STIGQter STIGQter: STIG Summary: Traditional Security Checklist Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

Controlled Unclassified Information - Marking/Labeling Media within Unclassified Environments (Not Mixed with Classified)

DISA Rule

SV-245850r1226304_rule

Vulnerability Number

V-245850

Group Title

IS-16.03.02

Rule Version

IS-16.03.02

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

General Information:

This fix is only for unclassified/sensitive media being used in a strictly unclassified physical environment. If all CUI media are in a mixed environment where classified systems and media are in use, then STIG ID IS-03.02.01. applies and this potential vulnerability is NA.

Ensure the following standard is met:

Regardless of media type, the requirement to identify as clearly as possible the information requiring protection remains. Therefore, ensure all unclassified media containing CUI is properly marked according to content. Where it is not feasible to include markings with all of the information required for classified or sensitive documents or media, an explanatory statement that provides the required information shall be included on the item or with the documentation that accompanies it.

While CUI is the primary marking used in DOD, all types of CUI markings must be considered for use as appropriate. For instance: "Law Enforcement Sensitive" is a marking sometimes applied by the Department of Justice and other activities in the law enforcement community, including those within the Department of Defense.

Check Contents

General Information:

This check is only for unclassified/sensitive media being used in a strictly unclassified physical environment. If all CUI media are in a mixed environment where classified systems and media are in use, then STIG ID IS-03.02.01 applies and this check is NA.

Check to ensure the following standard is met:

Regardless of media type, the requirement to identify as clearly as possible the information requiring protection remains. Therefore, check to ensure all unclassified media containing CUI is properly marked according to content. Where it is not feasible to include markings with all of the information required for classified or sensitive documents or media, an explanatory statement that provides the required information shall be included on the item or with the documentation that accompanies it.

While CUI is the primary marking used in DOD, all types of CUI markings must be considered for use as appropriate. For instance: "Law Enforcement Sensitive" is a marking sometimes applied by the Department of Justice and other activities in the law enforcement community, including those within the Department of Defense.

TACTICAL ENVIRONMENT: The check is applicable for all fixed tactical processing environments where CUI is developed and used. The check is not applicable to a field/mobile environment.

Vulnerability Number

V-245850

Documentable

False

Rule Version

IS-16.03.02

Severity Override Guidance

General Information:

This check is only for unclassified/sensitive media being used in a strictly unclassified physical environment. If all CUI media are in a mixed environment where classified systems and media are in use, then STIG ID IS-03.02.01 applies and this check is NA.

Check to ensure the following standard is met:

Regardless of media type, the requirement to identify as clearly as possible the information requiring protection remains. Therefore, check to ensure all unclassified media containing CUI is properly marked according to content. Where it is not feasible to include markings with all of the information required for classified or sensitive documents or media, an explanatory statement that provides the required information shall be included on the item or with the documentation that accompanies it.

While CUI is the primary marking used in DOD, all types of CUI markings must be considered for use as appropriate. For instance: "Law Enforcement Sensitive" is a marking sometimes applied by the Department of Justice and other activities in the law enforcement community, including those within the Department of Defense.

TACTICAL ENVIRONMENT: The check is applicable for all fixed tactical processing environments where CUI is developed and used. The check is not applicable to a field/mobile environment.

Check Content Reference

M

Target Key

5410