To whom should a CUI incident be reported?

• A. CUI Program Manager or designated authority.
• B. Your IT help desk.
• C. Your supervisor only.
• D. Only if legally required.

Answer: (A)

Reporting a CUI incident through the official channel—the CUI Program Manager or the designated authority—ensures the incident is handled, documented, and escalated correctly under policy. This person or office oversees the incident response for CUI, coordinating with security, legal, and any other required offices and maintaining the official incident record for compliance. Submitting to an IT help desk alone can delay or bypass the mandated workflow, and telling a supervisor only may leave the formal accountability and oversight gaps unaddressed. Reporting only if legally required suggests a wait-and-see approach, but policy requires reporting to the designated authority regardless of a legal trigger so that appropriate containment and notification actions occur from the start.