What is the 'need to know' principle in CUI handling?

• A. Access is based on role alone.
• B. Access is unlimited to all DoD personnel.
• C. Access is restricted to individuals with a legitimate need to know for official duties.
• D. Access is granted to anyone in the same department.

Answer: (C)

Access to CUI is restricted to individuals who have a legitimate need to know to perform official duties. This ensures information is shared only with those who must see it, supporting the principle of least privilege and reducing the risk of disclosure. A person’s role might suggest possible access, but having the role alone does not authorize access unless there is a specific need to know for an official task. Unlimited access across DoD personnel would undermine safeguarding, and granting access to everyone in the same department similarly ignores the need-to-know basis. By applying need to know, you balance operational requirements with protection of sensitive information.