Which of the following statements correctly reflects the required confidentiality level for DoD CUI systems?

• A. Low confidentiality
• B. Moderate confidentiality
• C. High confidentiality
• D. Moderate Confidentiality (Consistent with Federal Standards)

Answer: (D)

DoD CUI is protected at a level that reflects its sensitive but non-classified nature, aligned with federal information standards. The needed confidentiality level is Moderate, and the statement specifically ties that to consistency with Federal Standards, which is the essential point. This means CUI should be safeguarded with measures appropriate for moderate impact, such as robust access controls, encryption where required, and auditing, in accordance with federal guidance (like NIST/FIPS-based baselines). Choosing a lower level would under-protect sensitive information, while a higher level would impose protections beyond what federal standards require for CUI. The explicit note that the level is consistent with Federal Standards makes this option the correct reflection of how CUI confidentiality is defined.