What must be ensured before sharing CUI with contractors or external partners?

• A. Rely solely on the contractor's internal policies; DoD requirements do not apply to contractors.
• B. Confirm need-to-know, ensure proper CUI marking and safeguarding are required by contract (flow-down).
• C. Share freely as long as the contractor is trusted, regardless of need-to-know.
• D. Only encryption is required, no need-to-know verification.

Answer: (B)

Before sharing CUI with contractors or external partners, you must establish need-to-know and ensure that CUI marking and safeguarding are required by the contract and flowed down to the contractor. This makes the sharing contingent on a legitimate purpose and binds the partner to the same handling standards, so the information is protected consistently.

Relying on a contractor’s internal policies is not enough because DoD CUI requirements apply to all recipients, and contract flow-down enforces those protections across the whole supply chain. Trust alone does not justify access, since access should be limited to individuals who truly need the information to perform the work. Encryption is valuable, but it is not the sole requirement; without proper marking, safeguarding, and need-to-know controls, sensitive information remains at risk.