CUI Documents Must Be Reviewed According to Which Procedures?

The answer

CUI (Controlled Unclassified Information) documents must be reviewed according to Records Management procedures before they are destroyed. This review makes sure a document is not disposed of before its required retention period has expired and that, once it is eligible for destruction, it is destroyed using approved methods that render the CUI unreadable and unrecoverable. The governing policy is DoD Instruction (DoDI) 5200.48, which establishes how CUI is marked, handled, shared, and destroyed across the Department of Defense.

The logic is straightforward: CUI is sensitive information that still requires safeguarding even though it isn't classified. Before you shred, wipe, or otherwise destroy such a record, records-management review confirms two things — that the law and agency retention schedules permit destruction, and that the disposal method meets security standards.

Why Records Management is the correct answer

Records Management procedures exist precisely to control the lifecycle of documents: creation, use, retention, and disposition. Because destroying a record too early can violate federal recordkeeping law (and destroying it improperly can leak CUI), the review step is anchored in records management rather than, say, a purely IT or personnel process. DoDI 5200.48 ties CUI disposal to these procedures so that retention schedules and approved-destruction requirements are both satisfied.

Why the other options are wrong

Distractors on this question usually include:

• "Reviewed according to classification/declassification procedures" — Wrong. Those procedures apply to classified national-security information. CUI is unclassified, so classification review isn't the mechanism.
• "Reviewed according to Freedom of Information Act (FOIA) procedures" — Wrong. FOIA governs public release requests, not the retention-and-destruction lifecycle.
• "No review is required; just shred it" — Wrong. Skipping review risks premature destruction of records still under retention and improper disposal of sensitive data.
• "Reviewed according to physical-security procedures" — Wrong. Physical security protects material in storage/transit; it doesn't govern the retention-and-disposition decision.

Only Records Management procedures address the retention-schedule check plus approved-destruction requirement together, which is why it's the answer.

The bigger picture: the CUI destruction workflow

DoDI 5200.48 and related guidance describe a clean lifecycle. In practice:

1. Identify and mark the document as CUI.
2. Retain it for the period set by the applicable records schedule.
3. Review under Records Management procedures to confirm it is eligible for destruction.
4. Destroy using approved methods — cross-cut shredding, pulping, pulverizing, or approved digital wiping — so the CUI cannot be reconstructed. NIST SP 800-88 media-sanitization standards commonly back the digital side.
5. Document the disposal as required.

The insight the dense government PDFs bury: the review isn't bureaucratic box-ticking. It's the checkpoint that reconciles two competing obligations — keep records long enough to satisfy the law, but destroy CUI thoroughly enough that it can't be recovered. Records Management procedures are what balance those two demands, which is exactly why CUI must be reviewed under them before destruction.