Attachment 11 Safeguarding and Dissemination of Controlled Unclassified Information CUI Building Information.docx

Safeguarding and Dissemination of Controlled Unclassified Information (CUI) Building Information

Certain information contained in the Solicitation Documents may have been designated as Controlled Unclassified Information (CUI) building information. With respect to such information, Offerors shall agree to the terms as a condition of receipt such information, as set forth in this clause.

This clause applies to all recipients of CUI building information (which falls within the CUI Physical Security category), including offerors, bidders, awardees, contractors, subcontractors, lessors, suppliers and manufacturers.

Marking CUI:

Contractors must submit any contractor-generated documents that contain building information to GSA for review and identification of any CUI building information that may be included. In addition, any documents GSA identifies as containing CUI building information must be marked in accordance with the Order and the Marking Controlled Unclassified Information Handbook (the current version may be found at https://www.archives.gov/files/cui/20161206-cui-marking-handbook-v1-1.pdf) before the original or any copies are disseminated to any other parties. If CUI content is identified, the CO may direct the contractor, as specified elsewhere in this contract, to imprint or affix CUI document markings (CUI) to the original documents and all copies, before any dissemination, or authorized GSA employees may mark the documents.

1. Authorized recipients:

a. Building information designated as CUI must be protected with access strictly controlled and limited to those individuals having a Lawful Government Purpose to access such information, as defined in 32 C.F.R. § 2002.4(bb). Those with such a Lawful Government Purpose may include Federal, state and local government entities, and non-governmental entities engaged in the conduct of business on behalf of or with GSA. Non-governmental entities may include architects, engineers, consultants, contractors, subcontractors, suppliers, utilities, and others submitting an offer or bid to GSA, or performing work under a GSA contract or subcontract. Recipient contractors must be registered as “active” in the System for Award Management (SAM) database at www.sam.gov, and have a Lawful Government Purpose to access such information. If a subcontractor is not registered in the SAM database and has a Lawful Government Purpose to possess CUI building information in furtherance of the contract, the subcontractor must provide to the contractor its UEI number or its tax ID number and a copy of its business license. The contractor must keep this information related to the subcontractor for the duration of the contract and subcontract.

b. All GSA personnel and contractors must be provided CUI building information when needed for the performance of official Federal, state, and local government functions, such as for code compliance reviews and the issuance of building permits. Public safety entities such as fire and utility departments may have a Lawful Government Purpose to access CUI building information on a case-by-case basis. This clause must not prevent or encumber the necessary dissemination of CUI building information to public safety entities.

2. Dissemination of CUI building information:

a. By electronic transmission. Electronic transmission of CUI information outside of the GSA network must use session encryption (or alternatively, file encryption) consistent with National Institute of Standards and Technology (NIST) SP 800- 171. Encryption must be through an approved NIST algorithm with a valid certification, such as Advanced Encryption Standard or Triple Data Encryption Standard, in accordance with Federal Information Processing Standards Publication 140-2, Security Requirements for Cryptographic Modules, as required by GSA policy.

b. By nonelectronic form or on portable electronic data storage devices. Portable electronic data storage devices include CDs, DVDs, and USB drives. Nonelectronic forms of CUI building information include paper documents, photographs, and film, among other formats.

i. By mail. Contractors must only use methods of shipping that provide services for monitoring receipt such as track and confirm, proof of delivery, signature confirmation, or return receipt. CUI markings must not appear on the exterior of Packages.

ii. In person. Contractors must provide CUI building information only to authorized recipients with a Lawful Government Purpose to access such information. Further information on authorized recipients is found in section 1 of this clause.

3. Record keeping:

Contractors must maintain a list of all entities to which CUI is disseminated, in accordance with sections 2 and 3 of this clause. This list must include, at a minimum: (1) the name of the state, Federal, or local government entity, utility, or firm to which CUI has been disseminated; (2) the name of the individual at the entity or firm who is responsible for protecting the CUI building information, with access strictly controlled and limited to those individuals having a Lawful Government Purpose to access such information; (3) contact information for the named individual; and (4) a description of the CUI building information provided. Once “as built” drawings are submitted, the contractor must collect all lists maintained in accordance with this clause, including those maintained by any subcontractors and suppliers, and submit them to the CO. For Federal buildings, final payment may be withheld until the lists are received.

4. Safeguarding CUI documents:

CUI building information (both electronic and paper formats) must be stored within controlled environments that prevent unauthorized access. GSA contractors and subcontractors must not take CUI building information outside of GSA or their own facilities or network, except as necessary for the performance of that contract. Access to the information must be limited to those with a Lawful Government Purpose for access.

5. Destroying CUI building information:

When no longer needed, CUI building information must either be returned to the CO or destroyed in accordance with guidelines in NIST Special Publication 800-88, Guidelines for Media Sanitization.

6. Notice of disposal:

The contractor must notify the CO that all CUI building information has been returned or destroyed by the contractor and its subcontractors or suppliers in accordance with paragraphs 4 and 5 of this clause, with the exception of the contractor's record copy. This notice must be submitted to the CO at the completion of the contract to receive final payment. For leases, this notice must be submitted to the CO at the completion of the lease term.

7. CUI security incidents:

All improper disclosures or receipt of CUI building information must be immediately reported to the CO and the GSA Incident Response Team Center at gsa-ir@gsa.gov. If the contract provides for progress payments, the CO may withhold approval of progress payments until the contractor provides a corrective action plan explaining how the contractor will prevent future improper disclosures of CUI building information. Progress payments may also be withheld for failure to comply with any provision in this clause until the contractor provides a corrective action plan explaining how the contractor will rectify any noncompliance and comply with the clause in the future.

8. Subcontracts:

The contractor and subcontractors must insert the substance of this clause in all subcontracts.

[End of clause]

The requester shall complete the information below and return the entire CONTROLLED UNCLASSIFIED INFORMATION (CUI) Information document to the Contracting Officer or Contract Specialist. By signature below, the requestor of CUI building information acknowledges the requirement to maintain controls, as stated herein, to safeguard the information, and shall return or destroy the CUI building information as required by this Agreement. The undersigned acknowledges that the requester shall abide by this Agreement and shall only disseminate CUI building information to other authorized users under the conditions set forth herein.

Company Name: ______________________________________________

Name of Individual: ____________________________________________

Signature: ___________________________________________________

Title: _______________________________________________________

Date: _________________

UEI Number:_________________________________________

UEI Number Verified by Government Representative: Yes: ___ No: ___

Employer ID Number/Federal Tax ID Number ___________________________________

Offeror/bidder/contractor information and UEI number has been verified and release of CUI building information is approved by:

Contracting Officer's Name Date

Signature

DISPOSAL STATEMENT

(return upon completion of project and proper disposal of drawings)

Solicitation/Contract: Keating Courthouse Hardening Phase II- Construction

I hereby certify that all CONTROLLED UNCLASSIFIED INFORMATION (CUI) building information relative to the referenced solicitation/contract not previously returned to the Government has been destroyed or disposed of by burning or shredding paper copies, physically destroying computer diskettes or permanently deleting/removing/erasing electronic files from computers.

I also certify the no unauthorized physical or electronic copies of such CUI building information were made or are being retained.

Company Name: ______________________________________________

Name of Individual: ____________________________________________

Signature: ___________________________________________________

Title: _______________________________________________________

Date: _________________