What is the purpose of reporting to leadership within a CUI program?

• A. To ensure all staff understand CUI handling.
• B. To document compliance for external audits only.
• C. To provide visibility into compliance, risk, incidents, and resource needs for governance.
• D. To publish CUI holdings to the public.

Answer: (C)

In a CUI program, leadership reporting is about giving decision-makers a clear view of how the program is performing and what it needs to stay secure. This means showing current compliance with CUI handling requirements, the overall risk posture, any incidents or near misses, and the resources or funding needed to fix gaps and strengthen controls. With that visibility, leaders can set priorities, authorize corrective actions, and allocate budgets to improve the program over time. While training staff and preparing for audits happen, the primary goal of reporting to leadership is governance and risk management—not just education or compliance paperwork. Publishing CUI holdings to the public is not appropriate and would undermine security.