Which statement best describes the use of cross-domain solutions for CUI?

• A. Only approved cross-domain solutions may be used, ensuring proper protection and restrictions across domains.
• B. Any cross-domain product may be used if it is commercially available and tested.
• C. Cross-domain solutions are optional for CUI data transfers.
• D. Unapproved cross-domain tools are permitted during emergency operations.

Answer: (A)

When CUI is moved across security domains, strict controls at the boundary are essential to prevent data leakage or improper handling. Cross-domain solutions are security boundary devices designed to enforce transfer rules, apply data labeling and filtering, and provide an auditable trail of what crosses between domains. Because of the sensitivity of CUI, only approved cross-domain solutions receive the necessary accreditation and authorization after rigorous testing to ensure they meet the specific protection and restriction requirements across domains. Using anything that hasn’t earned that approval could bypass safeguards, introduce risks, and violate policy.

Commercial availability or testing alone doesn’t guarantee compliance with CUI handling requirements, and treating cross-domain transfers as optional would undermine the security controls that protect information. Even in emergencies, unapproved tools aren’t allowed because they’re not vetted for proper boundary protection.