How should CUI be handled in email?

• A. Mark emails containing CUI, limit distribution, and use encryption when transmitting
• B. Leave unmarked and distribute widely
• C. Mark only external emails
• D. Encryption is optional

Answer: (B)

Handling CUI in email hinges on three safeguards: marking, controlled distribution, and encryption in transit. Marking emails containing CUI signals to the recipients that the message carries sensitive information and must be handled accordingly. Limiting distribution ensures only authorized individuals who have a need to know can access the content, preventing unnecessary exposure across the organization. Encryption in transit protects the data as it travels between systems, guarding against interception while the email is moving through networks.

These practices together align with CUI protection requirements and reduce the risk of disclosure. Leaving CUI unmarked and distributing it widely undermines all three protections. Marking only external emails would still fail to safeguard internal CUI, and treating encryption as optional would leave data vulnerable during transmission.