Which policy governs handling of Controlled Unclassified Information (CUI) in TAP?

• A. NIST risk management framework guidelines for information handling.
• B. DoD policy on handling and safeguarding CUI is addressed in TAP procedures.
• C. Internal unit guidelines with no national policy reference.
• D. DoD policy on CUI handling and safeguarding measures.

Answer: (D)

CUI handling in TAP is governed by the official DoD policy on CUI handling and safeguarding measures. This policy sets the mandatory requirements for how CUI must be labeled, stored, transmitted, and accessed, and it directs how TAP implements safeguarding controls in daily operations. Frameworks like NIST RMF provide the method to apply security controls to systems that process CUI, but they do not establish the governing policy itself. Relying on internal guidelines without a national policy reference wouldn’t meet the mandated standard, whereas TAP procedures are designed to implement the DoD CUI policy.