How should a DoD electronic file containing CUI be marked?

• A. Only with a general 'CUI' label
• B. With the CUI banner, category/handling information, and any applicable safeguards in the metadata or header.
• C. With a 'Top Secret' banner
• D. With no markings required

Answer: (B)

Marking a DoD electronic file containing CUI should clearly communicate both its status and the protections required. The best approach is to place the CUI banner, include the category/handling information, and specify any applicable safeguards in the file’s metadata or header. This combination makes the CUI status obvious to anyone who handles the file and conveys the exact restrictions and protective measures—such as who may access it and how it must be stored or transmitted—so systems and people apply the correct controls. If you only put a general CUI label, you miss the specific category and handling rules; labeling it as Top Secret would inappropriately imply a higher classification; and providing no markings at all leaves the data unprotected and its restrictions unclear.