How should CUI be protected during electronic transmission?

• A. Transmit in plain text.
• B. Send via any email service.
• C. Store temporarily on shared drive then delete.
• D. Use approved secure channels and encryption; verify recipient authorization and need to know.

Answer: (D)

Protecting CUI during electronic transmission means using approved secure channels and encryption, and ensuring the recipient is authorized and has a need to know. Encryption guards the data while it’s in transit, so if it’s intercepted it remains unread. Approved channels ensure the transmission path and endpoints meet organizational security requirements, preventing exposure or tampering. Verifying recipient authorization and need-to-know limits who can access the information, reducing the risk that someone without a legitimate need gains access even if the data is reachable through the channel.

Transmitting in plain text leaves the information readable to anyone who could intercept it. Using any email service often means bypassing the required controls, potentially exposing CUI to untrusted systems or users. Storing temporarily on a shared drive and then deleting does not guarantee secure transmission or proper access controls; the data could be exposed to others who access the drive, and deletion doesn’t necessarily erase past copies or prevent unauthorized viewing. The recommended approach combines encryption, trusted channels, and strict access controls to maintain confidentiality and integrity during transmission.