When data contains both CUI and classified information, which safeguarding approach is recommended?

• A. Label only as CUI and apply CUI safeguards.
• B. Label only as classified data and apply classified safeguards.
• C. Apply the stricter safeguarding requirements of the more sensitive data and ensure proper labeling and access controls.
• D. Place data in an unclassified storage while keeping both policies.

Answer: (C)

When data contains both CUI and classified information, you apply the stricter safeguarding requirements of the more sensitive data and ensure proper labeling and access controls. This approach ensures the highest level of protection is consistently applied, so neither the classified portion nor the CUI portion is under-protected. Proper labeling communicates the needed handling requirements to users, while access controls restrict who can view the information based on clearance and need-to-know. Storing everything as unclassified or labeling only one category would leave portions of the data inadequately protected or mismanaged. By enforcing the stricter safeguards and correct labeling, you minimize risk and maintain compliant, coherent protection across the entire data set.