How should CUI be disposed of when no longer needed?

• A. Delete from all systems and backups immediately with no records.
• B. Archive for long-term storage.
• C. Dispose using approved methods to prevent reconstruction; maintain records of disposal when required.
• D. Simply delete the file and rely on overwriting during routine maintenance.

Answer: (C)

Disposing of CUI properly hinges on using approved methods that render data unrecoverable and, when required, documenting the disposal. This protects information from being reconstructed or accessed after it’s no longer needed, even if copies exist in backups or other storage.

Using approved methods means following defined sanitization or destruction processes that the organization or governing policies specify as capable of preventing reconstruction. This could include secure deletion tools that meet standards, cryptographic erasure where applicable, or physical destruction of media. Equally important is keeping records of disposal when policy or regulations require them, noting what was disposed, how, when, and by whom. This creates an auditable trail and ensures accountability.

Why the other approaches aren’t suitable: simply deleting and leaving no records can leave trace copies in backups or archived systems and often violates accountability requirements. Archiving CUI long-term preserves the information rather than disposing of it according to policy. Relying on routine deletion plus overwriting during maintenance does not guarantee complete and verifiable destruction, and may not meet approved methods or documentation needs.