Atch_2_CUI_Block 10j_11l_FA5209-24-Q-0068_Solicitation.docx

CONTINUATION OF DD FORM 254

CONTRACTOR: TBD

SOLICITATION NUMBER: FA5209-24-Q-0068

DD Form 254 Reference Blocks 10j and 11l – CUI

ATTACHMENT # 2

CONTROLLED UNCLASSIFIED INFORMATION

1. CONTROLLED UNCLASSIFIED INFORMATION (CUI):

a. The contractor shall comply with DoDI 5200.48_DAFI16-1403, Controlled Unclassified Information, DoDM 5200.01, Vol 1_AFMAN16-1404, Vol 1, Air Force Information Security Program, and DoDM 5400.07_AFMAN33-302, Freedom of Information Act (FOIA) Program. The contractor shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

b. CUI is a dissemination control applied by DoD to unclassified information the U.S. Government creates or possesses or unclassified information that an entity creates or possesses for, or on behalf of, the U.S. Government. Additionally, laws, regulations, or government-wide policies require or permit an agency to handle CUI with safeguarding, limited dissemination controls, or distribution statements.

c. The Office of the Under Secretary of Defense for Information Security (OUSD I&S) DoD CUI Program Registry (https://www.dodcui.mil/CUI-Categories-and-Abbreviations/) identifies approved CUI categories and subcategories, provides general descriptions for each category and subcategory, identifies the basis for controls, and sets out procedures for the use of CUI.

d. Use of the above markings does not mean that the information cannot be released to the public, only that it must be reviewed by the government prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions of it.

2. IDENTIFICATION MARKINGS:

a. At a minimum, CUI markings for unclassified DoD documents will include the acronym “CUI” in the banner and footer of the document.

b. If portion markings are selected, then all document subjects and titles, as well as individual sections, parts, paragraphs, or similar portions of a CUI document known to contain CUI, will be portion marked with “(CUI).” Use of the unclassified marking “(U)” as a portion marking for unclassified information within CUI documents or materials is required.

(1) There is no requirement to add the “U,” signifying unclassified, to the banner and footer as was required with the old FOUO marking (i.e., U//FOUO).

c. CUI markings in classified documents will appear in paragraphs or subparagraphs known to contain only CUI and must be portion marked with “(CUI).” “CUI” will not appear in the banner or footer of classified documents.

d. All classified documents, including legacy documents, will be reviewed for CUI and properly marked upon changes in the document’s classification level, particularly if the documents are to be completely declassified.

e. Electronically transmitted messages, including e-mail, containing CUI information shall be marked to show they contain information requiring protection.

f. When CUI information is contained in media or material (including hardware and equipment) the requirement remains to identify the information that requires protection.

3. DISSEMINATION: Contractors may disseminate CUI information to their employees and subcontractors who have a verified need-to-know for the information in connection with a classified contract.

4. STORAGE: During working hours, reasonable steps shall be taken to minimize the risk of access by unauthorized personnel. During non-working hours, CUI information may be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks is adequate when internal building security is provided during non-working hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after-hours protection of the material (i.e. stored in locked receptacles such as file cabinets, desks, or bookcases).

5. TRANSMISSION: Records containing CUI information shall be transported in a manner that prevents disclosure of the contents. When not commingled with classified information, CUI information may be sent via first-class mail or parcel post.

a. Electronically and Facsimile Transmitted Messages: Each part of electronically and facsimile transmitted messages containing CUI information shall be portion marked appropriately. Unclassified messages containing CUI information shall contain the abbreviation "CUI" before the beginning of the text. When transmitting CUI information, add CUI to the beginning of the subject line, followed by the subject. CUI attachments shall be marked with a statement similar to this one: CONTROLLED UNCLASSIFIED INFORMATION ATTACHMENT. Such messages and facsimiles shall be transmitted in accordance with approved COMSEC procedures or systems utilizing other protective measures such as public key infrastructure (PKI). Transmission by facsimile equipment is permitted, so long as cover sheets are utilized, the sending and receiving machines are verified to receive CUI information, authorized personnel are available to send and receive CUI.

b. An alternative to e-mail to is to use: DoD Safe Access File Exchange (SAFE) (supports file sizes up to 8 GB) (https://safe.apps.mil).

c. Discussion of CUI information on the telephone is authorized if necessary for the performance of this contract. Ensure need-to-know is verified prior to conversation.

6. DISPOSITION & DISCLOSURE: CUI information may be destroyed by any means approved for the destruction of classified information or by any other means that would make it difficult to recognize or reconstruct. Unauthorized disclosure of CUI information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure for further determination. The unauthorized disclosure of CUI information protected by the Privacy Act may result in criminal sanctions.

7. COVERED DEFENSE INFORMATION: The Contractor shall comply with DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (22 Dec 23). This subpart applies to contracts and subcontracts requiring contractors and subcontractors to safeguard covered defense information that resides in or transits through covered contractor information systems by applying specified network security controls. It also requires reporting cyber incidents. The subpart does not abrogate any existing contractor physical, personnel, or general administrative security operations governing the protection of unclassified DoD information, nor does it impact requirements of the National Industrial Security Program.