SFPC Controlled Unclassified Information (CUI) — Questions and Answers
Question 1: Which executive order established the government-wide Controlled Unclassified Information (CUI) program?
- Executive Order 13526
- Executive Order 13556 (Correct answer)
- Executive Order 12968
- Executive Order 12829
Correct answer: Executive Order 13556
EO 13556 (2010) created the CUI program to standardize how the executive branch handles unclassified information that requires safeguarding or dissemination controls. EO 13526 covers classified national security information, EO 12968 covers access to classified information, and EO 12829 created the NISP.
Question 2: Which federal agency serves as the Executive Agent responsible for implementing the CUI program?
- Department of Homeland Security
- Office of the Director of National Intelligence
- National Archives and Records Administration (NARA) (Correct answer)
- General Services Administration
Correct answer: National Archives and Records Administration (NARA)
NARA, through its Information Security Oversight Office (ISOO), is the CUI Executive Agent. It issues the implementing directive in 32 CFR Part 2002 and maintains the CUI Registry.
Question 3: What are the two types of CUI designated in the CUI Registry?
- CUI Basic and CUI Specified (Correct answer)
- CUI Open and CUI Restricted
- CUI Standard and CUI Enhanced
- CUI Public and CUI Private
Correct answer: CUI Basic and CUI Specified
CUI Basic is handled according to the uniform controls in the CUI rule. CUI Specified has additional or different handling controls set by a law, regulation, or government-wide policy, so it must be handled as that authority requires.
Question 4: What is the required banner marking for a document containing CUI?
- FOUO at the top of each page
- SENSITIVE BUT UNCLASSIFIED
- CUI at the top of each page (Correct answer)
- LIMITED OFFICIAL USE
Correct answer: CUI at the top of each page
Under 32 CFR Part 2002 the banner marking must include the word 'CUI'. Specified categories may add category markings. Legacy markings such as FOUO, SBU, and LES are not CUI banner markings.
Question 5: Which NIST publication provides the security requirements for protecting CUI on nonfederal systems and organizations?
- NIST SP 800-171 (Correct answer)
- NIST SP 800-37
- NIST SP 800-88
- NIST SP 800-61
Correct answer: NIST SP 800-171
NIST SP 800-171 defines the requirements for protecting the confidentiality of CUI in nonfederal systems, such as those of contractors. SP 800-37 covers the RMF, SP 800-88 covers media sanitization, and SP 800-61 covers incident handling.
Question 6: Under the CUI program, who may generally be given access to CUI?
- Only personnel holding a Secret clearance
- Anyone with a lawful government purpose, subject to any dissemination controls (Correct answer)
- Any U.S. citizen on request
- Only federal employees
Correct answer: Anyone with a lawful government purpose, subject to any dissemination controls
CUI access is based on a lawful government purpose and need to know. No security clearance is required, and any dissemination controls on the specific CUI must still be followed.
