How soon must a CUI incident be reported after discovery?

• A. As soon as feasible per policy, typically within 24 hours of discovery or per local SOP
• B. Within one week
• C. Only after full investigation
• D. Not required to report

Answer: (A)

Prompt reporting of a CUI incident is essential to minimize risk and trigger the proper response actions. Policies require that an incident be reported as soon as feasible, typically within 24 hours of discovery or according to local Standard Operating Procedures. This rapid notification allows the designated CUI program office and incident response teams to assess scope, determine which data were affected, begin containment, preserve evidence, and start any required notifications to stakeholders or authorities. You can provide initial, high-level details at first and then supply full findings as the investigation progresses; waiting for a full investigation before reporting delays protective measures and can widen the exposure. Reporting within a week or only after full investigation would miss the opportunity to limit damage and is not consistent with standard CUI handling requirements. Not required to report is incorrect because CUI incidents must be reported to maintain compliance and protective measures.