When data containing CUI is shared with external collaborators, which document is required to specify protection against CUI?

• A. Memorandum of Understanding only
• B. Data handling agreements that specify CUI protection and compliance with 5200.48
• C. Non-disclosure agreement only
• D. No documentation needed

Answer: (B)

When you share CUI with someone outside your organization, you need a binding contract that spells out exactly how that data will be protected and how compliance will be demonstrated. Data handling agreements serve this purpose by outlining the specific CUI protection requirements and tying the external party to applicable regulations, such as 5200.48. They cover concrete controls for handling, storage, transmission, access, incident reporting, and audit rights, ensuring everyone understands their responsibilities.

A memorandum of understanding tends to be a broad, collaborative terms document without the concrete security safeguards specific to CUI. A non-disclosure agreement focuses on keeping information confidential but often does not impose the detailed CUI safeguarding controls or reference the regulatory compliance needed. No documentation would leave protection unaddressed, which isn’t acceptable for CUI.