CUI Attachment A.pdf

This document is Attachment A to a federal contract, providing guidelines for handling Controlled Unclassified Information (CUI). It establishes requirements for protecting U.S. Government technical information and data that requires access and distribution controls but is not classified under Executive Order 13526.

The attachment defines three categories of information: Technical Information (recorded data related to experimental, developmental, or engineering works including specifications, drawings, and software documentation); CUI Information (unclassified information requiring safeguarding per applicable law and regulations but not classified); and CUI Markings (which must follow DoD 5200.48 standards). All contractors receiving, storing, or generating CUI must complete DoD Mandatory CUI training and maintain initial and annual refresher training. Access to CUI is restricted to individuals with a valid need for accomplishment of lawful, authorized Government purposes, with further dissemination at the discretion of the Government Security Manager. Storage and handling requirements mandate reasonable steps to minimize unauthorized access, including physical protection of media in locked containers and restriction of CUI from public areas and unsecured facilities. Electronic storage and processing must comply with DFARS requirements, and CUI cannot be processed on public computers or portable devices without authorization. Dissemination of CUI documents may occur through mail or commercial carriers to DoD personnel and contractors for official business, but transmission outside DoD requires Government Security Manager approval. All CUI transmission must use NIST/NIAP-approved encryption, with specific standards referenced for Public Key Infrastructure Certification and DoD Safe Exchange. The contractor must destroy or sanitize all covered defense information upon contract completion in accordance with established standards, with destruction methods required by law, regulation, or government policy. Loss of CUI must be reported to the Government Security Manager within 72 hours of discovery, including applicable dates, threat methodology, system impact, and information compromised.