Which elements are required when handling CUI by contractors?

• A. NDA signature only
• B. Encryption only
• C. Flow-down safeguarding requirements, ensure marking, access controls, encryption, and training for contractor personnel
• D. Marking only

Answer: (C)

Protecting CUI when contractors handle it relies on a layered, flow-down approach that extends safeguarding requirements to every contractor and subcontractor. You need clear marking so CUI is always identifiable and handled accordingly, access controls to ensure only authorized personnel can view or work with the data, encryption to shield it in transit and at rest, and training so contractor personnel know how to correctly handle, store, transmit, and report any incidents. Relying on a single measure isn’t enough: an NDA doesn’t implement technical protections; encryption alone doesn’t guarantee proper marking or access restrictions or trained personnel; marking alone doesn’t prevent mishandling. When these elements work together, CUI is protected throughout its lifecycle and across environments, which is essential in government contracting and aligns with established CUI safeguarding practices.