Which statement best describes external recipients' agreements before receiving CUI?

• A. External recipients must not sign any agreements.
• B. External recipients must sign non-disclosure or safeguarding agreements and agree to comply with CUI safeguards.
• C. External recipients must provide personal data to their security office.
• D. External recipients must obtain prior written authorization from the DoD.

Answer: (B)

Before external recipients can receive CUI, there must be a binding commitment that they will protect the information and follow the required safeguards. Signing a non-disclosure or safeguarding agreement and agreeing to comply with CUI safeguards provides that commitment and creates a enforceable basis for handling, storing, transmitting, and disposing of the material. This ensures everyone understands their responsibilities and the consequences of mishandling.

Without this kind of agreement, there’s no formal obligation to protect CUI, which is why the other options don’t fit. Requiring no agreement leaves protection to chance; asking for personal data to be shared with a security office isn’t a standard prerequisite for receiving CUI, and obtaining prior written authorization from the DoD isn’t how access is typically established—contracts or program procedures anchored by safeguarding or NDA terms do that work.