What is the purpose of inventories of CUI holdings?

• A. To know where CUI exists, who has access, and ensure appropriate controls and disposal.
• B. To maximize the amount of CUI stored.
• C. To decide which CUI to classify as public.
• D. To determine budget unrelated to CUI holdings.

Answer: (A)

Keeping an inventory of CUI holdings gives you clear visibility into where sensitive information exists, who has access to it, and what protections and disposal actions are in place. This makes it possible to enforce required safeguards across the full lifecycle of the data—from storage and access controls to marking, handling, and secure disposal when it’s no longer needed. With an up-to-date inventory, you can quickly locate CUI, limit access to those who truly need it, apply appropriate protective measures, and demonstrate compliance during audits or in incident response.

The other ideas miss the point. It isn’t about storing more CUI, which would increase risk; it isn’t about reclassifying information as public, which would undermine protections; and it isn’t about budgeting in a way that ignores CUI holdings.