Contractor CUI Training Slides.pptx

Controlled Unclassified Information (CUI)

UNCLASSIFIED

Train World Class Pilots

Definition CUI – Controlled Unclassified Information:

- Government created or possesses

- Entity creates/possesses on behalf of Government, that a Law, Regulation, or Government-Wide Policy (LRGWP) requires or permits an agency to handle using safeguarding or dissemination controls.

Why CUI

Identify and protect certain types of unclassified information that require application of access, distribution controls and protective measures for a variety of reasons

Set forth policies, practices and procedures to ensure maximum uniformity and effectiveness in the application of E.O. 13556

FOUO 9 Exemptions to CUI 126 Exemptions

DoD CUI Index 19 Major Indexes:

North Atlantic Treaty Organizations (NATO) (2) Major Indexes divided into 103 Categories

Types of CUI

Examples:

Controlled Technical Information (CTI) DoD Critical Infrastructure Security Information (DCRIT) Unclassified Controlled Nuclear Information (UCNI-D) Geodetic Product Information (GPI) Export Controlled International Agreement Information General Law Enforcement Controlled Substances NATO Restricted NATO Unclassified General Privacy Health Information General Intelligence Military Personnel Records Personnel Records Student Records

Social Networking is particularly risky as people freely post critical information about themselves. It is extremely important to protect your association with sensitive Air Force units and missions. It is also important that your family and friends do not associate you with sensitive Air Force units and missions.

We understand that people will interact on social media, but the key is to do so smartly. Limit what you share about yourself and your unit.

Defense.Gov is a good resource for additional information on social media.

Levels of CUI 2 levels of CUI: Basic and Specified

CUI Basic - Subset of CUI for which the authorizing law, regulation, or Government-wide policy does not set out specific handling or dissemination controls. Information handled in accordance with controls set forth in the CUI Registry.

CUI Specified - Subset of CUI in which the authorizing law, regulation, or Government-wide policy contains specific handling controls that it requires or permits agencies to use that differ from those for CUI Basic. Controls may be more stringent, or simply differ from, those required by CUI Basic Key distinction - Underlying authority spells out specific controls for CUI Specified information and doesn’t for CUI Basic information.

Access to CUI Access: Requires an authorized, lawful government purpose Need to Know: Individual which has possession of information makes determination based on LRGWP Disseminated: within DoD Components, between DoD Component officials, DoD contractors, consultants, grantees to conduct official business for the DoD Dissemination is consistent with controls imposed by a distribution statement or limited dissemination controls (LDC).

Privacy Act disclosure only authorized if requirements of DoD 5400.11-R are satisfied

Introduce the lists of 100.

Instructor Note: There were actually two lists produced, but the second one got little attention compared to the first.

In March 2015, the Islamic State’s so-called Hacking Division posted the names, photographs, and addresses of about 100 U.S. service members to a web site and suggested that U.S. sympathizers should kill those so listed:

“With the huge amount of data we have from various different servers and databases, we have decided to leak 100 addresses so that our brothers in America can deal with you. And now we have made it easy for you by giving you addresses, all you need to do is take the final step, so what are you waiting for?”

However, ISIS itself didn’t threaten to take action against the persons whose names appeared on the list; and it appears the posted information was not obtained (as suggested in the message) via hacking, but rather by collecting it from publicly available sources such as news stories and social media posts:

“It does not appear that the information had been hacked from government servers. One Defense Department official said that most of the information could be found in public records, residential address search sites and social media.”

Instructor Note: The main point is the information they used was provided my us. This actually worked out to be more of a psychological effort than an actual physical threat. Reference the follow sites for additional information:

- https://www.usatoday.com/story/news/nation/2015/03/23/pentagon-response-islamic-state-kill-list/70335810/

- https://nationalpost.com/news/world/israel-middle-east/isis-linked-group-releases-hit-list-of-u-s-military-personnel-including-names-and-addresses

- https://www.snopes.com/fact-check/the-war-at-home/

- https://www.nytimes.com/2015/03/22/world/middleeast/isis-urges-sympathizers-to-kill-us-service-members-it-identifies-on-website.html

- https://www.cnn.com/2015/03/23/us/online-threat-isis-us-troops/index.html

Marking CUI (Limited Dissemination Controls)

Limited Dissemination Controls

* The dissemination list limits access to the specified individuals, groups, or agencies and must accompany the document.

Instructor Note: Just a few examples of websites that can provide useful information on protecting your identity. There many, varied websites that can be accessed.

Marking CUI (Unclassified Documents) Minimum, CUI markings for unclassified documents will include:

Banners lines with the acronym "CUI" at the top and bottom of each page Do not add "UNCLASSIFIED" before "CUI.“ Portion markings are optional. However, if annotated, they must be applied to all portions, to include subjects, titles, paragraphs, subparagraphs, bullet points, figures, charts, tables, etc.

These are required reading for all. Available on the wing app and on SharePoint. Every member is required to read and understand the two documents.

Marking CUI (Unclassified Documents) CUI designation indicator must be annotated on first page or cover of CUI documents and placed at bottom right side of all documents containing CUI.

Line 1 Controlled by: name of the DoD component (not required if identified in the letterhead) Line 2 Controlled by: name of the office making the CUI determination Line 3 CUI Category: identify all types of CUI contained in the document Line 4 Distribution/Dissemination Control: applicable distribution statement or dissemination controls Line 5 POC: phone #, mailbox, or email of originating DoD component or authorized CUI holder

These are required reading for all. Available on the wing app and on SharePoint. Every member is required to read and understand the two documents.

Marking CUI (Unclassified Documents)

Minimum marking requirements. No portion markings

CUI

Marking Requirements for CUI

CUI

CUI

(U) Marking Requirements for CUI

CUI

Portion markings included Banner Line (CUI Basic) Portion Markings

CUI

Designation Indicator Banner Line (CUI Basic)

These are required reading for all. Available on the wing app and on SharePoint. Every member is required to read and understand the two documents.

Marking CUI (Classified Documents) A Warning Statement will be placed at the bottom of the first page of multi-page documents to alert readers to the presence of CUI in a classified DoD document:

This content is classified at the [insert highest classification level of the source data] level and may contain elements of controlled unclassified information (CUI), unclassified, or information classified at a lower level than the overall classification displayed. This content shall not be used as a source of derivative classification; refer instead to [cite specific reference, where possible, or state "the applicable classification guide(s)"]. It must be reviewed for both Classified National Security Information (CNSI) and CUI in accordance with DoDI 5230.09 prior to public release. [Add a point of contact when needed.]

Instructor Note: Just a few examples of websites that can provide useful information on protecting your identity. There many, varied websites that can be accessed.

Marking CUI (Classified Documents) CUI designation indicator must be readily apparent and may appear only on the first page or cover. It is placed at the bottom right side of all documents containing CUI, including classified documents.

CUI designation indicator is comparable to the classification authority block used for classified documents and materials.

Instructor Note: Just a few examples of websites that can provide useful information on protecting your identity. There many, varied websites that can be accessed.

Marking CUI (Classified Documents)

SECRET

(U) Marking Requirements for CUI

1. (S) Documents containing classified information will be marked in accordance with DoDM 5200.01, Volume 2, "DoD Information Security Program: Marking of Information." All documents will be portion marked, contain the overall classification, and include the classification authority block.

2. (CUI) CUI markings in classified documents will appear in portions known to contain only CUI and will be marked as "(CUI)." If possible, segregate CUI from classified portions. If this is not possible, the portion marking will reflect the highest classification level in the portion.

3. (U) "CUI" will not appear in the banner line.

4. (U) All documents containing CUI, both classified and unclassified, will include a CUI designation indicator.

5. (U) All classified documents containing CUI will also include the classification authority block as shown below.

6. (S) A warning will be placed on the first page of multi-page documents alerting readers to the presence of CUI in a classified DoD document.

This content is classified at the [insert highest classification level of the source data] level and may contain elements of controlled unclassified information (CUI), unclassified, or information classified at a lower level than the overall classification displayed. This content shall not be used as a source of derivative classification; refer instead to [cite specific reference, where possible, or state "the applicable classification guide(s)"]. It must be reviewed for both Classified National Security Information (CNSI) and CUI in accordance with DoDI 5230.09 prior to public release. [Add a point of contact when needed.]

SECRET

UNCLASSIFIED

Classification markings for illustration purposes only

Instructor Note: Just a few examples of websites that can provide useful information on protecting your identity. There many, varied websites that can be accessed.

Marking CUI (Email Without Portion Markings)

Banner Line

Banner Line

Instructor Note: Just a few examples of websites that can provide useful information on protecting your identity. There many, varied websites that can be accessed.

Marking CUI (Email With Portion Markings)

Portion Markings

Instructor Note: Just a few examples of websites that can provide useful information on protecting your identity. There many, varied websites that can be accessed.

Marking CUI (Limited Dissemination Controls)

determination]. Other requests for this document shall be referred to [insert controlling DoD office].

Distribution Statement C: Distribution authorized to U.S. Government agencies and their contractors [fill in reason and date of determination]. Other requests for this document shall be referred to [insert controlling DoD office].

Distribution Statement D: Distribution authorized to Department of defense and U.S. DoD contractors only [insert reason and date of determination]. Other requests for this document shall be referred to [insert controlling DoD office].

Distribution Statement E: Distribution authorized to DoD Components only [fill in reason and date of determination]. Other requests shall be referred to [insert controlling DoD office].

Distribution Statement F: Further dissemination only as directed by [insert controlling DoD office and date of determination] or higher DoD authority.

Distribution X *

* U.S. Government agencies and private individuals or enterprises eligible to obtain export controlled technical data in accordance with DoDD 5230.25. Distribution Statement X was cancelled and superseded by Distribution Statement C.

Instructor Note: Just a few examples of websites that can provide useful information on protecting your identity. There many, varied websites that can be accessed.

Protecting CUI

Work Hours: Take steps to minimize risk of unauthorized access.

Control entry into areas with CUI Clear desks when taking breaks After Work hours: Locked desks, cabinets unless building security provided.

Encrypt CUI emails Do not post CUI to public websites Shred or place CUI in a lockable recycle bin

Instructor Note: Just a few examples of websites that can provide useful information on protecting your identity. There many, varied websites that can be accessed.

Shipping or Mailing

Sending CUI, authorized holders:

May use United States Postal Service or any commercial delivery service when transport or delivery of CUI to another entity is required;

Should use in-transit automated tracking and accountability tools when sending CUI;

May use interoffice or interagency mail systems to transport CUI; and Must mark packages containing CUI according to marking requirements

Instructor Note: Just a few examples of websites that can provide useful information on protecting your identity. There many, varied websites that can be accessed.

Reproduction

May reproduce (e.g., copy, scan, print, electronically duplicate) CUI in furtherance of a lawful Government purpose; and Must ensure, equipment (e.g., printers, copiers, scanners, fax machines) used to reproduce CUI does not retain data or the agency must sanitize it in accordance with NIST SP 800-53.

Instructor Note: Just a few examples of websites that can provide useful information on protecting your identity. There many, varied websites that can be accessed.

Destruction

May be destroyed after documents and materials are formally reviewed and approved disposition authorities have been applied Must be destroyed in a manner that makes it unreadable, indecipherable, and irrecoverable.

Must use destruction methods specifically required by law, regulation, or Government-wide policy for that CUI. If authority does not specify a destruction method, one of the following methods must be used:

Guidance for destruction in NIST SP 800-53, and NIST SP 800-88; or Any method of destruction approved for Classified Information, Destruction, or any implementing or successor guidance.

Instructor Note: Just a few examples of websites that can provide useful information on protecting your identity. There many, varied websites that can be accessed.

Unauthorized Disclosure (UD)

UD of certain CUI, such as export controlled-technical data, may result in potential civil and criminal sanctions

Instructor Note: Just a few examples of websites that can provide useful information on protecting your identity. There many, varied websites that can be accessed.

Reporting Violations

Report violations to supervisor, commander and/or security manager Unit will then take steps to mitigate damage and report violation to the appropriate agencies

Instructor Note: Just a few examples of websites that can provide useful information on protecting your identity. There many, varied websites that can be accessed.

image4.jpeg image5.png image6.png image7.png image8.png image9.emf image1.jpeg image2.png image3.jpeg