DARPA-PS-26-141_APM_Attachment_J_APM_CUI_Guide.pdf

DISTRIBUTION STATEMENT A: Approved for public release; distribution is unlimited.

Controlled Unclassified Information Guide

Program: Atomically Precise Molecules

Program Manager: Dr. John Hoffman

Program Security Officer: Mr. James Persons

Date: 23 September 2026 Version: 1.0

Dr. John Hoffman Mr. James Persons MXO Program Manager MXO Program Security Officer ii

FOREWORD

1. DESCRIPTION

2. AUTHORITY

3. DISTRIBUTION

GENERAL

1. PURPOSE

2. APPLICABILITY AND SCOPE

3. OFFICE OF PRIMARY RESPONSIBILITY

4. CONTROLLED UNCLASSIFIED INFORMATION (CUI) CHALLENGES

5. OPERATION SECURITY (OPSEC)

6. CUI CATEGORIES

7. FREEDOM OF INFORMATION ACT (FOIA) EXEMPT INFORMATION

8. DISCLOSURE of CUI

9. CUI PROTECTION REQUIREMENTS

10. NOTIFICATION OF UNAUTHORIZED DISCLOSURE

11. INFORMATION PROTECTION GUIDANCE CHART

iii

FOREWORD

DESCRIPTION

The Atomically Precise Molecules (APM) will redefine the speed, resolution, and power scaling performance of non-linear optics by transitioning from the fixed, immutable properties of legacy materials. Current materials, both organic and inorganic, are limited by an inability to control the identity, orientation, and composition of molecules within the material with high precision.

Programmable materials, such as Programmable Precision Polymers (PPP), overcome this limitation through synthesis approaches that enable designers to control material properties across time and length scales, from single molecules to arrangements of molecules acting together in a coordinated fashion. By mastering the high-yield synthesis of programmable materials, the DoW moves towards deploying programmable materials engineered at the molecular level to maximize the physics of electro-optic performance at sub-nanosecond switching speeds.

APM will deliver high yield programmable materials with state-of-the-art non-linear properties, including electrooptic coefficients exceeding 8000 pV/m, a gain of 2 from current state of the art organic dyes. These materials will also demonstrate low optical losses and high thermal stability.

This will be shown in a proof-of-concept demonstration by integrating them into microfabricated electro-optic modulators with bandwidth exceeding 1 THz (~10x gain in performance) and voltage-length products (VpiL) less than 0.0005 V*cm (~20x gain in performance).

Certain technologies developed under APM will be critical to the DoD. This guide identifies those aspects of the program that performers must handle as Controlled Unclassified Information (CUI).

In addition, each performer must determine and assert the export controls (either Export Administration Regulations or International Traffic in Arms Regulations) relevant to their project and communicate that assertion to their contracting agent and to the DARPA Program Manager.

AUTHORITY

CUI elements referenced in this guide are under the authority of DoDI 5200.48, “Controlled Unclassified Information,” March 6, 2020.

DISTRIBUTION

Distribution unlimited, approved for public release.

1. PURPOSE

The purpose of this CUI guide is to ensure the protection of APM information IAW DoDI 5200.48.

Certain program items identified in this CUI Guide will be held at CUI. APM information deemed CUI should be controlled and stored consistent with federal requirements and guidance from the National Institute for Standards and Technology (NIST). Sensitive information does not include information in the public domain.

This guide is not for classified national security information as defined in Executive Order 13526, but identifies specific elements of sensitive information that are unclassified in nature requiring protection. This information is not classified national security information, but it is covered by the legislation at large for the Freedom of Information Act (FOIA) and the exemptions therein.

2. APPLICABILITY AND SCOPE

This guide applies to all DARPA personnel, support contractors, mission partners, and industrial performers who support APM. This guide should be cited as the basis for identifying, protecting and marking of information and material designated as a type of controlled unclassified information (CUI) associated with APM. As defined at 32 CFR Section 2002.4(h), CUI is information that the government creates or possesses – or that an entity creates or possesses on behalf of the government that law, regulation or government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. It is to be used in conjunction with related security classification guides and guidance documents associated with the overall effort of APM, in compliance with Executive Orders and related DoD guidance. The scope of this guide is based on the APM program as planned at the date of this guide and may be modified as strategic decisions are made over the course of the program.

3. OFFICE OF PRIMARY RESPONSIBILITY (OPR)

This CUI guide is issued by DARPA. All inquiries concerning content, interpretations, and clarification of this document should be addressed to DARPA at MXOSecurity@darpa.mil with any questions.

4. CONTROLLED UNCLASSIFIED INFORMATION (CUI) CHALLENGES

Authorized holders of CUI who, in good faith, believe that a designation of information as CUI within this guide is improper or incorrect, or who believe they have received unmarked CUI, should notify DARPA at MXOSecurity@darpa.mil. Until the challenge is resolved, the challenged CUI, including challenges to unmarked CUI, will continue to be safeguarded and disseminated at the appropriate control level indicated in the markings or presumed category.

5. OPERATIONS SECURITY (OPSEC)

OPSEC is a process that identifies and mitigates adversarial risks to our operations by looking at our operations through the eyes of our adversaries. The application of the OPSEC methodology includes identifying critical information, analyzing threats and vulnerabilities, analyzing and assessing adversarial risk, and implementing OPSEC measures that reduce this risk.

APM critical information falls under the following index of CUI:

- Defense (Controlled Technical Information)

- General Proprietary Business Information

- Export Control

6. CUI CATEGORIES

Controlled Technical Information (CTI). This category relates to technical information with military or space application that are subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Controlled technical information meeting those criteria, if disseminated, would use distribution statements B through F in accordance with DoD Instruction 5230.24, Distribution Statements on Technical Documents.

General Proprietary Business Information. General Proprietary Business Information. Material and information relating to, or associated with, a company's products, business, or activities, including but not limited to financial information; data or statements; trade secrets; product research and development; existing and future product designs and performance specifications.

Export Controlled. Unclassified information concerning certain items, commodities, technology, software, or other information whose export could reasonably be expected to adversely affect the United States national security and nonproliferation objectives. Includes dual use items; items identified in export administration regulations, international traffic in arms regulations and the munitions list; license applications; and sensitive nuclear technology information.

7. FREEDOM OF INFORMATION ACT (FOIA) EXEMPT INFORMATION

The Freedom of Information Act (FOIA), 5 U.S.C. § 552, is a federal law that defines agency records subject to public disclosure, outlines mandatory disclosure procedures, and defines nine exemptions that prohibit certain types of information from being released to the public. In addition to the FOIA, the Code of Federal Regulations (October 2016), 45 CFR § 5.31 specifies the type of information that falls under each of the nine exemptions that preclude release of information to the public under the FOIA. In accordance with 5 U.S.C. § 552(a)(8), DARPA will withhold records or information exempt from disclosure under the FOIA whenever disclosure would harm an interest protected by a FOIA exemption or disclosure is prohibited by law. The most relevant exemption for APM is listed below; however other exemptions could apply:

- Exemption 2: Internal agency rules and practices.

- Exemption 3: Information that is prohibited from disclosure by another federal law.

- Exemption 4: Trade secrets and other confidential business information.

8. DISCLOSURE OF CUI

Public Disclosure. Information from this CUI guide does not allow automatic public release of this information. DoD information requested by the media or members of the public or proposed for release to the public by DoD civilians or military personnel or their contractors will be processed in accordance with DARPA Instruction 65 and DoD Instructions 5230.09, 5230.29;

Volume 3 of DoD Manual 5200.01; and DoD Manual 5400.07, as applicable. Proposed public disclosures of unclassified information shall be submitted using the public release form located at https://www.darpa.mil/work-with-us/contract-management/public-release.

Freedom of Information Act (FOIA) Requests. All personnel with knowledge of this Project must coordinate with the DARPA MXO Program Security Officer (PSO) prior to providing a response to requests for information under the provisions of the FOIA.

Proprietary Information (PROPIN). Additional safeguards may become necessary if a contract requires the transfer of PROPIN. The holder of the information must clearly identify any and all PROPIN prior to its disclosure and release, the release will be coordinated with the PROPIN owner.

Foreign Disclosure. Disclosure of DARPA CUI to foreign nationals will be in accordance with DoD Instruction 5200.48 and the “Revised Policy on Sharing CUI with Foreign Entities.” The PSO is required to be informed of all foreign national participants.

9. CUI PROTECTION REQUIREMENTS

APM CUI (e.g., OPSEC data, proprietary business information, etc.) regardless of media or format, will be protected from disclosure to unauthorized persons or groups, by properly storing in locked offices, cabinets, and drawers in accordance with DoDI 5200.48.

CUI may only be processed on systems that are compliant with DFARS 252.204-7012 requirements as detailed in NIST 800-171.

10. NOTIFICATION OF UNAUTHORIZED DISCLOSURE

Personnel must immediately report all unauthorized disclosures or suspected and known security incidents, privacy breaches, and suspicious activities involving CUI to the APM PSO and PSR at james.persons@darpa.mil and robert.shearer.ctr@darpa.mil

Data breaches of DIB networks and systems involving APM CUI material must be reported IAW DFARS 252.204-7012 requirements. In addition, all breaches must be reported to the DARPA Project Contracting Officer and MXO PSO upon discovery.

https://www.darpa.mil/work-with-us/contract-management/public-release

11. INFORMATION PROTECTION GUIDANCE CHART

These charts are provided to assist in identifying what types of information associated with the APM program may be sensitive, provide guidance on the relevant markings for this information to control dissemination, and provide guidance on when these dissemination controls no longer apply. If at any time there are questions regarding which category of information something falls under, or what dissemination controls apply, individuals should request guidance from DARPA at MXOSecurity@darpa.mil.

Element of Information Index Category Reason LDC or Distribution Statement Remarks

Synthesis and modeling processes of PPPs with non-linear optical properties, scale up process integration, and performance data applicable in next-generation military systems is protected as CUI and may be CTI.

Defense Controlled Technical Information

(CTI)

Executive Order#14104 - Federal Research & Development in Support of Domestic Manufacturing and US Jobs dated 28 July 2023

Distribution statements B through F

FOIA

Exemptions 4 & 3 may be applicable

Data contractually identified as controlled by a business or individual as proprietary.

Proprietary Business Information

General Proprietary Business Information

(PROPIN)

18 U.S. Code § 1905

18 U.S. Code § 664

Federal Employees and Contractors Only (FEDCON)

FOIA

Exemption 3 may be applicable

Information or data defined within the Commerce Control List (CCL), United States Munitions List (USML), or applied license applications to control export.

Export Control

Export Controlled

10 USC 130(a), 13 USC 301(g), 42 USC 2077(a), 42 USC 2156, 42 USC

2168(a), 50 USC 4614(c), 50 USC 4605(l)(5), 15

CFR 718.3, 15 CFR 736

Supplement 2, 15 CFR 748.1(c), 15 CFR 760.5(c)

15 CFR 772.1, 15 CFR

774 Supplement 1, 15 CFR 774 Supplement 2, 22 CFR Part 120, 22 CFR 124.9(a)(5), 22 CFR 126.10(b), 32 CFR 250.4(a), 32 CFR 250.9

DISTRIBUTION

STATEMENT D.

Distribution authorized to the Department of Defense and U.S. DoD contractors only Export Controlled, (Date). Other requests shall be referred to DARPA, Microsystems Technology Office.

FOIA

Exemptions 4 & 3 may be applicable