Who is responsible for applying CUI markings and dissemination instructions?

• A. The authorized holder (if the information is CUI)
• B. The original classification authority
• C. The information owner
• D. The custodian of records

Answer: (A)

The person or organization that has possession and control of the CUI—the authorized holder—is the one responsible for applying CUI markings and dissemination instructions. Marking the information and attaching any sharing or access restrictions travel with it as it is created or received, so downstream users understand how it may be handled, shared, and who may access it. This responsibility isn’t about who originally classified the data, who owns the information at a strategic level, or who stores it; those roles may exist, but the day-to-day duty to correctly mark the CUI and include dissemination controls lies with the authorized holder who has custody and control of the material.