CUI handling must be guided by which authorities?

• A. Internal DoD emails only.
• B. Industry standards only.
• C. Classification guidance.
• D. Law, regulation, and government-wide policies.

Answer: (D)

CUI handling is governed by law, regulation, and government-wide policies. These authorities provide the binding rules that apply across the entire federal government, ensuring consistent protection of sensitive but unclassified information. Laws and executive orders establish the baseline requirements for how CUI can be stored, transmitted, and shared. Regulations turn those requirements into specific, enforceable rules, and government-wide policies ensure uniform application across agencies and contractors.

Internal DoD emails alone do not set binding requirements at the federal level, and industry standards, while helpful, are not mandatory unless adopted into policy. Classification guidance focuses on marking and handling information that is classified, which is a different category from CUI.