Do derivative documents shared outside DoD need to be marked if the information qualifies as CUI?

• A. Yes, they must be marked if the information qualifies as CUI
• B. No, they can be shared unmarked
• C. Only if the outside party is a government entity
• D. Only if the material is re-created from scratch

Answer: (A)

CUI markings travel with the information, even when you create something new from it. If you derive a document—whether by compiling, summarizing, redacting, or re-creating content—from CUI, that derivative still contains CUI content and must be marked accordingly before sharing outside DoD. The marking signals to external recipients how to handle and protect the information and what restrictions apply, keeping the sensitivity and safeguards intact across transmissions and formats. This applies regardless of who the outside recipient is, and it ensures consistent protection beyond the original source. So, when the material qualifies as CUI and you share a derivative outside DoD, you must apply the appropriate CUI markings to that derivative.