What determines whether legacy information meets CUI requirements?

What determines whether legacy information meets CUI requirements?

• A. It must be reviewed by the information owner
• B. The original classification authority decides
• C. The acquiring office decides
• D. A legal review determines the outcome

Answer: (A)

The key factor is who decides the CUI status for legacy materials—the information owner. Under CUI policy, the information owner is responsible for identifying what information is sensitive, determining whether it should be designated as CUI, and ensuring proper markings and safeguarding. When dealing with legacy information created before CUI rules were in place, the owner (or their designated representative) reviews the material against the CUI Registry and guidance to decide if it qualifies as CUI and how it must be handled. The original classification authority is only for classified information, not CUI; the acquiring office isn’t the decider for legacy items, and while a legal review can help verify compliance, it doesn’t make the designation itself.

The key factor is who decides the CUI status for legacy materials—the information owner. Under CUI policy, the information owner is responsible for identifying what information is sensitive, determining whether it should be designated as CUI, and ensuring proper markings and safeguarding. When dealing with legacy information created before CUI rules were in place, the owner (or their designated representative) reviews the material against the CUI Registry and guidance to decide if it qualifies as CUI and how it must be handled. The original classification authority is only for classified information, not CUI; the acquiring office isn’t the decider for legacy items, and while a legal review can help verify compliance, it doesn’t make the designation itself.