Which is an allowed exception to using unofficial email for official CUI business?

Which is an allowed exception to using unofficial email for official CUI business?

• A. There are no exceptions.
• B. Personal email may be used for CUI communications if the supervisor approves.
• C. Approved/authorized contractor systems.
• D. Personal email is never allowed for CUI communications.

Answer: (C)

Handling CUI requires using official channels, but an exception is allowed when the recipient uses an approved/authorized contractor system. If a contractor provides a system that has been vetted and certified to protect CUI—meeting the necessary safeguarding controls—the CUI can be transmitted or stored there under the contract and applicable security requirements. This keeps collaboration with external partners possible while maintaining proper protection for CUI. Personal email isn’t an acceptable channel for CUI, even with supervisor approval, and there isn’t a blanket “no exceptions” rule. The option that reflects the legitimate exception is the use of approved/authorized contractor systems.

Handling CUI requires using official channels, but an exception is allowed when the recipient uses an approved/authorized contractor system. If a contractor provides a system that has been vetted and certified to protect CUI—meeting the necessary safeguarding controls—the CUI can be transmitted or stored there under the contract and applicable security requirements. This keeps collaboration with external partners possible while maintaining proper protection for CUI.

Personal email isn’t an acceptable channel for CUI, even with supervisor approval, and there isn’t a blanket “no exceptions” rule. The option that reflects the legitimate exception is the use of approved/authorized contractor systems.