What are the destruction requirements for CUI?

• A. Destroy CUI materials so they cannot be reconstructed or retrieved, using approved methods.
• B. Delete from one device and leave others
• C. Archive for archival purposes
• D. Delete after five years

Answer: (C)

Destruction and disposition of CUI are governed by formal procedures that ensure information cannot be reconstructed or retrieved once it is no longer needed. The main idea is that CUI must be disposed of securely when it no longer serves a purpose, using approved methods, unless there is a formal authorization to preserve it for archival purposes.

Archiving for archival purposes is the best fit here because, when information has enduring value or is required for historical records, it can be designated for archival retention under approved disposition instructions rather than destroyed. This mirrors the concept that destruction isn’t automatic in every case; there are controlled exceptions where preserving the material is authorized and appropriate.

Destroying only on one device, deleting after a fixed period, or treating destruction as a unilateral action without a formal disposition plan all fail to capture the authorized pathway for long-term preservation that the policy allows. The option to archive for archival purposes reflects the approved, intentional retention path for CUI when not destroying it.