How is CUI defined in the general sense?

• A. Classified information requiring top secret clearance.
• B. Information that is always publicly releasable.
• C. Information that is only for internal use and always protected.
• D. Information that requires safeguarding or dissemination controls identified in law, regulation, or government-wide policy, but does not meet classification requirements.

Answer: (D)

CUI is unclassified information that still requires safeguarding or dissemination controls defined by law, regulation, or government-wide policy. It isn’t classified at any level, but it isn’t free to be shared without restrictions. The controls specify who can access it, how it can be used or disclosed, and through what channels, ensuring that sensitive but unclassified information is protected in the right contexts. This keeps information secure while allowing authorized sharing when needed, such as with partners under formal agreements.

That’s why it isn’t about top-secret or classified material, which would fall outside the CUI category; it isn’t necessarily publicly releasable, since many CUI items must be restricted; and it isn’t guaranteed to be internal-use-only and always protected, because CUI can be disclosed to external parties under proper controls.