When can CUI be disseminated to a foreign recipient?

• A. For official business, only if approved by a disclosure authority and the CUI is appropriately marked as releasable to the intended foreign recipient.
• B. As long as the recipient is allied.
• C. If the CUI is public domain.
• D. If the recipient signs NDA.

Answer: (A)

Disseminating CUI to a foreign recipient is tightly controlled to protect sensitive information. The rule is that such sharing for official business can occur only when an authorized disclosure authority explicitly approves it and the CUI is properly marked to indicate it is releasable to the specific foreign recipient. This combination—authority approval plus correct marking—ensures that the foreign distribution is intentional, authorized, and that the recipient understands the handling and restrictions that apply.

Relying on being allied, or assuming something already in the public domain, or simply having the recipient sign an NDA does not by itself authorize release. Alliances don’t automatically grant permission, public-domain status means the information is no longer restricted by CUI controls, and an NDA can help with protections but does not replace the required official authorization and markings for foreign disclosure.