What does “flow-down” mean in CUI contracts?

• A. The obligation to pass on CUI designation, safeguarding, and handling requirements to subcontractors.
• B. The obligation to destroy CUI after the project.
• C. The obligation to store CUI on a single device.
• D. The obligation to encrypt all CUI data.

Answer: (A)

Flow-down means passing CUI designation, safeguarding, and handling requirements down to subcontractors. When a prime contract involves CUI, the prime firm must embed CUI protection clauses in subcontracts so that any subcontractors who will handle CUI are bound to the same rules. This extends the protective obligations through the entire supply chain, ensuring that CUI is marked correctly, safeguarded with appropriate controls (access, storage, transmission), incidents are reported, and personnel are trained. It isn’t about destroying CUI after the project, storing it on a single device, or encrypting all CUI data by default; those are specific actions that may be required in certain contexts, but they aren’t what flow-down means.