What action is required if a CUI container is lost or stolen?

• A. Notify a coworker first, then report later.
• B. Wait 24 hours before reporting.
• C. Immediately report incident to the designated official and initiate protective actions.
• D. Document internally and do not report.

Answer: (C)

Immediate reporting to the designated official and initiating protective actions is required when a CUI container is lost or stolen. This ensures the incident triggers the approved response process right away, so the organization can quickly determine what data was present, who had access, and what steps are needed to contain and mitigate the risk. Protective actions may include securing the location, revoking or changing access, locating or recovering the media, and notifying the appropriate stakeholders and authorities as required. Delaying reporting or handling the situation informally can leave sensitive information exposed and hamper timely containment and risk assessment.

Informing a coworker first delays official escalation, waiting 24 hours increases exposure risk, and simply documenting the incident without reporting fails to activate the necessary containment and notification steps.