Which item is NOT listed as a CUI compliance document?

• A. Policies
• B. Training records
• C. Flow-down contracts
• D. Security awareness posters

Answer: (D)

CUI compliance documentation focuses on formal records that prove safeguarding requirements are established, implemented, and verifiable. Policies define the rules for handling and protecting CUI. Training records show that personnel have completed required instruction and are aware of how to apply the rules. Flow-down contracts ensure that subcontractors and third parties who handle CUI are bound by the same obligations, extending protection beyond the primary organization.

Security awareness posters, while useful for promoting ongoing awareness, are not formal compliance documents. They don’t prove that policies exist, that training has been completed, or that external partners are contractually bound to CUI requirements. They’re supportive tools, not documentation used to verify compliance.