Attachment 15 - DD 254 Attch 2 CUI.docx

DD 254 Attachment 2 FA4897-XX-X-XXXX

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

The following procedures are a summary of measures (not inclusive) to be used in the protection Controlled Unclassified Information IAW DoDI 5200.48, Controlled Unclassified Information (CUI).

There is a shared responsibility between the DoD and industry, when established by contract, grants, or other legal agreements or arrangements, in the identification, creation, sharing, marking, safeguarding, storage, dissemination, decontrol, disposition, destruction, and records management of CUI documents and materials.

1. HANDLING:

a) When CUI is to be provided to or generated by DoD contractors, the controls and protective measures to be applied shall be described in the pertinent contract documents. Access to CUI material shall be limited to those employees needing the material for government necessity. The CUI marking is assigned to material created by a DoD User Agency. CUI marking is assigned to information at the time of its creation.

b) Use of the above marking means the information must be reviewed by the Government prior to its release to the public to determine if a significant and legitimate government purpose is served by withholding the information or portions of it.

2. IDENTIFICATION MARKINGS:

a) An unclassified document containing CUI information will be marked at the bottom of the front cover, the first page, each page containing CUI information, the back page, and the outside of the back cover. CUI designation indicator information will be annotated on the bottom of the first page.

b) Within a classified document, an individual page that contains CUI and classified information will be marked at the top and bottom with the highest security classification of information appearing on the page. A CUI warning box is shall be annotated on the first page and “CUI” portion marking will be marked on portions containing CUI information.

c) Mark other records such as computer print outs, photographs, films, tapes, or slides “CUI” so the receiver or viewer knows the record contains CUI material.

d) The originator or other competent authority can only accomplish removal of the CUI marking. When the CUI status is terminated, all known holders will be notified to the extent practical.

3. DISSEMINATION: CUI information may be disseminated within the DoD Components and between DoD Component officials and DoD contractors, consultants, and grantees to conduct official business for the DoD, provided dissemination is consistent with controls imposed by a distribution statement or limited dissemination controls (LDC).

4. STORAGE: During normal duty hours, place CUI material in an out-of-sight location, if your work area is accessible to persons who do not have a valid need for the material. After normal duty hours, store CUI material to prevent unauthorized access. Store CUI materials in a locked container such as file cabinets, desks or bookcases.

5. TRANSMISSION: CUI material shall be PKI encrypted when transmitted by email. Discussion of CUI material on the telephone is authorized if necessary for the performance of the contract. Personnel will not use unofficial or personal (e.g., .net; .com) e-mail accounts, messaging systems, or other non-DoD information systems, except approved or authorized government contractor systems, to conduct official business involving CUI.

6. RELEASE: CUI material shall not be released outside the contractor’s facility except to representatives of the DoD. Unauthorized disclosure of CUI information does not constitute a security violation, but the releasing agency should be informed of any unauthorized disclosure.

a) The release or disclosure to foreign governments, international organizations, coalitions, or allied personnel of CUI not controlled as NOFORN will be in accordance with a law, regulation, or government-wide policy. Contractors will consult the Wing Foreign Disclosure Officer before doing so.

7. DESTRUCTION: When no longer needed, CUI material shall be disposed of by a method that precludes its disclosure to unauthorized individuals. MHAFB has a 100% shred policy mandating that all official documents are destroyed by NSA approved devices.

8. REPORTING: Contractors shall report CUI safeguarding deviations or unauthorized disclosures to unit or wing security representatives. Additionally, contractors must monitor and alert officials to potential classification of aggregated or compiled CUI.