DARPA-PS-26-10-Attachment_F-CUI_Guide.pdf

UNCLASSIFIED

Controlled Unclassified Information Guide

Program: Generative Optogenetics Program Manager: Dr. Matthew Pava

Program Security Officer: John Slawinski

Date: 11 November 2025 Version: 1

Dr. Matthew Pava Mr. John Slawinski BTO Program Manager BTO Program Security Officer ii

UNCLASSIFIED

FOREWORD

1. DESCRIPTION

2. AUTHORITY

3. DISTRIBUTION

GENERAL

1. PURPOSE

2. APPLICABILITY AND SCOPE

3. OFFICE OF PRIMARY RESPONSIBILITY

4. CONTROLLED UNCLASSIFIED INFORMATION (CUI) CHALLENGES

5. CUI CATEGORIES

6. EXPORT CONTROL RESTRICTED INFORMATION

7. DISCLOSURE OF CUI

8. CUI PROTECTION REQUIREMENTS

9. NOTIFICATION OF UNAUTHORIZED DISCLOSURE

10. INFORMATION PROTECTION GUIDANCE CHARTS

iii

FOREWORD

1. DESCRIPTION

Generative Optogenetics (GO) aims to develop a nucleic acid compiler (NAC; i.e, molecular machine) capable of creating a direct interface between computers and living cells, enabling template-free synthesis of genetic sequence information (DNA and/or RNA) within a living cell using optical signals. This innovative approach will establish a highly precise and efficient platform for controlling and engineering biological systems at the molecular level.

2. AUTHORITY

CUI elements referenced in this guide are under the authority of Executive Order 13556, Controlled Unclassified Information, November 4, 2010 (as amended) and in accordance with DoDI 5200.48, “Controlled Unclassified Information,” March 6, 2020.

3. Distribution: Approved for Public release

UNCLASSIFIED

1. PURPOSE

a. The purpose of this CUI guide is to ensure the protection of GO program information IAW DoDI 5200.48. GO information must be controlled and stored consistent with DFARS 252.204-7012 requirements as detailed in National Institute for Standards and Technology (NIST) 800-171.

b. This guide is not for classified national security information as defined in

Executive Order 13526, but identifies specific elements of sensitive information that are unclassified but require additional protections.

2. APPLICABILITY AND SCOPE:

This guide applies information, material and processes generated by GO, specifically the DNA sequence of the nucleic acid compiler (NAC). This guide is the basis for identifying, protecting and marking of information and material designated as a type of controlled unclassified information (CUI) associated with GO. This guide is used in conjunction with related guidance (security classification guides, DoD Policy, etc) associated with the overall effort of GO. The scope of this guide is based on GO as planned at the date of this guide and may change over the course of GO.

The scope of this guide encompasses all aspects of the NAC sequence development, including its design, optimization, and integration into living cell systems, and prohibits public disclosure or publication of the NAC sequence during the program. Program performers are encouraged to file patents protecting their IP, but the prohibition on disclosure of the NAC sequence limits them to filing CUI-designated patents with secrecy orders to safeguard intellectual property and prevent premature access by adversaries. This guide is designed to protect the NAC sequence until 24 months after the final program milestones are achieved, ensuring performers have adequate time to refine and optimize their technologies. After the 24-month protection period, DARPA will review the status of the technology and determine whether the CUI designation and secrecy orders on patents can be lifted. This decision will be based on the readiness of performers to transition their technologies to public domains and the assessment of risks associated with disclosure. DARPA reserves the right to extend the protection period if deemed necessary to safeguard national security or strategic interests. This strategy balances the need for innovation and optimization with the imperative to protect sensitive information, ensuring the success of the GO program while mitigating risks of exploitation by adversaries or the miss use of the technology.

DARPA encourages performers to publish their findings in scientific journals to advance the broader research community and showcase the innovative work conducted under the GO program. However, the DNA sequence of the NAC is strictly prohibited from publication until explicitly approved by DARPA. All other results generated during the program may be submitted for peer-reviewed publication but must first undergo the DISTAR process for approval

UNCLASSIFIED

to ensure compliance with program security and dissemination guidelines. Performers are required to coordinate with DARPA to ensure all publications align with CUI protections and program objectives.

A goal of the GO program is the successful commercialization of the technologies developed during the program, while ensuring the information is uncompromised. DARPA encourages performers to engage with potential investors, collaborators, and other stakeholders to explore opportunities for transitioning their innovations to the commercial sector. However, all such engagements must be coordinated with the DARPA team and the PSO in advance to ensure compliance with the CUI guide. This coordination is essential to protect sensitive program information, including the NAC sequence, and to adhere to export control regulations and dissemination guidelines. Performers must seek approval prior to sharing any program-related information with external parties to safeguard the integrity of the program and its objectives Individuals who are being briefed to CUI information must completed CUI training through https://securityawareness.dcsa.mil/cui/story.html or other U.S. Government approved CUI training program, and are required to safeguard information in accordance with DODI 5200.48.

on NIST 800-171 compliant system information is transferred to them.

3. OFFICE OF PRIMARY RESPONSIBILITY (OPR): The Office of Primary Responsibility is BTO_Security@darpa.mil.

4. CONTROLLED UNCLASSIFIED INFORMATION (CUI) CHALLENGES: CUI Challenges are directed to the OPR. Information is protected in accordance with this guide until the challenge is resolved.

a. CUI Protection Duration: The CUI designation for the DNA sequence of the NAC and related technical information will remain in effect for 24 months following the achievement of the final metric of the GO program. This timeline ensures that performers have sufficient time to optimize their inventions and protect their intellectual property before the information is made publicly accessible. During this period, performers are prohibited from publishing the NAC DNA sequence details in scientific articles, conferences, or other public forums.

b. Performers should consult with a patent attorney prior to filling patents and review the U.S. Patent Office’s https://www.uspto.gov/web/offices/pac/mpep/s120.html

c. Currently DARPA will require patents be filed under the secrecy orders for any inventions related to the NAC during the program. Filing CUI-designated, secrecy order patents ensures that sensitive information remains protected under export control and intellectual property laws, preventing premature disclosure to potential adversaries or competitors. The CUI designation for patents will remain in effect for the duration of the program and the subsequent 24-month protection period following the achievement of the final program milestones. After this period, performers may transition to public patents if approved by DARPA, ensuring that the timing of disclosure aligns with national security and program objectives.

5. CUI Categories. The following CUI Categories are used to protect GO:

https://www.archives.gov/cui/registry/category-list

a. Defense:

i. Controlled Technical Information (CTI). Controlled Technical Information means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination.

Controlled technical information is to be marked with one of the distribution statements B through F, in accordance with Department of Defense Instruction 5230.24, "Distribution Statements of Technical Documents." The term does not include information that is lawfully publicly available without restrictions. "Technical Information" means technical data or computer software, as those terms are defined in Defense Federal Acquisition Regulation Supplement clause 252.227-7013, "Rights in Technical Data - Noncommercial Items" (48 CFR 252.227-7013).

Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

b. Export Control

i. Export Controlled Research (EXPTR). Related to the systematic investigation into and study of materials and sources in order to establish facts and reach new conclusions 15 CFR 734.8(b).

c. Patent:

i. Inventions (INVENT). An invention is any art or process (way of doing or making things), machine, manufacture, design, or composition of matter, or any new and useful improvement thereof, or any variety of plant, which is or may be patentable under the patent laws of the United States, in which the federal government owns or may own a right, title, or interest.

ii. Patent Application (APP). Application for patent filed under 35 U.S.C.

111(a) that includes all types of patent applications (i.e., utility, design, plant, and reissue) except provisional applications. The nonprovisional application establishes the filing date and initiates the examination process. A nonprovisional utility patent application must include a specification, including a claim or claims; drawings, when necessary; an oath or declaration; and the prescribed filing fee.

UNCLASSIFIED

d. (U) General Proprietary Business Information (PROPIN): Material and information relating to, or associated with, a company's products, business, or activities, including but not limited to financial information; data or statements; trade secrets; product research and development; existing and future product designs and performance specifications.

6. EXPORT CONTROL RESTRICTED INFORMATION: Each performer is responsible for assessing their technology and ensuring compliance with all export control laws and regulations.

This CUI guide does not relieve any program participant from export control requirements.

7. DISCLOSURE of CUI.

a. Public Disclosure. Public Disclosure of any GO information must follow the DISTAR process. Please contact the GO OPR and Public_Release_Center@darpa.mil for additional guidance.

b. Freedom of Information Act (FOIA) Requests. All FOIA request are directed to the DARPA FOIA Office.

c. Foreign Disclosure. CUI controlled by DARPA may be shared with foreign nationals if access to such information would accomplish a lawful government purpose and would not be detrimental to national security and approved by DARPA.

d. Disclosure timeline. The CUI protections for the GO program will remain in effect throughout the program's duration and extend for 24 months following the achievement of the final metric. During this period, all sensitive information, including the DNA and amino acid sequence of the NAC, must be safeguarded under CUI guidelines. Performers are encouraged to publish non-sensitive results through the DISTAR process, but the NAC sequence and related technical details cannot be disclosed publicly without explicit approval from DARPA. After the 24-month protection period, DARPA will review the status of the program and determine whether CUI protections can be lifted, ensuring performers have adequate time to optimize their technologies and protect intellectual property before transitioning to public disclosure. See the remarks section of Section 10 of the CUI table for more detail.

Timeline Classification Actions & Restrictions Remarks Start of Phase 2 Month 13-30

Full CUI Protections

- All NAC-related information, including DNA sequences, optogenetic designs, and protein architectures, remains under full CUI protections.

- Performers may publish Phase 1 results through DISTAR approval.

- CUI patents required for inventions.

- External engagements (e.g., investors) must be coordinated with DARPA PSO.

Focus on refining molecular components and addressing technical challenges.

UNCLASSIFIED

Phase 2 Month 18-30

CUI - NAC-related information remains under CUI protections, but limited technical details (excluding DNA sequence) may be shared with approved stakeholders under CTI guidelines.

- Publications and presentations of non-sensitive results require DISTAR approval.

- CUI patents remain mandatory.

Focus on advanced in vivo demonstrations and NAC refinement.

Phase 2 Month 30-42

CUI - Performers may request DARPA approval to transition certain elements of NAC-related information (excluding DNA sequence) to public disclosure.

- NAC DNA sequence remains under CUI protections until 24 months after final milestones.

- CUI patents may transition to public patents with DARPA approval.

In vivo demonstrations and preparation for commercialization.

Post Phase 2 (Month 66)

Decontrol - CUI protections on NAC DNA sequence and related information may be lifted, subject to DARPA approval.

- Performers must ensure compliance with export control regulations and national security guidelines.

DARPA reserves the right to extend CUI protections if necessary.

8. CUI PROTECTION REQUIREMENTS and Science and Technology Program Protection Implementation Plan: GO CUI must be stored in accordance with DODI 5200.48. Processing of CUI is only authorized on systems compliant with DFARS 252.204-7012 as detailed in NIST 800-171.

A Science & Technology Protection Implementation Plan (S&TPIP) must be approved by the PM & PSO that demonstrates the ability to do the task listed prior to any work being done. This will be a deliverable during Phase 1 of the program. DARPA will provide the template and guidance for completing the plan upon award.

9. UNAUTHORIZED DISCLOSURE

a. Personnel must immediately report all unauthorized disclosures or suspected and known security incidents, and suspicious activities involving CUI to the GO PSO and PSR at BTO_Security@darpa.mil

b. Data breaches of Defense Industrial Base (DIB) networks and systems involving

GO CUI material must be reported IAW DFARS 252.204-7012 requirements. In addition, all breaches must be reported to the DARPA Project contracting officer and program security officer (PSO) upon discovery.

UNCLASSIFIED

10. INFORMATION PROTECTION GUIDANCE CHARTS

These charts are provided to assist in identifying what types of information associated with the GO program effort may be sensitive, provide guidance on the relevant markings for this information to control dissemination, and provide guidance on when these dissemination controls no longer apply. If at any time there are questions regarding which category of information something falls under, or what dissemination controls apply, individuals should request guidance from Biological Technology Office (BTO).

Element of Information

Index Category Reason LDC or Distribution Statement

Remarks

Individual molecular components (e.g.

optogenetic domains, opto-gated polymerase, and error mitigation mechanisms) prior to integration unless protected elsewhere in this chart.

N/A N/A N/A N/A UNCLASSIFIED

All NAC-related information, including DNA sequences, optogenetic designs, and protein architectures when results NAC demonstrate synthesis of ≥1.5 kb-long nucleic acid sequence

Export Control

Defense

Export Controlled Research (EXPT)

Controlled Technical Information (CTI)

15 CFR 734.8(b)

DFARS

252.204.7012 and DoDI 5230.24

DISTRO C The CUI designation will be considered for decontrol 24 months after completion of the program.

DARPA reserves the right to extend CUI protections if necessary.

UNCLASSIFIED

Detailed NAC-related information, including DNA sequences, optogenetic designs, and protein architectures when results of NAC demonstrate in vitro or in vivo synthesis of <1.5 kb-long nucleic acid sequence of arbitrarily defined sequences containing at least 2 different bases

Export Control

Defense

Export Controlled Research (EXPT)

Controlled Technical Information (CTI)

15 CFR 734.8(b)

DFARS

252.204.7012 and DoDI 5230.24

DISTRO C The CUI designation will be considered for decontrol after peer review of research, and is ready to be submitted for publication.

DARPA reserves the right to extend CUI protections if necessary.

Integrated error mitigation process when demonstrated in vivo or in vitro to reduce error by ≥10x in terms of either error/bp or the fraction of sequences synthesized containing errors

Export Control

Defense

Export Controlled Research (EXPT)

Controlled Technical Information (CTI)

15 CFR 734.8(b)

DFARS

252.204.7012 and DoDI 5230.24

DISTRO C The CUI designation will be considered for decontrol after peer review of research, and ready is ready to be submitted for publication

DARPA reserves the right to extend CUI protections if necessary.

Results when information is not protected elsewhere in this guide are disclosed

N/A N/A N/A N/A UNCLASSIFIED

UNCLASSIFIED

General explanation of the technology and design when details protected elsewhere in the guide are not disclose

N/A N/A N/A N/A UNCLASSIFIED

Non-public data controlled by the business or individual as proprietary

Proprietary Business

General Proprietary Business

(PROPIN)

18 USC 1905

29 USC 664

Federal Employees and

Contractors Only

(FEDCON)

DARPA will protect all PROPIN as CUI. Performers are NOT REQUIRED to protect their PROPIN a CUI

Inventions and Patent applications

Patent applications

Inventions

APP

INVENT

35 USC 186

35 USC 187

35 USC 205

35 USC 205

48 CFR 27.305-4

37 CFR

401.13(c)(1)

37 CFR

401.13(c)(3)-(5)

Federal Employees and

Contractors Only

(FEDCON)

DARPA will protect all patents applications and invention information as CUI. Performers are NOT REQUIRED to protect these as CUI unless the information is protected elsewhere within the CUI Guide