Which documents demonstrate CUI compliance?

• A. Incident reports
• B. Training records and marking templates
• C. Policies, procedures, marking templates, training records, flow-down contracts, and incident reports
• D. Flow-down contracts only

Answer: (C)

Demonstrating CUI compliance requires evidence across governance, labeling, training, contracts, and incident handling. Policies and procedures establish how CUI should be managed in daily operations. Marking templates ensure consistent labeling so CUI is clearly identified and protected. Training records show personnel have completed the required education and understand how to handle CUI properly. Flow-down contracts ensure that subcontractors and suppliers also follow CUI requirements, extending protection beyond the organization. Incident reports document that when events occur, they are reported and addressed in line with established procedures. Together, these documents create a complete, auditable trail that proves rules exist, are followed, and are enforceable. Relying on any single element—such as just incident reports or just contracts—doesn't demonstrate the full governance and execution needed for true compliance.