QBI_CUI_Guide.pdf

Distribution Statement A. Approved for public release: distribution is unlimited.

i

Controlled Unclassified Information (CUI) Guide

Program: Quantum Benchmarking Initiative (QBI) Program Manager: Joseph Altepeter, Ph.D.

Program Security Officer: James Persons

Date: June 11, 2025 Version: 1.0

Joseph Altepeter, Ph.D. James Persons MTO Program Manager MTO Program Security Officer ii

FOREWORD

1. DESCRIPTION

2. AUTHORITY

3. DISTRIBUTION

GENERAL

1. PURPOSE

2. APPLICABILITY AND SCOPE

3. OFFICE OF PRIMARY RESPONSIBILITY

4. CONTROLLED UNCLASSIFIED INFORAMTION (CUI) CHALLENGES

5. OPERATION SECURITY (OPSEC)

6. CUI CATEGORIES

7. EXPORT CONTROL RESTRICTED INFORMATION

8. FREEDOM OF INFORMATION ACT (FOIA) EXEMPT INFORMATION

9. DISCLOSURE OF CUI

10. CUI PROTECTION REQUIREMENTS

11. NOTIFICATION OF UNAUTHORIZED DISCLOSURE

12. HORIZONTAL SECURITY PROTECTION

13. INFORMATION PROTECTION GUIDANCE CHARTS

14. ADDITIONAL INFORMATION PROTECTION GUIDANCE

iii

FOREWORD

1. DESCRIPTION

DARPA’s Quantum Benchmarking Initiative (QBI) aims to determine if it is possible to build an industrially useful quantum computer much faster than conventional predictions.

Specifically, QBI is designed to rigorously verify and validate if any quantum computing approach can achieve utility-scale operation — meaning its computational value exceeds its cost

— by the year 2033.

The Quantum Benchmarking Initiative is an expansion of the existing DARPA

Underexplored Systems for Utility-Scale Quantum Computing (US2QC). It is a multi-stage approach to provide third-party verification and validation of an organization’s path to a utility-scale quantum computer. QBI will also communicate the results of this verification and validation effort to other U.S. government stakeholders.

2. AUTHORITY

CUI elements referenced in this guide are under the authority of DoDI 5200.48, “Controlled Unclassified Information,” March 6, 2020.

3. DISTRIBUTION

1. PURPOSE

a. The purpose of this CUI guide is to ensure the protection of QBI information in accordance with Department of Defense Instruction (DoDI) 5200.48. QBI information should be controlled and stored consistent with federal requirements and guidance from the National Institute for Standards and Technology (NIST). Sensitive information does not include information in the public domain.

b. This guide is not for classified national security information as defined in Executive

Order 13526, but identifies specific elements of sensitive information that are unclassified in nature requiring protection. This information is not classified national security information, but it is covered by the legislation at large for the Freedom of Information Act (FOIA) and the exemptions therein. Certain technologies developed or proposed by performers could fall under 48 CFR 252.227-7013, Controlled Technical Information.

2. APPLICABILITY AND SCOPE

This guide applies to all DARPA personnel, support contractors, mission partners, and performers who support the QBI program. This guide should be cited as the basis for identifying, protecting and marking of information and material designated as a type of controlled unclassified information (CUI) associated with the QBI program. As defined at 32 CFR Section 2002.4(h), CUI is information that the government creates or possesses – or that an entity creates or possesses on behalf of the government that law, regulation or government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. It is to be used in conjunction with related security classification guides and guidance documents associated with the overall effort of QBI, in compliance with Executive Orders and related DoD guidance. The scope of this guide is based on the QBI program as planned at the date of this guide, and may expand or change as strategic decisions are made over the course of the QBI program.

3. OFFICE OF PRIMARY RESPONSIBILITY (OPR)

This CUI guide is issued by DARPA. All inquiries concerning content, interpretations, and clarification of this document should be addressed to DARPA at MTO_Security@darpa.mil with any questions.

4. CONTROLLED UNCLASSIFIED INFORMATION (CUI) CHALLENGES

CUI Challenges: Authorized holders of CUI who, in good faith, believe that a designation of information as CUI within this guide is improper or incorrect, or who believe they have received unmarked CUI, should notify the DARPA QBI Program Manager. Until the challenge is resolved, the challenged CUI, including challenges to unmarked CUI, will continue to be safeguarded and disseminated at the appropriate control level as indicated by the markings or presumed category on the document.

5. OPERATIONS SECURITY (OPSEC)

a. OPSEC is a process that identifies and mitigates adversarial risk to our operations by looking at our operations through the eyes of our adversaries. The application of the OPSEC methodology includes identifying critical information, analyzing threats and vulnerabilities, analyzing and assessing adversarial risk, and implementing OPSEC measures that reduce this risk.

b. QBI critical information falls under the following indices of CUI:

1) Defense

2) Export Control

3) Financial

4) Proprietary Business Information

5) Provisional

6) Intelligence

7) Procurement and Acquisition

6. CUI Categories

a. Defense: Controlled Technical Information (CTI). This category relates to technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Controlled technical information would meet those criteria, if disseminated, for distribution statements B through F using the criteria set forth in DoDI 5230.24, Distribution Statements on Technical Documents.

b. Export Control: Export Controlled (EXPT). Unclassified information concerning certain items, commodities, technology, software, or other information whose export could reasonably be expected to adversely affect the United States national security and nonproliferation objectives. To include dual use items; items identified in export administration regulations, international traffic in arms regulations and the munitions list; license applications; and sensitive nuclear technology information. This category relates to the systematic investigation into and study of materials and sources in order to establish facts and reach new conclusions.

c. Financial: Budget (BUDG). Related to information concerning the federal budget, including authorizations and estimates of income and expenditures.

d. Proprietary Business Information: General Proprietary Business Information (PROPIN). Material and information relating to, or associated with, a company's products, business, or activities, including but not limited to financial information; data or statements; trade secrets; product research and development; existing and future product designs and performance specifications.

1) QBI utilizes a program-unique system for marking PROPIN, subdividing each performer’s individual PROPIN into Categories.

(a) Category 1: data is limited to Government Employees and Authorized Government Support Contractors.

(b) Category 2: data is limited to DARPA Employees, DARPA Support Contractors, and the QBI Team. For further details on QBI PROPIN Categories, refer to the QBI Proprietary Marking Reference guide dated May 2025.

e. Operations Security (OPSEC). Critical information determined to give evidence of the planning and execution of sensitive (frequently classified) government activities after going through a formal systematic vetting process in accordance with National Security Presidential Memorandum Number 28. This process identifies unclassified information that must be protected. It almost always results from an agency’s official OPSEC program or is otherwise commonly approved for use by the CUI Senior Agency Official.

f. Source Selection (SSEL). The formal process of evaluating competitive proposals in accordance with policies, procedures, and criteria to enter into a procurement contract.

Includes information prepared for use for the purpose of evaluating a bid or proposal to enter into an agency procurement contract, if that information has not been previously made available to the public or disclosed publicly.

g. General Procurement and Acquisition (PROCURE). Material and information relating to, or associated with, the acquisition and procurement of goods and services, including but not limited to, cost or pricing data, contract information, indirect costs and direct labor rates.

7. EXPORT CONTROL RESTRICTED INFORMATION

Program material may contain technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751, et seq.) or the Export Administration Act of 1979 (Title 50, U.S.C., App. 2401 et seq.), as amended. Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DoD Directive 5230.25.

8. FREEDOM OF INFORMATION ACT (FOIA) EXEMPT INFORMATION

a. The Freedom of Information Act (FOIA), 5 U.S.C. § 552, is a federal law that defines agency records subject to public disclosure, outlines mandatory disclosure procedures, and defines nine exemptions that prohibit certain types of information from being released to the public. In addition to the FOIA, the Code of Federal Regulations (October 2016), 45 CFR § 5.31 specifies the type of information that falls under each of the nine exemptions that preclude release of information to the public under the FOIA. In accordance with 5 U.S.C. § 552(a)(8), DARPA will withhold records or information exempt from disclosure under the FOIA whenever disclosure would harm an interest protected by a FOIA exemption or disclosure is prohibited by law. The most relevant exemptions for QBI are listed below; however other exemptions could apply:

1) Exemption 3 – Protects information exempted from release by statute.

2) Exemption 4 – Protects trade secrets and commercial or financial information which could harm the competitive posture or business interests of a company.

3) Exemption 5 – Protects inter-agency or intra-agency memorandums or letters which would not be available by law to a party other than an agency in litigation with the agency.

9. DISCLOSURE of CUI

a. Public Disclosure. Information from this CUI guide does not allow automatic public release of this information. DoD information requested by the media or members of the public or proposed for release to the public by DoD civilians or military personnel or their contractors will be processed in accordance with DARPA Instruction 65 and DoD Instructions 5230.09, 5230.29; Volume 3 of DoD Manual 5200.01; and DoD Manual 5400.07, as applicable. Proposed public disclosures of unclassified information shall be submitted using the public release form located at https://www.darpa.mil/work-with-us/contract-management/public-release.

b. Freedom of Information Act (FOIA) Requests. All personnel with knowledge of this Project must coordinate with the DARPA PSO prior to providing a response to requests for information under the provisions of the FOIA.

c. Proprietary Information (PROPIN). Additional safeguards may become necessary if a contract requires the transfer of PROPIN. Handling of QBI Performer data may be subject to additional restrictions described in the Other Transactions Agreement with that Performer. The holder of the information must clearly identify any and all PROPIN prior to its disclosure and release, the release will be coordinated with the PROPIN owner.

https://www.darpa.mil/work-with-us/contract-management/public-release

d. Foreign Disclosure. CUI controlled by DARPA, as part of a DARPA funded project, may be shared with a U.S. organization’s (i.e., the U.S. defense industry base (DIB), U.S.

academia, or U.S. research institutions) and non-U.S. citizen employees of those U.S.

organizations under specific conditions:

(1) CUI controlled by DARPA, to include CUI marked NOFORN or EXPORT CONTROLLED, may be disclosed to U.S. Persons if they are a performer on a DARPA S&T proposal team or, if they are a performer who has been awarded a DARPA S&T project. A U.S.

Person is a person who is a lawful permanent resident of the United States or who is a protected individual as defined by 8 U.S.C. 1101(a)(20) or 8 U.S.C.1324b(a)(3).

(2) CUI that is NOFORN may be shared with U.S. Persons, but will not be provided, in any form, to foreign governments (including coalition partners), international organizations, foreign nationals, or other non-U.S. persons without the originator’s approval in accordance with E.O.s 13526 and 13556.”

(3) CUI may be disclosed to a foreign person employed by U.S. organizations if:

(a) They are operating under a formally issued solicitation or awarded DARPA S&T project that clearly defines the U.S. organization’s responsibilities to comply with DoD CUI policies and procedures as detailed in either DoD 5200.48, DFARS 252.204-7012, 7019, and 7020, or similarly acceptable guidance and direction, OR

(b) Access to such information would help accomplish a lawful and authorized DoD mission or purpose and would not be detrimental to the interests of the DoD or the U.S.

Government.

AND all of the following conditions exist:

(c) The CUI is not NOFORN.

(d) The Export Controlled information follows the laws and regulations in Section 7

(e) Access to such information is within the scope of their assigned duties.

(f) The performer notifies the DARPA PSO of who the foreign person is and what they will be working on.

10. CUI PROTECTION REQUIREMENTS

a. QBI program CUI (defined in Section 13) regardless of media or format, will be protected from disclosure to unauthorized persons or groups, by properly storing in locked offices, cabinets, and drawers in accordance with DoDI 5200.48.

b. CUI may only be processed on information systems that are compliant with DFARS 252.204-7012 requirements as detailed in NIST 800-171.

11. NOTIFICATION OF UNAUTHORIZED DISCLOSURE

c. Personnel must immediately report all unauthorized disclosures or suspected and known security incidents, privacy breaches, and suspicious activities involving CUI to the QBI PSO and PSR at MTO_Security@darpa.mil.

d. Data breaches of information networks and systems involving QBI CUI material must be reported in accordance with DFARS 252.204-7012 requirements. In addition, all breaches must be reported to the DARPA QBI Program Manager, Contracting Officer, and Program Security Officer (PSO) upon discovery.

12. HORIZONTAL SECURITY PROTECTION

a. The following results were derived from relevant security classification guides through the course of horizontal security protection research.

• DARPA-CG-1137, “The Fault Tolerant Quantum Computing (FTQC) Security Classification Guide”

13. INFORMATION PROTECTION GUIDANCE CHARTS

The following table is provided to assist in identifying what types of information associated with the QBI effort may be sensitive, provide guidance on the relevant markings for this information to control dissemination, and provide guidance on when these dissemination controls no longer apply. If at any time there are questions regarding which category of information something falls under, or what dissemination controls apply, individuals should request guidance from the DARPA QBI Program Manager.

Element of Information Index Category Reason LDC, Distribution Statement, or Marking Guidance

Remarks

Pre-decisional program or proposed budget/financial information. Disclosure, protection, and marking of contractor bid or proposal information and source selection information

Procurement and Acquisition

Source Selection

(SSEL)

FAR 2.101 and 3.104

Source Selection Information – Distribution with Agreements Officer’s authorization only

FOIA

Exemption 5 may be applicable

Program planning, programming, and budgeting, including financial plans by fiscal year and budget

Financial Budget

(BUDG)

FAR 2.101 and 3.104

Federal Employees and Contractors Only

(FEDCON)

Material and information relating to, or associated with, the acquisition and procurement of goods and services, including but not limited to, cost or pricing data, contract information, indirect costs and direct labor rates

Procurement and Acquisition

General Procurement and Acquisition

(PROCURE)

FAR 2.101 and 3.104

Federal Employees and Contractors Only

(FEDCON)

Element of Information Index Category Reason LDC, Distribution Statement, or Marking Guidance

Remarks

Program information that could constitute an indicator of U.S. Government intentions, capabilities, operations, or activities or otherwise threaten/compromise operations security

Intelligence Operations Security

(OPSEC)

Provisional Approval 2018-09-07

Federal Employees and Contractors Only

(FEDCON)

FOIA

Exemption 3 may be applicable

Description of any operational goals of the program or research areas as they relate to specific transition partners or mission concepts of operations with military or space applications

Defense Controlled Technical Information

(CTI)

DFARS

252.204.7012 and DoDI 5230.24

Distribution Statement C

FOIA

Exemption 3 may be applicable

Technical conclusions, data, or software results created by DARPA or Government-side partners based on analysis of performer data that contain intellectual property enhancements

Defense Controlled Technical Information

(CTI)

DFARS

252.204.7012 and DoDI 5230.24

Distribution Statement C, plus proprietary markings for each performer as appropriate

FOIA

Exemption 4 may be applicable

Documents that contain proprietary information from a single program performer, but do not contain any other CUI elements in this table

Proprietary Business Information

General Proprietary Business Information

(PROPIN)

DFARS

252.204-7000

DFARS 252-

227.7025

Use QBI markings, including legends specified in the Other Transaction Agreement for that performer, as

FOIA

Exemption 4 may be applicable described in the QBI Marking Guide

Element of Information Index Category Reason LDC, Distribution Statement, or Marking Guidance

Remarks

Documents that contain proprietary information from a single program performer, plus specialized export control markings specified for that performer, but do not contain any other CUI elements in this table

Proprietary Business Information and Export Control

General Proprietary Business Information

(PROPIN)

and Export Controlled

(EXPT)

DFARS

252.204-7000

DFARS 252-

227.7025

Use QBI markings, including legends specified in the Other Transaction Agreement for that performer, as described in the QBI Marking Guide.

In addition, add specialized markings describing export control restrictions specific to that performer.

FOIA

Exemption 4 may be applicable

Documents that contain proprietary information from more than one program performer

Proprietary Business Information

General Proprietary Business Information

(PROPIN)

DFARS

252.204-7000

DFARS 252-

227.7025

Distribution:

Use the most restrictive distribution among the legends specified in the Other Transaction Agreements for all included performers’ data

Marking:

Include all legends specified in the Other

FOIA

Exemption 4

Transaction Agreements for all included performers

Element of Information Index Category Reason LDC, Distribution Statement, or Marking Guidance

Remarks

Documents that contain proprietary information from more than one program performer, plus unclassified information concerning certain items, commodities, technology, software, or other information whose export could reasonably be expected to adversely affect the United States national security and nonproliferation objectives.

To include dual use items;

items identified in export administration regulations, international traffic in arms regulations (ITAR) and the munitions list; license applications; and sensitive nuclear technology information.

Export Control

Export Controlled

(EXPT)

15 CFR

734.8(b)

Distribution Statement C, plus Export Control Warning Notice

FOIA

Exemption 3

14. ADDITIONAL INFORMATION PROTECTION GUIDANCE

a. QBI performers operate under Other Transaction agreements or Contracts that may describe how proprietary data is handled. In each case, the Agreement is the superseding document.

b. Access to specific performer data may be subject to restrictions as specified in the Agreement (e.g., the individual must be covered by the appropriate DFARS clause or has signed a non-disclosure agreement).

c. When performer proprietary information is identified and marked by the performer using restrictive legends as specified in the individual Agreement, these proprietary labels must be retained on all documents containing such proprietary information.

d. Documents containing only one performer’s proprietary information but not containing other types of CUI information described in Section 13 are considered CUI, but have QBI-program-specific handling requirements, as described below:

1. When communicating with performer organizations, documents containing that performer’s proprietary information that are intended to be shared with the performer will not be labeled as CUI data when stored on Government-side information systems, when stored on performer-side information systems, and when transmitted to the performer.

2. This includes both documents originally delivered from the performer and Government-generated documents containing only that performer’s proprietary information (but not containing other types of CUI data defined by the table in Section 13).

3. Documents must be handled using normal CUI methods, e.g., transmitted via encrypted methods. The QBI program Box implementation is the preferred method of storing and transmitting documents, but other secure transmission methods may be used, encrypted email, encrypted zip files, or DoD SAFE.

4. All such documents must contain the restrictive legends as specified in the individual Agreement. Please contact the DARPA QBI program team for this marking information.

5. When possible, these documents must be affixed with a QBI Proprietary cover sheet to help Government-side personnel to recognize QBI information. This cover sheet serves as a reminder of the need for careful handling.

6. For data where adding the cover sheet is not practical (e.g., Microsoft Teams recordings, source code) a similar warning should be applied so that all recipients understand the information is marked correctly and protected from unauthorized disclosure.

e. Documents determined to be CUI by meeting one of the other CUI criteria in Section 13 must be handled and marked as CUI documents.

1. Documents must bear full CUI markings, including headers, footers, and CUI indicator block. Portion markings are not required. Marking guidance is supplied in a separate QBI Marking Guidance document.

2. Any QBI CUI documents that also contain performer proprietary information must also contain the restrictive legends as specified in the individual Agreement.

e. Please see the figure below for a summary of the above discussion.