What is the difference between 'FOUO' and 'CUI' labeling?

• A. They are the same.
• B. FOUO is a legacy label; CUI is the current framework with standardized safeguarding requirements.
• C. CUI is legacy; FOUO is the current framework.
• D. FOUO is for email only

Answer: (B)

FOUO and CUI labeling differ in that FOUO is a legacy designation for information that should be protected from broad disclosure, while CUI is the current, standardized framework that defines categories and uniform safeguarding requirements for unclassified information. FOUO came from older practices and varied in how it was applied, without a single government-wide set of handling and marking rules. CUI, established to harmonize protection across agencies, requires specific markings (such as CUI with a category), defined safeguarding controls, access restrictions, and rules for dissemination, transmission, storage, and incident handling. As agencies transition, information previously labeled FOUO should be re-marked under the CUI framework if it meets CUI criteria, ensuring consistent protection nationwide. The idea that they are the same, or that FOUO is current and CUI is legacy, or that FOUO applies only to email, isn’t accurate.