth (month, day, and year)
  • Passport number
  • Driver's license number
  • Patient identification number
  • Financial account or credit care number
  • Personal address
  • Biometric records
  • Citizenship or immigration status
  • Ethnic or religious affiliation
  • Sexual orientation
  • Criminal history
  • Medical information
  • System authentication information such as mother's maiden name, account passwords, or personal identification numbers
When do I need to put a Privacy Act Statement (PAS) on a document?
When a Federal agency requests that you provide personal information (name, date of birth, social security number, etc) for a system of records, regardless of the method used to collect the information (i.e., forms, personal or telephonic interview, etc), a Privacy Act Statement (PAS) is required.  If the information requested will not be included in a system of records, a PAS is not required.

Is the DD Form 2875, "System Access Authorization Request," CUI because it contains the EDIPI?
No, presence of the EDIPI (DoD ID number) alone does not make the form CUI.

Can I take CUI home with me?
Yes, personnel can take CUI home.  CUI materials hand-carried out of the office or approved telework location must have a CUI cover sheet (Standard Form 901) on top of the documents, with all materials placed in an opaque envelope, without CUI markings or indications on the outermost layer.  In personal residences, secure CUI documents in desks, file cabinets, bookcases, or similarly-secured areas when not actively in use.  Disconnect devices such as Alexa when discussing CUI.

 

Back to Top

Training Certificates

How do I get my certificate after I complete the CUI mandatory Training?
If you take the training directly from the CDSE website, there is an option to create and print a certificate upon completion of the test.  If you take the training through a learning management system, a certificate should be available for you to download and print.  In either case, if you have problems getting a certificate, please talk to your training manager.  

Back to Top