Who shares duties for establishing and maintaining the CUI program besides the senior DoD official?

• A. External contractors.
• B. All DoD personnel.
• C. Component-level program managers and system owners.
• D. The Secretary of Defense.

Answer: (C)

Responsibility for establishing and maintaining the CUI program is shared across the people who actually implement and oversee it within the DoD, not just the top official. Component-level program managers oversee the CUI program within their specific component, ensuring policy alignment, governance, training, labeling, handling, and overall compliance. They coordinate with system owners to make sure requirements are carried out in practice.

System owners are responsible for the CUI protections within each information system. They ensure proper security controls, authorization, configuration management, access controls, incident reporting, and ongoing risk management in the system’s operation. Together, these roles translate policy into real-world protections for CUI.

External contractors may perform tasks under supervision, but they don’t share the overall duties of establishing and maintaining the program. All DoD personnel is too broad a category, and the Secretary of Defense is the senior official who signs policy, not the day-to-day stewardship. The question targets those who actively carry the program’s duties day-to-day, which are the component-level managers and system owners.