Which items must be included (at minimum) in CUI training standards?

• A. Individual responsibilities; indexes/categories routinely handled; describe the CUI Registry; differences between Basic vs Specified; oversight offices; marking requirements; safeguards; destruction; incident reporting; dissemination methods; decontrolling methods.
• B. Individual responsibilities; marking requirements.
• C. CUI Registry description; differences between Basic and Specified.
• D. Oversight offices; incident reporting; dissemination methods; decontrolling methods.

Answer: (A)

CUI training standards must cover how individuals are responsible for protecting CUI across its entire lifecycle, with practical guidance on the exact procedures they will encounter. This includes understanding who oversees the CUI program (oversight offices) and knowing which categories of information exist and how they are handled, which is described in the CUI Registry. Trainees need to grasp the differences between Basic and Specified CUI so they apply the correct level of protection and restrictions on dissemination. The training should also cover how to mark materials correctly, the safeguards required for physical and digital handling, how to store and transport CUI, how to destroy it when appropriate, and how to apply decontrolling methods when authorized to do so. Incident reporting is essential so staff know how to respond to any loss or disclosure, and they must understand permissible dissemination methods. Together, these elements ensure personnel can protect CUI from creation through destruction and respond appropriately to incidents. Other options omit one or more of these critical areas, leaving gaps in understanding the full handling and protection requirements.