Which statement best defines need-to-know in the context of CUI sharing?

• A. Access is limited to individuals with a legitimate need to know to perform official duties.
• B. Access is granted to all personnel with a security clearance.
• C. Need-to-know applies only to contractors, not internal staff.
• D. Need-to-know is irrelevant if the information is encrypted.

Answer: (A)

Need-to-know means access to CUI is restricted to people whose duties require it. This limits exposure to only those who need the information to perform official tasks, reducing risk of unnecessary disclosure. Even with a security clearance, access isn’t automatic—clearance signals trustworthiness, not blanket access to all CUI. The other statements miss this nuance: a clearance alone doesn’t guarantee access; the rule applies to all personnel, including internal staff and contractors; and encryption doesn’t remove the need-to-know requirement because protection in transit or at rest doesn’t authorize viewing by someone who doesn’t have a justified job-related need.