What must accompany any sharing of CUI with contractors to ensure protection?

• A. Verbal assurances
• B. Data handling agreements that specify CUI protection and compliance with 5200.48
• C. No documentation required
• D. Only NDA

Answer: (B)

The key idea is that protecting CUI when it’s shared with contractors requires a formal agreement that binds the contractor to specific safeguarding requirements. A data handling agreement that explicitly outlines how CUI must be protected and confirms compliance with DoD safeguarding standards, specifically 5200.48, provides enforceable duties, responsibilities, and controls. This ensures there are concrete expectations for how data is marked, stored, transmitted, accessed, and disposed of, plus requirements for incident reporting and training. Verbal assurances or NDAs alone don’t establish the concrete controls or the DoD-compliance framework needed for CUI, and no documentation would leave gaps in safeguarding. By tying protection practices directly to a contract and to 5200.48, you create accountability and a verifiable path to maintain CUI integrity.