Who determines whether an individual has an authorized government purpose to access CUI?

Who determines whether an individual has an authorized government purpose to access CUI?

• A. The person with authorized possession, knowledge, or control of the CUI.
• B. The individual's supervisor.
• C. The CUI registry administrator.
• D. The requester.

Answer: (A)

Access to CUI is controlled by the person who possesses, knows about, or controls the information. That individual is responsible for deciding whether a requester has an authorized government purpose to access it. In practice, they assess the requester’s identity, role, and need-to-know, and ensure the access aligns with the stated government purpose for that CUI. The supervisor may participate in the workflow or grant general approvals, but the ultimate determination rests with the holder of the CUI. The registry administrator maintains records and metadata, not the access decision for a specific data item, and the requester cannot grant access on their own.

Access to CUI is controlled by the person who possesses, knows about, or controls the information. That individual is responsible for deciding whether a requester has an authorized government purpose to access it. In practice, they assess the requester’s identity, role, and need-to-know, and ensure the access aligns with the stated government purpose for that CUI. The supervisor may participate in the workflow or grant general approvals, but the ultimate determination rests with the holder of the CUI. The registry administrator maintains records and metadata, not the access decision for a specific data item, and the requester cannot grant access on their own.