DD254 Attachment 4_Item_10j_CUI_Addendum.doc

Attachment 4 CONTROLLED UNCLASSIFED INFORMATION (CUI) ADDENDUM

Ref Block 10, Item j., Controlled Unclassified Information (CUI)

PRIME CONTRACT NUMBER: FA7014-20-X-XXXX

IDENTIFICATION AND PROTECTION OF CUI

1. GENERAL. In addition to classified information, certain types of unclassified information also require application of access and distribution controls and protective measures for a variety of reasons. In accordance with Reference (e), such information is referred to collectively as CUI. This enclosure identifies the controls and protective measures developed for DoD CUI (i.e., For Official Use Only (FOUO), Law Enforcement Sensitive (LES), DoD Unclassified Controlled Nuclear Information (DoD UCNI), and LIMITED DISTRIBUTION) as well as some of those developed by other Executive Branch agencies. This enclosure also addresses handling of certain foreign government information and the use of distribution statements on unclassified technical documents as a means to facilitate control, distribution, and release of such documents.

a. In accordance with Reference (b), information may not be designated CUI to:

(1) Conceal violations of law, inefficiency, or administrative error;

(2) Prevent embarrassment to a person, organization, or agency;

(3) Restrain competition; or

(4) Prevent or delay the release of information that does not require protection under statute or regulation.

b. Information shall not be designated CUI:

(1) To prevent or avoid its proper classification in accordance with the requirements of Reference (d) and Volume 1 of this Manual; or

(2) If there is significant doubt concerning the need for such designation in accordance with section 3.b of Reference (e)

c. Information that has been disclosed to the public under proper authority may not be subsequently designated or re-designated CUI.

d. The originator of a document is responsible for determining at origination whether the information may qualify for CUI status, and if so, for applying the appropriate CUI markings. However, this responsibility does not preclude competent authority (e.g., officials higher in chain of command; functional experts) from modifying the marking(s) applied or originally applying additional markings. In such cases, the originator shall be notified of the changes. Additionally, Freedom of Information Act Officers (individuals expert in section 552 of title 5, United States Code (U.S.C.) (also known as “The Freedom of Information Act” and hereinafter referred to as “FOIA” (Reference (h))) can be consulted for advice or training on the proper application of FOIA exemptions.

ENCLOSURE 3 9 DoDM 5200.01-V4, February 24, 2012

e. When CUI is to be provided to or generated by DoD contractors, the controls and protective measures to be applied shall be described in the pertinent contract documents (e.g., contract clause; statement of work; or DD Form 254, “Department of Defense Contract Security Classification Specification”). Solicitations and contracts shall use a non-disclosure of information clause that prohibits release of unclassified information to the public without approval of the contracting activity (e.g., clause 252.204-7000 of the Defense Federal Acquisition Regulation Supplement (Reference (i). The clause shall also be made applicable to subcontractors.

f. ALL DoD unclassified information MUST BE REVIEWED AND APPROVED FOR RELEASE through standard DoD Component processes before it is provided to the public (including via posting to publicly accessible websites) in accordance with DoDD 5230.09 (Reference (j)), Deputy Secretary of Defense Memorandum (Reference (k)), and other applicable regulations. Unclassified information previously approved for release to the public may be shared with any foreign government or organization.

g. Release or disclosure of CUI to foreign governments or international organizations shall be in accordance with DoDD 5230.20 (Reference (l)) and other policy and procedures that may be established by the USD(P).

h. Some CUI is export-controlled information which may additionally be protected by law, Executive order, regulation, or contract. DoD officials must pay particular attention to export control regulations and to access restrictions on each type of CUI to ensure compliance with export requirements, especially when non-U.S. citizens are assigned to or visit their organizations

i. Release or disclosure of CUI to non-U.S. citizens employed by the Department of Defense is permitted, provided access is within the scope of their assigned duties; access would further the execution of a lawful and authorized DoD mission or purpose and would not be detrimental to the interests of the Department of Defense or the U.S. Government; there are no contract restrictions prohibiting access; and the access complies with the requirements of DoDD 8500.01E (Reference (m)), DoD 5200.2-R (Reference (n)), and export control regulations, as applicable. In such cases, the non-U.S. citizen shall execute a nondisclosure agreement approved by appropriate DoD Component authorities.

j. CUI may be identified in security classification guides to ensure the information receives appropriate protection. If the security classification guide is subsequently cancelled, a separate memorandum or other guidance document may be issued to identify the declassified information, if any, that qualifies as CUI as well as any CUI previously cited in the guide.

k. For unauthorized disclosures of CUI, no formal security inquiry or investigation is required. However, appropriate management action shall be taken to fix responsibility for unauthorized disclosure of CUI whenever feasible or required by other guidance, and appropriate disciplinary action shall be taken against those responsible (see section 17 of Enclosure 3 of Volume 1 for sanctions). Unauthorized disclosure of some CUI (e.g., information protected by section 552a of Reference (h) (also known and hereinafter referred to as “The Privacy Act of

ENCLOSURE 3 10 DoDM 5200.01-V4, February 24, 2012 1974, as amended”) or export-controlled technical data) may also result in civil and criminal sanctions against responsible persons. The DoD Component that originated the CUI shall be informed of its unauthorized disclosure.

l. Controlled unclassified documents and material that constitute permanently valuable records of the Government shall be maintained and disposed of according to DoDD 5015.2 (Reference (o)). Other controlled unclassified material shall be destroyed as specified in this Volume.

m. Exceptions to the guidance provided in this Volume must be approved by the USD(I). Requests shall be sent to the Deputy Under Secretary of Defense for Intelligence and Security through command channels.