How is CUI incident response integrated with the broader incident handling process?

• A. CUI incidents are managed separately from general incident handling.
• B. There is no requirement for reporting CUI incidents.
• C. The CUI incident response is integrated into the broader incident handling process to ensure prompt reporting and mitigation.
• D. CUI incident response is handled exclusively by the IT department.

Answer: (C)

CUI incident response is integrated into the broader incident handling process to ensure prompt reporting and mitigation. When an incident involves Controlled Unclassified Information, it should follow the same incident response lifecycle as other major security events—identify, contain, eradicate, recover, and lessons learned—so risks are addressed quickly and with proper oversight. This integration prevents handling CUI incidents in isolation, elevating them to the right stakeholders (security operations, information assurance, legal/compliance, and program owners) and coordinating through established playbooks and communication channels. It also protects the sensitive information during investigation by maintaining appropriate access controls and chain of custody. Timely reporting aligns with policy requirements and enables rapid containment and remediation, while a unified process promotes consistency, better situational awareness, and shared lessons across the organization. Keeping CUI incidents separate or leaving reporting out would introduce delays, reduce visibility, and weaken compliance and protection of CUI.