Training & Education

During work hours, keep CUI under the control of authorized people and do not leave it where unauthorized people can access, view, or overhear it. After hours, decide storage based on whether the facility provides continuous monitoring of access. If it does, unlocked desks, cabinets, or containers may be acceptable under the DoD rule. If it does not, use locked desks, file cabinets, bookcases, locked rooms, or similarly secured areas.

Printers, copiers, scanners, monitors, and shared workspaces can all become physical CUI exposure points if they are not properly controlled. NIST SP 800-171 Rev. 3 explicitly requires organizations to restrict physical access to output devices so unauthorized individuals cannot obtain Controlled Unclassified Information. This article breaks down what that means in practice, why shared office equipment creates real compliance risk, and how physical safeguards like coversheets, signs, labels, and controlled workspaces help protect CUI during everyday handling.