Before disclosing CUI to another party, what must you verify?

• A. Recipient's department.
• B. Recipient authorization and need to know.
• C. Recipient's security clearance regardless of need.
• D. Only the recipient's name.

Answer: (C)

Before disclosing CUI, you must verify the recipient's security clearance. This clearance acts as the essential gatekeeper for handling sensitive information, ensuring that only individuals who have been vetted to a level appropriate for the data can access it. Even if someone has a stated need to know, without the proper clearance they should not receive CUI, because access must be tied to both authorization and appropriate safeguarding. While confirming authorization and need-to-know is important, the clearance check is the fundamental step that determines whether disclosure can proceed. Relying on department, or simply knowing the recipient’s name, does not establish that the information is being shared with someone qualified to handle it.