How to Check a Document for Classified or CUI Markings Before Sending It

Disclosure. Strike Labs makes Strike Gate, an automated marking scanner. This guide describes a review process that works with or without any tool, including ours, and is explicit about what automated checks miss.

Sending a document takes seconds. Cleaning up an improper disclosure can take months and cost a contract.

Most release mistakes are not deliberate. A slide is copied from a marked briefing. A template carries an old banner. A paragraph pasted from source material keeps its portion mark. A comment or tracked change preserves text everyone thought was deleted. A quick look at page one misses a portion mark on page 47.

The process below is meant to catch those mistakes. It does not make anyone a classification authority, and it does not replace your organization's release procedures, your Facility Security Officer (FSO), or your contract's security requirements.

1. Know what you're looking for

Four kinds of marking matter for release decisions. Formats below are illustrative; follow the official guidance for your agency and contract.

Keep a few distinctions straight:

• CUI is not classified. A CUI banner never makes a document classified, and the two systems have different rules.
• Words are not markings. "Confidential" on a commercial NDA or "secret sauce" in a proposal is not a classification. A real marking has a specific format and location.
• Formats vary in the wild. Older documents, foreign-government material, and joint markings may not match current formats exactly. Treat anything that looks like a marking as worth a second look.

2. Inspect the whole file, not just what's on screen

The visible pages are only part of the file. Markings and sensitive text often survive in places a reader never sees:

Practical steps:

• Read every page. Banners on page one do not tell you about portion marks on page 47.
• Run the built-in cleanup tools. Word and PowerPoint have File > Info > Check for Issues > Inspect Document; Acrobat Pro has Redact and Sanitize Document. Use them before external release.
• Check images. Text in screenshots and scanned pages is invisible to search and to most text-based scanners unless OCR is applied.
• Never "redact" by drawing a black box. In many PDFs and Office files, the text underneath is still there and can be copied out. Use a real redaction tool and verify by trying to select or search the removed text.
• Check the release itself. Is every recipient authorized, with a lawful government purpose where CUI is involved? Is the transmission method approved? For DoD contractors, CUI must stay on systems that meet NIST SP 800-171 under DFARS 252.204-7012.

3. Know what marking checks cannot catch

A marking check, manual or automated, only finds markings. The most serious release risks often have none:

• Unmarked sensitive information. Content that should have been marked but wasn't, such as technical details drawn from a classified program or CUI that no one labeled.
• Compilation. Individually unclassified facts can be classified when combined. No scanner can judge that; your security classification guide and an authorized classifier can.
• Derived content. Paraphrasing or summarizing marked material removes the marking but not the sensitivity.
• Wrong markings. A marking may be outdated, over-classified, or incorrect. Finding one tells you to ask, not what the answer is.
• Examples and training material. Some documents show markings as examples. They still deserve a check before release.

This is why a marking check is one step in a release review, never the whole review.

4. If you find something, stop

Treat any unexpected marking as a reason to pause the release, not to investigate on your own.

If it might be classified:

• Stop the release. Do not send, forward, print, or copy the file.
• Do not delete it or try to "fix" it yourself; that can complicate the response.
• Do not upload it to any scanner, AI tool, or cloud service to check it. If the file is classified, it is already on a system not authorized for it, and every copy makes it worse.
• Contact your FSO or security officer right away and follow their instructions. Cleared contractors have reporting obligations for possible spills.

If it's CUI:

• Confirm the recipient is authorized and the channel is approved before sending.
• Check the CUI category and any limited dissemination controls, such as NOFORN or FEDCON.
• If you are unsure, ask your security or contracts point of contact, or the controlling agency named in the designation block.

5. Add an automated check — and know its limits

Automated scanners are good at one thing people are bad at: checking every page, header, and portion mark consistently. Options range from enterprise labeling and DLP platforms to focused scanners such as Strike Gate. Choose based on where your documents live and whether you need detection, labeling, or enforcement.

A reasonable workflow:

1. Open the file only in an environment authorized for it.
2. Run the scan.
3. Review each finding and its location; open the document to confirm it.
4. Resolve findings with the right people, not by deleting markings.
5. Continue with your normal release approval.

Before relying on any scanner, find out:

• Which file types and parts it reads. Does it check comments, tracked changes, speaker notes, embedded objects, metadata, and attachments?
• Whether it reads images. Without OCR, scanned pages and screenshots are blind spots.
• Which marking formats its rules recognize, and how it handles legacy and non-standard markings.
• How it fails. If a file can't be parsed, does it say so, or does it report no findings?
• Where your file goes during scanning. See our guide to verifying that a scanner doesn't upload files.

What a clean result means: the tool's rules found no recognized markings in the parts of the file it was able to read. It does not mean the document is unclassified, free of CUI, or approved for release. Strike Gate's results carry the same limits.

Before you click Send

• [ ] Read every page, including headers, footers, tables, and appendices
• [ ] Checked comments, tracked changes, hidden content, speaker notes, and embedded objects
• [ ] Ran Inspect Document (Office) or Sanitize (PDF)
• [ ] Checked images and scanned pages
• [ ] Ran an automated marking check, if your organization uses one
• [ ] Confirmed every recipient is authorized
• [ ] Confirmed the transmission method is approved
• [ ] Escalated anything uncertain to security

The rule: check the markings, confirm the release, and escalate anything you're unsure about. Tools reduce what gets overlooked. Only authorized people and your established procedures decide what can be released.

Strike Gate flags patterns for human review. It does not make classification decisions or authorize handling. Follow your organization's approved procedures.

Sources and further reading

• NARA CUI Program and Registry
• 32 CFR Part 2002 — Controlled Unclassified Information
• 32 CFR Part 2001, Subpart C — Identification and Markings
• ISOO (Information Security Oversight Office) — marking guidance for classified information
• 32 CFR Part 117 — NISPOM
• DoDI 5200.48, Controlled Unclassified Information
• DoDI 5230.24, Distribution Statements on DoD Technical Information
• Strike Gate detection rules