Sensitivity Label Inheritance: When Files Keep Their CUI Markings

Files keep their CUI markings when you pair human-readable banners and labels with machine-readable sensitivity labels that carry forward in common workflows. Microsoft Purview supports that carry-forward in Office and Exchange, with specific conditions you must configure and test.

Federal CUI marking rules for electronic media

DFARS 252.204-7012 points to the CUI Registry and defines the contract trigger. The clause ties safeguarding to covered defense information that a contract or system owner marked or otherwise identified. Contractors need markings that inform holders that content contains CUI and that set any dissemination limits grounded in the CUI Registry.

NARA maintains the CUI Registry as the authoritative source for categories and limited dissemination controls. NARA guidance provides standard forms for coversheets and media labels. Agencies and contractors use these to mark paper and physical media so users recognize CUI at a glance.

ISOO training reinforces the intent. Markings inform users and direct handling. When individual file markings on systems become impractical, agencies may use alternate indicators such as banners or splash screens to flag CUI presence on that system.

NIST SP 800-171 and CMMC Level 2 expectations for media markings

NIST SP 800-171 Rev. 2 sets the requirement. Control 3.8.4 directs you to mark media with necessary CUI markings and distribution limitations. The CMMC Level 2 Assessment Guide carries this into MP.L2-3.8.4. Assessors check whether you marked media that contains CUI, and whether the marking conveys any dissemination limits that apply based on NARA guidance.

You cover both digital and paper. You also set ownership and contact information so users can resolve questions fast, which aligns with the Assessment Guide note that media marking can pair with an identifiable owner requirement.

Purview sensitivity labels as CUI indicators

Microsoft Purview sensitivity labels give users and systems a consistent indicator for CUI-equivalent handling in Office and Exchange. The Microsoft documentation describes how Office apps apply and honor labels on documents and email. Administrators can enable label support for files in SharePoint and OneDrive so web clients recognize and preserve labels that desktop apps apply.

Treat sensitivity labels as a technical aid, not as the official CUI marking itself. NARA defines the official markings. Your policy needs to map CUI categories and any limited dissemination controls from the CUI Registry to a label taxonomy that users can apply in normal work. The label display name and tooltip can carry plain-language cues such as “CUI” and relevant LDCs, while your procedures cover page banners, coversheets, and media stickers for human users.

Pair labels with data loss prevention so your tenants enforce handling rules that match the markings. We outlined that coupling in Microsoft Purview for CUI DLP.

Label inheritance across Office and email

Microsoft Purview supports label inheritance in email based on attached files. When you configure the policy, Exchange evaluates attachments and applies the highest-priority sensitivity label to the message. The Microsoft guidance limits this to physical file attachments. A link to a file in SharePoint or OneDrive does not trigger email inheritance.

Administrators control precedence. Policy can allow an inherited label to raise the classification on a message that has a lower default. Policy can also stop a user from sending a message with a label that conflicts with the attached file. You confirm these outcomes in your tenant with test cases that mirror real workflows.

Office desktop and web clients honor labels on documents. You enable labeling for files in SharePoint and OneDrive so web editors read and write labels that you or a user set in Word, Excel, or PowerPoint. That alignment keeps the machine-readable indicator with the file through save, sync, and coauthoring.

Two points set user expectations in mail flows:

Attach labeled files when the email content inherits classification by policy.
Avoid relying on inheritance when you share links to labeled files stored in SharePoint or OneDrive.

SharePoint and OneDrive file behavior

SharePoint and OneDrive store the file and its sensitivity label as content metadata that Office clients understand. Administrators enable this support so the web apps and the sync client respect labels applied in Office desktop clients. That step prevents a label from dropping during a save to SharePoint or a browser edit in Word for the web.

Email behavior differs from repository behavior. An email that points to a file by link does not gain a label from that link. You rely on repository access controls, the file’s label, and any DLP rules to protect that scenario. If the message body also contains CUI, users need to label the message, or your policy needs to enforce a message label based on conditions independent of attachment inheritance.

Two design moves reduce confusion for collaboration sites:

Set a default sensitivity label on high-value libraries to nudge users toward the right choice for new files.
Train site owners to recognize when a location-driven default makes sense and when a file-level label should take precedence.

Policy design that binds human markings and technical labels

A sound CUI marking program uses both official NARA-aligned human markings and machine-readable labels that systems can act on. You write policy so the two work together.

Define a label taxonomy that mirrors your CUI categories at the level users can pick without guesswork. Include limited dissemination language in the label name or tooltip when policy requires that guidance at the point of use.
Direct users to apply page banners, coversheets, and media stickers per NARA guidance for paper and physical media, and to apply sensitivity labels in Office and Outlook for electronic files and mail.

Administrators configure the tenant to support that policy:

Publish label policies to the roles that create and send CUI. Enforce mandatory labeling for email and Office documents when your governance process supports that control.
Enable label support for SharePoint and OneDrive so clients preserve labels during web editing and sync.

Document the design and the user instructions in your SSP and procedures. Align the control language with MP.L2-3.8.4 in your NIST 800-171 and CMMC Level 2 mapping. Keep your CUI boundary explicit so you focus labels and enforcement on in-scope systems.

Testing, evidence, and assessor expectations

Test label inheritance and preservation in the flows your users run every day. Focus on the cases that drive risk and that assessors will sample.

Attach labeled Office files to a message with no label, then confirm the message gains the highest-priority label by policy.
Insert a SharePoint or OneDrive link to a labeled file in a message, then confirm the message label does not change and that DLP or transport rules still enforce policy if the body contains CUI.

Keep screenshots and configuration exports for label policies and SharePoint and OneDrive label enablement. Train users on when to attach, when to share, and how to set a label when the policy does not set it for them. Assessors will review whether you marked media that contains CUI with the required markings and any dissemination limits. Your evidence should show the end-to-end picture, from the NARA-driven human marking to the machine-readable label that Office and Exchange honor.

Boundaries and limits

Do not present sensitivity labels as the official CUI marking. NARA controls the marking scheme. Use labels to keep CUI-equivalent indicators with files and mail in Microsoft 365, and use banners, coversheets, and stickers to satisfy human recognition needs for paper and physical media.

Microsoft documents label inheritance for email and label support in Office, SharePoint, and OneDrive. The documentation does not claim inheritance across every client, file type, or integration. You test your tenant and note any gaps in procedures. If a workflow cannot carry a label by policy, users need instructions that fill that gap.