If you create a new document from legacy material, what happens if the info qualifies as CUI?

If you create a new document from legacy material, what happens if the info qualifies as CUI?

• A. The new document must be marked as CUI
• B. The new document must be destroyed
• C. The new document remains unmarked until a reviewer decides
• D. The original legacy marking suffices

Answer: (A)

When information is CUI, the marking travels with the information itself. Creating a new document from legacy material that contains CUI produces a derivative document that still carries that sensitivity, so the new document must be marked as CUI to indicate its handling, dissemination, and protection requirements. This ensures anyone who handles the document understands how to protect it and who may access it. Relying on the legacy marking alone isn’t sufficient because the new document is a separate asset with its own labeling needs. Destroying the new document would lose protected information and violate CUI protection rules, and leaving it unmarked until a reviewer decides would delay and weaken proper handling. The appropriate action is to apply the CUI marking to the new document to reflect its content and safeguarding requirements.

When information is CUI, the marking travels with the information itself. Creating a new document from legacy material that contains CUI produces a derivative document that still carries that sensitivity, so the new document must be marked as CUI to indicate its handling, dissemination, and protection requirements. This ensures anyone who handles the document understands how to protect it and who may access it.

Relying on the legacy marking alone isn’t sufficient because the new document is a separate asset with its own labeling needs. Destroying the new document would lose protected information and violate CUI protection rules, and leaving it unmarked until a reviewer decides would delay and weaken proper handling. The appropriate action is to apply the CUI marking to the new document to reflect its content and safeguarding requirements.