Attachment 0002_DD254 Attach A_Guidelines for VPS CUI.pdf

Revised March 18, 2022

W56HZV-21-R-0202 / VPS RAT AMPV Sets

ATTACHMENT A

ADDITIONAL GUIDELINES FOR CONTROLLED UNCLASSIFIED INFORMATION

General: There are types of information that are not classified but that require application of access and distribution controls and protective measures for a variety of reasons. This information is known as “controlled unclassified information (CUI).” The types of information considered CUI are U.S. Government technical information and information listed at the DoD CUI registry (https://www.dodcui.mil/Home/DoD-CUI-Registry/). When handling CUI material, all personnel are to comply with these requirements and follow their company policy and/or applicable Non-Disclosure Agreement (NDA) concerning the protection of proprietary information in situations not clearly stated herein.

Technical Information: Per DoDI 5230.24, Technical Information is defined as technical data or computer software of any kind that can be used, or adapted for use, in the design, production, manufacture, assembly, repair, overhaul, processing, engineering, development, operation, maintenance, adapting, testing, or reconstruction of goods or material;

or any technology that advances the state of the art, or establishes a new art, in an area of significant military applicability in the United States. The data may be in tangible form, such as a blueprint, photograph, plan, instruction, or an operating manual, or may be intangible, such as a technical service or oral, auditory, or visual descriptions. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, and related information, and computer software documentation.

CUI Information Description: This is unclassified Information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies (LRGWP) but is not classified under EO 13526, (Classified National Security Information).

CUI Markings All documents containing CUI will carry the CUI markings in accordance with DoDI 5200.48. Discontinue all use of legacy or other markings not permitted or included in either the DoD CUI Registry or DoDI 5200.48. Marking of Technical Information will include the Distribution Statement provided in the Security Classification Guide. If the contents of the technical document require more than one Distribution Statement, apply the most restrictive statement. This does not preclude additional mandated markings as may be required by the contract. Distribution Statements and Export Control warnings shall be in accordance with DoDI 5230.24 and DoDI 5200.48.

Protection of CUI Information

Supplier / Developer Capture or Creating CUI Data and Storage/Handling: CUI may be captured, created, or evolved as part of aggregation of data in any form, which is a natural by-product of the development or testing efforts at USG facilities or the Supplier’s managed and controlled facilities. If a cooperative or distributed team of primary and secondary suppliers are engaged, all are bound by the same Supply Chain tiered level requirements referenced in NIST SP 800- 161.

Access: CUI may be released only to an individual who has a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose under this contract. Personnel no longer requiring access to CUI must dispose (see “Disposal” below) or surrender any in their possession and terminate future access to it.

Storing/Handling: During working hours, take reasonable steps to minimize risk of access to CUI by unauthorized personnel. After working hours, when not in physical possession of the owner, all CUI (whether hardcopy or optical media (e.g., DVDs, CDs) that contain CUI) must be afforded a reasonable degree of physical protection to prevent theft of program information (e.g., store CUI information in locked desks or file cabinets, locked rooms, cable lock laptops, storing in a trunk, storing out of site or similar means). Do not display CUI in public places (e.g., airports, airplanes, restaurants).

Electronic storing and processing of CUI shall be in accordance with DFARS 252.204-7012 Safeguarding Controlled Defense Information and Cyber Incident Reporting. Do not process CUI on public computers (e.g., those available for use by the general public in kiosks, hotel business centers), public wireless networks or computers that do not have access control. Personally owned computers and personally owned devices are not authorized to process CUI. Portable electronic devices (e.g., smartphones, laptop computers, tablets), non- portable computers, and removable media (e.g., external hard drives, flash drives, USB drives; not including optical media) must be physically and electronically protected as described in this instruction, DFARS 252.204-7012 and DoDI 8582.01. Information systems processing CUI must meet NIST Special Publication (SP) 800-171 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations security requirements. A basic self-assessment will be completed by the collaborator and documented in the Supplier Performance Risk System (SPRS) at https://www.sprs.csd.disa.mil// and concurrence provided by PEO GCS weapon system ISSM prior to processing CUI on covered systems, reference DFARS clause 252.204-7020.

Dissemination: CUI printed documents and material may be transmitted through mail channels, commercial carrier or hand-carried without formal courier orders. CUI information may be disseminated to DoD personnel and DoD contractors http://www.dodcui.mil/Home/DoD-CUI-Registry/) http://www.sprs.csd.disa.mil/

Revised March 18, 2022 to conduct official business for the program. Technical information will follow the release instructions identified in the Distribution Statement. Use secure communications whenever possible; however, land-line telephones are more secure than cellular telephones and should be used whenever available for discussions involving CUI. Transmit voice and facsimile transmissions only when you have a reasonable assurance that only authorized recipients will have access to the transmission. Digital transmission shall comply with the below:

All transmission and/or dissemination of CUI (i.e., email and file transfers) must use NIST/NIAP-approved cryptographic products/algorithms, e.g., DoD-approved Public Key Infrastructure Certification or DoD Safe Exchange at https://safe.apps.mil/. These are available at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm. This encryption requirement includes communications that contain passcodes to teleconferences or web conferences where there is a reasonable expectation that CUI may be discussed. When encryption is not available, a government collaborative suite (aka Integrated Digital Environment [IDE]) must be used to transmit CUI.

• Contractor-hosted collaborative suites may be used for digital transmission and/or dissemination of CUI by personnel not located on a government network (e.g., NIPRNET), provided the following conditions apply: 1) Use only NIST/NIAP-approved cryptographic products/algorithms. The latest validation lists may be obtained at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm; and, 2) FedRAMP Impact 4/5 environments authorized for CUI (https://marketplace.fedramp.gov/#!/products are used for all third party collaborative suites.

• Do not post CUI to web pages that are publicly available or have access limited only by domain/IP restrictions. As permitted by other contract provisions, CUI may be posted to web pages that control access through the use of a DoD approved Public Key Infrastructure Certification and that provide protection via use of secure sockets, or other equivalent technologies. These are available at http://iase.disa.mil/pki/eca.

• As new technologies become available in the electronics arena, care should be given to providing a reasonable degree of protection from known vulnerabilities.

• The Internet is “Public Access”. CUI must be reviewed and officially approved by the PEO GCS Public Affairs Officer for public release before placing on the Internet. This is not applicable when the Internet is used for e-mail transmissions and encryption is used as noted above.

Reproduction: Authorized holders may reproduce (e.g. copy, scan, print, electronically duplicate) CUI in furtherance of a lawful US Government purpose relating to this contract. The equipment (e.g. printers, copiers, scanner, or fax machines) utilized to reproduce CUI documents should not retain any CUI data or the agency must otherwise sanitize it in accordance with NIST SP 800-53.

Decontrolling: CUI information will be decontrolled in accordance with DoDI 5200.48, unless otherwise stated in the contract language. The only entity that is authorized to decontrol CUI is the Information Owner. Decontrolling occurs when the Information Owner of the CUI material removes safeguarding or dissemination controls from CUI that no longer requires such controls. CUI documents and materials must be formally reviewed in accordance with DoDI 5230.09 before decontrol or release to the public.

Disposal: The contractor shall ensure any covered defense information provided by the Government under this contract is destroyed or sanitized from contractor owned media and reported in accordance with NIST SP 800-88, Rev 1, Guidelines for Media Sanitization , December 2014, and in accordance with Section 2002.14 of Title 32, CFR. Destroy CUI documents may be destroyed by means approved for classified information or by any other means making it unreadable, indecipherable, and unrecoverable.

Report Loss of CUI: Report any loss of CUI to the Government Security Manager. Initial reports shall be made as expeditiously as possible in all cases within 72 hours of discovery. If additional information is required after submission and review of the initial report, guidance will be provided at that time. Initial report content shall include the following information as available.

• Applicable dates, including dates of compromise and dates of discovery

• Threat methodology, including all known resources used (e.g. IP addresses, domain names, software tools)

• Account of what actions the threat(s) may have taken on victim system/network

• What information may have been compromised or lost, and its potential impact on government programs http://iase.disa.mil/pki/eca http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm http://iase.disa.mil/pki/eca http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm%3B http://iase.disa.mil/pki/eca