Does the policy scope include contractor personnel who handle CUI?

• A. No; it applies only to DoD components.
• B. Only DoD civilian employees are governed.
• C. Yes; DoD components and contractor personnel who handle CUI.
• D. Only contractors are covered.

Answer: (C)

Protecting CUI in DoD programs extends beyond DoD personnel to anyone who processes or has access to CUI. The policy scope includes DoD components and contractor personnel who handle CUI because safeguarding sensitive information must apply across the entire supply chain. Contractors and their staff are required to follow CUI handling rules through contract clauses and DoD program guidance, including marking, safeguarding, access control, need-to-know, training, and incident reporting. This coverage also extends to subcontractors and other third-party partners who touch CUI in DoD work. So, contractor personnel who handle CUI are indeed covered.