Who has overall responsibility for establishing and maintaining a CUI program per DoD 5200.48?

• A. The senior DoD official designated as the CUI program lead.
• B. All DoD personnel.
• C. Component-level program managers and system owners.
• D. The Secretary of Defense.

Answer: (A)

The main idea is that governance and accountability for the CUI program lies with a single senior DoD official designated as the CUI program lead. This person has the authority to establish policy, allocate resources, and oversee the program across DoD components, ensuring a unified, department-wide approach to protecting controlled unclassified information.

While those at the component level—program managers and system owners—are responsible for implementing and maintaining the specific controls and procedures, and all DoD personnel must comply with them, the top-level responsibility for establishing and maintaining the program rests with the designated senior official. The Secretary of Defense holds ultimate authority, but the question focuses on who is designated to oversee and drive the CUI program across the department—and that role is the CUI program lead.