What is the role of risk assessment in CUI protection?

• A. Identify threats/risks to CUI and implement controls to mitigate them across physical, technical, and administrative domains.
• B. Limit access to CUI based on seniority alone.
• C. Focus solely on digital threats and ignore physical and administrative risks.
• D. Mark CUI documents and rely on labeling to protect information.

Answer: (A)

Risk assessment in CUI protection means systematically identifying threats and vulnerabilities to controlled unclassified information and deciding what controls to put in place to reduce those risks across all domains—physical, technical, and administrative. It’s about looking at where CUI is stored, processed, and transmitted, who has access, how it’s handled, and how incidents are detected and responded to. From this analysis, you implement appropriate safeguards—secure facilities and physical access controls; technical measures like encryption, access control, and monitoring; and administrative controls such as policies, training, incident response, and oversight. The aim is to prioritize protections based on the level of risk and reduce residual risk to an acceptable level.

The other options describe narrower ideas: relying solely on seniority-based access, ignoring non-digital threats, or depending only on labeling without mitigating risk. These don’t address the comprehensive, risk-based approach that considers all domains.