CUI Request Form and Clause - EQ8PCS-21-0068.pdf

SAFEGUARDING AND DISSEMINATION OF

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

BUILDING INFORMATION

This clause applies to all recipients of CUI building information (which falls within the CUI Physical Security category), including offerors, bidders, awardees, contractors, subcontractors, lessors, suppliers and manufacturers.

(a) Marking CUI. Contractors must submit any contractor-generated documents that contain building information to GSA for review and identification of any CUI building information. In addition, any documents GSA identifies as containing CUI building information must be marked in accordance with the GSA Order (PBS 3490.3) and the Marking Controlled Unclassified Information Handbook (the current version may be found at https://www.archives.gov/files/cui/ 20161206-cui-marking-handbook-v1-1.pdf) before the original or any copies are disseminated to any other parties. If CUI content is identified, the CO may direct the contractor, as specified elsewhere in this clause or subsequent Agreement, to imprint or affix CUI document markings (CUI) to the original documents and all copies, before any dissemination. Alternatively, authorized GSA employees may mark the documents as appropriate prior to any dissemination.

(b) Authorized recipients. Building information designated as CUI must be protected with access strictly controlled and limited to those individuals having a Lawful Government Purpose to access such information (as defined in 32 C.F.R. § 2002.4(bb)). Those with such a Lawful Government Purpose may include Federal, State, and local government entities, and nongovernmental entities engaged in the conduct of business on behalf of or with GSA. Nongovernmental entities may include architects, engineers, consultants, contractors, subcontractors, suppliers, and others submitting an offer or bid to GSA or performing work under a GSA contract or subcontract. Recipient contractors must be registered as “active” in the System for Award Management (SAM) database at www.sam.gov, and have a Lawful Government Purpose to access such information. If a subcontractor is not registered in the SAM database and has a Lawful Government Purpose to possess CUI building information in furtherance of the contract, the subcontractor must provide to the contractor its DUNS number or its tax ID number and a copy of its business license. The contractor must keep this information related to the subcontractor for the duration of the contract and subcontract.

All GSA personnel and contractors must be provided CUI building information when needed for performance of official Federal, state, and local government functions, such as for code compliance reviews and the issuance of building permits.

Public safety entities such as fire and utility departments may have a Lawful Government Purpose to access CUI building information on a case-by-case basis. This clause must not prevent or encumber the necessary dissemination of CUI building information to public safety entities.

(c) Dissemination of CUI building information:

(1) By electronic transmission. Electronic transmission of CUI information outside of the GSA firewall and network must use session encryption (or alternatively file encryption). Sessions (or files) must be encrypted consistent with the National Institute of Standards and Technology (NIST) SP 800-171. Encryption must be through an approved NIST algorithm with a valid certification, such as Advanced Encryption Standard (AES) or Triple Data Encryption Standards (3DES), in accordance with the Federal Information Processing Standards Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules, as required by GSA policy. (Not all vendors of security products that claim conformance with FIPS 140-2 have validation certificates.)

(2) By nonelectronic form or on portable electronic data storage devices. Portable electronic data storage devices include but are not limited to CDs, DVDs, and USB drives. Nonelectronic forms of CUI building information include paper documents.

(i) By mail. Utilize only methods of shipping that provide services for monitoring receipt such as track and confirm, proof of delivery, signature confirmation, or return receipt.

(ii) In person. Contractors must provide CUI building information only to authorized recipients with a Lawful Government Purpose to access such information. Further information on authorized recipients is found in section 1 of this clause.

https://www.archives.gov/files/cui/%2020161206-cui-marking-handbook-v1-1.pdf https://www.archives.gov/files/cui/%2020161206-cui-marking-handbook-v1-1.pdf http://www.sam.gov/

(3) Record Keeping. Contractors must maintain a list of all entities to which CUI is disseminated, in accordance with sections 2 and 3 of this clause. This list must include at a minimum (1) the name of the State, Federal, or local government entity or firm to which CUI has been disseminated; (2) the name of the individual at the entity or firm who is responsible for protecting the CUI building information, with access strictly controlled and limited to those individuals having a Lawful Government Purpose to access such information; (3) contact information for the named individual; and (4) a description of the CUI building information provided. Once work is completed, or for leased space with the submission of the “as built” drawings, the contractor must collect all lists maintained in accordance with this clause, including those maintained by any subcontractors and/or suppliers, and submit them to the contracting officer. For federal buildings, final payment may be withheld until the lists are received.

(d) Safeguarding CUI documents. CUI building information (both electronic and paper formats) must be stored within controlled environments that prevent unauthorized access. GSA contractors and subcontractors must not take CUI building information outside of GSA or their own facilities or networks, except as necessary for the performance of the contract. Access to the information must be limited to those with a Lawful Government Purpose for access.

(e) Destroying CUI building information. When no longer needed, CUI building information must either be returned to the CO or destroyed in accordance with guidelines in NIST Special Publication 800-88 Rev. 1, Guidelines for Media Sanitization.

(f) Notice of disposal. The contractor must notify the contracting officer that all CUI building information has been destroyed, or returned to the contracting officer, by the contractor and its subcontractors or suppliers in accordance with section (e) of this clause, with the exception of the contractor’s record copy. This notice must be submitted to the contracting officer at the completion of the contract in order to receive final payment. For leases, this notice must be submitted to the contracting officer at the completion of the lease term. For entities receiving this information as part of a solicitation or for review of a project opportunity, this notice must be submitted to the contracting officer after the award decision or business decision not to submit a proposal.

(g) Incidents. All improper disclosures of CUI building information must be immediately reported to the contracting officer at dylan.white@gsa.gov. If the contract provides for progress payments, the contracting officer may withhold approval of progress payments until the contractor provides a corrective action plan explaining how the contractor will prevent future improper disclosures of CUI building information. Progress payments may also be withheld for failure to comply with any provision of this clause until the contractor provides a written corrective action plan explaining how the contractor will rectify any noncompliance and comply with the clause in the future.

(h) Subcontracts. The Contractor must insert the substance of this clause in all subcontracts.

mailto:dylan.white@gsa.gov

REQUEST FOR CONTROLLED UNCLASSIFIED INFORMATION (CUI) BUILDING INFORMATION

Pre-Solicitation Notice ID: EQ8PCS-21-0068

Project Title: APHIS Trailer Relocation

The requester shall complete the information below and return the entire Request for Controlled Unclassified Information (CUI) Building Information document to the Contracting Officer or Contract Specialist. By signature below, the requestor of CUI building information acknowledges the requirement to maintain controls, as stated herein, to safeguard the information, and shall return or destroy the CUI building information as required by this Agreement. The undersigned acknowledges that the requester shall abide by this Agreement and shall only disseminate CUI building information to other authorized users under the conditions set forth herein.

Company Name: _____________________________________________________

Name of Individual and Title: ____________________________________________

Signature: ___________________________________________________

Date: _______________________________________________________

(The Offeror shall attach copy of business license or formation document.)

Unique Entity Identifier (UEI) Number: _______________________________

UEI Number Verified by Government Representative at:

https://beta.sam.gov/ Yes: ___ No: ___

Employer ID Number/Federal Tax ID Number _______________________________

Offeror/bidder/contractor information and UEI number has been verified and release of CUI building information is approved by:

Dylan White Date Contracting Officer https://beta.sam.gov/

DISPOSAL STATEMENT FOR CONTROLLED UNCLASSIFIED INFORMATION (CUI) BUILDING INFORMATION

Pre-Solicitation Notice ID: EQ8PCS-21-0068

Project Title: APHIS Trailer Relocation

I hereby certify that all Controlled Unclassified Information (CUI) building information relative to the referenced Notice ID and project not previously returned to the Government has been destroyed or disposed of by burning or shredding paper copies, physically destroying computer diskettes or permanently deleting/removing/erasing electronic files from computers.

I also certify the no unauthorized physical or electronic copies will be made or retained of such CUI building information.

Company Name: ______________________________________________

Name of Individual: ____________________________________________

Signature: ___________________________________________________

Title: _______________________________________________________

Date: _________________