SBU Policy and Procedures.pdf

A-1

Appendix A. Examples of Sensitive But Unclassified Building Information

Not all building information is automatically considered Sensitive But Unclassified (SBU). After the PBS Project Manager (PM) has reviewed, identified, and marked SBU building information, then access to the information must be controlled. SBU building information may be contained in any document (including drawings, specifications, virtual modeling, reports, studies, analyses) and in any format with information pertaining to:

1. Location and details of secure functions or secure space in a building, location or space. Examples include:

a. Prisoner or judges’ secure circulation paths or routes (both vertical and horizontal).

b. Detention or holding cells.

c. Sally ports.

d. Security areas, including but not limited to control rooms and incident command centers

e. Building automation systems.

f. Telephone and riser closets

2. Location and type of structural framing for the building, including any information regarding structural analysis. Examples include information related to:

a. Progressive collapse.

b. Seismic.

c. Building security.

i. Blast mitigation.

ii. Counterterrorism methods taken to protect the occupants and the building.

3. Risk assessments and information regarding security systems or strategies of any kind. Examples include:

a. Camera locations.

b. Nonpublic security guard post information (e.g., number, location, operations, etc.).

Note: In the case of building information related to a specific suite, room/space, or other component that is designated as SBU (i.e. Building Automation System (BAS) diagram, security camera layout, etc.), the SBU designation does not necessarily carry over to the entire building, or to the entire campus.

Note: Building information for a stand-alone steam plant facility or similar service facility and its associated tunnels shall be designated SBU when it services a building that is designated SBU.

B-1

Appendix B. Sensitive But Unclassified Marking Information

1. Any electronic or printed document, pages containing SBU building information must have the following markings:

SENSITIVE BUT UNCLASSIFIED (SBU)

PROPERTY OF THE UNITED STATES GOVERNMENT

FOR OFFICIAL USE ONLY

Do not remove this notice

Properly destroy or return documents when no longer needed

2. The following mark must be affixed to the cover or first page of any document (such as the cover page on a set of construction drawings).

SENSITIVE BUT UNCLASSIFIED (SBU)

PROPERTY OF THE UNITED STATES GOVERNMENT

COPYING, DISSEMINATION, OR DISTRIBUTION OF THIS DOCUMENT

TO UNAUTHORIZED RECIPIENTS IS PROHIBITED

Do not remove this notice Properly destroy or return documents when no longer needed

3. The previous two markings must be prominently labeled in bold type in a size appropriate for the document or portable electronic data storage device or both, if applicable. On a set of construction drawings, for example, the statements must be in a minimum of 14 point bold type or equivalent.

4. The SBU markings must be used regardless of the medium through which the information appears or is conveyed.

C-1

Appendix C. SBU Contract Clause

Contracting Officers (COs) shall include the following clause, or a similar updated clause per the General Services Administration Acquisition Manual (GSAM), in: (1) all solicitations containing SBU building information (including Solicitations for Offers (SFOs)); and shall include the following clause in: (2) contracts and/or final leases that may contain, require access to, or cause the generation of SBU building information.

[Begin clause]

Safeguarding and Dissemination of Sensitive But Unclassified (SBU) Building Information

This clause applies to all recipients of SBU building information, including offerors, bidders, awardees, contractors, subcontractors, lessors, suppliers and manufacturers.

1. Marking SBU. Contractor-generated documents that contain building information must be reviewed by GSA to identify any SBU content, before the original or any copies are disseminated to any other parties. If SBU content is identified, the Contracting Officer (CO) may direct the contractor, as specified elsewhere in this contract, to imprint or affix SBU document markings to the original documents and all copies, before any dissemination.

2. Authorized recipients.

a. Building information designated SBU must be protected with access strictly controlled and limited to those individuals having a legitimate business need to know such information. Those with a need to know may include Federal, State and local government entities, and nongovernment entities engaged in the conduct of business on behalf of or with GSA. Nongovernment entities may include architects, engineers, consultants, contractors, subcontractors, suppliers, utilities, and others submitting an offer or bid to GSA, or performing work under a GSA contract or subcontract. Recipient contractors must be registered as “active” in the System for Award Management (SAM) database at www.sam.gov and have a legitimate business need to know such information. If a subcontractor is not registered in the SAM and has a need to possess SBU building information, the subcontractor shall provide to the contractor its DUNS number or its tax ID number and a copy of its business license. The contractor shall keep this information related to the subcontractor for the duration of the contract and subcontract.

b. All GSA personnel and Contractors must be provided SBU building information when needed for the performance of official Federal, State, and local government functions, such as for code compliance reviews and for the issuance of building permits. Public safety entities such as fire and utility departments may require access to SBU building information on a need to know basis. This clause must

C-2 not prevent or encumber the dissemination of SBU building information to public safety entities.

3. Dissemination of SBU building information:

a. By electronic transmission. Electronic transmission of SBU information outside of the GSA network must use session encryption (or alternatively, file encryption). Encryption must be via an approved NIST algorithm with a valid certification, such as Advanced Encryption Standard (AES) or Triple Data Encryption Standard (3DES), in accordance with Federal Information Processing Standards Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules per GSA policy.

b. By nonelectronic form or on portable electronic data storage devices. Portable electronic data storage devices include, but are not limited to CDs, DVDs, and USB drives. Nonelectronic forms of SBU building information include paper documents, among other formats.

i. By mail. Contractors must utilize only methods of shipping that provide services for monitoring receipt such as track and confirm, proof of delivery, signature confirmation, or return receipt.

ii. In person. Contractors must provide SBU building information only to authorized recipients with a need to know such information. Further information on authorized recipients is found in Section 2 of this clause.

4. Record keeping. Contractors must maintain a list of all entities to which SBU is disseminated, in accordance with sections 2 and 3 of this clause. This list must include at a minimum: (1) the name of the State, Federal, or local government entity, utility, or firm to which SBU has been disseminated; (2) the name of the individual at the entity or firm who is responsible for protecting the SBU building information, with access strictly controlled and limited to those individuals having a legitimate business need to know such information; (3) contact information for the named individual; and (4) a description of the SBU building information provided. Once “as built” drawings are submitted, the contractor must collect all lists maintained in accordance with this clause, including those maintained by any subcontractors and/or suppliers, and submit them to the CO.

For Federal buildings, final payment may be withheld until the lists are received.

5. Safeguarding SBU documents. SBU building information (both electronic and paper formats) must be protected, with access strictly controlled and limited to those individuals having a legitimate business need to know such information. GSA contractors and subcontractors must not take SBU building information outside of GSA or their own facilities or network, except as necessary for the performance of that

C-3

[End of clause] clause in all subcontracts.

9. Subcontracts. The contractor and subcontractors must insert the substance of this noncompliance and comply with the clause in the future.

provides a corrective action plan explaining how the contractor will rectify any withheld for failure to comply with any provision in this clause until the contractor improper disclosures of SBU building information. Progress payments may also be provides a corrective action plan explaining how the contractor will prevent future payments, the CO may withhold approval of progress payments until the contractor reported to the CO at amy.heusser@gsa.gov . If the contract provides for progress

8. Incidents. All improper disclosures of SBU building information must be immediately to the CO rather than destroying them.

CO at the completion of the lease term. The contractor may return the SBU documents the contract to receive final payment. For leases, this notice must be submitted to the contractor's record copy. This notice must be submitted to the CO at the completion of suppliers in accordance with paragraphs 4 and 6 of this clause, with the exception of the information has been returned or destroyed by the contractor and its subcontractors or

7. Notice of disposal. The contractor must notify the CO that all SBU building

SBU building information may be returned to the CO.

A of NIST Special Publication 800-88, Guidelines for Media Sanitization. Alternatively, sanitization within GSA CIO IT Security 06-32, Media Sanitization Guide and Appendix incapable of being restored, in accordance with guidelines provided for media information must be destroyed so that marked information is rendered unreadable and

6. Destroying SBU building information. When no longer needed, SBU building need to know.

contract. Access to the information must be limited to those with a legitimate business use for the term of retention. Documents no longer needed shall be destroyed (such as after contract award, after completion of any appeals process or completion of the work). Destruction shall he done by burning or shredding hardcopy, and/or physically destroying CD's, deleting and removing files from the electronic recycling bins, and removing material from computer hard drives using a permanent erase utility or similar software.

3. Term of Effectiveness. The efforts required above shall continue throughout the entire term of contract and for what specific time thereafter as may be necessary, as determined by the Government. Necessary record copies for legal purposes (such as those retained by the architect, engineer, or contractor) must be safeguarded against unauthorized use for the term of retention.

4. Written agreement of disposal. For all contracts using SBU building information, the contractor shall provide a written statement that he and his subcontractors have properly disposed of the SBU building documents, with the exception of the contractor's record copy, at the time of Release of Claims to obtain final payment. Documents no longer needed shall be destroyed (such as after contract award, after completion of any appeals process or completion of the work). Destruction shall be done by burning or shredding hardcopy, and/or physically destroying CDs, deleting and removing files from the electronic recycling bins, and removing material from computer hard drives using a permanent erase utility or similar software.

The recipient acknowledges the requirement to use reasonable care, as outlined above, to safeguard the documents and, if not awarded, the contract (and at the completion of any protest/appeal process) will make every reasonable and prudent effort to destroy or render useless all SBD information received during the solicitation.

I agree that I will abide by this agreement and will only disseminate Sensitive But Unclassified (SBU) building information to other authorized users under the conditions set forth above.

Signature: _________________________________

Title: _____________________________________

Date:___________________

Copy of business license attached

DUNS Number: _________________________________

Verified: ____Yes _____No

IRS Tax lD Number ______________________________