CUI Marker
Detect, classify, and mark Controlled Unclassified Information per 32 CFR Part 2002.
Without this skill, CUI documents enter uncontrolled ArangoDB collections with no
marking, no distribution controls, and no audit trail — a compliance failure.
Commands
| Command |
Description |
./run.sh scan <path> |
Scan file/directory for CUI indicators |
./run.sh scan --collection <name> |
Scan ArangoDB collection for unmarked CUI |
./run.sh mark <doc_id> --category <cat> |
Apply CUI marking to document |
./run.sh mark <doc_id> --auto |
Auto-detect and apply appropriate marking |
./run.sh verify <doc_id> |
Verify document has proper CUI markings |
./run.sh categories |
List CUI categories and subcategories |
./run.sh report |
Generate CUI inventory report |
./run.sh flow <doc_id> |
Trace CUI flow through system |
./run.sh audit |
Audit all collections for unmarked CUI |
CUI Categories (Relevant to DIB)
| Category |
Subcategory |
Indicators |
| CTI |
Controlled Technical Information |
Engineering specs, test data, drawings |
| EXPT |
Export Controlled |
ITAR/EAR controlled data |
| PROPIN |
Proprietary Business |
Contractor proprietary, trade secrets |
| PRVCY |
Privacy |
PII, PHI |
| PROCURE |
Procurement & Acquisition |
Source selection, bid/proposal |
| INTEL |
Intelligence |
Threat data, assessments |
| INFOSEC |
Information Security |
Vulnerability data, pen test results |
CUI Marking Format (per NARA CUI Registry)
CUI//SP-CTI
CUI//SP-EXPT
CUI//REL TO USA, AUS, GBR
CUI//NOFORN
Documents receive:
- Banner marking — top/bottom of each page
- Portion marking — individual paragraphs containing CUI
- Distribution statement — who can receive
- Destruction notice — how to dispose
Detection Patterns
The scanner uses regex + LLM classification for:
- Technical data indicators (specifications, test procedures, drawings)
- Export control markers (ITAR, EAR, USML categories)
- PII patterns (SSN, DoD ID, clearance levels)
- Procurement language (source selection, FOUO markers)
- Legacy markings (FOUO, SBU, LES) that need CUI conversion
1---2name: cui-marker3description: Detect, classify, and mark Controlled Unclassified Information (CUI) per 32 CFR Part 2002. Scans documents and ArangoDB collections for CUI indicators, applies proper markings, and tracks CUI flow through the system.4---5
6# CUI Marker
7
8Detect, classify, and mark Controlled Unclassified Information per 32 CFR Part 2002.
9Without this skill, CUI documents enter uncontrolled ArangoDB collections with no
10marking, no distribution controls, and no audit trail — a compliance failure.
11
12## Commands
13
14| Command | Description |
15|---------|-------------|
16| `./run.sh scan <path>` | Scan file/directory for CUI indicators |
17| `./run.sh scan --collection <name>` | Scan ArangoDB collection for unmarked CUI |
18| `./run.sh mark <doc_id> --category <cat>` | Apply CUI marking to document |
19| `./run.sh mark <doc_id> --auto` | Auto-detect and apply appropriate marking |
20| `./run.sh verify <doc_id>` | Verify document has proper CUI markings |
21| `./run.sh categories` | List CUI categories and subcategories |
22| `./run.sh report` | Generate CUI inventory report |
23| `./run.sh flow <doc_id>` | Trace CUI flow through system |
24| `./run.sh audit` | Audit all collections for unmarked CUI |
25
26## CUI Categories (Relevant to DIB)
27
28| Category | Subcategory | Indicators |
29|----------|-------------|------------|
30| CTI | Controlled Technical Information | Engineering specs, test data, drawings |
31| EXPT | Export Controlled | ITAR/EAR controlled data |
32| PROPIN | Proprietary Business | Contractor proprietary, trade secrets |
33| PRVCY | Privacy | PII, PHI |
34| PROCURE | Procurement & Acquisition | Source selection, bid/proposal |
35| INTEL | Intelligence | Threat data, assessments |
36| INFOSEC | Information Security | Vulnerability data, pen test results |
37
38## CUI Marking Format (per NARA CUI Registry)
39
40```
41CUI//SP-CTI
42CUI//SP-EXPT
43CUI//REL TO USA, AUS, GBR
44CUI//NOFORN
45```
46
47Documents receive:
481. **Banner marking** — top/bottom of each page
492. **Portion marking** — individual paragraphs containing CUI
503. **Distribution statement** — who can receive
514. **Destruction notice** — how to dispose
52
53## Detection Patterns
54
55The scanner uses regex + LLM classification for:
56- Technical data indicators (specifications, test procedures, drawings)
57- Export control markers (ITAR, EAR, USML categories)
58- PII patterns (SSN, DoD ID, clearance levels)
59- Procurement language (source selection, FOUO markers)
60- Legacy markings (FOUO, SBU, LES) that need CUI conversion