How should leadership reporting support governance in a CUI program?

• A. To share compliance metrics only.
• B. To summarize budgetary expenditures only.
• C. To provide visibility into compliance, risk, incidents, and resource needs for governance.
• D. To publish CUI holdings publicly.

Answer: (C)

Leadership reporting should provide visibility into compliance, risk, incidents, and resource needs so governance can oversee the program effectively. In a CUI program, governance bodies are responsible for ensuring protective measures are working across people, processes, and technology. They need a single, integrated view that translates technical controls into business-relevant information: where compliance is solid, where risk is rising, what incidents have occurred and how they were handled, and what resources are required to strengthen defenses and close gaps.

This holistic view lets leadership set priorities, approve and adjust budgets, manage risk appetite, and track remediation progress. It ensures decision-makers can see trends over time, understand residual risk, and allocate funding, staffing, training, and tool investments accordingly. Focusing only on compliance metrics misses the bigger picture of how controls reduce risk and how incidents drive changes, while a budget-only report ignores how those funds translate into security outcomes. Publicly publishing CUI holdings would also violate security policies, so leadership reports should remain internal.