Does legacy information automatically become CUI?

Does legacy information automatically become CUI?

• A. Yes, it automatically becomes CUI
• B. No; it must be reviewed by the information owner to determine if it meets CUI requirements
• C. It becomes CUI after five years
• D. It becomes CUI if it contains sensitive numbers

Answer: (B)

Legacy information isn’t automatically CUI just because it’s old. CUI designation is applied only after an assessment by the information owner or custodian to determine if the material meets CUI requirements. The owner checks whether the content falls into a CUI category or requires CUI-style safeguarding and markings. If it does, it must be marked and protected accordingly; if not, it remains outside the CUI designation or is governed by other policies. Time passing or the presence of sensitive numbers alone does not decide CUI status.

Legacy information isn’t automatically CUI just because it’s old. CUI designation is applied only after an assessment by the information owner or custodian to determine if the material meets CUI requirements. The owner checks whether the content falls into a CUI category or requires CUI-style safeguarding and markings. If it does, it must be marked and protected accordingly; if not, it remains outside the CUI designation or is governed by other policies. Time passing or the presence of sensitive numbers alone does not decide CUI status.