How should data-sharing agreements be used for CUI?

• A. Allow recipients to ignore protections if they are trusted.
• B. Ensure recipients commit to CUI protection and compliance with 5200.48; include flow-down requirements.
• C. Only provide a general agreement with no flow-downs.
• D. Skip any agreement.

Answer: (B)

When sharing CUI, the binding terms of the data-sharing agreement must require the recipient to protect CUI and to follow the controlling safeguarding rules, including compliance with 5200.48. The strongest approach also includes flow-down provisions, ensuring that any sub-recipients or downstream contractors inherit the same obligations. This creates a chain of accountability so safeguards stay in place throughout the entire data-sharing arrangement. Without these protections, up the chain or with partners who aren’t bound by the same requirements, CUI is at greater risk of exposure and noncompliance. A generic agreement with no flow-downs or skipping an agreement altogether would leave critical protections unenforced and the data vulnerable.