CUI Attachment A.pdf

This is Attachment A, an appendix containing additional guidelines for handling Controlled Unclassified Information (CUI) in federal contracts.

The document establishes requirements for contractors who receive, store, or generate CUI material. CUI is unclassified information requiring safeguarding or dissemination controls per applicable law, regulations, and government-wide policies, but not classified under Executive Order 13526. All CUI documents must carry markings in accordance with DoD 5200.48. Access to CUI is restricted to individuals with a lawful and authorized government purpose, requiring initial training and annual refresher training through the DoD Mandatory CUI training available on the Security Awareness Hub. Personnel must sign CUI Non-disclosure Agreements prior to accessing information and must surrender or destroy access upon termination.

Storage and handling requirements mandate reasonable protection measures during working hours, including locked storage for physical media and reasonable protection against theft. Electronic storage and processing must comply with DFARS 252.204-7012. CUI must not be processed on public computers, public wireless networks, or devices lacking access control. Dissemination of CUI requires NIST/NIAP-approved encryption for digital transmission via email or file transfers, with DoD Safe Exchange or secure collaborative suites approved for use. CUI cannot be posted to publicly accessible web pages unless using DoD-approved Public Key Infrastructure Certification. When CUI is lost or compromised, contractors must report to the Government Security Manager within 72 hours, including applicable dates, threat methodology, actions taken, and information potentially compromised. The contractor must destroy or sanitize CUI from contractor-owned media per NIST guidelines and applicable destruction methods specified by law or regulation.