What are general physical storage requirements for CUI?

• A. Store CUI in controlled, access-restricted environments to prevent unauthorized access or disclosure.
• B. Store CUI in open, shared offices to maximize collaboration.
• C. Store CUI on personal devices without policy.
• D. Store CUI in unsecured racks for easy access.

Answer: (A)

The essential idea is that CUI must be protected in spaces with controlled access to prevent unauthorized access and disclosures. Keeping CUI in a dedicated, access-restricted environment creates a physical barrier that only authorized personnel can enter, reducing the risk of exposure from incidental contact or theft. Within that protected space, you would use secure measures such as locked cabinets, safes, or dedicated rooms with badge control, visitor logs, and monitored entry to ensure that only those with a legitimate need to know can access the material. This approach aligns with the principle of limiting exposure to authorized individuals and adds a tangible layer of security beyond policies and procedures.

Open, shared offices fail to restrict who can see or handle the material, increasing the chance of inadvertent exposure. Storing CUI on personal devices or in unsecured racks removes the physical safeguards needed to deter unauthorized access and disclosure. In short, a controlled, access-restricted environment is the reliable way to minimize physical risk and protect sensitive information.