Administrative, civil, or criminal sanctions may be imposed for unauthorized disclosure of CUI. True or false?

The answer

The statement is True. Under DoD mandatory CUI training and the governing regulations (32 CFR Part 2002 and DoD Instruction 5200.48), an unauthorized disclosure of Controlled Unclassified Information can result in administrative, civil, or criminal sanctions. These are not mutually exclusive — the same incident can trigger more than one, and the level applied depends on how serious the disclosure was and whether it was accidental or deliberate.

CUI is unclassified information that still requires safeguarding or dissemination controls under law, regulation, or government-wide policy — for example, export-controlled data, privacy information, or sensitive law-enforcement records. Because it is unclassified, people sometimes assume mishandling it carries no consequences. That assumption is wrong, which is exactly what this training point drives home.

The three sanction tiers

The reason "True" is correct is that federal policy deliberately provides a graduated set of penalties:

• Administrative sanctions — internal, employer-imposed discipline. Examples: a formal reprimand, loss of security clearance, suspension, revoked system access, mandatory retraining, or termination. This is the most common outcome for negligent or first-time mishandling.
• Civil sanctions — monetary penalties or lawsuits. A person or agency can be sued, and fines can be assessed under statutes such as the Privacy Act. Civil liability compensates for harm without requiring criminal intent.
• Criminal sanctions — prosecution under federal criminal statutes, which can carry fines and imprisonment. These apply to willful, knowing, or malicious disclosures, or when the underlying information is protected by criminal law (for example, certain export-control or Privacy Act violations).

Why this matters and who imposes it

The practical point for anyone handling CUI is that consequences scale with conduct. An honest mistake — leaving a CUI document unattended — typically draws administrative action. A deliberate leak to someone not authorized to receive it can escalate to civil suits and criminal charges.

Different authorities impose each tier. Administrative sanctions come from your agency, command, or employer through their disciplinary process. Civil penalties are pursued through the courts, often by the affected agency or the Department of Justice. Criminal charges are brought by federal prosecutors (DOJ) and decided by the courts. Because these operate under separate legal frameworks, one disclosure can move through more than one channel at once.

So the safest reading — and the correct exam answer — is that all three categories are on the table. The takeaway from CUI training is simple: unclassified does not mean unprotected, and unauthorized disclosure can cost you your job, your money, or your freedom.