How should CUI containing PII be safeguarded?

• A. Protected with standard CUI safeguards only.
• B. Requires heightened privacy protections per policy and applicable privacy laws, with restricted access and enhanced safeguards.
• C. PII data must be deleted immediately.
• D. PII within CUI requires no additional protections beyond CUI.

Answer: (B)

PII within CUI is especially sensitive, so safeguarding it goes beyond the baseline CUI protections. When CUI contains PII, you must apply heightened privacy protections in line with applicable policy and privacy laws. This means restricting access to those with a legitimate need to know, and applying enhanced safeguards such as stronger access controls, encryption in transit and at rest, robust monitoring and audit trails, and clear handling and disposal procedures. These measures help prevent exposure, ensure accountability, and comply with legal and agency requirements. Deleting PII immediately or assuming no extra protections are needed would ignore the privacy obligations that accompany PII. Therefore, the correct approach is to enforce heightened privacy protections with restricted access and enhanced safeguards.