How should mixed data containing CUI and classified information be handled?

• A. Apply the stricter safeguarding requirements of the more sensitive data and ensure proper labeling and access controls.
• B. Treat as CUI only; ignore classified data.
• C. Label accordingly but apply only CUI safeguards.
• D. Mixing policies is prohibited; must keep separate.

Answer: (A)

When mixed data contains CUI and classified information, you protect the data at the level of the highest sensitivity present. The classified portion imposes stricter handling rules, so the entire dataset should be labeled and safeguarded accordingly. Label the material with the highest applicable marking, ensure access controls reflect the most restrictive level, and apply the required security measures for the highest classification across storage, transmission, and handling. This prevents under-protecting the sensitive portion and reduces the risk of improper disclosure.

If you treated it only as CUI, the classified information would not receive the necessary protections. Applying only CUI safeguards to a mixed dataset ignores the stricter requirements of classification. Keeping policies completely separate isn’t practical in practice because the data is interwoven; the safer, correct approach is to adopt the higher standard for the entire item.