When can CUI be disseminated within DoD and to contractors/consultants/grantees?

When can CUI be disseminated within DoD and to contractors/consultants/grantees?

• A. To conduct official business, provided dissemination is consistent with distribution statements or limited dissemination controls.
• B. To conduct personal research.
• C. For training purposes only.
• D. For declassification.

Answer: (A)

CUI sharing is allowed when it serves official DoD business and is governed by the proper dissemination controls. In practice, this means you may share CUI with DoD personnel and with contractors, consultants, or grantees if the sharing is necessary for the task, and the material is being distributed under the documented controls—distribution statements or limited dissemination controls—that dictate who can receive it and under what conditions. These controls ensure recipients have a need-to-know and that the information is protected according to its level of sensitivity. Disseminating for personal research isn’t authorized as official DoD business, and training-only dissemination doesn’t automatically satisfy the need-to-know and control requirements. Declassification isn’t a method of disseminating CUI; once declassified, the information is no longer CUI and the dissemination rules no longer apply.

CUI sharing is allowed when it serves official DoD business and is governed by the proper dissemination controls. In practice, this means you may share CUI with DoD personnel and with contractors, consultants, or grantees if the sharing is necessary for the task, and the material is being distributed under the documented controls—distribution statements or limited dissemination controls—that dictate who can receive it and under what conditions. These controls ensure recipients have a need-to-know and that the information is protected according to its level of sensitivity.

Disseminating for personal research isn’t authorized as official DoD business, and training-only dissemination doesn’t automatically satisfy the need-to-know and control requirements. Declassification isn’t a method of disseminating CUI; once declassified, the information is no longer CUI and the dissemination rules no longer apply.