What verification steps confirm a recipient's need-to-know before sharing CUI?

• A. Confirm the recipient's authorization and need-to-know through established processes and records.
• B. Request the recipient's personal opinions about the data.
• C. Physically examine the recipient's device.
• D. Publish CUI to the recipient's public profile.

Answer: (A)

Confirming a recipient's authorization and need-to-know through established processes and records is how you verify access to CUI. This approach ensures that sharing is limited to individuals whose official duties require the information and who have been formally approved in a tracked, auditable way. It ties access to role-based need-to-know and documented authorizations, reducing the risk of accidental or intentional disclosure. Relying on personal opinions about the data doesn’t provide a reliable, objective basis for access and lacks the necessary accountability. Likewise, physically examining a recipient’s device doesn’t determine whether they should see the data and can’t substitute formal authorization or documented need. Publishing CUI to a public profile is inappropriate and would make restricted information accessible to unauthorized audiences, violating protection requirements.