What confidentiality impact level applies to DoD systems processing, storing, or transmitting CUI?

What confidentiality impact level applies to DoD systems processing, storing, or transmitting CUI?

• A. Low
• B. Moderate
• C. High
• D. Very High

Answer: (B)

The key idea is how CUI protection is scaled by confidentiality impact. For DoD systems that process, store, or transmit CUI, the default confidentiality impact level is Moderate. This means the safeguards are commensurate with the expectation that a breach could cause measurable but not catastrophic harm to operations, assets, or individuals. Higher levels are used only for CUI that’s designated as Specified or otherwise identified as highly sensitive, where the risk assessment indicates a greater potential impact. Very High isn’t used in this framework. So, most DoD CUI falls under Moderate, with Higher protections reserved for specifically designated categories.

The key idea is how CUI protection is scaled by confidentiality impact. For DoD systems that process, store, or transmit CUI, the default confidentiality impact level is Moderate. This means the safeguards are commensurate with the expectation that a breach could cause measurable but not catastrophic harm to operations, assets, or individuals. Higher levels are used only for CUI that’s designated as Specified or otherwise identified as highly sensitive, where the risk assessment indicates a greater potential impact. Very High isn’t used in this framework. So, most DoD CUI falls under Moderate, with Higher protections reserved for specifically designated categories.