Safeguarding_and_Dissemination_of_Controlled_Unclassified_Information-Abreviated_0001.pdf

C.1.0.1 Safeguarding and Dissemination of Controlled Unclassified Information

C.1.0.1.1 General

This subsection applies to all recipients of Controlled Unclassified Information (CUI), including offerors, bidders, awardees, contractors, subcontractors, lessors, suppliers and manufacturers. Dissemination of sensitive but unclassified paper and electronic building information shall be made on a need-to-know basis in accordance.

C.1.0.1.2 Marking CUI

Contractor-generated documents that contain building information shall be reviewed by the

USGS point of contact (POC) to identify any CUI content, before the original or any copies are disseminated to any other parties. If CUI content is identified the Contractor, shall imprint or affix CUI document markings to the original documents and all copies, before any dissemination.

C.1.0.1.3 Authorized Recipients

Building information designated CUI shall be protected and controlled by strictly limiting access to those individuals having a legitimate business need to know such information.

Those with a need to know shall include Federal, state and local Government entities, and non-Government entities engaged in the conduct of business on behalf of or with USGS.

Non-Government entities shall include architects, engineers, consultants, contractors, subcontractors, suppliers, utilities, and others submitting an offer or bid to USGS, or performing work under a USGS contract or subcontract. Recipient Contractors shall be registered as “active” in the System for Award Management (SAM) database. If a subcontractor is not registered in the SAM and has a need to possess CUI building information, the subcontractor shall provide to the Contractor its DUNS number or its tax ID number, a copy of its business license and a valid state driver’s license with photograph or other valid IDs with photograph. The Contractor shall keep this information related to the subcontractor for the duration of the Contract and subcontract.

All USGS personnel and Contractors shall be provided CUI building information when needed for the performance of official Federal, state, and local Government functions, such as for code compliance reviews and for the issuance of building permits. Public safety entities such as fire and utility departments shall require access to CUI building information on a need-to-know basis. This clause shall not prevent or encumber the dissemination of CUI building information to public safety entities.

C.1.0.1.4 Dissemination of CUI Building Information

C.1.0.1.4.1 By Electronic Transmission

Electronic transmission of CUI information outside of the USGS network shall use session encryption (or alternatively, file encryption). Encryption shall be via an approved NIST algorithm with a valid certification, such as Advanced Encryption Standard (AES) or Triple

Data Encryption Standard (3DES), in accordance with Federal Information Processing

Standards Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules per GSA policy.

C.1.0.1.4.2 By Non-electronic Form or on Portable Electronic Data Storage Devices

Portable electronic data storage devices include CDs, DVD, and USB drives. Non-electronic forms of CUI building information include, among other formats, paper documents.

C.1.0.1.4.2.1 By Mail

Contractors shall use only methods of shipping that provide services for monitoring receipt such as track and confirm, proof of delivery, signature confirmation, or return receipt.

C.1.0.1.4.2.2 In Person

Contractors shall provide CUI building information only to authorized recipients with a need to know such information.

C.1.0.1.5 Record Keeping

Contractor shall maintain a list of all entities to which CUI is disseminated. This list shall include at a minimum: (1) the name of the state, Federal, or local Government entity, utility, or firm to which CUI has been disseminated; (2) the name of the individual at the entity or firm who is responsible for protecting the CUI building information, with access strictly controlled and limited to those individuals having a legitimate business need to know such information; (3) contact information for the named individual; and (4) a description of the CUI building information provided. Once “as built” drawings are submitted, the Contractor shall collect all lists maintained in accordance with this clause, including those maintained by any subcontractors and suppliers, and submit them to the USGS POC. For Federal buildings, final payment shall be withheld until the lists are received.

C.1.0.1.6 Safeguarding CUI Documents

CUI building information (both electronic and paper formats) shall be protected. USGS

Contractors and subcontractors shall not take CUI building information outside of USGS or their own facilities or network, except as necessary for the performance of that contract.

Access to the information shall be limited to those with a legitimate business need to know.

C.1.0.1.7 Destroying CUI Building Information

When no longer needed, CUI building information shall be destroyed so that marked information is rendered unreadable and incapable of being restored, in accordance with guidelines provided for media sanitization within GSA CIO 2103.1 Controlled Unclassified

Information (CUI) Policy and Appendix A of NIST Special Publication 800-88, Guidelines for

Media Sanitization. Alternatively, CUI building information may be returned to the USGS

POC.

C.1.0.1.8 Notice of Disposal

The Contractor shall notify the USGS POC that all CUI building information has been returned or destroyed by the Contractor and its subcontractors or suppliers except for the Contractor's record copy. This notice shall be submitted to the USGS POC at the completion of the

Contract to receive final payment. The Contractor may return the USGS POC documents to the CO rather than destroying them.

C.1.0.1.9 Incidents

All improper disclosures of CUI building information must be reported immediately to the

USGS POC. If the Contract provides for progress payments, the USGS POC shall withhold approval of progress payments until the Contractor provides a corrective action plan explaining how the Contractor shall prevent future improper disclosures of CUI building information. Progress payments shall also be withheld for failure to comply with any provision in this clause until the Contractor provides a corrective action plan explaining how the

Contractor shall rectify any noncompliance and comply with the clause in the future.

C.1.0.1.10 Subcontracts

The Contractor and subcontractors shall insert the substance of these subsections 1.6.2, Safeguarding and Dissemination of Controlled Unclassified Information Building Information through 1.6.2.9, Incidents, in all subcontracts.

I have read the above information and agree to follow all requirements specified.

Company/Organization

Print Name Title

Signature Date