What notification is required for systems that contain CUI?

What notification is required for systems that contain CUI?

• A. No notification is required.
• B. A notice and consent/splash screen must be used to alert users of CUI within the program/system.
• C. A banner indicating CUI status is sufficient.
• D. A dedicated CUI notice appears on first login.

Answer: (B)

Notification and awareness are essential whenever a system handles CUI. The requirement is to present a notice that CUI is present and to obtain explicit user acknowledgment before or during access, typically through a splash screen or consent prompt. This ensures that every user understands they are entering a CUI environment and agrees to follow the handling rules, reinforcing accountability and reducing the risk of improper use or disclosure. A simple banner might be ignored or bypassed, and a notice only at first login may not cover subsequent sessions, while no notification at all fails to meet the awareness requirement. Therefore, a notice plus consent/splash screen best satisfies the need to alert users and obtain their acknowledgment of CUI handling responsibilities.

Notification and awareness are essential whenever a system handles CUI. The requirement is to present a notice that CUI is present and to obtain explicit user acknowledgment before or during access, typically through a splash screen or consent prompt. This ensures that every user understands they are entering a CUI environment and agrees to follow the handling rules, reinforcing accountability and reducing the risk of improper use or disclosure. A simple banner might be ignored or bypassed, and a notice only at first login may not cover subsequent sessions, while no notification at all fails to meet the awareness requirement. Therefore, a notice plus consent/splash screen best satisfies the need to alert users and obtain their acknowledgment of CUI handling responsibilities.