When must DoD CUI be controlled?

When must DoD CUI be controlled?

• A. Indefinitely.
• B. Only during records active.
• C. Only during official meetings.
• D. Until authorized for public release under DoD public release processes.

Answer: (D)

CUI must be controlled throughout its entire life cycle until there is an official decision to release it to the public. It stays as DoD CUI and requires safeguarding, marking, and handling from creation through storage, transmission, and dissemination, wherever it resides, until the DoD Public Release Process authorizes public release. Only after that authorization is the information no longer treated as CUI. That’s why the other ideas don’t fit. Releasing it indefinitely would block needed transparency; restricting control only to active records ignores that CUI can exist or be shared in drafts, backlogs, or non-active contexts; and limiting control to official meetings misses the broader handling and distribution that occur beyond meetings. The public release authorization is the point at which CUI protection ends.

CUI must be controlled throughout its entire life cycle until there is an official decision to release it to the public. It stays as DoD CUI and requires safeguarding, marking, and handling from creation through storage, transmission, and dissemination, wherever it resides, until the DoD Public Release Process authorizes public release. Only after that authorization is the information no longer treated as CUI.

That’s why the other ideas don’t fit. Releasing it indefinitely would block needed transparency; restricting control only to active records ignores that CUI can exist or be shared in drafts, backlogs, or non-active contexts; and limiting control to official meetings misses the broader handling and distribution that occur beyond meetings. The public release authorization is the point at which CUI protection ends.