By William Price, Certified Lead CMMC Assessor (CCA) — A³ Vallum CMMC Advisory
Overmarked CUI is the scope-expansion problem most contractors do not see “until the bill arrives”. A prime contractor stamps “CUI” on a flow-down package because their compliance lead picked the conservative option. The sub accepts the marking. The systems that touched the package now sit inside the CMMC boundary. Six figures of architecture work follows. And the underlying document never met the CUI definition in the first place. The other way this commonly happens is a DoD contract officer liberally applies the “CUI” banner to everything they give you.
You have a right to push back. Here is what the rule says, with the citations, so you can shrink your scope to the data that actually warrants protection. We have seen customers decrease their needed CMMC enclave size from 200 users to 20 users by pushing back and getting reclassification of alleged CUI.
Per 32 CFR § 2002.20, a contractor may challenge an improper CUI marking and request decontrol from the originating agency. The information must continue to be treated as CUI until decontrol is granted. Decontrol is the cheapest control available, because a document correctly removed from CUI is a document that no longer drives systems into your CMMC assessment scope. Under Department of Defense Instruction (“DoDI”) 5200.48 §3.7.e, when an authorized person within DoD designates information as CUI, they are supposed to create a Security Classification Guide (“SCG”) or an equivalent memo that defines the attributes of the information that make it CUI. Simply requesting them to provide this can cause them to decontrol the CUI.
What overmarking actually is
Per 32 CFR § 2002.4, CUI is information the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, that a law or government-wide policy requires an agency to handle using dissemination controls. The phrase “law, regulation, or government-wide policy” is the test. If a contracting officer marks a document “CUI//SP-PRVCY” but the underlying authority does not exist, the document is overmarked.
The patterns seen most often:
Blanket flow-down marking. A prime or contract officer stamps “CUI” across an entire package because their compliance lead chose the conservative legal position. The SOW, the schedule, and the cover memos get the marking even though only the drawings might meet a Registry category.
Marking the wrapper, not the data. A statement of work is marked CUI even though the SOW itself contains no controlled technical information — only the deliverables it references would.
Export-control overmarking. A document is stamped “CUI//SP-EXPT” for export-control reasons but the underlying technical data does not meet the EAR or ITAR threshold. See ITAR vs CUI for where these regimes actually overlap.
Pre-emptive marking. A subcontractor marks emails as CUI because the prime might eventually send them CUI (before any covered defense information has actually been exchanged).
Stamping public domain content. An agency marks documents that are already publicly released, or whose underlying content has been released under FOIA.
Why overmarking matters for CMMC scope
If your CMMC scope is driven by where CUI flows, and the marking is wrong, your scope is wrong too. Overmarking leads to CMMC over-scoping.
The mechanics:
A document marked CUI gets logged as CUI. It enters your CUI inventory and your asset categorization under the CMMC Scoping Guide Level 2.
The systems that touched it become CUI Assets. The protections you apply — encryption, access control, audit logging, FIPS validation, the full set of Level 2 requirements — follow the asset.
The cost is real. A single misclassified document on a non-tenant SharePoint site can pull the whole site into scope. Licensing, IAM, logging, architecture changes follow.
I have seen contractors spend six figures hardening environments because they accepted overmarked content rather than challenge it. Preventable. The cheapest control you have is a correct CUI determination at receipt.
The decontrol process under 32 CFR 2002.20
The mechanism for fixing overmarking is decontrol, defined in 32 CFR §§ 2002.18 and 2002.20. Five points matter:
Decontrol is the originating agency’s call. The contracting officer or program office that applied the marking is the only entity with authority to remove it, except in narrow circumstances where the marking was clearly improper or the information has been released.
A contractor can request decontrol. Per § 2002.20(d), the recipient writes to the senior agency official or to the originating contracting officer, identifies the document, and explains why the marking does not meet the criteria.
The request must be in writing and specific. Cite the document control number, the marking applied, and the basis for the challenge — the information does not match a Registry category, the underlying authority does not exist, the content has been publicly released.
Treat the information as CUI until decontrol is granted. Per § 2002.20(e), you cannot self-decontrol. Even if you are sure the marking is wrong, you protect the information at the marked level until you receive written decontrol authority.
Keep a written record. The request, the response, the updated marking guidance — these go in your CMMC evidence package as the rationale for whatever you did with the document.
When to challenge, when to let it go
Not every overmark is worth the fight. The challenge process takes time and can damage a working relationship with a contracting officer if you use it on every document. Pick the moments that move the needle.
Challenge when: the overmarking has a meaningful scope or cost impact on your CMMC environment; the marking would force you to acquire infrastructure you would not otherwise need (a new tenant, a FedRAMP service, a new control implementation); the marking would block your business — an SOW marked CUI you need to share with a non-cleared subcontractor for proposal work; the pattern is systematic across an agency or prime; the marking conflicts with the CUI Registry on its face.
Do not challenge when: the overmark covers a single, low-volume document and protecting it costs you almost nothing; the contracting officer has signaled decontrol is unlikely and the relationship matters more than the principle; you cannot articulate a clear basis. “We don’t think this should be CUI” is not a basis. “This document does not contain technical information meeting the criteria for CUI//SP-CTI under the Registry, and it is materially identical to information already released under FOIA case 24-XXX” is.
The decontrol process works best when you can articulate an authority-based mismatch in writing.
DIBFI for CUI determination
DIBFI builds the CUI determination workflow, the decontrol-request templates, and the evidence trail directly into the readiness platform — so the marking review happens at receipt, not at assessment. Built for MSPs and consultants supporting CMMC clients.
A worked example
A small manufacturer I worked with received a flow-down package from a prime. Forty-seven pages, marked “CUI//SP-CTI” at the top of every page. The package included drawings (correctly marked), a statement of work (pages 1–18), and a master schedule (pages 35–47). The SOW and the schedule did not contain any technical information meeting the SP-CTI category — they referenced the drawings.
How decontrol fits the Scoping Guide
The Scoping Guide Level 2 categorizes assets based on whether they process, store, or transmit CUI. If a document was marked CUI, was decontrolled, and is now correctly unmarked, the systems that handled it after decontrol are not CUI Assets on that basis. Your evidence package needs to show four things:
- The original marking.
- The decontrol request and the agency response.
- The point in time at which the document and any derived data were no longer CUI.
- The downstream handling treatment after that point.
Without the third item, an assessor will reasonably treat the document as CUI through the entire period and your scope reduction will not hold. The fix is procedural — a dated marking change in the evidence trail.
Common mistakes
1. Self-decontrol. The contractor decides the marking is wrong, removes it on the local copy, and proceeds to handle the document in a non-CUI environment. This is a § 2002.20(e) violation. If the underlying information turns out to actually warrant CUI protection, it is also a CUI mishandling event reportable under DFARS 252.204-7012.
2. Challenging without a basis. A general objection to the marking, no Registry citation, no underlying authority, no specific content basis. The agency rejects on procedural grounds.
3. Challenging too late. The document has been distributed across the contractor’s organization for six months. Even if decontrolled, the audit trail is muddy. Challenge early, before the document propagates.
4. Confusing CUI with FCI or proprietary. A document can be sensitive without being CUI. The decontrol process applies to CUI markings only. If the customer is using “CUI” as a shorthand for “confidential,” the right path is a marking-clarification conversation, not a § 2002.20 challenge.
5. Forgetting the record-keeping. No audit-defensible artifact of the request and response. The decontrol happened in someone’s email and the email was not retained.
Frequently Asked Questions
Can I just refuse to handle an overmarked document? No. Once the document arrives marked CUI, you are bound to protect it at that level until the marking is changed by the originating authority. Refusing receipt is sometimes possible at the contracting stage. Rarely once flow-down is underway.
Who at the agency do I send a decontrol request to? The contracting officer first. Cc the agency’s CUI senior agency official if the issue is systematic. Each agency has a designated SAO under 32 CFR § 2002.16. The CUI Registry on the NARA site lists current SAO contacts.
How long does decontrol typically take? In my experience with DoD contracts, 14 to 60 days. Programs that have a CUI training discipline are faster. Programs where CUI is new are slower. The regulation does not impose a deadline on the agency.
What if my contracting officer refuses to decontrol? Document the refusal. You can escalate to the agency SAO, and ultimately to ISOO at NARA, but the practical reality is that you continue to protect the document at the marked level. Pick the fights that matter.
Does decontrol apply retroactively? Generally yes — once the agency confirms the marking was inappropriate, the information was never properly CUI. Your handling history is what it is. If you treated the document as CUI for six months, your scope analysis for that period does not change. Going forward, the document is unmarked.
Is overmarking a DFARS 252.204-7012 incident? No. Overmarking is a CUI program issue under 32 CFR Part 2002, not a cybersecurity incident. There is no 72-hour reporting clock.
Can I challenge a marking on an entire contract’s worth of documents at once? Yes — if the basis is the same. A systematic-overmarking pattern is a stronger position than a one-off challenge. Document the pattern, cite the contract, propose marking-discipline guidance for the program, and copy the agency SAO.
Closing thoughts
Contractors who run a fast CUI determination at receipt against the Registry, by someone trained are the ones who keep their CMMC scope tight. The contractors who accept every marking and harden every adjacent system are the ones who pay for protection that the underlying data never warranted. The regulation gives you a path to push back. So before you accept the next overmarked package and start hardening, ask yourself — does the content actually meet a Registry category, or are you about to spend money on a determination the agency would correct in 21 days if you asked?
A³ Vallum runs CUI determination and decontrol-request engagements for defense contractors. If you are about to invest in protecting data you suspect is overmarked, reach out for a CCA’s read on the marking and the path to challenge it.
About DIBFI for MSPs and consultants
DIBFI is a multi-tenant CMMC readiness platform built for MSPs and consultants. White-label by design, with SSP builders, CRMs, evidence lockers, CUI determination workflows, and “Ask an Assessor” guidance built in. Manage scope, evidence, POA&Ms, and assessment readiness across your entire client portfolio in one place.
Sources
- 32 CFR Part 2002 — Controlled Unclassified Information, particularly §§ 2002.4 (definitions), 2002.16 (senior agency officials), 2002.18 (decontrol), 2002.20 (challenges and decontrol requests)
- CUI Registry, National Archives and Records Administration (NARA)
- CUI Notice 2017-01, Information Security Oversight Office (ISOO), NARA
- CMMC Assessment Scope – Level 2, v2.13 (September 2024), DoD CIO (DoD-CIO-00006)
- DFARS clause 252.204-7012 — Safeguarding Covered Defense Information
- NIST SP 800-171 Revision 2 — security requirements
- NIST SP 800-171A — assessment objectives
