What steps are taken during personnel turnover or departure to protect CUI?

• A. Delete their emails from their account only
• B. Reassign their duties to another employee
• C. Immediately archive their data for later use
• D. Retrieve all CUI materials, revoke access, and ensure proper destruction or transfer of custody of any copies

Answer: (D)

Protecting CUI during turnover focuses on securing data and cutting off access before someone leaves. The best approach is to retrieve all CUI materials, revoke access to systems and networks, and ensure proper destruction or transfer of custody for any copies. This means collecting physical documents and media, reclaiming devices, and making sure digital copies stored in emails, shared drives, or cloud services are returned or access is removed. It also involves transferring any necessary CUI copies to an authorized custodian or securely destroying them according to policy, and revoking credentials to prevent post‑departure access. Working with information security, records management, and legal ensures retention and destruction rules are followed and the chain of custody is preserved. By securing both the data and the access rights, you prevent unauthorized disclosure or loss as personnel exit.