21R2007_Attachment 5 - MCSC Controlled Unclassified Information (CUI) Training_FINAL.pptx

Marine Corps Systems Command Controlled Unclassified Information (CUI) Training

15 March 2021

UNCLASSIFIED

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Agenda Background CUI Defined Who is Responsible Making the CUI Determination CUI Marking Prohibitions CUI Categories Limited Dissemination Controls Distribution Statements CUI Designation Indicator Marking Unclassified Materials Marking Classified Materials

UNCLASSIFIED

Marking CTI & Export Control Documents Safeguarding Failure to Protect CUI Decontrolling Destruction Other Considerations Legacy Information Additional Resources Summary

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Why Are We Here?

DoDI 5200.48, released 6 March 2020, established the Controlled Unclassified Information (CUI) Program as a response to the information sharing challenges from inconsistent definitions and marking requirements applied to CUI.

All personnel of the DON are personally and individually responsible for properly creating, marking, safeguarding, transmitting, and destroying Classified National Security Information and Controlled Unclassified Information (CUI) under their custody and control.

DoD military and civilian personnel may be subject to criminal or administrative sanctions if they knowingly, willfully, or negligently violate any provisions of the policy.

UNCLASSIFIED

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Background U.S. Government agencies have been marking sensitive information for decades. Every agency had their own method, acronyms, and labels which hindered sharing information and created inconsistencies in handling and safeguarding of that information.

Within DoD, the most commonly used marking in the past to identify sensitive unclassified information was For Official Use Only (FOUO).

Standardized CUI markings ensure CUI is adequately protected by all agencies and facilitates timely information sharing to authorized recipients.

UNCLASSIFIED

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES CUI Defined CUI is defined as information that Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. CUI does not include classified information.

Basic CUI is the subset of CUI for which the authorizing law, regulation, or Government-wide policy does not set our specific handling or dissemination controls.

Specific CUI is the subset of CUI in which the authorizing law, regulation, or Government-wide policy contains specific handling controls that it requires or permits agencies to use that differ from those for CUI Basic.

NOTE: During DoD’s initial phased implementation of the CUI Program, only Basic CUI is authorized – all CUI is BASIC.

UNCLASSIFIED

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Who is Responsible The authorized holder of a document or material is responsible for determining, at the time of creation, whether information in a document or material falls into a CUI category. If so, the authorized holder is responsible for applying the appropriate CUI markings and dissemination controls accordingly.

Authorized holders include:

DoD civilian and military personnel Contractors providing support to the DoD pursuant to contractual requirements

UNCLASSIFIED

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES How to Make CUI Determination

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES CUI Marking Prohibitions Information cannot be marked as CUI in order to:

Conceal violations of the law, inefficiency, or administrative errors Prevent embarrassment to a person, organization, or agency Prevent open competition Control information that does not require protection under a law, regulation, or policy

UNCLASSIFIED

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES CUI Category(ies) can be found at https://www.dodcui.mil/Home/DoD-CUI-Registry/ If you have information that meets the definition of CUI requiring dissemination controls, but the type of information is not identified within the list of CUI Categories – Select a CUI Category that resembles (as closely as possible) the information you’re trying to safeguard.

Note: The Organizational Index Group is not a CUI Category (e.g., Defense, Privacy, Export Control, etc.)

CUI Categories

UNCLASSIFIED

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Example - Organizational Index Grouping & CUI Categories Emergency Management (EMGT) General Critical Infrastructure Information (CRIT) Information Systems Vulnerability Information (ISVI) Physical Security (PHYSEC) CUI Category / Category Marking Controlled Technical Information (CTI) Export Controlled (EXPT) Export Controlled Research (EXPTR) Operations Security Information (OPSEC) Sensitive Personally Identifiable Information (PRVCY) Critical Infrastructure Defense Organizational Index Grouping (OIG) Export Control Provisional

General Procurement and Acquisition (PROCURE) Small Business Research and Technology (SBIZ) Source Selection (SSEL) Procurement and Acquisition

General Proprietary Business Information (PROPIN) Proprietary Manufacturer (MFC) Proprietary Business Information

UNCLASSIFIED

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Example – OIG & CUI Categories (cont.)

Contract Use (CONTRACT) Death Records (DREC) General Privacy (PRVCY) Genetic Information (GENETIC) Health Information (HLTH) Inspector General Protected (PRIIG) Military Personnel Records (MIL) Personnel Records (PERS) Student Records (STUD) CUI Category / Category Marking Organizational Index Grouping (OIG) Privacy

UNCLASSIFIED

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Limited Dissemination Controls Limited Dissemination Controls (LDCs) are CUI executive agent-approved controls that may be used to limit or specify CUI dissemination.

LDCs are not carried forward to the banner line.

LDCs and distribution statements cannot unnecessarily restrict CUI access.

Personnel who receive CUI from another Executive Branch agency must comply with the LDC markings annotated on the document.

UNCLASSIFIED

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES LDCs (cont.)

Access to CUI should be encouraged and permitted to the extent the access or dissemination:

complies with law, regulation, or government-wide policy furthers a lawful government purpose is not restricted by an authorized LDC is not otherwise prohibited by any other law, regulation, or government-wide policy Agencies may place limits on disseminating CUI for lawful government purposes only using dissemination controls or methods authorized by law, regulation, or government-wide policy.

UNCLASSIFIED

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Marking Example - LDCs

Additional LDCs can be found in the DoD CUI Marking Aid found at: https://www.dodcui.mil/Home/Desktop-Aids/

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Distribution Statements Distribution statements shall be used in addition to applicable classification and dissemination control markings (e.g., REL TO FVEY).

Distribution statements will be used in lieu of LDCs in the CUI Designation Indicator for documents with:

Export Controlled (EXPT) materials Controlled Technical Information (CTI) Scientific, technical, and engineering information Distribution controls are not carried forward to the banner and footer.

The wording of the distribution statements specified in DoDI 5230.24 may not be modified to accommodate additional distribution.

UNCLASSIFIED

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES

UNCLASSIFIED

Example - Distribution Statements Specific format and reasons for use can be found in DoDI 5230.24

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES CUI Designation Indicator The CUI Designation Indicator must be readily apparent and shall appear on the bottom right side of the first page or cover of the document or material containing CUI, including a document with commingled classified information.

Controlled by: [Name of DoD Component] (not required if identified in the letterhead) Controlled by: [Name of office creating the document] CUI Category: [Identification of the categories contained in the document] Distribution/Dissemination Control: [Applicable LDC or distribution statement] POC: [First and Last Name and phone number of document author]

UNCLASSIFIED

Note: For the Distribution/Dissemination Control line, you must choose either the “Distribution Statement:” (i.e. B, C, D), or “Limited Dissemination Control:” (i.e. FEDCON). Ensure that you choose the most restrictive (Distribution Statement) if applicable.

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Marking Unclassified Materials At a minimum, the acronym “CUI” will be placed in the banner and footer.

Portion markings are optional for unclassified documents.

If portion markings are used, they must be applied to all portions, paragraphs, figures, and tables.

The material’s subjects and titles, as well as individual sections, parts, paragraphs, or similar portions known to contain CUI, will be portion marked with “(CUI)”.

Use of the unclassified marking “(U)” as a portion marking for unclassified information within CUI materials is required.

Note: There is no requirement to add the “U”, signifying unclassified, to the banner and footer as was required with the old FOUO marking (i.e., U//FOUO).

UNCLASSIFIED

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Marking Example – Unclassified Document without Portion Markings

UNCLASSIFIED

Classification and CUI Markings for Training Purposes Only

CUI Banner CUI Footer CUI Designation Indicator

First line is not required Since MARCORSYSCOM is identified in letterhead

Security Note: Even though CUI portion markings are optional, it is highly advised you portion mark, otherwise the recipient will not know what information must be controlled.

No Portion Markings

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Marking Example – Unclassified Document with Portion Markings

UNCLASSIFIED

Classification and CUI Markings for Training Purposes Only

CUI Banner CUI Footer CUI Designation Indicator

Portion

Security Note: The portion marking of the subject should be (U) for unclassified unless the subject line actually contains CUI. If the subject contains CUI then it should be portion marked as (CUI).

First line is not required Since MARCORSYSCOM is identified in letterhead

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES

Marking Example – Unclassified Slides without Portion Markings

CUI Banner CUI Footer CUI Designation

Security Note: Even though CUI portion markings are optional in an unclassified slides containing CUI, it’s highly advised that slides be portion marked otherwise the recipient will not know what information must be controlled.

Classification and CUI Markings for Training Purposes Only

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES

Marking Example – Unclassified Slides with Portion Markings

CUI Designation Indicator

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES

UNCLASSIFIED

Marking Example – Unclassified Email without Portion Markings

CUI Banner CUI Footer CUI Designation Indicator

Security Note: Even though CUI portion markings are optional, it is highly advised you portion mark, otherwise the recipient will not know what information must be controlled.

All NIPRNet email containing CUI or attachments containing CUI MUST be encrypted

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES

UNCLASSIFIED

Marking Example – Unclassified Email with Portion Markings

Portion Markings CUI Banner CUI Footer CUI Designation Indicator

Security Note: The portion marking of the email subject should be (U) for unclassified unless the subject actually contains CUI. If the subject contains CUI then it should be portion marked as (CUI).

All NIPRNet email containing CUI or attachments containing CUI MUST be encrypted

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES CUI markings in classified documents will appear in paragraphs or subparagraphs known to contain only CUI and must be portion marked with “(CUI)”.

“CUI” will not appear in the banner or footer.

A warning box will be added on the first page of multi-page documents to alert readers to the presence of CUI in a classified DoD document, as shown below.

UNCLASSIFIED

CUI Markings in a Classified Document

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES

UNCLASSIFIED

Marking Example – Classified Document with CUI Markings

CUI

Warning CUI Designation Indicator Classification Authority Block

Classification and CUI Markings for Training Purposes Only Security Note: The portion marking of the subject line is the classification level of the subject, NOT the overall classification level of the document.

Classification Banner Classification Footer

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES

UNCLASSIFIED

Marking Example – Classified Slide with CUI Markings

CUI Designation

Classification Authority Block

CUI

Warning

Security Note: The portion marking of the subject line is the classification level of the subject, NOT the overall classification level of the slide.

Classification Banner

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES

UNCLASSIFIED

Marking Example – Classified Email with CUI Marking

Portion Markings

CUI

Warning CUI Designation Indicator

Classification Authority Block

Security Note: The portion marking of the subject line is the classification level of the subject, NOT the overall classification level of the email.

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Marking Documents Containing CTI & EXPT Controlled Technical Information (CTI) and Export Controlled (EXPT) are CUI that have unique marking and dissemination controls.

Controlled Technical Information (CTI), defined in DFARS clause 252.227-7013 and clarified in the CUI Registry, is technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Examples include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identification, data sets, studies and analyses and related information, and computer software executable code and source code.

UNCLASSIFIED

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Marking Documents Containing CTI & EXPT (cont.)

Export controlled (EXPT) is unclassified information concerning certain items, commodities, technology, software, or other information whose export could reasonably be expected to adversely affect the United States national security and nonproliferation objectives. To include dual use items; items identified in export administration regulations, international traffic in arms regulations and the munitions list; license applications; and sensitive nuclear technology information.

“CUI” will be placed in the banner and footer of unclassified documents containing CTI and EXPT.

Portion markings are optional.

A Distribution Statement will appear in the CUI Designation Indicator in lieu of a Limited Dissemination Control.

UNCLASSIFIED

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Marking Documents Containing CTI & EXPT (cont.)

Distribution Statement and export control warning will not appear in the banner and footer.

For each newly generated technical document, the controlling DoD office shall determine whether the document contains export controlled technical data.

Export controlled (EXPT) information must also be marked with an export control warning as directed in DoDI 5230.24, DoDD 5230.25, and Part 250 of Title 32, CFR.

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES

Marking Example – Documents Containing CTI with CUI Markings

CUI Footer CUI Designation Indicator First line is not required Since MARCORSYSCOM is identified in letterhead Security Note: Even though CUI portion markings are optional, it is highly advised you portion mark, otherwise the recipient will not know what information must be controlled.

Distribution Statement Controlled Technical Information will be identified as the CUI Category

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES

Marking Example – Documents Containing EXPT with CUI Markings

Export Controlled will be identified as the CUI Category

First line is not required Since MARCORSYSCOM is identified in letterhead Distribution Statement CUI Designation Indicator Export Control Warning Classification and CUI Markings for Training Purposes Only Security Note: Even though CUI portion markings are optional, it is highly advised you portion mark, otherwise the recipient will not know what information must be controlled.

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES

Distribution Statement Export Control Warning Marking Example – Technical Drawing

UNCLASSIFIED

Classification and CUI Markings for Training Purposes Only

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES

Distribution Statement Export Control Warning

UNCLASSIFIED

Classification and CUI Markings for Training Purposes Only Marking Example – Technical Drawing

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES

CUI

UNCLASSIFIED

Classification and CUI Markings for Training Purposes Only Marking Example – Technical Drawing

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES

UNCLASSIFIED

Classification and CUI Markings for Training Purposes Only Marking Example – Technical Drawing

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Safeguarding Non-DoD information systems processing, storing, or transmitting CUI will provide adequate security and the appropriate requirements must be incorporated into all contracts, grants, and other legal agreements with non-DoD entities in accordance with DoDI 8580.01. The NIST SP 800-171 governs and protects CUI on non-Federal Information Systems when applied by contract.

The authorized holder is responsible for determining authorized access to CUI.

Limit access to CUI to a person(s) or organization(s) with a lawful government purpose.

UNCLASSIFIED

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Safeguarding (cont.)

During working hours, steps will be taken to minimize the risk of access by unauthorized personnel, such as not reading, discussing, or leaving CUI unattended where unauthorized personnel are present.

IAW with DoDI 5200.48, after working hours, CUI will be stored in unlocked containers, desks, or cabinets if the government or government-contracted building provides security for continuous monitoring of access.

If building security is not provided, the information will be stored in locked desks, file cabinets, bookcases, locked rooms, or similarly secured areas.

Note: The concept of a controlled environment means there is sufficient internal security measures in place to prevent or detect unauthorized access to CUI.

UNCLASSIFIED

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Safeguarding (cont.)

CUI information and materials may be transmitted via first class mail, parcel post, or bulk shipment.

When practical, CUI information will be transmitted electronically, via approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure or transport layer security (e.g., https).

Avoid wireless telephone transmission of CUI when other options are available.

CUI transmission via facsimile machine is permitted; however, the sender is responsible for determining whether appropriate protection will be available at the receiving location before transmission.

UNCLASSIFIED

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Unauthorized disclosure of certain CUI, such as Export Controlled (EXPT) technical data, may also result in potential civil and criminal sanctions against responsible persons based on the procedures codified in the relevant law, regulation, or government-wide policy.

Failure to properly mark, control, and protect CUI falls under the personnel security adjudicative guideline of “Handling Protected Information.”

The misuse, mishandling, or unauthorized disclosure of CUI must be reported to the Acquisition Program Security Officer or the AC/S G-2.

UNCLASSIFIED

Failure to Protect CUI

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES When documents or materials containing CUI no longer require safeguarding, they will be decontrolled and either retained, if a permanent record, or destroyed.

Agencies must promptly decontrol CUI properly determined by the CUI owner to no longer require safeguarding or dissemination controls.

Decontrolling CUI through the public release process relieves authorized holders from requirements for handling information IAW the CUI Program.

Pursuant to MARCORSYSCOMO 5720.2A, Public Release Review Process, the document originator must ensure prepublication and security policy review is conducted before public release or posting to a publicly accessible website.

UNCLASSIFIED

Decontrolling

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES CUI documents and materials will be formally reviewed before approved disposition authorities are applied.

Record and non-record CUI documents and materials may be destroyed by means approved for destroying classified or in a manner making it unreadable, indecipherable, and irrecoverable.

If the law, regulation, or government-wide policy specifies a method of destruction, agencies must use the method prescribed.

MARCORSYSCOM’s approved method of destroying CUI documents is disposal in a locked shred bin.

CDs/DVDs containing CUI must be taken to Bldg. 2200 Lester Street to the CMCC Room 247 or the SCIF Room 250 for destruction.

UNCLASSIFIED

Destruction

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Other Considerations DoD information systems processing, storing, or transmitting CUI will be categorized at the moderate impact level, and follow the guidance in DoDIs 8500.01 and 8510.01.

DoD personnel will not use unofficial or personal (e.g., .net; .com) e-mail accounts, messaging systems, or other non-DoD information systems, except approved or authorized government contractor systems, to conduct official business involving CUI.

This is necessary to ensure proper accountability for Federal records and to facilitate data spill remediation in accordance with Public Law 113-187 and the January 16, 2018 Deputy Secretary of Defense memorandum.

UNCLASSIFIED

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Legacy Information Legacy information does not automatically become CUI. It must be reviewed by the owner of the information to determine if it meets CUI requirements. If so it will be marked accordingly.

Legacy marked information stored on a DoD access-controlled website or database does not need to be remarked as CUI, even if other agencies and contractors are granted access to such websites or databases.

Not all Legacy FOUO will be considered CUI. The information must fall within one of the DoD CUI categories; otherwise, it is considered uncontrolled unclassified information and will not be marked as CUI.

When legacy information is incorporated into, or cited in, another document or material, it must be reviewed for CUI and marked accordingly.

UNCLASSIFIED

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Legacy Information (cont.)

Materials bearing legacy markings, while they remain under DoD control or are accessed online and downloaded for use within the DoD, do not require redacting or re-marking.

Unless:

a new document is created with information derived from legacy material it must be marked as CUI if the information qualifies as CUI; or if any such material or new derivative material is being shared outside DoD it must be marked as CUI if the information qualifies as CUI.

All classified materials, including legacy, will be reviewed for CUI and properly marked upon changes in the material’s classification level, particularly if the documents are to be completely declassified.

UNCLASSIFIED

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES DoDI 5200.48 DoD CUI Marking Aid DoD CUI Registry DoD Mandatory CUI Training https://www.dodcui.mil/Home/Training/ Official Websites

UNCLASSIFIED

Additional Resources

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES Summary This is a major change to how DoD is used to marking FOUO information.

This is MARCORSYSCOM’s initial approach at implementing the DoD CUI Program and it’s marking requirements.

Additional CUI marking requirements will be forthcoming All employees are required to take the CUI training (initially (before creating or marking any CUI documents) and annually) available at https://www.dodcui.mil/Home/Training/.

Failure to comply with CUI security requirements is a reportable offense.

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES image2.png image3.jpeg image4.png image5.png image6.jpeg image7.jpeg image8.jpeg image9.jpeg image10.jpeg image11.jpeg image12.jpg image13.jpg image14.png image15.jpeg image16.jpeg image17.jpeg image18.jpg image19.png image20.jpeg image21.jpeg image22.jpeg image23.jpeg image24.jpeg image25.jpeg image1.png