You'll find all six elements in one place: the National Archives and Records Administration's Controlled Unclassified Information Registry at archives.gov/cui. The registry is the government-wide catalog that lists every CUI information category, its approved dissemination controls, the required cover sheets, and the policy documents behind them. Forms and training resources are linked from the same program page rather than embedded in the registry itself. That split β catalog at NARA, forms and training distributed across agency and DoD sites β is where most people get lost.
The NARA CUI Registry Is the Single Authoritative Catalog for Categories and Controls
Start at the CUI Registry page on archives.gov. The registry organizes categories under a short list of organizational indexes β Defense, Export Control, Financial, Immigration, Intelligence, Law Enforcement, Legal, Natural and Cultural Resources, Privacy, Procurement and Acquisition, Statistical, Tax, and Critical Infrastructure β with each index containing the individual information categories that fall under it. That two-tier structure matters: an information category is the specific label you mark a document with, and the index is just the shelf it sits on.
Each category entry in the registry carries the same fields: the category name, the citation to the underlying law, regulation, or government-wide policy that authorizes it, the approved dissemination controls, and the marking guidance. The citation field is the one auditors care about most, because it tells you which authority a decontrol decision must be reconciled against. When a category has no citation listed, that's a signal the category exists under policy rather than statute, which affects how easily an agency can add or remove it.
The registry is maintained by the CUI Program within the Information Security Oversight Office, which sits inside NARA. That placement is deliberate: NARA holds the government-wide policy role under 32 CFR Part 2002, the National Archives regulation that governs the CUI Program. So the registry isn't an agency preference page β it's the operational expression of a codified executive branch policy.
One practical limit: the registry catalogs what is authorized, not what your agency has implemented. An agency may have adopted a subset of categories, added agency-specific handling caveats, or published its own marking guide. Treat the registry as the ceiling of what's permitted, and your agency's CUI implementing instruction as the floor of what's required.
Cover Sheets Live in the Registry, but the Standard Form Numbers Matter More
The registry publishes the approved CUI cover sheets as downloadable files, and this is the answer to the cover sheet half of your question. The standard set includes the CUI cover sheet, the CUI designation indicator, limited dissemination control cover sheets for categories like Law Enforcement Sensitive and Controlled Unclassified Information, and special handling sheets for Privacy Act and other protected information. NARA distributes these as PDFs and as templates agencies can brand with their own marking block.
The form numbers behind those sheets are what let you find them outside the registry. Standard Form 704 is the CUI cover sheet most people are looking for, and Standard Form 705 is the CUI designation indicator. Knowing the numbers helps when procurement staff or a records officer asks for "the SF 704" rather than "the CUI cover sheet," and it helps you find the current version through the GSA forms library rather than through a stale copy saved on someone's shared drive.
Cover sheet application depends on the medium and the container, not just the document. For a paper document, the cover sheet goes on top of the stack and the designation indicator goes on the first page beneath it. For a folder or binder, the cover sheet attaches to the outside. For digital files stored in a shared repository, the cover sheet becomes the container's label and the designation indicator goes into the document itself. Get this wrong and the marking is incomplete even when the document text is correct.
Here's the failure case that trips up contractors: a cover sheet alone is not a marking. If a document carries an SF 704 but the first page has no designation indicator showing the category, the controlling agency, and the dissemination controls, the document is not properly marked under the CUI Program. NARA's marking guidance treats the two as a pair, and auditors will too. The cover sheet is the banner; the designation indicator is the substance.
A Ten-Minute Walkthrough That Takes You From Registry Entry to Correctly Marked Document
The sequence below is the order that avoids rework. Doing it out of order usually means re-marking every page once you discover the wrong control.
1: Open the CUI Registry on archives.gov and locate your information under the correct organizational index; note the exact category name and its citation. 2: Go to your agency's CUI implementing instruction or marking guide and confirm the category is adopted locally and check for any agency-specific caveats. 3: Download the CUI cover sheet (SF 704) and the CUI designation indicator (SF 705) from the registry's forms section or the GSA forms library. 4: Cross-reference the category's approved dissemination controls against your need-to-know list, applying only controls the registry lists for that category. 5: Build the designation indicator with the category, the controlling agency, and the dissemination controls, then place it on the first page. 6: Apply the banner marking to the top and bottom of every page, and portion marks to any paragraph carrying a different category. 7: Attach the cover sheet to the container β stack, folder, binder, or digital repository label β and log the document in your CUI tracking.
If the registry lists no dissemination controls for your category, stop and check with your agency's CUI office rather than assuming "none." The absence usually means the category inherits controls from a parent index, and applying the wrong assumption at step four means rebuilding every page at step six. If your agency has not adopted a category the registry lists, that's not permission to use it β escalate to the agency CUI office, because local adoption governs what you may mark.
Dissemination Controls Are a Fixed Menu, and You Can Only Apply the Ones Listed for Your Category
The registry defines a closed set of dissemination controls, and the two you'll meet most often are Controlled Unclassified Information Basic and Specified. CUI Basic is the default: the information requires safeguarding and handling under the program but carries no additional distribution restriction beyond need-to-know. CUI Specified applies when the underlying law or regulation imposes its own handling rules, and it's where authorized holders may be limited to a named group.
Beyond those two, the registry publishes limited dissemination controls that narrow distribution further, including ones tied to law enforcement, export control, critical infrastructure, and foreign recipient restrictions. These are additive and narrow β applying one shrinks the audience, never widens it. The registry lists which controls are valid for each category, and that per-category listing is the part people skip.
That skipping is the source of the most common error in the whole program. People see a control referenced in a policy memo and apply it to every document in sight. If the registry doesn't list that control for your category, applying it can itself be a marking violation, because the banner now claims a restriction the authority doesn't support. Reciprocity also breaks down: a receiving agency can't verify a control that wasn't authorized, so the document stalls in the transfer.
Treat the dissemination control field as a three-way check rather than a free-text box. The registry must list the control for the category, the underlying authority must require it, and the document's audience must actually need the restriction. If any leg fails, don't apply it, and document why in your review notes so the next reviewer doesn't relitigate the decision.
Limited dissemination controls also raise the question of who can grant relief. Only the controlling agency β the one the designation indicator names β can authorize sharing that exceeds the listed controls. For a contractor, that means the contracting officer or the agency's CUI office, not your own security team, and not an informal email from a program manager who says it's fine. The registry names the controls; the controlling agency names who may relax them.
Policies Underpinning the Registry Come From 32 CFR Part 2002 and Agency Implementing Instructions
The rulebook behind the registry is 32 CFR Part 2002, the National Archives regulation implementing the CUI Program. It defines what CUI is, who may designate it, how it must be marked, how it's decontrolled, and how agencies must self-inspect. The CUI Registry is the annex to that regulation in every way that matters operationally β it converts the rule's abstract categories into specific, citable labels.
Executive Order 13556 established the program in 2010, replacing the prior patchwork of more than 100 ad hoc agency markings with a single system. That history is worth knowing because it explains the registry's structure: it's an attempt to collapse decades of inconsistent practice into one controlled vocabulary, and the organizational indexes are the residue of the old agency-by-agency schemes. When a category feels oddly specific, it usually is β it survived from a legacy marking that had to be preserved for legal reasons.
Agency implementing instructions sit below the regulation and above the registry in your daily work. Each agency publishes its own instruction telling employees which categories it has adopted, what its marking block looks like, how it handles decontrol, and who its CUI office contacts are. The Department of Defense instruction and manual are the most-cited examples because DoD handles the largest CUI volume, but every department has one, and for contractors the relevant instruction is often the one in the contract rather than the one in your own company policy.
Enforcement runs through self-inspection rather than through the registry directly. Agencies must inspect their own CUI programs, and the registry supplies the category and control definitions against which those inspections are judged. If an inspector finds a document marked with a category the agency hasn't adopted, the finding cites the agency's instruction, not the registry β but the registry is what establishes that the category existed and was adoptable. Keep both documents in front of you during any audit preparation.
Finding Forms Is the Weakest Link, and Knowing Which Issuer Controls Each Form Saves Hours
Forms are where the "one registry" expectation breaks down hardest. NARA publishes the cover sheets and designation indicators, but agency-specific forms β CUI marking templates, decontrol logs, self-inspection checklists, training rosters β live on individual agency sites. There is no single cross-agency forms library for CUI, and anyone who tells you otherwise is describing an aspiration rather than a live system.
The practical fix is to know which issuer controls which form family. NARA's CUI Program page carries the cover sheets and designation indicators. GSA's forms library carries the numbered standard forms, which is where you confirm you have the current SF 704 and SF 705 rather than an archived version. DoD's CUI page and the DoD instruction carry DoD-specific marking guides and training artifacts. Civilian agencies each post their own instruction, marking guide, and decontrol procedures on their CUI program page.
Version drift is the real risk here, not broken links. A form saved to a shared drive two years ago may carry an outdated marking block or a superseded control list. Before you reuse a template, confirm the version against the issuer's current page, and note the retrieval date in your document control log. That single habit prevents the most common audit finding in program reviews: forms in use that don't match the current published version.
For contractors, the controlling form set is usually the one named in the contract or the one the cognizant agency publishes, not your company's internal template. Your company template may be more convenient, but if the agency's review checklist expects the agency's marking block, convenience loses. Ask the contracting officer which marking guide governs deliverables, and record the answer β that exchange is itself worth keeping in the contract file.
Training Resources Are Distributed by Role, and the Registry Points Rather Than Hosts
The CUI training you need depends on your role, and the sources split accordingly. General awareness training β what CUI is, how to recognize a marking, how to handle a document β is typically delivered through your agency's or company's learning management system using content aligned to the NARA CUI Program's published training materials. Role-specific training for authorized holders, decontrol authorities, and self-inspection officials is usually agency-developed and sits behind the agency's own training portal.
NARA publishes training aids and awareness materials on its CUI Program page, which is the closest thing to a centralized training catalog. What NARA does not do is host a universally available course that satisfies every agency's requirement. That gap is structural: the regulation requires training, but each agency designs and delivers it. A certificate from one agency's course does not automatically satisfy another agency's requirement.
The timing requirement is the part people underestimate. Initial training is required before an individual is authorized to designate or handle CUI, annual refresher training is standard across agencies, and role changes trigger retraining. If you're a contractor onboarding a new employee, budget the training window into the start date β an uncleared employee who has completed general awareness but not role-specific training cannot act as an authorized holder, and letting them handle documents "just to review" is a program violation.
Records of training completion belong with your CUI program documentation, not just in the LMS. Inspectors ask for evidence that holders were trained before they handled designated information, and an LMS completion timestamp is the cleanest evidence you can produce. Export a roster each quarter and store it with your decontrol log; that pairing answers two of the most common inspection questions at once.
What the Registry Omits, and How Contractors Usually Fill the Gap
Read the registry carefully and you'll notice what it doesn't tell you: which categories your agency has adopted, what your contract requires, how your company's systems are authorized to store CUI, and who in your chain of command can approve a transfer. Contractors fill that gap from three sources β the contract, the agency's implementing instruction, and the company's CUI program documentation β and the registry serves as the reference the other three are checked against.
Here's a worked calculation worth doing once. Suppose you onboard ten staff and each needs general awareness training at roughly two hours plus role-specific training at four hours. That's 60 hours of training time before anyone is an authorized holder, and if one staff member handles both marking and decontrol duties, add a third module. The arithmetic isn't in the registry, but the training requirement that drives it is, and planning the 60 hours into a project schedule prevents the scramble that happens when deliverables are due and no one can sign as the authorized holder.
The FAQ below covers the questions that come up most often after people find the registry. A few of them are misconception corrections β the kind of thing that gets repeated in meetings until it's treated as policy.
FAQ
Is there one website that contains every CUI form and training course in a single download?
No, and the closest approximation is the NARA CUI Program page, which carries the approved cover sheets, designation indicators, policy, and training aids but does not host agency-specific forms or courses. Agency-specific forms and training sit on each agency's own CUI page or learning management system. Plan for three retrieval points β NARA, GSA forms library, and your agency's CUI page β rather than one.
What is the difference between the CUI Registry and an agency's CUI instruction?
The registry is the government-wide catalog of authorized categories, controls, cover sheets, and citations; an agency instruction is that agency's adoption decision, telling employees which categories it uses and how. A category can appear in the registry and still be unused at your agency, which means the registry is the ceiling and the instruction is the requirement.
Can I apply a dissemination control that isn't listed for my category?
No. The registry lists which dissemination controls are valid for each category, and applying an unlisted control produces a banner the controlling agency cannot verify, which can stall the document on transfer. If the authority seems to require it, escalate to the controlling agency's CUI office before marking rather than after.
Where do I find the current version of Standard Form 704?
Confirm it through the GSA forms library, which is the issuer of record for numbered standard forms, rather than from a saved copy on a shared drive. The registry's forms section links to the cover sheets NARA publishes, but the version check belongs at GSA. Record the retrieval date in your document control log.
How much training time should a contractor budget before someone can handle CUI?
Plan on roughly two hours of general awareness plus four hours of role-specific training per person, so ten staff means about 60 hours before anyone is an authorized holder. The numbers vary by agency and role, but the sequencing does not: training must be completed before handling, not after.
Do I need a cover sheet on a digital file?
Yes, though it takes a different form. For digital documents the cover sheet becomes the container or repository label and the designation indicator goes inside the document on the first page. A file with a correct banner but no designation indicator is incompletely marked, and auditors treat it that way.
What happens if my agency hasn't adopted a category the registry lists?
You may not mark with it. Local adoption governs what you can designate, so escalate to your agency's CUI office rather than improvising. Using an unadopted category produces markings the agency cannot defend during self-inspection, even though the category is legitimate at the government-wide level.
How often do agencies have to inspect their CUI programs?
Self-inspection is required under 32 CFR Part 2002, with the frequency set by each agency's implementing instruction rather than by the registry. The registry supplies the definitions inspectors measure against, so prepare by reconciling your markings to registry categories and your training rosters to holder records. Confirm your agency's specific cycle in its instruction.
This article is general educational information about the CUI Program and is not a legal opinion or a compliance determination for your organization. Requirements vary by agency, contract, and jurisdiction, so confirm marking, decontrol, and training obligations with your agency's CUI office, your contracting officer, or a qualified local professional before acting. If you are facing an immediate security incident involving protected information, contact your organization's security office and the appropriate authorities right away.