Who has the authority to designate CUI within a DoD program?

• A. The component's designated official responsible for CUI designation (Designating Official).
• B. The DoD Chief Information Officer
• C. The Secretary of Defense
• D. The Program Manager for the program only

Answer: (A)

CUI designation within a DoD program rests with the component’s designated official responsible for CUI designation. This Designating Official has the authority to determine, based on applicable laws, policy, and the CUI Registry, whether information qualifies as CUI and to apply the proper markings and handling instructions. They work with data owners and program staff to ensure consistent labeling, safeguarding, and dissemination controls throughout the data’s lifecycle. While the DoD CIO sets overarching policy and the Secretary of Defense provides high-level direction, the actual designation authority is delegated to the component level. The Program Manager handles program execution and risk management, but does not confer or exercise designation authority.