In January 2026 the Department of Defense Inspector General published a management advisory on Controlled Unclassified Information handling across the Department. The review examined more than 48,000 documents from 2023 and 26,000 documents from 2024. It found that required CUI designation indicator blocks were absent from 9 percent of the 2023 documents and 11 percent of the 2024 documents reviewed.
Those percentages are the single most useful piece of CMMC-related data to come out of the government this year, and almost nobody is writing about the fact that it is not being leveraged for CMMC. The DoD has established that inconsistent CUI marking is not reflective of how the industry is missing the mark. Rather, it is a finding by the government, about how government agencies are not adhearing to the guidance.
This matters because scope follows classification, and classification depends on marking. A contractor cannot scope its environment correctly against information that was never properly marked, and a Prime contractor cannot flow down obligations correctly against the same gap. The entire CMMC compliance stack rests on a classification process the Department has acknowledged is not working consistently.
This article covers what the problem actually is, why marking errors run in two directions and both are expensive, how a contractor should respond when the markings it receives cannot be trusted, and what questions to ask the Contracting Officer before accepting the risk.
The Scope Mechanism That Marking Breaks
CMMC scope is determined by the information handled, not by company size or contract value. A defense contractor processing, storing or transmitting CUI during performance requires Level 2 compliance standards to be met. Whereas a contractor handling only Federal Contract Information requires Level 1 compliance standards to be met. The level determines which controls apply, which assessments are needed and how much the program costs.
That selection logic is covered in detail in our article on who actually needs CMMC Level 2*. The relevant point here is that every step of that logic depends on correctly identifying what is CUI in the first place. If the government marked a document incorrectly, the scoping decision downstream of that marking will be wrong regardless of how carefully the contractor reasons from it.
Three things depend on the marking being right.
The level the contractor requires: CUI triggers Level 2, Federal Contract Information triggers Level 1, and nothing triggers nothing. A document marked CUI that does not actually contain CUI pushes a contractor to a higher level than the standard requires. A document that contains CUI but arrives unmarked allows a contractor to scope for a level below what the standard requires.
The boundary of the environment the contractor must protect: Where CUI actually resides defines the Level 2 scope. Over-marking expands that boundary beyond what the standard requires. Under-marking leaves CUI outside a protected boundary where NIST SP 800-171 controls are not applied.
The flow-down the Prime contractor imposes on subcontractors: Where the Prime cannot confidently separate CUI from non-CUI it has received, the operational response is to flow down the strictest requirement to every supplier regardless of what each supplier actually handles. That decision is rational for the Prime and expensive for the supplier.
What the IG numbers mean operationally
Nine to eleven percent of federal documents reviewed in the IG's sample lacked required CUI designation blocks.
In a program where control scope is driven by information category, that is not a documentation gap. It is a scoping gap, distributed across the supply chain, that the contractor cannot resolve from inside its own environment.
Over-Marking and Under-Marking Are Both Expensive
Marking errors travel in two directions, and the operational cost of each is different.
Over-marking expands scope
A document marked CUI that is not actually CUI, or a document marked CUI without the correct category and limited dissemination controls, pushes the receiving organization to treat the information as more sensitive than its content warrants. The receiving contractor then applies Level 2 controls, flows the requirement down, and expands the compliance boundary accordingly.
The cost shows up in four places: expanded Level 2 assessment scope, broader implementation of NIST SP 800-171 controls, higher ongoing operational cost for the enlarged protected environment, and extended flow-down obligations to subcontractors who may handle no CUI at all. Industry commentary submitted to the Reform Task Force identified this pattern as the mechanism by which small businesses are priced out of defense work.
Under-marking leaves CUI exposed
The reverse error is less commonly discussed in commercial coverage and more serious legally. A document that qualifies as CUI but arrives without the designation indicator block appears to the receiving contractor to be ordinary business information. The contractor handles it accordingly, which means outside the Level 2 boundary and without the required safeguards.
The contractor has not necessarily done anything wrong. The information was not marked. But the exposure is real: a government assessment or a later investigation can identify CUI handling that fell outside the protected scope, and the contractor's compliance posture relative to its actual information handling becomes questionable.
A separate complication deserves naming. Information generated by the contractor during performance can qualify as CUI even where the Prime contractor or the Department supplied no marked CUI at the outset. The contractor who creates CUI during performance is responsible for marking what it created, which is a scoping question that cannot be answered by inspecting what came in.
The specific role of CUI Specified
CUI handling is further complicated by the distinction between CUI Basic and CUI Specified. Basic CUI is handled under the general safeguarding and dissemination controls defined in the CUI Registry. Specified CUI carries additional, category-specific controls defined by the authorizing law or policy, and the markings must include the specific category tag.
A document arriving with only a generic CUI marking, where it should carry a Specified category tag, is a common form of under-marking. The receiving contractor treats the information under Basic rules when stricter Specified rules were required. That gap is a compliance exposure the contractor did not knowingly accept.
Who Is Actually Responsible for Marking
The primary responsibility for identifying and marking CUI rests with the government agency designating the information. Executive Order 13556 and the implementing rule at 32 CFR Part 2002 assign that duty to the originating agency. The Department of Defense documents its own responsibilities in DoD Instruction 5200.48.
The contractor's responsibility is secondary but not absent. A contractor must apply correct markings to CUI it generates during performance, maintain markings on CUI it receives and reproduces, and raise questions about markings it has reason to believe are incorrect. The contractor cannot unilaterally mark down a document the government marked as CUI, and cannot unilaterally classify as CUI something the government did not.
That division of responsibility is why the IG findings matter so much. If the government is missing designation blocks on 11 percent of its own documents, the contractor cannot close that gap by being more careful. The problem is upstream of the contractor's environment.