Do legacy marked documents stored on a DoD access-controlled website need to be re-marked as CUI?

• A. Yes, always
• B. No, not required; but derivative documents shared outside DoD must be marked if the info qualifies as CUI
• C. Only if accessed by non-DoD personnel
• D. Only if the document is updated

Answer: (B)

Marking for CUI is about how information is shared outside DoD, not about every internal copy stored within DoD systems. Legacy documents that are already on an access-controlled DoD site stay within a controlled boundary, so simply retaining their existing marks does not require re-marking them as CUI. The important rule is that once content qualifies as CUI and is shared beyond DoD or used to create derivative documents that go outside DoD, those materials must be marked accordingly to communicate their sensitivity and handling requirements. If a document remains for internal DoD use, no automatic re-mark is needed; if it’s going to leave DoD or be distributed externally, then proper CUI marking applies to the outbound material.