Attachment_B_-_Security_Designation_Guide.pdf

Sensitive But Unclassified

BEP Security Designation Guide For Level I Overt Features

DEPARTMENT OF THE TREASURY

BUREAU OF ENGRAVING AND PRINTING

OFFICE OF SECURITY

WASHINGTON, DC

Prepared by:

Office of Product Development

Office of Security

Change Number Date of Change Change made by Change approved by

Description of Change:

Change Number Date of Change Change made by Change approved by

Description of Change:

Attachment B

BEP Security Designation Guide for:

Melrose

February 25, 2014

1. GENERAL

a. Purpose. This security designation guide is issued for the purpose of identifying specific topics of information associated with the Bureau of Engraving and Printing projects requiring protection in accordance with the Department of the Treasury Security Manual, and its implementing directives. The guide provides topics of information that do not meet the standards and criteria of classification under E.O. 12958, as amended, but are nonetheless sensitive and require protection against unauthorized disclosure. Such sensitive but unclassified information shall be categorized as Sensitive but Unclassified (SBU) and marked as applicable.

b. Approval. This guide is approved by Judith Diaz Myers, Associate Director, Product and Technology Development.

c. Scope, Applicability, and Supersession. This document provides security designation guidance for information associated with Melrose. This guide shall be cited as the basis for designation of information and materials under BEP cognizance and control.

Changes in the designation guidance required for operational necessity will be made immediately upon notification and concurrence of the approving authority and will be disseminated to original recipients of this guide. The provisions of this guide are applicable to all organizational entities and contractors associated with the Bureau of Engraving and Printing.

d. The BEP office of primary responsibility (OPR):

Bureau of Engraving and Printing Office of Product Development Washington, D.C.

Telephone number: (202) 927-3657 Fax Number: (202) 874-3483 this action.

2. POLICY

a. General. The project consists of Level I features defined herein as overt features intended for public use. The features include pigmentary materials, inks containing pigmentary materials, composite additions to the substrate including laminates, patches, foils, modified substrate(s), authentication technology, and quality assurance technology designed as a system for use by the public to authenticate U.S. currency. Certain aspects of this system require protection as sensitive but unclassified information for the duration of the project and the contract.

b. Program Determination. SBU shall be the primary term used to mark sensitive but unclassified information originating within the Bureau of Engraving and Printing. Criteria and terminology defining the types of information warranting designation as “sensitive” varies across the Federal Government and such designations and use are discretionary.

Designating particular information as “sensitive” is not a license to (1) conceal possible negligence, waste or illegal activities; (2) prevent embarrassment to a person, organization, or agency; to restrain competition; (3) prevent or delay the release of information; or (4) restrict access by executive, legislative, or judicial agencies, organizations or officials. The term “Sensitive But Unclassified” originated with the Computer Security Act of 1987. It defined SBU as “any information, the loss, misuse, or unauthorized access to or modification of which could adversely affect the national interest or the conduct of Federal programs, or the privacy to which individuals are entitled under Section 552a of Title 5, United States Code (USC) (the Privacy Act) but which has not been specifically authorized under criteria established by an executive order or an act of Congress to be kept secret in the interest of national defense or foreign policy.” More recently, the Electronic Government Act of 2002 recognized the importance of information security to the economic and national security interests of the United States.

c. Time Frame for Protection of Data. Bureau of Engraving and Printing Officials who create SBU information are responsible for determining how long the information must be protected. Information creators, not system-operators, shall determine what information requires protection depending on the nature of the information and the environment in which it is processed and stored. SBU information shall not remain designated as such when its disclosure would no longer reasonably be expected to adversely impact economic, industrial or international financial institutions; or compromise unclassified programs or essential operations or critical infrastructures.

d. Exceptional Circumstances. Should a situation arise where a holder of information believes the information should be but is not covered by this security designation guide the information will be handled and safeguarded in accordance with the level of designation the holder believes it to be. In such instances, the information will be marked with the tentative notation “Pending Designation Review.” The information will be transmitted, by a means approved for the level of designation, to the OPR identified in Section 1.d of this guide, for a determination.

e. Users of This Guide. This guide is for the use of BEP employees and contractors performing security designation actions when addressing the elements of information covered by this guide.

3. SENSITIVE BUT UNCLASSIFIED (SBU) PROCESSING

a. Conversion to SBU. SBU shall be the primary term used to mark sensitive but unclassified information originating within Treasury/bureau offices. The SBU marking shall identify information, the release of which may adversely impact economic, industrial, or international financial institutions; or compromise unclassified programs or Treasury/bureau essential operations or critical infrastructures. Previous designations to label sensitive information like Limited Official Use, For Official Use Only, Market Sensitive, Close Hold, Eyes Only, Privileged or Proprietary, et al., shall be discontinued in identifying SBU information produced by the BEP unless a particular term is authorized by law, statute, or agency regulation, or is not meant for public release but controlled or restricted in conducting official Treasury/bureau business.

b. Access to SBU – Access to SBU shall be based on a determination that an employee, contractor personnel or consultant requires access to specific SBU information in order to perform or assist in lawful, authorized, Treasury/bureau governmental functions; a security clearance is not required to access SBU information.

c. Categorizing SBU and Restrictions Criteria and terminology defining the types of information warranting designation as “sensitive” varies across the Federal Government and such designations and use are discretionary. Foreign governments also share restricted information or provide sensitive but unclassified information in confidence based on treaty, bilateral exchange agreements, or other obligations. Designating particular information as “sensitive” is not a license to: (1) conceal possible negligence, waste, or illegal activity; (2) prevent embarrassment to a person, organization, or agency;

to restrain competition; (3) prevent or delay the release of information; or, (4) restrict access by executive, legislative, or judicial agencies, organizations, or officials.

d. Relationship to the Freedom of Information Act and Privacy Act SBU information is not automatically exempt from provisions of the Freedom of Information Act (FOIA) or the Privacy Act. Treasury/bureau components receiving a FOIA request for SBU or other sensitive information must evaluate the information and determine in each instance whether one or more FOIA exemptions apply. Such evaluation pertains to both marked and unmarked records that are subject to the FOIA. However, information sensitivity is expected to decrease with passage of time or changes in circumstances and this must be a factor in determining whether SBU information shall be released. The Privacy Act also requires agencies to collect, maintain, disseminate and make available to a person his or her personal information as required by the Act and its implementing regulations. SBU may include, but is not necessarily limited to, information:

(1) Within international/domestic banking and finance sectors or otherwise protected by statute, treaty, or other agreements, or requiring protection until officially released.

(2) Identifying Treasury/bureau unclassified critical infrastructures/key resources, protective measures for safeguarding information, facility schematics, etc.

(3) Unclassified systems data, e.g., routing, configuration, engineering, systems-architecture, surveys or reports.

e. Exception for Law Enforcement Sensitive, Bank Secrecy, Tax Return Information and Other Agency Markings. Except for the term “LAW ENFORCEMENT SENSITIVE” used by other agencies and Treasury/bureau law enforcement components, e.g., Office of Terrorism and Financial Intelligence (TFI); Internal Revenue Service (IRS) Criminal

Investigations (CI) Division; Office of Inspector General (OIG); Treasury Inspector General for Tax Administration (TIGTA); the Financial Crimes Enforcement Network (FinCEN); and the Office of Foreign Assets Control (OFAC), descriptions similar to “Improper use of the report is a violation of 18 United States Code (USC) 641” used by the Comptroller of the Currency and the Office of Thrift Supervision (OTS) for bank exam/secrecy reports and “tax return information” restricted under Section 6103 of the Internal Revenue Code, no other terms shall be applied to Treasury/bureau-originated sensitive information determined to be SBU unless authorized by law, statute, or regulation. Treasury/bureau users shall follow protective requirements of the U.S.

Government agency/organization providing sensitive information but are not expected to re-mark such information. However, in responding to FOIA/Privacy Act requests for information, updated decisions as to the continued value or need to protect such information shall be noted on documentation for future reference prior to being returned to files. Employees shall contact non-Treasury originators of specifically marked SBU information for guidance or instructions on proper handling. In the absence of such guidance the information shall be safeguarded in accordance with the requirements contained in this section.

f. Responsibilities

(1) Treasury/bureau employees, contractor personnel and consultants must be aware and comply with safeguarding requirements for SBU information. Personnel should also be aware that divulging SBU information without proper authority could result in administrative or disciplinary action (including termination of contract). The lack of an SBU marking does not necessarily mean the information is not sensitive nor does it relieve the creator or holder of such information from responsibility to appropriately safeguard the information from unauthorized use or inadvertent disclosure.

(2) Treasury/bureau officials who create SBU information are responsible for determining how long the information must be protected, for example, either by date or lapse of a determinable event. Unless otherwise noted on a document, information marked as SBU shall generally no longer be treated as sensitive after 25 years except as provided by statute, law or agency regulation. Previously generated sensitive information of Treasury/bureau origin shall be subject to release determinations under the FOIA/Privacy Act. Information creators, not system-operators, shall determine what information requires protection depending on the nature of the information and the environment in which it is processed and stored. SBU information shall not remain designated as such when its disclosure would no longer reasonably be expected to adversely impact economic, industrial, or international financial institutions; or compromise unclassified programs or essential operations or critical infrastructures.

(3) Treasury/bureau security officials shall provide routine oversight of measures in place to protect SBU information through a program of routine administration and day-to-day management of their information security program.

(4) Supervisors and program managers are responsible for employees being trained to recognize and safeguard SBU information supporting their mission, operations and assets. Supervisors and managers shall also ensure an adequate level of education and awareness is maintained by affected employees. Education and awareness shall begin upon initial employee assignment and annually reinforced through mandatory training, staff meetings or other methods/media contributing to an informed workforce.

This includes requiring appropriate security contract clauses for personnel, facilities and information protection through the acquisition process when access to SBU information is necessary.

(5) Employees are also responsible for protecting SBU information supporting their mission, operations and assets. Protection efforts shall focus on preventing unauthorized or inadvertent disclosure and especially when visitors enter areas where SBU information is handled, processed, discussed or stored. This includes being aware of surreptitious and accidental threats posed by high-end communications technologies carried/used by employees and visitors, such as cell phones (with or without photographic capability), personal data assistants, portable/pocket computers, cameras and other video imaging recorders, flash drives, multi-functional and two-way pagers, and wireless devices capable of storing, processing or transmitting information.

(6) Contracting officials, program managers, and technical assistants are also responsible for requiring appropriate security contract clauses for personnel, facilities, and information protection through the acquisition process of contracts or grants that concern access to SBU information.

4. MARKING REQUIREMENTS Information designated as SBU and requiring such markings shall be distinctly labeled so persons authorized access are readily aware of its sensitivity. The lack of SBU markings, however, does not relieve the holder from safeguarding responsibilities.

Unmarked SBU information already in records storage does not need to be removed, marked, and restored. However, when individual items are temporarily removed from storage that have no markings (and are subsequently deemed to be SBU) they shall be appropriately marked to reflect the correct status as SBU before being re-filed. Items containing SBU information shall be:

a. Prominently marked at the top/bottom of the front/back cover and each individual page with the marking “SENSITIVE BUT UNCLASSIFIED” or “SBU.” Information system prompts may be adjusted to incorporate SBU markings in headers and footers.

b. Portions, paragraphs and subject titles containing SBU information shall be marked with the abbreviation (SBU) to differentiate it from the remaining text. Only when the entire text contains SBU information are individual portion markings optional.

c. Controlling, decontrolling or originator information markings are not required.

d. When sent outside Treasury/bureaus, SBU information documents shall include a statement alerting the recipient in a transmittal letter or directly on the document containing SBU information, for example: This document belongs to the Department of the Treasury (cite bureau name). It may not be released without the express permission of (cite creating office or bureau). Refer requests and inquiries for the document to: (insert name and address of originating office/bureau and contact number(s)).

5. GENERAL HANDLING PROCEDURES. Protective measures start when markings are applied and end when such markings are cancelled or the records are destroyed. Although SBU is Treasury’s standard for identifying sensitive information, some types of SBU information might be more sensitive than others and warrant additional safeguarding measures beyond the minimum requirements established herein. Certain information might be extremely sensitive based on repercussions if the information is released or compromised – potential loss of life or compromise of a law enforcement informant or operation. Bureau employees must use sound judgment coupled with an evaluation of the risks, vulnerabilities, and the potential damage to personnel or property/equipment as the basis for determining the need for safeguards in excess of the minimum requirements contained herein.

a. Use of SBU Cover sheets. A green "SENSITIVE BUT UNCLASSIFIED” cover sheet shall be used to prevent unauthorized or inadvertent disclosure when SBU information is removed from an authorized storage location and persons without a need-to-know are present or casual observation would reveal SBU information

b. Internal routing of SBU. When forwarding SBU information within the BEP, an SBU cover sheet shall be placed inside the envelope and on top of the transmittal letter, memorandum or document.

c. Receipt of SBU from other Government Agencies. When receiving SBU or equivalent information from another U.S. Government agency, it shall be handled in accordance with the guidance provided by the other U.S. Government agency. Where no guidance is provided it shall be handled in accordance with BEP policy as described herein.

d. Copying SBU. SBU information may be reproduced on regular office copiers to the extent needed to carry out official business. Flawed or otherwise unusable reproductions shall be destroyed via shredding or placement in burn-bags.

6. DISSEMINATION AND ACCESS

a. Information designated as SBU shall be orally, visually, or electronically disseminated in such manner to avoid access by unauthorized persons. Precautions might include preventing visual access and restricting oral disclosure to designated individuals.

Websites, if available to the public, shall not contain or provide links to SBU information.

b. Access to SBU information shall be on a need-to-know basis as determined by the holder of the information. However, where there is uncertainty as to a person’s need-to-know, the holder of the information shall request dissemination instructions from his or her next level supervisor or manager.

c. Holders of SBU information shall comply with any additional access and/or dissemination restrictions cited on the document.

d. Unless marked to the contrary, SBU information officially released to Treasury/bureaus may be provided to another U.S. Government agency without prior permission of the originator.

7. STORAGE REQUIREMENTS

a. Physical Storage of SBU. SBU information shall be stored, at a minimum, in a file cabinet, desk drawer, overhead storage bin, credenza, or similar locked compartment.

SBU information may also be stored in a room or area with physical access control measures affording adequate protection and preventing unauthorized access by the public, visitors, or other persons without a need-to-know. Examples include, but are not limited to, a key-locked room, or restricted access work area controlled by a cipher lock or card reader. To the extent possible, SBU information stored in the same container used for safeguarding classified information shall be filed separately from classified information. However, when SBU and classified information are co-mingled in a BEP document or file, the required protection for the particular file will be governed by the highest level of classified information.

b. Electronic Storage/Processing of SBU. Processing SBU information shall comply with Treasury/bureau systems security requirements for use of Treasury/bureau-owned or leased equipment. When laptop computers are not being used, the laptop shall be stored to protect it from loss, theft, and unauthorized access. Information contained therein or stored on removable disks shall also be labeled and protected from unauthorized disclosure. Contractors shall (a) store all SBU information on a stand alone hard drive and (b) password protect all SBU documents.

8. TRANSMISSION OF SBU DATA

a. Within the U.S. and Territories. SBU information to be transmitted within the United States and its territories shall be in a single opaque envelope/container and sealed to prevent inadvertent opening and to reveal evidence of possible tampering. The envelope/container shall bear the complete name and address of the sender and intended recipient or program office. SBU information may be opened and examined by mail room personnel in the same manner in which other incoming mail is evaluated and determined to be safe for internal delivery. SBU information shall be mailed by U.S. Postal Service (USPS) First Class Mail. Use of express mail services or commercial overnight delivery service is authorized, as warranted.

b. Overseas. When sent to overseas offices, SBU information shall be transmitted electronically and may be encrypted for purposes of transmission. If serviced by a military postal facility, i.e., APO/FPO, SBU information may be mailed directly to the recipient. Where the overseas office is not serviced by a military postal facility, the information shall be sent through the Department of State’s (DOS’s) unclassified diplomatic pouch. Advanced coordination with State officials shall be made to ensure delivery at the final destination meets BEP needs and State’s schedule for such deliveries.

c. Via FAX. Secure fax is encouraged for transmitting SBU information. However, SBU information may be transmitted via unsecured fax unless verbal or written restrictions have been cited by the originator. Where an unsecured fax is used, the sender shall be reasonably assured by the intended recipient that the information will not be left unattended or subject to possible unauthorized disclosure on the receiving end. Such assurance might entail the recipient standing by to receive SBU information and immediately phoning the sender to verbally acknowledge receipt. The recipient of the information shall comply with any access, dissemination, and transmittal restrictions cited thereon or verbally communicated by the originator.

d. Via Secure Phone. The use of a Secure Telephone Unit (STU III) or Secure Telephone Equipment (STE) is encouraged though not required. When using regular office telephones, users shall confirm speaking to an authorized person before discussing the information, and inform the person that the forthcoming discussion will include SBU information and identify those part(s) of the discussion that are sensitive. Only under exigent circumstances should voice-mail messages containing SBU information be left for a recipient. Thereafter, BEP IT personnel shall be engaged to effectively delete such messages except where the message itself is regarded as evidence by a competent investigative authority.

e. Via e-mail. Treasury/bureau internal e-mail systems provide sufficient safeguards to allow for the transmission of SBU information. However, it is up to the holder to determine if the information should be sent via e-mail or other means. If the holder determines the information is too sensitive to transmit via e-mail, then it should not be sent electronically. Alternate secure arrangements must then be made to disseminate the information. If the holder determines e-mail provides sufficient protection, the information may be sent. For added security, the information to be sent may be included as an attachment rather than in the text of the message. The holder may then password-protect the attached file by activating the password capability of the word-processing program using a previously established password or a password sent to the intended recipient under separate cover. For electronic transmission of information inside or outside of the bureau, all SBU files shall be password protected prior to transmission.

9. DISPOSITION. Originators and their successors may decontrol a record’s SBU information status when circumstances indicate the information no longer requires protection. Known holders of the information shall be notified to the extent possible, that the information is no longer SBU and be directed to mark their copies accordingly.

10. DESTRUCTION. SBU documents shall be destroyed by burning, mulching, pulping, or pulverizing beyond recognition and reconstruction depending on the local jurisdiction’s requirements. SBU information may also be destroyed by shredding or disposed of in burn bags.

When using burn bags, the outside shall be distinctly labeled or marked SBU to distinguish the contents from burn bags containing classified information. When using office shredders, employees are encouraged to dispose of the residue with normal paper waste in more than one trash receptacle to disseminate the remains as widely as possible. Treasury Publication 85-01, Volume II, Part 1, Section 4.3.3 provides guidance and suggested methods for clearing or sanitizing various sensitive media. At the end of the project, the contractor shall return all electronic and hardcopy SBU files to BEP for destruction.

11. INCIDENT REPORTING

a. Employees or contractor personnel who observe or become aware of the loss, compromise, suspected compromise, or unauthorized disclosure of SBU information shall report it immediately, but not later than the next business day, to their supervisor and to BEP security officials. Notification to appropriate Treasury/bureau officials shall be made without delay when the disclosure or compromise could result in physical harm to an individual or compromise an unclassified plan or on-going operation. The initial notification may be either verbal or in writing.

b. The BEP security official or designee shall conduct an inquiry to determine the details and prepare a report, copy of which shall be provided to the BEP Director, including the following:

Whether or not an incident actually occurred. If there was no loss, compromise, or unauthorized disclosure, the security official shall so state.

The responsible person(s).

The cause of the incident.

Actions taken to minimize damage or neutralize the potential for further compromise.

Recommendations that can be implemented to prevent recurrence of similar incidents.

The estimated impact.

Any disciplinary action taken or planned, including training, to prevent recurrence.

BEP SECURITY DESIGNATION GUIDE

FOR LEVEL I OVERT FEATURES

Melrose February 25, 2014

A. PRODUCT IDENTIFICATION DESIGNATION DURATION

1. Printed Features

Materials/Inks

Pigment(s)/Material Code(s) Unclassified

Pigment(s)/Material Federal Stock Number(s) Unclassified

Material composition when associated with project Sensitive but Unclassified (SBU)

Material Structure(s) when associated with project SBU

Incorporation media Unclassified

Material plus Incorporation Media SBU Until issued

Substrate(s) containing material plus Incorporation media SBU Until issued

2. Composite Addition(s)

Technical Specifications when associated with project SBU

3. Modified Substrate(s)

Technical Specifications when associated with project SBU

B. INSPECTION AND AUTHENTICATION

Inspection method (if applicable) SBU Until issued

Inspection criteria (such as illumination sources, intensity, etc.) SBU Until issued

Test Data and Results SBU

C. WEAKNESS AND VULNERABILITIES

Adversarial Analysis / Results SBU

System Vulnerabilities SBU