Atch 8- MCSC CUI TRAINING 20210315.pdf

MARINE CORPS SYSTEMS COMMAND

Equipping our MARINES

MARINE CORPS SYSTEMS COMMAND

Controlled Unclassified Information (CUI)

Training

15 March 2021

UNCLASSIFIED

Equipping our MARINES

Agenda

• Background

• CUI Defined

• Who is Responsible

• Making the CUI Determination

• CUI Marking Prohibitions

• CUI Categories

• Limited Dissemination Controls

• Distribution Statements

• CUI Designation Indicator

• Marking Unclassified Materials

• Marking Classified Materials

UNCLASSIFIED

• Marking CTI & Export Control

Documents

• Safeguarding

• Failure to Protect CUI

• Decontrolling

• Destruction

• Other Considerations

• Legacy Information

• Additional Resources

• Summary

Equipping our MARINES

Why Are We Here?

• DoDI 5200.48, released 6 March 2020, established the

Controlled Unclassified Information (CUI) Program as a response to the information sharing challenges from inconsistent definitions and marking requirements applied to

CUI.

‒ All personnel of the DON are personally and individually responsible for properly creating, marking, safeguarding, transmitting, and destroying Classified National Security

Information and Controlled Unclassified Information (CUI) under their custody and control.

‒ DoD military and civilian personnel may be subject to criminal or administrative sanctions if they knowingly, willfully, or negligently violate any provisions of the policy.

Equipping our MARINES

Background

• U.S. Government agencies have been marking sensitive information for decades. Every agency had their own method, acronyms, and labels which hindered sharing information and created inconsistencies in handling and safeguarding of that information.

• Within DoD, the most commonly used marking in the past to identify sensitive unclassified information was For Official

Use Only (FOUO).

• Standardized CUI markings ensure CUI is adequately protected by all agencies and facilitates timely information sharing to authorized recipients.

Equipping our MARINES

CUI Defined

• CUI is defined as information that Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or

Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. CUI does not include classified information.

‒ Basic CUI is the subset of CUI for which the authorizing law, regulation, or Government-wide policy does not set our specific handling or dissemination controls.

‒ Specific CUI is the subset of CUI in which the authorizing law, regulation, or Government-wide policy contains specific handling controls that it requires or permits agencies to use that differ from those for CUI Basic.

NOTE: During DoD’s initial phased implementation of the CUI Program, only

Basic CUI is authorized – all CUI is BASIC.

Equipping our MARINES

Who is Responsible

• The authorized holder of a document or material is responsible for determining, at the time of creation, whether information in a document or material falls into a CUI category. If so, the authorized holder is responsible for applying the appropriate CUI markings and dissemination controls accordingly.

• Authorized holders include:

‒ DoD civilian and military personnel

‒ Contractors providing support to the DoD pursuant to contractual requirements

Equipping our MARINES

How to Make CUI Determination

Equipping our MARINES

CUI Marking Prohibitions

• Information cannot be marked as CUI in order to:

‒ Conceal violations of the law, inefficiency, or administrative errors

‒ Prevent embarrassment to a person, organization, or agency

‒ Prevent open competition

‒ Control information that does not require protection under a law, regulation, or policy

Equipping our MARINES

• CUI Category(ies) can be found at https://www.dodcui.mil/Home/DoD-CUI-Registry/

• If you have information that meets the definition of CUI requiring dissemination controls, but the type of information is not identified within the list of CUI

Categories – Select a CUI Category that resembles (as closely as possible) the information you’re trying to safeguard.

Note: The Organizational Index Group is not a CUI Category (e.g., Defense, Privacy, Export Control, etc.)

CUI Categories https://www.dodcui.mil/Home/DoD-CUI-Registry/

Equipping our MARINES

Example - Organizational Index

Grouping & CUI Categories

Emergency Management (EMGT)

General Critical Infrastructure Information (CRIT)

Information Systems Vulnerability Information (ISVI)

Physical Security (PHYSEC)

CUI Category / Category Marking

Controlled Technical Information (CTI)

Export Controlled (EXPT)

Export Controlled Research (EXPTR)

Operations Security Information (OPSEC)

Sensitive Personally Identifiable Information (PRVCY)

Critical Infrastructure

Defense

Organizational Index

Grouping (OIG)

Export Control

Provisional

General Procurement and Acquisition (PROCURE)

Small Business Research and Technology (SBIZ)

Source Selection (SSEL)

Procurement and

Acquisition

General Proprietary Business Information (PROPIN)

Proprietary Manufacturer (MFC) Proprietary Business

Information

Equipping our MARINES

Example – OIG & CUI

Categories (cont.)

Contract Use (CONTRACT)

Death Records (DREC)

General Privacy (PRVCY)

Genetic Information (GENETIC)

Health Information (HLTH)

Inspector General Protected (PRIIG)

Military Personnel Records (MIL)

Personnel Records (PERS)

Student Records (STUD)

CUI Category / Category MarkingOrganizational Index

Grouping (OIG)

Privacy

Equipping our MARINES

Limited Dissemination Controls

• Limited Dissemination Controls (LDCs) are CUI executive agent-approved controls that may be used to limit or specify

CUI dissemination.

• LDCs are not carried forward to the banner line.

• LDCs and distribution statements cannot unnecessarily restrict CUI access.

• Personnel who receive CUI from another Executive Branch agency must comply with the LDC markings annotated on the document.

Equipping our MARINES

LDCs (cont.)

• Access to CUI should be encouraged and permitted to the extent the access or dissemination:

‒ complies with law, regulation, or government-wide policy

‒ furthers a lawful government purpose

‒ is not restricted by an authorized LDC

‒ is not otherwise prohibited by any other law, regulation, or government-wide policy

• Agencies may place limits on disseminating CUI for lawful government purposes only using dissemination controls or methods authorized by law, regulation, or government-wide policy.

Equipping our MARINES

Marking Example - LDCs

UNCLASSIFIED

• Additional LDCs can be found in the DoD CUI Marking Aid found at: https://www.dodcui.mil/Home/Desktop-Aids/ https://www.dodcui.mil/Home/Desktop-Aids/

Equipping our MARINES

Distribution Statements

• Distribution statements shall be used in addition to applicable classification and dissemination control markings

(e.g., REL TO FVEY).

• Distribution statements will be used in lieu of LDCs in the

CUI Designation Indicator for documents with:

• Export Controlled (EXPT) materials

• Controlled Technical Information (CTI)

• Scientific, technical, and engineering information

• Distribution controls are not carried forward to the banner and footer.

• The wording of the distribution statements specified in DoDI

5230.24 may not be modified to accommodate additional distribution.

Equipping our MARINES

16UNCLASSIFIED

Example - Distribution

Statements

• Specific format and reasons for use can be found in DoDI 5230.24

Equipping our MARINES

CUI Designation Indicator

• The CUI Designation Indicator must be readily apparent and shall appear on the bottom right side of the first page or cover of the document or material containing CUI, including a document with commingled classified information.

Controlled by: [Name of DoD Component] (not required if identified in the letterhead)

Controlled by: [Name of office creating the document]

CUI Category: [Identification of the categories contained in the document]

Distribution/Dissemination Control: [Applicable LDC or distribution statement]

POC: [First and Last Name and phone number of document author]

UNCLASSIFIED

Note: For the Distribution/Dissemination Control line, you must choose either the “Distribution Statement:” (i.e. B, C, D), or “Limited Dissemination Control:”

(i.e. FEDCON). Ensure that you choose the most restrictive (Distribution

Statement) if applicable.

Equipping our MARINES

Marking Unclassified Materials

• At a minimum, the acronym “CUI” will be placed in the banner and footer.

• Portion markings are optional for unclassified documents.

• If portion markings are used, they must be applied to all portions, paragraphs, figures, and tables.

‒ The material’s subjects and titles, as well as individual sections, parts, paragraphs, or similar portions known to contain CUI, will be portion marked with “(CUI)”.

‒ Use of the unclassified marking “(U)” as a portion marking for unclassified information within CUI materials is required.

Note: There is no requirement to add the “U”, signifying unclassified, to the banner and footer as was required with the old FOUO marking (i.e., U//FOUO).

Equipping our MARINES

Marking Example – Unclassified

Document without Portion Markings

UNCLASSIFIED

Classification and CUI Markings for Training Purposes Only

CUI Banner

CUI Footer

CUI Designation

Indicator

First line is not required

Since MARCORSYSCOM is identified in letterhead

Security Note: Even though CUI portion markings are optional, it is highly advised you portion mark, otherwise the recipient will not know what information must be controlled.

No Portion

Markings

Equipping our MARINES

Marking Example – Unclassified

Document with Portion Markings

UNCLASSIFIED

Classification and CUI Markings for Training Purposes Only

CUI Banner

CUI Footer

CUI Designation

Indicator

Portion

Markings

Security Note: The portion marking of the subject should be (U) for unclassified unless the subject line actually contains CUI. If the subject contains CUI then it should be portion marked as (CUI).

First line is not required

Since MARCORSYSCOM is identified in letterhead

Equipping our MARINES

21UNCLASSIFIED

Marking Example – Unclassified

Slides without Portion Markings

CUI Banner

CUI Footer

CUI Designation

Indicator

Security Note: Even though CUI portion markings are optional in an unclassified slides containing CUI, it’s highly advised that slides be portion marked otherwise the recipient will not know what information must be controlled.

Classification and CUI Markings for Training Purposes Only

Equipping our MARINES

22UNCLASSIFIED

Marking Example – Unclassified

Slides with Portion Markings

CUI Banner

CUI Footer

CUI Designation

Indicator

Portion

Markings

Portion

Markings

Equipping our MARINES

23UNCLASSIFIED

Marking Example – Unclassified

Email without Portion Markings

CUI Banner

CUI Footer

CUI Designation

Indicator

Security Note: Even though CUI portion markings are optional, it is highly advised you portion mark, otherwise the recipient will not know what information must be controlled.

All NIPRNet email containing CUI or attachments containing

CUI MUST be encrypted

Equipping our MARINES

24UNCLASSIFIED

Marking Example – Unclassified

Email with Portion Markings

Portion

Markings CUI Banner

CUI Footer

CUI Designation

Indicator

Security Note: The portion marking of the email subject should be (U) for unclassified unless the subject actually contains CUI. If the subject contains

CUI then it should be portion marked as (CUI).

All NIPRNet email containing CUI or attachments containing

CUI MUST be encrypted

Equipping our MARINES

• CUI markings in classified documents will appear in paragraphs or subparagraphs known to contain only CUI and must be portion marked with “(CUI)”.

• “CUI” will not appear in the banner or footer.

• A warning box will be added on the first page of multi-page documents to alert readers to the presence of CUI in a classified DoD document, as shown below.

UNCLASSIFIED

CUI Markings in a

Classified Document

Equipping our MARINES

26UNCLASSIFIED

Marking Example – Classified

Document with CUI Markings

CUI

Warning

CUI Designation

Indicator

Classification

Authority Block

Portion

Markings

Classification and CUI Markings for Training Purposes Only

Security Note:

The portion marking of the subject line is the classification level of the subject, NOT the overall classification level of the document.

Classification Banner

Classification Footer

Equipping our MARINES

27UNCLASSIFIED

Marking Example – Classified

Slide with CUI Markings

CUI Designation

Indicator

Classification

Authority Block

CUI

Warning

Security Note:

The portion marking of the subject line is the classification level of the subject, NOT the overall classification level of the slide.

Portion

Markings

Portion

Markings

Classification and CUI Markings for Training Purposes Only

Classification Banner

Classification Banner

Equipping our MARINES

28UNCLASSIFIED

Marking Example – Classified

Email with CUI Marking

Portion

Markings

CUI

Warning

CUI Designation

Indicator

Classification

Authority Block

Security Note: The portion marking of the subject line is the classification level of the subject, NOT the overall classification level of the email.

Classification and CUI Markings for Training Purposes Only

Classification Banner

Equipping our MARINES

Marking Documents Containing

CTI & EXPT

• Controlled Technical Information (CTI) and Export Controlled

(EXPT) are CUI that have unique marking and dissemination controls.

• Controlled Technical Information (CTI), defined in DFARS clause 252.227-7013 and clarified in the CUI Registry, is technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Examples include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identification, data sets, studies and analyses and related information, and computer software executable code and source code.

Equipping our MARINES

Marking Documents Containing

CTI & EXPT (cont.)

• Export controlled (EXPT) is unclassified information concerning certain items, commodities, technology, software, or other information whose export could reasonably be expected to adversely affect the United

States national security and nonproliferation objectives. To include dual use items; items identified in export administration regulations, international traffic in arms regulations and the munitions list; license applications; and sensitive nuclear technology information.

• “CUI” will be placed in the banner and footer of unclassified documents containing CTI and EXPT.

• Portion markings are optional.

• A Distribution Statement will appear in the CUI Designation

Indicator in lieu of a Limited Dissemination Control.

Equipping our MARINES

Marking Documents Containing

CTI & EXPT (cont.)

• Distribution Statement and export control warning will not appear in the banner and footer.

• For each newly generated technical document, the controlling DoD office shall determine whether the document contains export controlled technical data.

• Export controlled (EXPT) information must also be marked with an export control warning as directed in DoDI 5230.24, DoDD 5230.25, and Part 250 of Title 32, CFR.

Equipping our MARINES

Marking Example – Documents

Containing CTI with CUI Markings

UNCLASSIFIED

Classification and CUI Markings for Training Purposes Only

CUI Banner

CUI Footer

CUI Designation

Indicator

First line is not required

Since MARCORSYSCOM is identified in letterhead

Security Note: Even though CUI portion markings are optional, it is highly advised you portion mark, otherwise the recipient will not know what information must be controlled.

Distribution

Statement

Controlled Technical

Information will be identified as the CUI Category

Equipping our MARINES

Marking Example – Documents

Containing EXPT with CUI Markings

UNCLASSIFIED

Export Controlled will be identified as the CUI Category

CUI Banner

CUI Footer

First line is not required

Since MARCORSYSCOM is identified in letterhead

Distribution Statement

CUI Designation

Indicator

Export Control

Warning

Classification and CUI Markings for Training Purposes Only

Security Note: Even though CUI portion markings are optional, it is highly advised you portion mark, otherwise the recipient will not know what information must be controlled.

Equipping our MARINES

Safeguarding

• Non-DoD information systems processing, storing, or transmitting CUI will provide adequate security and the appropriate requirements must be incorporated into all contracts, grants, and other legal agreements with non-DoD entities in accordance with DoDI 8580.01. The NIST SP

800-171 governs and protects CUI on non-Federal

Information Systems when applied by contract.

• The authorized holder is responsible for determining authorized access to CUI.

• Limit access to CUI to a person(s) or organization(s) with a lawful government purpose.

Equipping our MARINES

Safeguarding (cont.)

• During working hours, steps will be taken to minimize the risk of access by unauthorized personnel, such as not reading, discussing, or leaving CUI unattended where unauthorized personnel are present.

• IAW with DoDI 5200.48, after working hours, ‒ CUI will be stored in unlocked containers, desks, or cabinets if the government or government-contracted building provides security for continuous monitoring of access.

‒ If building security is not provided, the information will be stored in locked desks, file cabinets, bookcases, locked rooms, or similarly secured areas.

Note: The concept of a controlled environment means there is sufficient internal security measures in place to prevent or detect unauthorized access to CUI.

Equipping our MARINES

Safeguarding (cont.)

• CUI information and materials may be transmitted via first class mail, parcel post, or bulk shipment.

• When practical, CUI information will be transmitted electronically, via approved secure communications systems or systems utilizing other protective measures such as

Public Key Infrastructure or transport layer security (e.g., https).

• Avoid wireless telephone transmission of CUI when other options are available.

• CUI transmission via facsimile machine is permitted;

however, the sender is responsible for determining whether appropriate protection will be available at the receiving location before transmission.

Equipping our MARINES

• Unauthorized disclosure of certain CUI, such as Export

Controlled (EXPT) technical data, may also result in potential civil and criminal sanctions against responsible persons based on the procedures codified in the relevant law, regulation, or government-wide policy.

• Failure to properly mark, control, and protect CUI falls under the personnel security adjudicative guideline of “Handling

Protected Information.”

• The misuse, mishandling, or unauthorized disclosure of CUI must be reported to the Acquisition Program Security Officer or the AC/S G-2.

Failure to Protect CUI

Equipping our MARINES

• When documents or materials containing CUI no longer require safeguarding, they will be decontrolled and either retained, if a permanent record, or destroyed.

• Agencies must promptly decontrol CUI properly determined by the CUI owner to no longer require safeguarding or dissemination controls.

• Decontrolling CUI through the public release process relieves authorized holders from requirements for handling information

IAW the CUI Program.

• Pursuant to MARCORSYSCOMO 5720.2A, Public Release

Review Process, the document originator must ensure prepublication and security policy review is conducted before public release or posting to a publicly accessible website.

Decontrolling

Equipping our MARINES

• CUI documents and materials will be formally reviewed before approved disposition authorities are applied.

• Record and non-record CUI documents and materials may be destroyed by means approved for destroying classified or in a manner making it unreadable, indecipherable, and irrecoverable.

• If the law, regulation, or government-wide policy specifies a method of destruction, agencies must use the method prescribed.

• MARCORSYSCOM’s approved method of destroying CUI documents is disposal in a locked shred bin.

• CDs/DVDs containing CUI must be taken to Bldg. 2200 Lester

Street to the CMCC Room 247 or the SCIF Room 250 for destruction.

Destruction

Equipping our MARINES

Other Considerations

• DoD information systems processing, storing, or transmitting

CUI will be categorized at the moderate impact level, and follow the guidance in DoDIs 8500.01 and 8510.01.

• DoD personnel will not use unofficial or personal (e.g., .net;

.com) e-mail accounts, messaging systems, or other non-DoD information systems, except approved or authorized government contractor systems, to conduct official business involving CUI.

• This is necessary to ensure proper accountability for Federal records and to facilitate data spill remediation in accordance with Public Law 113-187 and the January 16, 2018 Deputy

Secretary of Defense memorandum.

Equipping our MARINES

Legacy Information

• Legacy information does not automatically become CUI. It must be reviewed by the owner of the information to determine if it meets CUI requirements. If so it will be marked accordingly.

• Legacy marked information stored on a DoD access-controlled website or database does not need to be remarked as CUI, even if other agencies and contractors are granted access to such websites or databases.

• Not all Legacy FOUO will be considered CUI. The information must fall within one of the DoD CUI categories; otherwise, it is considered uncontrolled unclassified information and will not be marked as CUI.

• When legacy information is incorporated into, or cited in, another document or material, it must be reviewed for CUI and marked accordingly.

Equipping our MARINES

Legacy Information (cont.)

• Materials bearing legacy markings, while they remain under

DoD control or are accessed online and downloaded for use within the DoD, do not require redacting or re-marking.

• Unless:

‒ a new document is created with information derived from legacy material it must be marked as CUI if the information qualifies as CUI; or

‒ if any such material or new derivative material is being shared outside DoD it must be marked as CUI if the information qualifies as CUI.

• All classified materials, including legacy, will be reviewed for

CUI and properly marked upon changes in the material’s classification level, particularly if the documents are to be completely declassified.

Equipping our MARINES

• DoDI 5200.48

• DoD CUI Marking Aid

• DoD CUI Registry

• DoD Mandatory CUI Training https://www.dodcui.mil/Home/Training/

• Official Websites

DoD CUI Program https://www.dodcui.mil/Home/Training/

CUI Category Definitions https://archives.gov/cui/registry/category-list

Additional Resources

Equipping our MARINES

Summary

• This is a major change to how DoD is used to marking FOUO information.

• This is MARCORSYSCOM’s initial approach at implementing the DoD CUI Program and it’s marking requirements.

• Additional CUI marking requirements will be forthcoming

• All employees are required to take the CUI training (initially

(before creating or marking any CUI documents) and annually) available at https://www.dodcui.mil/Home/Training/.

• Failure to comply with CUI security requirements is a reportable offense.

Equipping our MARINES

Questions