ACT Insturctions for CUI 102320.doc

“CONTROLLED UNCLASSIFIED INFORMATION (CUI)” ATTACHMENT

1. GENERAL:

The contractor shall adhere to DoDI 5200.48 CUI and Army Controlled Unclassified Information (CUI) guidance as it relates to controlling, marking, safeguarding, storage and disposal of CUI materials on this contract /agreement.

2. IDENTIFYING CUI.

a. The official CUI Registry approved by the CUI Executive Agent identifies all approved CUI categories; provides general descriptions for each; identifies the basis for controls; establishes markings, and includes guidance on handling procedures. The Contractor shall refer to the CUI Registry’s category listing found at https://www.archives.gov/cui/registry/category-list to determine if information can be designated as CUI. The contractor shall also coordinate with the COR/AOR for support and advice.

b. The authorized holder (originator/owner of the information; the original classification authority or other official (government or contractor) that controls the information) is responsible for determining, at the time of creation, whether information in a document or material falls into a CUI category. If so, the authorized holder is responsible for applying CUI markings and dissemination instructions accordingly.

c. Only categories listed in the CUI Registry (includes DoD related categories) can be used to identify if the information meets CUI designation.

3. LEGACY MATERIAL.

a. Policy for legacy CUI created and marked under Department of Defense Manual (DoDM) 5200.01, Volume 4 is cancelled. For information on Army legacy material: (Ref: DoDI 5200.48, para 3.2)

(1) Will not be required to be re-marked or redacted while it remains under control or is accessed on line and downloaded for use on the contract. However, when legacy CUI is incorporated into, or cited in, another document or material, it must be reviewed for CUI and marked in accordance with DoDI 5200.48.

(2) Marked and stored on an access-controlled website or database does not need to be remarked as CUI, even if other agencies and contractors are granted access to the websites or databases.

(3) Does not automatically become CUI. It must be reviewed by the owner of the information to determine if it meets or falls under one of the new CUI categories. If it meets the new CUI requirements, it will be marked in accordance with DoDI 5200.48.

b. The original classification authorities (OCAs) are required to review all SCGs under their authority to determine if the information (previously marked as “For Official Use Only” or “FOUO” or other legacy markings) meets the CUI designation. The SCGs must be reissued to ensure clear protection guidance is provided. (Ref: DoDI 5200.48, para 3-7e and 3.8)

4. Marking. The contractor shall ensure that all documents containing CUI carry the CUI markings in accordance with DoDI 5200.48. Discontinue all use of legacy or other markings is not permitted or included in either the CUI Registry or DoDI 5200.48. Refer to the OUSD(I&S)/DDI(CL&S) Information Security CUI Marking Guidance dated April 2020.

5. Safeguarding and Storage. The contractor shall protect CUI from unauthorized disclosure or access by unauthorized personnel, by ensuring these measures are implemented: (Ref: DoDI 5200.48, para 4.1e)

a. During working hours. Contractor employees working with CUI will be careful not to expose CUI to unauthorized users or others who do not have a lawful government purpose to see the information. Cover sheets (Stand Form 901) can be placed on top of documents to conceal the contents from casual viewing.

b. The contractor shall keep CUI under control at all times or protect it with at least one physical barrier and reasonably ensure that the information is protected from unauthorized access and observation.

c. CUI will not be stored in personal residence, hotel room safes, and automobiles or viewed while on public transportation if allowed to transfer hard-copy (document form) CUI material outside the organization.

6. Transmission Requirements.

a. CUI information may be transmitted electronically (e.g., data, website, or e-mail), via approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure or transport layer security (e.g., https). Avoid wireless telephone transmission of CUI when other options are available. (Ref: DoDI 5200.48, para 4.1e).

b. CUI transmission via facsimile machine is permitted; however, the sender is responsible for determining whether appropriate protection will be available at the receiving location before transmission (e.g., facsimile machine attended by a person authorized to receive CUI; facsimile machine located in a controlled government environment) or an authorized DoD contractor facility.

c. CUI information and material may be transmitted via first class mail, parcel post, FEDEX or, bulk shipments. Do not place CUI markings on the outer envelopes or packaging. Refer to the OUSD(I&S)/DDI(CL&S) Information Security CUI Marking Guidance dated April 2020.

d. The contractor shall not use unofficial or personal (e.g., .net; .com) e-mail accounts, messaging systems, or other non-DoD information systems, except approved or authorized government contractor systems, to conduct official business involving CUI.

7. CUI within Information Systems. (Ref: DoDI 5200.48, para 3-3, 3-10)

a. DoD information systems (IS) processing, storing, or transmitting CUI will be categorized at the moderate impact level, and follow the guidance in DoDI 8500.01 and 8510.01.

b. Non-DoD information systems processing, storing, or transmitting CUI will provide adequate security, and the appropriate requirements must be incorporated into all contracts, grants, and other legal agreements with non-DoD entities in accordance with DoDI 8582.01. The NIST-SP 800-171 identifies the baseline system requirements for processing CUI for industry.

c. For systems, networks, and programs operating on the various domains, a splash screen warning and notice of consent must be employed to alert users of the presence of CUI.

d. When made available by the DoD Chief Information Officer and OUSD(I&S), Army organizations will modify or install classification marking tools on unclassified, Secret and Top Secret network systems to account for CUI information and readily permit inclusion of CUI markings and designator indicators.

8. Dissemination. (Ref DoDI 5200.48, para 4-2)

a. The contractor shall follow CUI access to the extent the access or dissemination: complies with the Law, Regulation, and Government-wide policy (LRGWP) identifying the information as CUI; furthers a lawful government purpose; is not restricted by an authorized Limited Dissemination Controls (LDC); or is not prohibited by any LRGWP.

b. Authorized holders may place limits on disseminating CUI for a lawful government purpose using the approved LDCs and associated marking or methods authorized by a specific LRGWP.

c. The originator may use the LDCs to limit access to those on an accompanying dissemination list, as shown in Table 2 of DoDI 5200.48. LDCs or distribution statements cannot unnecessarily restrict CUI access.

d. When handling other Executive Branch CUI (non-DoD or Army), DA personnel will follow their regulatory guidance for when the application of dissemination controls and its markings are allowed, and by whom, while ensuring the policy is in accordance with Part 2002 of Title 32, CFR.

e. The government CUI designated information may be disseminated to a foreign recipient in order to conduct official business for the Army, provided the dissemination has been approved the foreign disclosure officer in accordance with AR 380-10 and the CUI is marked as releasable to the intended foreign recipient. Refer to DoDI 5200.48, para 3.9 on general release and disclosure requirements.

9. Legacy Distribution Statements.

a. Legacy CUI technical documents and materials requiring export control have used distribution statements in accordance with DoDI 5230.24 in order to address the shared responsibility between the DoD and its contractors to safeguard this information. This was done for legacy CUI creation, transmission, receipt, storage, distribution, decontrol, and approved disposition authorities, including destruction. (Ref: DoDI 5200.48, para 4.3a)

b. CUI export controlled technical information or other scientific, technical, and engineering information will continue to use distribution statements and must be marked with an export control warning in accordance with DoDI 5230.24, DoDD 5230.25, and Part 250 of Title 32, CFR (Withholding of Unclassified Technical Data from Public Disclosure). However, where other markings are authorized and used in accordance with associated LRGWP (e.g., North Atlantic Treaty Organization markings, REL TO), those markings may be used to further inform distribution decisions. (Ref: DoDI 5200.48, para 4.3b)

c. “REL TO” is authorized for use with foreign nationals once the information distribution is properly coordinated with the requiring activity foreign disclosure office.

10. Destruction. (Ref: DoDI 5200.48, para 4.5)

a. The contractor shall take all CUI documents (Record and Non-record copies) and materials and formally review them in accordance with Chapter 33 of Title 44, United States Code (and AR 25-400-2 before approved disposition authorities are applied, including destruction. Media containing CUI must include decontrolling indicators. (Ref: DoDI 5200.48, para 4.5)

b. The contractor shall ensure that CUI will be destroyed in a manner that makes it unreadable, indecipherable, and irrecoverable. The CUI will be destroyed according to any specific directives regarding the information. If the authority does not specify a destruction method, the contractor shall use one of the following methods: (Ref: DoDI 5200.48, para 4.5a and b)

(1) Any method of destruction approved for classified information.

(2) Guidance for destruction outlined in the NIST SP 800-88, and further explained in NARA’s CUI Notice 2019-03.

11. Decontrol of CUI. Decontrol occurs when the information has been removed from the protection of the CUI designation and no longer requires safeguarding or dissemination controls.

a. Decontrolling and releasing CUI records will be executed by the originator of the Information or other authority (e.g., initial Freedom of Information Act (FOIA) denial and appellant authorities) and designated government program office for decontrolling CUI pursuant to the procedures for the review and release of information (see AR 360-1). There are no specific timelines to decontrol CUI unless specifically required in a LRGWP. Decontrol will occur when the CUI no longer requires safeguarding and will follow Army records management procedures (see AR 25-400-2). (Ref: DoDI 5200.48, para 4.4)

b. CUI documents and materials will be formally reviewed by the government program chief engineer, SME before being decontrolled or chief engineer, SME, OPSEC officer, legal and PAO prior to public release.

c. Decontrol will occur when the designating agency decides to release the CUI to the public by making an affirmative, proactive disclosure (for example, FOIA request). Disclosure under FOIA does not automatically constitute CUI decontrol for all purposes.

d. Disclosures under the Privacy Act constitute decontrol only with respect to the limited purpose of disclosure to the individual who requested access to their records maintained in a system of records.

e. When indicated by a decontrol marking specifying a decontrol date or event, CUI is decontrolled without further review by the originator.

f. A designating agency may also decontrol CUI:

(1) In response to a request from an authorized holder to decontrol CUI.

(2) Concurrently with any declassification action under E.O. 13526 or any predecessor or successor order, as long as the information also appropriately qualifies for decontrol as CUI.

(3) In PEO STRI, the government program office in charge of the contract is the local CUI personnel it authorizes to decontrol CUI, consistent with a LRGWP.

(4) Decontrolling CUI for purposes other than FOIA disclosure relieves the requirement to handle the information under the CUI Program but does not constitute authorization for public release.

(5) Personnel must clearly indicate that CUI is no longer controlled when restating, paraphrasing, re-using, releasing to the public, or donating the CUI to a private institution. Otherwise, personnel do not have to mark, review, or take other actions to indicate the CUI is no longer controlled.

g. Once decontrolled, any public release of information that was formerly CUI must be in accordance with AR 360-1.

h. Authorized holders may request that the designating agency decontrol CUI that they believe should be decontrolled. If an authorized holder publicly releases CUI in accordance with the designating agency’s (not Army or DoD) authorized procedures, the release constitutes decontrol of the information.

i. Unauthorized disclosure of CUI does not constitute decontrol.

j. Personnel must not decontrol CUI to conceal, or to otherwise circumvent accountability for, an unauthorized disclosure.

k. When a LRGWP require specific decontrol procedures, personnel must follow such requirements

l. CUI and the Freedom of Information Act (FOIA). FOIA may not be cited as a CUI safeguarding or disseminating control authority for CUI. When determining whether to disclose information in response to a FOIA request, the decision must be based on content of the information and applicability of any FOIA statutory exemptions, regardless of whether or not the information is designated or marked as CUI. (Ref: Title 32 CFR 2002.44(b), Part 2002)

m. CUI and the Privacy Act. Information contained in Privacy Act systems of records may be subject to controls under other CUI categories and may need to be marked as CUI for that reason. In addition, when determining whether certain information must be protected under the Privacy Act or whether the Privacy Act allows an individual the right to access their information maintained in a system of records, the decision to release must be based upon the content of the information as well as Privacy Act criteria, regardless of whether the information is designated or marked as CUI.

n. Decontrol of CUI for the limited purpose of making an individual’s information available to them under the Privacy Act does not result in decontrol. (Ref: CFR 2002.46, Title 32 Part 2002)

12. Challenges to Designation of Information as CUI.

a. The contractor who believes that a designation as CUI is improper or incorrect, or who believe they have received unmarked CUI, should notify the government agency that disseminated the information. When the disseminating agency is not the designating agency of the CUI, it is the responsibility of the disseminator agency to contact the designating agency of the challenge. Challenges may be made anonymously; and challengers cannot be subject to retribution for bringing such challenges. (Ref: CFR 2002.50 Title 32, Part 2002)

b. If a contractor or government command or organization receives a challenge, the government program office or other designated individual for handling challenges will take the following measures:

(1) Acknowledge receipt of the challenge in writing, providing an expected timeline for response to the challenger,

(2) Review the merits of the challenge with a subject matter expert, offer an opportunity to the challenger to define a rationale for belief that the CUI in question is inappropriately designated,

(3) Notify the challenger of the decision in writing, and provide contact information of the official making the decision in this matter.

c. Until the challenge is resolved, the challenged CUI, including challenges to unmarked CUI, will continue to be safeguarded and disseminated at the appropriate control level indicated in the markings or presumed category. If a challenging party disagrees with the response to a challenge, contact the contract cognizant security office (Information Security Team) for assistance with resolution.

13. Misuse or Unauthorized Disclosure of CUI.

a. The contractor shall report promptly and shall take appropriate action in cases of misuse, mishandling or unauthorized disclosure (UD) of CUI.

b. For UD of CUI, no formal security inquiry or investigation is required unless disciplinary action will be taken against the individual(s) responsible, in such case an inquiry would be appropriate. Incidents involving the UD of CUI will be reported to the COR/AOR and contracting officer.

14. CUI Training. All contractors handling CUI in support to this contract, will execute initial and refresher CUI training as stated in item 13 paragraph 14. CUI training can be taken at the following URL; https://securityhub.usalearning.gov/index.html

15. CUI Requirements in Army Contracts. (Ref: DoDI 5200.48, para 5.3)

a. CUI will be identified by the government program office in all Army contracts to include the applicable security clauses and security standards associated with the CUI in accordance with DoDI 5200.48.

b. Whenever the Army and government program office provides CUI to, or CUI is generated by, non-DoD entities, protective measures and dissemination controls, including those directed by LRGWP, will be articulated in the contract, grant, or other legal agreement, as appropriate.

c. The contractor shall monitor CUI for aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

d. The contractor shall report the potential classification of aggregated or compiled CUI to the Army requiring activity.

e. The contractor shall submit unclassified Army information for review and approval for release in accordance with the standard Army release requirements under AR 360-1.

f. All CUI records must follow the approved mandatory disposition authorities whenever the government requiring activity provides CUI to, or CUI is generated by, non-DoD entities.