Which statement best describes the flow-down obligations in data-sharing agreements for CUI?

• A. Flow-down requirements are optional.
• B. Flow-down requirements that recipients commit to CUI protection and compliance with 5200.48.
• C. Flow-down can be omitted if the recipient is trusted.
• D. Flow-down is not defined in such agreements.

Answer: (B)

Flow-down obligations ensure that everyone who receives CUI from your organization is bound by the same protection standards. The best choice requires recipients to commit to protecting CUI and to comply with the safeguarding requirements described in 5200.48. This ties the entire handling chain to a single, enforceable standard, so sub-recipients and downstream partners cannot bypass or reinterpret the controls. By mandating adherence to 5200.48, the agreement guarantees consistent security practices, incident reporting, access controls, and handling procedures across all parties that touch the data. Flow-down is not optional or negotiable based on trust, and it is defined to ensure there are no gaps in protection throughout the data-sharing relationship.