Attachment 3a - CUI Guidance.docx

DD FORM 254 (CONTINUATION)

Attachment 1

GUIDANCE FOR THE PROTECTION OF

“CONTROLLED UNCLASSIFIED” (CUI) INFORMATION

1. General. “CONTROLLED UNCLASSIFIED INFORMATION” (CUI) is any information the Government creates or possesses, or that an entity creates or possesses on behalf of the Government that requires safeguarding or dissemination controls consistent with applicable law, regulations, and government policies but does not meet the standards for classification outlined in DoDI 5200.01. CUI replaces For Official Use Only (FOUO). Use of the marking does not mean that the information cannot be released to the public, only that it must be reviewed by the government prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions of it. Common categories of CUI include privacy, legal and budget information.

2. Identification Markings.

a. An unclassified document containing CUI information will, at a minimum, be marked “CUI” at the top and bottom of each page, on the back page, and on the outside of the back cover (if any). Dissemination controls such as REL TO and NOFORN will not appear in the banner. Portion markings are optional. However, if annotated they must be applied to all portions. The markings will also include the “CUI” designation indicator. This is also where dissemination controls will appear. The “CUI” designation indicator must be annotated on the first page or on the cover of the document.

b. The designation indicator is:

Line 1: The name of the DoD component Line 2: Identification of the Letterhead Line 3: Identification of the categories contained in the document Line 4: Applicable distribution statement or dissemination controls Line 5: Name and phone number/email of POC

Example:

Controlled by: OUSD (I&S) Controlled by: CL&S INFOSEC CUI Categories: PRVCY Distribution/Dissemination Controls: REL TO USA, UK POC John Smith 702-555-0123

c. Within a classified document, an individual page that contains both CUI and classified information will be marked at the top and bottom with the highest security classification of information appearing on the page. If an individual portion contains CUI information but no classified information, the portion will be marked, CUI.

d. Removal of the “CUI” marking can only be accomplished by the originator or other competent authority. When the “CUI” status is terminated, all know holders will be notified to the extent possible.

3. Dissemination. “CONTROLLED UNCLASSIFIED INFORMATION” information may be disseminated as long as it: Complies with the law, regulation, or government – wide policy identifying the information as “CUI”, Furthers a lawful government purpose, Is not restricted by an authorized Limited Dissemination Control and is not otherwise prohibited by any other law, regulation or government-wide policy.

4. Storage. During working hours, “CONTROLLED UNCLASSIFIED INFORMATION” information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During nonworking hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified record in unlocked files or desks, is adequate when internal building security is provided during nonworking hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after-hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

5. Transmission. “CONTROLLED UNCLASSIFIED INFORMATION” documents and material can be transmitted via first-class mail, parcel post, or for bulky shipments fourth class mail. Electronic transmission of CUI information by voice, data, facsimile, or similar means, should be by approved secure communications systems whenever possible. Emails containing “CUI” must be encrypted.

6. Destruction. When no longer needed, “CUI” information may be destroyed by any means approved for destroying classified information or by any other means making it unreadable, indecipherable, and unrecoverable.

7. Unauthorized disclosure. Unauthorized disclosure of “CONTROLLED UNCLASSIFIED INFORMATION” does not constitute a security violation however it should be reported to the Unauthorized Disclosure Program Management Office. In addition, notify the appropriate Military Department Counterintelligence Organization of all incidents. Unauthorized disclosure of “CUI” protected by the privacy act may result in criminal sanctions.

8. Decontrol. Decontrolling of “CUI” will be executed by the originator of the information, the original classification authority (OCA) if identified in a security classification guide, or designated offices for decontrolling “CUI” pursuant to the procedures for the review and release of information under the FOIA. There are no specific timelines to decontrol “CUI” specifically required in a law, regulation or government-wide policy. Decontrol will occur when the “CUI” no longer requires safeguarding and will follow DoD records management procedures.

Reference DoDI 5200.48 Controlled Unclassified Information (CUI)