Which statement best describes the difference between dissemination and disclosure of CUI?

• A. Dissemination is controlled distribution within or outside the organization; disclosure is releasing information to a specific external party under authorization.
• B. Dissemination is the release to any external party; disclosure is internal sharing only.
• C. Dissemination requires no need-to-know; disclosure requires need-to-know.
• D. Dissemination is permanent; disclosure is temporary.

Answer: (A)

Dissemination and disclosure describe two ways CUI is shared, with authorization guiding who can receive it. Dissemination is controlled distribution of CUI to recipients inside or outside the organization, meaning it’s the process of getting information to those who are permitted to receive it, under established controls. Disclosure is releasing CUI to a specific external party under an authorized agreement or safeguarding measure (such as a contract or NDA). That distinction matters because dissemination covers general, regulated distribution—including internal teams—while disclosure is a defined external release that relies on formal authorization. For example, sharing with teammates in your organization is dissemination, whereas providing information to a contractor under a signed NDA is disclosure. The other choices imply either unrestricted external sharing, internal-only sharing, or no need-to-know requirements, which don’t align with how CUI sharing is controlled.