Addendum_2__RAP_DD254__UNCLASS.docx

Addendum 2 to DD Form 254, Page 1 of 2 Solicitation/Contract:

Contract Expiration Date:

CONTROLLED UNCLASSIFIED INFORMATION ADDENDUM

General: There are types of information that are not classified but require application of access and distribution controls and protective measures developed for DoD Controlled Unclassified Information for a variety of reasons. The types of CUI identified for the program are For Official Use Only (FOUO), Law Enforcement Sensitive (LES), DoD Unclassified Controlled Nuclear Information (DoD UCNI), and LIMITED DISTRIBUTION as well as some of those developed by other Executive Branch agencies of the U.S. Government and technical data described below as well as protective measures for CUI material.

For Official Use Only (FOUO) Information Description: Is a Government protective marking/caveat designation applied to unclassified information that may be exempt from mandatory release to the public because of foreseeable harm to an interest protected by the Freedom of Information Act (FOIA), as implemented by DoD 5400.7-R and/or the Privacy Act of 1974, as amended.

Law Enforcement Sensitive (LES): A marking sometimes applied, in addition to the marking “FOR OFFICIAL USE ONLY,” by the Department of Justice and other activities in the law enforcement community, including those within the Department of Defense to denote that the information was compiled for law enforcement purposes and should be afforded security in order to protect certain legitimate government interests. Procedures can be found in DoDM 5200.01-V4, Enclosure 3.

DoD Unclassified Controlled Nuclear Information (DoD UCNI): Unclassified information on security measures (including security plans, procedures, and equipment) for the physical protection of DoD Special Nuclear Material (SNM), SNM equipment, SNM facilities, or nuclear weapons in DoD custody. Information is designated DoD UCNI in accordance with DoDD 5210.83.

LIMITED DISTRIBUTION: Caveat used by the National Geospatial-Intelligence Agency (NGA) to identify a select group of sensitive, unclassified imagery or geospatial information and data created or distributed by NGA or information, data, and products derived from such information. DoDI 5030.59 contains details of policies and procedures.

Technical Data Description: Any recorded information related to experimental, developmental, or engineering works that can be used to define an engineering or manufacturing process, or can be used to design, procure, produce, support, maintain, operate, repair, or overhaul program material. The data may be graphic or pictorial delineations in media (e.g., computer software, drawings, photographs, etc.), text in specifications, related performance or design documents, or computer printouts. Examples of technical data include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, related information, and computer software documentation. The DoD Scientific and Technical Information Program (see DoDI 3200.12.

CUI Markings: Prescribed marking of CUI documents will be in accordance with DoDM 5200.01-Vol 4. CUI may also be identified in security classification guides to ensure the information receives appropriate protection.

Addendum 2 to DD Form 254, Page 2 of 2 Solicitation/Contract:

Contract Expiration Date:

Access: CUI may be released to an individual who has a valid need for such access within the scope of their assigned duties, furthering the accomplishment of a lawful and authorized government purpose and would not be detrimental to the interests of the DoD or U.S. Government. Information in any media format will be disseminated on a need-to-know basis. This restricts the use or dissemination of CUI data to those with direct affiliation with the given program/project to conduct official business for the DoD, provided that dissemination is consistent with any further controls imposed by a distribution statement. Personnel no longer requiring access to CUI must surrender any information in their possession to the program lead, who will take action to terminate further access.

Storing and Handling: During working hours, take reasonable steps to minimize the risk of access to CUI by unauthorized personnel (e.g., not reading, discussing, leaving FOUO information unattended where unauthorized personnel are present or display CUI in public places to include the internet). After working hours, store CUI information in locked desks, file cabinets, bookcases, locked rooms, locked/controlled e-files or similar means to prevent theft of program information. Computers used to process CUI do not need to be accredited for classified use. Do not process CUI on public computers (e.g., those available to the public in kiosks, hotels, café’s, etc.) or computers that do not have Public Key Infrastructure (PKI) access controls. Personally owned computers are not authorized to process CUI. Authorized electronic devices provided by the government agency (e.g., laptops, cell phone) used to store CUI must be physically protected and use NIST/NIAP-approved cryptographic products, e.g., DoD approved PKI Certification available at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/cryptval/, which require encryption passcodes to teleconferences/web conferences where CUI may be discussed.

Dissemination: CUI printed documents and material may be transmitted through mail channels or hand-carried without formal courier orders. CUI information may be disseminated to DoD personnel and DoD contractors to conduct official business for the program. If dissemination is required outside of DoD channels contact the program lead, contracting officer, and security manager for approval. Release of technical data will follow the release instructions identified in the distribution statement. Use secure communications whenever available for discussions involving CUI. Send voice and facsimile transmissions only when authorized recipients have acknowledged positive control measures are in place to receive the information.

Destruction: CUI documents shall be disposed of according to provisions of EO 13556, CUI; DoDM 5200.01 Vol 4, DoD Information Security Program CUI; AFI 33-332. Component records management directives. Non-record FOUO documents may be destroyed by any methods that prevents compromise, e.g., tearing, burning, or shredding of the means approved for the destruction of classified information or by any other means that would make it difficult to recognize or reconstruct the information.

Reporting: Report any loss or unauthorized attempt to gain access to CUI information to the organization’s security manager immediately, but no later than the end of the first duty day. If additional information is required after initial notification, guidance will be provided at that time.