How should CUI be managed in cloud computing environments?

• A. Apply risk management, data handling controls, and ensure cloud providers implement CUI safeguarding in accordance with policy.
• B. Avoid using cloud services for CUI due to risk.
• C. Only use vendor-provided encryption; other controls are optional.
• D. CUI cannot be stored in the cloud.

Answer: (A)

Managing CUI in cloud environments revolves around a risk-based, layered safeguarding approach that aligns with policy and leverages the cloud provider under a shared responsibility model. Start by identifying CUI assets in the cloud, conducting risk assessments, and applying data handling controls such as proper labeling and classification, access controls and least-privilege, data segregation, retention, and secure configuration. Ensure the cloud provider is contractually required to implement CUI safeguarding and can supply evidence of compliance (like security plans and ongoing monitoring) that matches the policy requirements. Implement strong protections across the data lifecycle: encryption for data at rest and in transit, strong authentication, detailed auditing, incident response planning, and continuous monitoring. This approach acknowledges that safeguarding is a collaborative effort between you and the cloud provider and must be governed by policy rather than relying on encryption alone or avoiding cloud use.