SFPC Controlled Unclassified Information (CUI)

Question 1

Which executive order established the government-wide Controlled Unclassified Information (CUI) program?

Accepted Answer

Executive Order 13556

Answer

EO 13556 (2010) created the CUI program to standardize how the executive branch handles unclassified information that requires safeguarding or dissemination controls. EO 13526 covers classified national security information, EO 12968 covers access to classified information, and EO 12829 created the NISP.

Question 2

Which federal agency serves as the Executive Agent responsible for implementing the CUI program?

Accepted Answer

National Archives and Records Administration (NARA)

Answer

NARA, through its Information Security Oversight Office (ISOO), is the CUI Executive Agent. It issues the implementing directive in 32 CFR Part 2002 and maintains the CUI Registry.

Question 3

What are the two types of CUI designated in the CUI Registry?

Accepted Answer

CUI Basic and CUI Specified

Answer

CUI Basic is handled according to the uniform controls in the CUI rule. CUI Specified has additional or different handling controls set by a law, regulation, or government-wide policy, so it must be handled as that authority requires.

Question 4

What is the required banner marking for a document containing CUI?

Accepted Answer

CUI at the top of each page

Answer

Under 32 CFR Part 2002 the banner marking must include the word 'CUI'. Specified categories may add category markings. Legacy markings such as FOUO, SBU, and LES are not CUI banner markings.

Question 5

Which NIST publication provides the security requirements for protecting CUI on nonfederal systems and organizations?

Accepted Answer

NIST SP 800-171

Answer

NIST SP 800-171 defines the requirements for protecting the confidentiality of CUI in nonfederal systems, such as those of contractors. SP 800-37 covers the RMF, SP 800-88 covers media sanitization, and SP 800-61 covers incident handling.

SFPC - Security Fundamentals Professional Certification Practice Test

SFPC - Security Fundamentals Professional Certification Practice Test

SFPC Controlled Unclassified Information (CUI)