For Official Use Only (FOUO)

For Official Use Only (FOUO) is a legacy designation previously used to mark sensitive but unclassified government information that required protective handling, though it has been largely superseded by the Controlled Unclassified Information (CUI) framework established under Executive Order 13556.

What is FOUO?

FOUO was historically one of the most common markings on sensitive but unclassified government documents, indicating that the information should not be publicly disclosed but is not formally classified. The marking appeared on law enforcement data, pre-decisional policy drafts, personally identifiable information, and other sensitive administrative records. With the issuance of Executive Order 13556 in 2010 and NARA's implementation of the CUI program, FOUO is being phased out in favor of the standardized CUI framework, which uses specific category markings (such as "CUI//PRVCY" for privacy information or "CUI//LAW ENF" for law enforcement sensitive data) rather than the generic FOUO label. Despite this transition, contractors still encounter FOUO markings on older documents and in some agencies that have not fully migrated to CUI. Contractors who receive or generate government information marked FOUO must handle it with appropriate protective measures, typically limiting access to personnel with a need to know and not releasing it to the public or unauthorized parties.

Why FOUO matters for government contractors

Contractors frequently handle FOUO or CUI-marked information as part of performance, government-provided data, draft reports, procurement-sensitive information, and personnel data. Mishandling FOUO/CUI information can result in contract termination, debarment, and legal liability. Contractors should train staff on information handling requirements and establish compliant data management practices as part of their security programs.

Example

A management consulting firm receives a package of agency planning documents marked FOUO as background material for a strategic assessment contract. The firm restricts internal distribution to only the team members with a demonstrated need, stores the documents on a secure file share inaccessible to other employees, and includes a FOUO/CUI handling policy in its contract kickoff training, consistent with the contractual requirements for handling sensitive government information.

Frequently Asked Questions

Is FOUO still a valid marking?

FOUO is being phased out as agencies transition to the CUI program, but it remains in use at agencies that have not yet fully implemented CUI. Contractors should treat FOUO markings with the same protective handling they would apply to CUI, as the underlying information sensitivity is equivalent.

What is CUI and how does it replace FOUO?

Controlled Unclassified Information (CUI) is the standardized framework for protecting sensitive but unclassified government information, established under Executive Order 13556. It replaces FOUO and dozens of other agency-specific markings with a uniform set of categories and handling requirements managed by NARA's CUI Program.

Are contractors required to implement CUI programs?

Contractors who handle CUI on behalf of the government are required to implement CUI handling requirements, which are typically specified in contract clauses (particularly DFARS 252.204-7012 for defense contractors). The requirements include marking, storage, access controls, training, and incident reporting.

What is the penalty for mishandling FOUO or CUI?

Mishandling FOUO/CUI is typically not a criminal offense unless the information is also export-controlled or privacy-protected, but it can result in contract termination, civil liability, loss of facility clearance for cleared contractors, and reputational damage. Contractors have contractual obligations to protect government-provided information regardless of whether criminal penalties apply.