Which domains are addressed in safeguarding CUI protections?

• A. Physical safeguards only.
• B. Administrative safeguards only.
• C. Technical safeguards only.
• D. Physical, Administrative, and Technical safeguards.

Answer: (D)

Protecting CUI requires a multi-domain approach that covers physical, administrative, and technical safeguards. Physical safeguards protect the actual space and hardware housing CUI—secure facilities, controlled access, proper handling and storage of media, and safe disposal. Administrative safeguards include the people and processes behind the system—policies, role-based access, least-privilege practices, training, incident response, and continuous risk management. Technical safeguards involve the technology itself—strong authentication and access controls, encryption for data at rest and in transit, secure configuration, monitoring and auditing, and incident detection. Each domain addresses different ways CUI could be exposed, and together they create defense in depth. Focusing on only one domain leaves gaps that could be exploited, so safeguarding CUI protections encompass all three: physical, administrative, and technical safeguards.