Are DoD contractors required to protect CUI?

• A. No; contractors are not required to protect CUI.
• B. Yes; they must implement safeguarding, marking, flow-down, and incident reporting requirements per contract.
• C. Only DoD employees are required to protect CUI.
• D. Protection is only required for encrypted data.

Answer: (B)

Protecting CUI in DoD contracting is a contractual obligation that travels with the data when it’s created or received by the contractor. The contract specifies how CUI must be handled, including safeguarding to prevent disclosure or compromise, marking so everyone handling the data knows its sensitivity and restrictions, flow-down to ensure subcontractors also apply the same protections, and incident reporting so DoD is alerted promptly if something goes wrong. This framework is built on established requirements like DFARS clauses and the NIST SP 800-171 baseline, which set the concrete controls for protecting CUI across the contractor’s environment. The reason this approach is the correct one is that DoD relies on contractors to securely manage CUI across the entire supply chain; protections aren’t optional or limited to DoD employees, and they encompass more than just encryption. The emphasis is on a comprehensive set of practices that ensure proper marking, broadened safeguarding, proper cascading of obligations to all partners, and timely reporting of incidents, all defined in the contract.