Attachment C - DoDI 5200.48 DAFI 16-1403 (CUI - Oct 21).pdf

BY ORDER OF THE SECRETARY OF DOD INSTRUCTION 5200.48_

OF THE AIR FORCE DEPARTMENT OF THE AIR FORCE

INSTRUCTION 16-1403

5 OCTOBER 2021

Operations Support

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

COMPLIANCE WITH THIS PUBLICATION IS MANDATORY

ACCESSIBILITY: Publications and forms are available for downloading or ordering on the e-Publishing web site at www.e-Publishing.af.mil.

RELEASABILITY: There are no releasability restrictions on this publication.

OPR: SAF/AAZ Certified by: SAF/AAZ

(Mr. William E. MacLure)

Supersedes: AFGM2021-16-01, 22 July 2021 Pages: 55

This Department of the Air Force publication implements guidance delineated from Air Force Policy

Directive (AFPD) 16-14, Security Enterprise Governance, and Department of Defense Instruction (DoDI)

5200.48, Controlled Unclassified Information (CUI). The DoDI is printed word-for-word in regular font, without change. The Department of the Air Force (DAF) supplement material is printed in blue font

((Added) (AF)). The publication describes DAF responsibilities under the DoDI and establishes the requirements to support the DoD Information Security Program. It applies to individuals, at all levels, who create, handle, or store CUI, including all civilian employees and uniformed members of the Regular

Air Force, the Air Force Reserve, the Air National Guard, the Civil Air Patrol when conducting missions as the official Air Force Auxiliary, United States Space Force (USSF), and contractor support personnel when stated in the contract or DD Form 254, Department of Defense Contract Security Classification

Specification, except where noted otherwise. Refer recommended changes and questions about this publication to the office of primary responsibility (OPR) listed above, using the AF Form 847, Recommendation for Change of Publication, and route through the local information protection office.

The authorities to waive wing/unit level requirements in this publication are identified with a Tier (“T-0, T-1, T-2, T-3”) number following the compliance statement. See DAFI 33-360, Publications and Forms

Management, for a description of the authorities associated with the Tier numbers. Submit requests for waivers through the chain of command to the appropriate Tier waiver approval authority, or alternately, to http://www.e-publishing.af.mil/ the requestor’s commander for non-tiered compliance items. Ensure all records generated as a result of processes prescribed in this publication adhere to Air Force Instruction 33-322, Records Management and

Information Governance Program, and are disposed in accordance with the Air Force Records

Information Management System (AFRIMS) Records Disposition Schedule (RDS).

SUMMARY OF CHANGES

This publication has been changed from a Department of the Air Force Instruction to a DAF supplement, to the Department of Defense manual. It incorporates roles and responsibilities regarding the DAF information security program oversight and implementation, and incorporates changes promulgated in Air

Force Guidance Memorandum (AFGM) 2021-16-01.

DOD INSTRUCTION 5200.48

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

Originating Component: Office of the Under Secretary of Defense for Intelligence and Security

Effective:

Releasability:

Cancels:

March 6, 2020

Cleared for public release. Available on the Directives Division Website at https://www.esd.whs.mil/DD/

DoD Manual 5200.01, Volume 4, “DoD Information Security Program:

Controlled Unclassified Information,” February 24, 2012, as amended

Approved by: Joseph D. Kernan, Under Secretary of Defense for Intelligence and

Security (USD(I&S))

Purpose: In accordance with the authority in DoD Directive (DoDD) 5143.01 and the December 22, 2010 Deputy Secretary of Defense Memorandum, this issuance:

• Establishes policy, assigns responsibilities, and prescribes procedures for CUI throughout the DoD in accordance with Executive Order (E.O.) 13556; Part 2002 of Title 32, Code of Federal

Regulations (CFR); and Defense Federal Acquisition Regulation Supplement (DFARS) Sections

252.204-7008 and 252.204-7012.

• Establishes the official DoD CUI Registry.

https://www.esd.whs.mil/DD/

TABLE OF CONTENTS

SECTION 1: GENERAL ISSUANCE INFORMATION

1.1.Applicability ………………………………………………………………………………6

1.2. Policy ……………………………………………………………………………………..6

SECTION 2: RESPONSIBILITIES………………………..…………………………………...8

2.1. USD (I&S) ………………………………………………………………………………8

2.2. Director for Defense Intelligence (Counterintelligence, Law Enforcement, and Security

(DDI (CL&S)) ………………………………………………………………………….8

2.3. Director, Defense Counterintelligence and Security Agency (DSCA) ………………...9

2.4. Chief Management Officer of the Department of Defense (CMO) …………………..10

2.5. PFPA ………………………………………………………………………………….10

2.6. Under Secretary of Defense for Policy ……………………………………………….11

2.7. USD (A&S) …………………………………………………………………..………11

2.8. USD(R&E) ………………………………………………………………………..….12

2.9. DoD CIO ……………………………………………………………………………..13

2.10. OSD and DoD Component Heads ………………………………………………….14

2.11. Secretaries of the Military Departments ……………………………………………16

2.12. Chairman of the Joint Chiefs of Staff ………………………………………………16

SECTION 3: PROGRAMMATICS ………… …….……………………………..…………18

3.1. Background …………………………………………………………………………..18

3.2. Legacy Information Requirements …………………………………………………...18

3.3. Handling Requirements ………………………………………………………………19

3.4. Marking Requirements ………………………………………………………………..21

3.5. General DoD CUI Administrative Requirements …………………………………….24

3.6. General DoD CUI Procedures ………………………………………………………...25

3.7. General DoD CUI Requirements ……………………………………………………...28

3.8. OCA …………………………………………………………………………………...34

3.9. General Release and Disclosure Requirements ……………………………………….35

3.10. General System and Network CUI Requirements …………………………………...36

SECTION 4: DISSEMINATION, DECONTROLLING, AND DESTRUCTION OF CUI ………..38

4.1. General ………………………………………………………………………………...38

4.2. Dissemination Requirements for DoD CUI …………………………………………...39

4.3. Legacy Distribution Statements ……………………………………………………….39

4.4. Decontrolling …………………………………………………………………………..41

4.5. Destruction …………………………………………………………………………….42

SECTION 5: APPLICATION OF DOD INDUSTRY …………………………….…………43

5.1. General …………………………………………………………………………………43

5.2. Misuse or UD of CUI ………………………………………………………………….44

5.3. Requirements for DoD Contractors ……………………………………………………45

GLOSSARY ………………………………………..……………….…………………………...47

G.1. Acronyms …………………………………………………………………………….….47

G.2. Definitions ……………………………………………………………………………….48

REFERENCES ………………………………………………………………………….……….53

TABLES

Table 1. DoD CUI Registry Category Examples

Table 2. Dissemination Control and Distribution Statement Markings

FIGURES

Figure 1. CUI Warning Box for Classified Material Figure 2. CUI Designation Indicator for All Documents and Material Figure 3. Notice and Consent

DoDI5200.48_DAFI16-1403 5 OCTOBER 2021

SECTION 2: RESPONSIBILITIES 6

SECTION 1: GENERAL ISSUANCE INFORMATION

1.1. APPLICABILITY

This issuance applies to:

a. Office of the Secretary of Defense (OSD), the Military Departments, the Office of the

Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the Department of Defense (OIG DoD), the Defense Agencies, the

DoD Field Activities, and all other organizational entities within the DoD (referred to collectively in this issuance as the “DoD Components”).

b. Arrangements, agreements, contracts, and other transaction authority actions requiring access to CUI according to terms and conditions of such documents, as defined in Clause 2.101 of the Federal Acquisition Regulation and Section 2002.4 of Title 32, CFR, including, but not limited to, grants, licenses, certificates, memoranda of agreement/arrangement or understanding, and information-sharing agreements or arrangements.

1.2. POLICY

It is DoD policy that:

a. As part of the phased DoD CUI Program implementation process endorsed by the CUI

Executive Agent (EA) pursuant to Information Security Oversight Office (ISOO) Memorandum dated August 21, 2019, the designation, handling, and decontrolling of CUI (including CUI identification, sharing, marking, safeguarding, storage, dissemination, destruction, and records management) will be conducted in accordance with this issuance and Sections 252.204-7008 and

252.204-7012 of the DFARS when applied by a contract to non-DoD systems.

b. All DoD CUI must be controlled until authorized for public release in accordance with

DoD Instructions (DoDIs) 5230.09, 5230.29, and 5400.04, or DoD Manual (DoDM) 5400.07.

Official DoD information that is not classified or controlled, as CUI will also be reviewed prior to public release in accordance with DoDIs 5230.09 or 5230.29.

c. Information will not be designated CUI in order to:

(1) Conceal violations of law, inefficiency, or administrative error.

(2) Prevent embarrassment to a person, organization, or agency.

(3) Prevent open competition.

(4) Control information not requiring protection under a law, regulation, or government-wide policy, unless approved by the CUI EA at the National Archives and Records Administration

(NARA), through the Under Secretary of Defense for Intelligence and Security (USD (I&S)).

SECTION 2: RESPONSIBILITIES 7

d. In accordance with the DoD phased CUI Program implementation, all documents containing CUI must carry CUI markings in accordance with this issuance.

e. Although DoD Components are not required to use the terms “Basic” or “Specified” to characterize CUI at this time, DoD Components will apply:

(1) At least the minimum safeguards required to protect CUI.

(2) Terms and specific marking requirements will be promulgated by the USD (I&S) in future guidance.

f. Nothing in this issuance alters or supersedes the existing authorities of the Director of

National Intelligence (DNI) regarding CUI.

g. Nothing in this issuance will infringe on the OIG DoD’s statutory independence and authority, as articulated in the Inspector General Act of 1978 in the Title 5, United States Code

(U.S.C.) Appendix. In the event of any conflict between this instruction and the OIG DoD’s statutory independence and authority, the Inspector General Act of 1978 in the Title 5, U.S.C.

Appendix takes precedence.

SECTION 2: RESPONSIBILITIES 8

SECTION 2: RESPONSIBILITIES

2.1. USD(I&S)

The USD(I&S):

a. As the DoD Senior Agency Official (SAO) for Security, establishes policy and oversees the DoD Information Security Program.

a. (Added)(AF) Secretary of the Air Force Administrative Assistant (SAF/AA) is the

Component Senior Agency Official (CSAO) for the Department of the Air Force (DAF), responsible for oversight of information security program, appointed by the Secretary of the Air

Force (see Headquarters Air Force Mission Directive 1-6). SAF/AA is also the DAF Security

Program Executive (SPE), representing the DAF security enterprise on the Defense Security

Enterprise Executive Committee.

b. In coordination with the requesting DoD Component, submits changes to CUI categories on behalf of DoD Components to the CUI EA at NARA.

b. (Added)(AF) SAF/AA, on behalf of the DAF, submits changes to CUI categories to the

CUI EA, at NARA, in collaboration with USD(I&S).

c. Provides reports to the CUI EA on the DoD CUI Program status, as described in

Paragraph 3.6.c., in accordance with Part 2002 of Title 32, CFR.

d. Establishes protocol for resolving disputes about implementing or interpreting E.O.

13556, Part 2002 of Title 32, CFR, the CUI Registry, and this issuance, within and between the

DoD Components.

e. Coordinates with the Department of Defense Chief Information Officer (DoD CIO) on

CUI waiver requests for DoD information systems (IS) and networks.

e. (Added)(AF) SAF/AA coordinates with the Office of the Deputy Chief Information

Officer (SAF/CN) on CUI waiver requests that require technical advice on DAF IS or Networks.

f. Coordinates with the CUI EA on DoD Component CUI waiver requests.

2.2. DIRECTOR FOR DEFENSE INTELLIGENCE (COUNTERINTELLIGENCE, LAW

ENFORCEMENT, AND SECURITY (DDI (CL&S))

The DDI (CL&S):

a. Oversees and manages the DoD CUI Program.

a. (Added)(AF) Secretary of the Air Force, Director of Security, Special Program Oversight and Information Protection (SAF/AAZ) oversees and manages the DAF CUI Program.

SECTION 2: RESPONSIBILITIES 9

b. Reviews and signs all reports and other correspondence related to the DoD CUI Program.

Coordinates with the Secretaries of the Military Departments, Under Secretary of Defense for

Research and Engineering (USD(R&E)), Under Secretary of Defense for Acquisition and

Sustainment (USD (A&S)), and the DoD Component heads to:

(1) Recommend changes to national CUI policy relating to identifying, safeguarding, disseminating, marking, storing, transmitting, reviewing, transporting, re-using, decontrolling, and destroying CUI, and responding to unauthorized disclosure (UD) of CUI.

(1) (Added)(AF) SAF/AAZ recommends changes to DAF CUI policy relating to identifying, safeguarding, disseminating, marking, storing, transmitting, reviewing, transporting, re-using, decontrolling, and destroying CUI, and responding to UD of CUI.

(2) Review and provide guidance on DoD Component implementation policy and

CUI-related matters.

d. Assists the USD (I&S) with overseeing the CUI policy and program execution via the

Defense Security Enterprise Executive Committee in accordance with DoDD 5200.43.

d. (Added)(AF) SAF/AAZ assists SAF/AA with overseeing the CUI policy and program execution, via the Defense Security Enterprise Executive Committee, in accordance with DoDD

5200.43.

e. In coordination with the DoD CIO, USD (A&S), and USD(R&E), provides guidance on implementing uniform standards to display TOP SECRET, SECRET, CONFIDENTIAL, and

UNCLASSIFIED for CNSI and CUI controls and banners for DoD systems and networks.

2.3. DIRECTOR, DEFENSE COUNTERINTELLIGENCE AND SECURITY AGENCY

(DCSA)

Under the authority, direction, and control of the USD (I&S) and in addition to the responsibilities in Paragraph 2.10., the Director, DCSA:

a. Administers the DoD CUI Program for contractually established CUI requirements for contractors in classified contracts in accordance with the May 17, 2018 Under Secretary of

Defense for Intelligence Memorandum.

b. Assesses contractor compliance with contractually established CUI system requirements in DoD classified contracts associated with the National Industrial Security Program (NISP) in accordance with Part 2003 of Title 32, CFR and National Institute of Standards and Technology

Special Publication (NIST SP) 800-171 guidelines.

c. Establishes and maintains a process to notify the DoD CIO, USD(R&E), and USD (A&S) of threats related to CUI for further dissemination to DoD Components and contractors in accordance with the Section 252.204-7012 of the DFARS.

SECTION 2: RESPONSIBILITIES 10

d. Provides, in coordination with the USD(I&S), security education, training, and awareness on the required topics identified in Section 2002.30 of Title 32, CFR, including protection and management of CUI, to DoD personnel and contractors through the Center for Development of

Security Excellence (CDSE).

e. Provides security assistance and guidance to the DoD Components on the protection of

CUI when DoD Components establish CUI requirements in DoD classified contracts for NISP contractors falling under DCSA security oversight.

f. Serves as the DoD-lead to report UDs of CUI, except for the reporting of cyber incidents in accordance with Section 252.204-7012 of the DFARS, associated with contractually established CUI system requirements in DoD classified contracts for NISP contractors falling under DCSA security oversight.

g. Coordinates with the DoD CIO to implement uniform security requirements when the IS or network security controls for unclassified and classified information are included in DoD classified contracts for NISP contractors falling under DCSA security oversight.

h. Consolidates DoD Component input on the oversight of CUI protection requirements in

DoD classified contracts for NISP contractors under DCSA security oversight, as required by

Information Security Oversight Office (ISOO) Notice 2016-01.

2.4. CHIEF MANAGEMENT OFFICER OF THE DEPARTMENT OF DEFENSE (CMO)

In addition to the responsibilities in Paragraph 2.10., the CMO:

a. Serves as the subject matter expert on CUI containing personally identifiable information and its release in accordance with Subsection 552 of Chapter 5 of Title 5, United States Code

(U.S.C.), also known as and referred to in this issuance as the “Freedom of Information Act

(FOIA),” implemented through DoDD 5400.07 and DoDI 5400.11, and Subsection 552a of

Chapter 5 of Title 5, U.S.C., also known and referred to in the issuance as the “Privacy Act of

1974.”

a. (Added)(AF) Secretary of the Air Force Chief Information Officer (SAF/CN) serves as the DAF subject matter expert on CUI containing personally identifiable information and its release under FOIA and the Privacy Act.

b. Supports OSD with information security matters, as appropriate.

2.5. Pentagon Force Protection Agency (PFPA)

Under the authority, direction, and control of the CMO, through the Director for Administration and Organizational Policy, and in addition to the responsibilities in Paragraph 2.10., the Director, PFPA:

SECTION 2: RESPONSIBILITIES 11

a. Provides information security administrative support to OSD.

b. Provides information on OSD CUI Program status and other formally requested assistance to the USD (I&S) to support the CUI Program.

c. Conducts CUI staff assistance visits to OSD in the National Capital Region.

2.6. UNDER SECRETARY OF DEFENSE FOR POLICY

In addition to the responsibilities in Paragraph 2.10., the Under Secretary of Defense for Policy:

a. Establishes policy and procedures for disclosing DoD CUI to foreign governments, the

North Atlantic Treaty Organization, and international organizations based on formally signed agreements and arrangements between the parties.

b. Requires CUI to be identified in international agreements, arrangements, and contracts having licensing export controls for foreign partners.

2.7. USD(A&S)

In addition to the responsibilities in Paragraph 2.10., pursuant to Section 133b of Title 10, U.S.C., and in coordination with the USD (I&S), DoD CIO, and USD(R&E), the USD (A&S):

a. Maintains, in accordance with Section 252.204-7012 of the DFARS, DoD acquisition contracting processes, policies, and procedures for safeguarding DoD CUI in DoD procurement arrangements, agreements, and contracts, including other transaction authority actions.

a. (Added)(AF) Secretary of the Air Force for Acquisition, Technology, and Logistics

(SAF/AQ) maintains DAF acquisition contracting processes, policies, and procedures for acquisition professionals to validate covered contractor information systems meet network security requirements for handling DAF CUI in DAF procurement arrangements, agreements, and contracts, including other transaction authority actions.

b. Supports the development and implementation of a Federal Acquisition Regulation clause applying CUI requirements to defense contractors.

c. (Added)(AF) SAF/AQ issues guidance requiring the written designation of a representative to oversee CUI safeguarding across the supply chain for all new and existing

Critical Programs and Technologies (CP&T) contracts.

SECTION 2: RESPONSIBILITIES 12

2.8. USD(R&E)

In addition to the responsibilities in Paragraph 2.10., pursuant to Section 133a of Title 10, U.S.C., and in coordination with USD (I&S), the USD(R&E):

a. Establishes DoD CUI processes, policies, and procedures for grants and cooperative research and development arrangements, agreements, and contracts involving controlled technical information (CTI).

a. (Added)(AF) SAF/AQ is responsible for establishing these DAF CUI processes and procedures involving CTI.

b. Establishes a standard process to identify CTI; guidelines for sharing, marking, safeguarding, storing, disseminating, decontrolling, and destroying CTI; and CTI records management requirements contained in contracts, as appropriate.

b. (Added) (AF) SAF/AQ is responsible for establishing standard processes to identify CTI.

c. Oversees and ensures DoD CUI guidelines and requirements for sharing, marking, safeguarding, storage, dissemination, decontrol, destruction, and records management of all research, development, test, and evaluation information are properly executed for all DoD owned records.

c. (Added) (AF) SAF/AQ is responsible for the oversight and execution of these guidelines and requirements for all DAF-owned records.

d. In coordination with the USD(A&S), ensures:

(1) Contracts, arrangements, and agreements for research, development, testing, and evaluation identify CUI at the time of award.

(1) (Added)(AF) SAF/AQ ensures all contracts, arrangements, and agreements for research, development, testing, and evaluation identify CUI at the time of award. SAF/AQ, in collaboration with the Deputy Under Secretary of the Air Force for International Affairs

(SAF/IA), ensures DAF international agreements, arrangements, and contracts with foreign partners identify CUI within the documents.

(2) USD(R&E) international agreements, arrangements, and contracts with foreign partners identify CUI within the documents.

(3) DoD Components concluding international agreements, arrangements, and contracts with foreign partners include U.S. Government-approved text on CUI.

(3) (Added) (AF) SAF/AQ, in collaboration with SAF/IA, ensures DAF international agreements, arrangements, and contracts include U.S. Government-approved text on CUI.

SECTION 2: RESPONSIBILITIES 13

2.9. DOD CIO

In addition to the responsibilities in Paragraph 2.10., the DoD CIO:

a. Oversees CUI metadata tagging standards, consistent with federal data tagging approaches in accordance with the National Strategy for Information Sharing and Safeguarding, to implement the marking requirements in Paragraph 3.4.c. and in accordance with DoDI

8320.07.

a. (Added)(AF) SAF/CN is responsible for overseeing CUI metadata tagging standards within the DAF.

b. Integrates CUI metadata tagging standards into DoD information technology content management tools to support discovery, access, auditing, safeguarding, and records management decisions regarding CUI (including monitoring CUI data for visibility, accessibility, trust, interoperability, and comprehension).

b. (Added)(AF) SAF/CN is responsible for integration of CUI metadata tagging standards into DAF information technology content management tools to support discovery, access, auditing, safeguarding, and records management decisions regarding CUI.

c. Provides policy and standards recommendations to the USD(I&S) on updates for the sharing, marking, safeguarding, storage, dissemination, decontrol, destruction, and records management of DoD CUI residing on both DoD and non-DoD IS in accordance with DoDI

8582.01.

c. (Added)(AF) SAF/CN is responsible for providing policy and standards recommendations to SAF/AA on updates for the sharing, marking, safeguarding, storage, dissemination, decontrol, destruction, and records management of DAF CUI residing on both DoD and non-DoD information systems in accordance with DoDI 8582.01.

d. Oversees Defense Industrial Base Cybersecurity Activities, using the DoD Cyber Crime

Center as the single DoD focal point for receiving and disseminating all cyber incident reports impacting unclassified networks of defense contractors.

e. Coordinates with the USD(I&S), USD(A&S), USD(R&E), and DoD Component heads to develop uniform security requirements for industry partners’ IS and network security controls adequate for the type of CUI identified in the contract in accordance with Part 2002 of Title 32, CFR, Section 252.204-7012 of the DFARS, and NIST SP 800-171.

f. Coordinates with the Director, DCSA to implement uniform security requirements when

IS or network security controls for unclassified and classified information are included in DoD classified contracts of NISP contractors falling under DCSA security oversight.

f. (Added)(AF) SAF/AA will coordinate with the Director, DCSA to implement uniform security requirements when IS or network security controls for unclassified information are

SECTION 2: RESPONSIBILITIES 14

included in DAF classified contracts of the National Industrial Security Program (NISP) contractors falling under DCSA security oversight.

(1) (Added) (AF) For Special Access Programs (SAP), SAF/AA will coordinate with the

Office of Special Investigations (OSI PJ) when DCSA has been carved out and OSI PJ has been given this responsibility.

g. Coordinates with the USD(I&S) to:

(1) Implement information security policy standards for markings to display, CUI for

DoD classified and unclassified systems and networks.

(1) (Added)(AF) SAF/AA coordinates with SAF/CN on the implementation of information security policy standards for markings to display CUI on DAF classified and unclassified systems and networks.”

(2) Integrate training on safeguarding and handling CUI into updates to initial and annual cybersecurity awareness training.

(2) (Added)(AF) SAF/CN coordinates with SAF/AA to integrate training on safeguarding and handling CUI into updates to initial and annual cybersecurity awareness training.

h. Notifies the CUI EA in coordination with the USD(I&S) of CUI waivers impacting IS or networks in accordance with Title 32 of the CFR.

i. Oversees and ensures DoD Component- and National Archives-approved disposition authorities for CUI are implemented for DoD records and information.

j. Oversees and ensures the Director, DoD Cyber Crime Center:

(1) Manages and updates, as necessary and in coordination with DoD CIO, the policies in Section 236.4 of Title 32, CFR and Section 252.204-7012 of the DFARS.

(2) Maintains the website at https://dibnet.dod.mil to receive contractor mandatory incident reports in accordance with Paragraph 3.9.d(1).

2.10. OSD AND DOD COMPONENT HEADS

OSD and DoD Component heads:

a. Identify, program, and commit the necessary resources to implement CUI Program requirements as part of their overall information security programs.

a. (Added)(AF) SAF/AA performs this responsibility for SecAF and reports shortfalls to

SecAF through programming and budgeting processes.

https://dibnet.dod.mil/

SECTION 2: RESPONSIBILITIES 15

b. Designate in writing (with copy to the USD(I&S)):

(1) A DoD Component senior agency official (CSAO) at the Senior Executive

Service level or equivalent to implement their CUI Program and perform the duties in

Paragraph 3.5.

(2) A DoD Component program manager (CPM) to manage their CUI Program.

c. Ensure their subordinate organizations comply with DoD CUI Program requirements.

d. Ensure their personnel receive initial and annual refresher CUI education and training, and maintain documentation of this training for audit purposes.

d. (Added)(AF) All DAF personnel are required to complete CUI education and training.

Upon release of the CUI training on the My Learning platform, all personnel will complete this initial training within 180 days. (T-0) Completion of training can be accomplished by either accessing the training via My Learning, or by taking in-person or virtual training sessions using authorized presentations that align to the content within the training housed on My Learning.

Personnel who previously completed the training using the Center for Development of Security

Excellence training platform will receive credit upon presentation of a course completion certificate to their unit training manager.

e. Report DoD Component training completion data to the USD(I&S) annually or as directed.

f. Provide an annual report to the USD(I&S) on CUI implementation status in accordance with Title 32, CFR, Part 2002.

g. Determine if any CUI documents or materials constitute permanently valuable records of the government, which require maintenance and disposal in accordance with DoDI 5015.02.

h. As the requiring activity, oversee CUI requirements for contractor implementation in partnership with the Defense Contract Management Agency, based on Defense Contract

Management Agency responsibilities, or DCSA for cleared contractors in accordance with the

NISP, as appropriate.

i. Ensure DoD Component- and National Archives-approved disposition authorities are implemented for DoD records and information regardless of classification.

j. Manage their CUI programs in accordance with guidelines prescribed in this DoD issuance.

SECTION 2: RESPONSIBILITIES 16

2.11. SECRETARIES OF THE MILITARY DEPARTMENTS

In addition to the responsibilities in Paragraph 2.10., the Secretaries of the Military Departments oversee the implementation of their CUI programs.

2.12. CHAIRMAN OF THE JOINT CHIEFS OF STAFF

In addition to the responsibilities in Paragraph 2.10., the Chairman of the Joint Chiefs of Staff oversees the implementation of the CUI programs in the Joint Staff organizations and Combatant

Commands.

2.13. (Added)(AF) MAJCOM/FIELD COMMAND/DRU/FOA DIRECTOR, INFORMATION PROTECTION

a. (Added)(AF) Advises the SPE on CUI requirements and information protection issues within the command dealing with safeguarding, disseminating, marking, storing, transmitting, transporting, and destroying CUI.

b. (Added)(AF) Integrates CUI protection into Major Commands, Direct Reporting Units, Field Operating Agencies (MAJCOM/Field Command/DRU/FOA) operations.

c. (Added)(AF) Provides oversight and direction to security specialists assigned to the

MAJCOM/Field Command/DRU/FOA Information Protection Directorate dealing with safeguarding, disseminating, marking, storing, transmitting, transporting, and destroying CUI.

d. (Added)(AF) Provides CUI program management, oversight, risk management, policy and guidance to subordinate units within the command dealing with safeguarding, disseminating, marking, storing, transmitting, transporting, and destroying CUI .

e. (Added)(AF) In cases where an OCA determines the information is classified due to compilation, ensure a damage assessment is completed when a potential compromise or compromise of classified information occurs, in accordance with DoD Manual (DoDM) 5200.01

Volume 3, DoD Information Security Program: Protection of Classified Information. (T-0)

2.14. (Added) (AF) SAF/IA

a. (Added) (AF) Authorizes the disclosures of CUI to foreign governments and international organizations in support of DAF international agreements, arrangements, and contracts with foreign partners.

b. (Added) (AF) Authorizes disclosures of CUI to foreign nationals in accordance with

Delegation of Disclosure Authority Letters (DDLs).

SECTION 2: RESPONSIBILITIES 17

2.15. (Added) (AF) INSTALLATION/WING COMMANDERS

a. (Added)(AF) Installation wing commanders and directors will assist with implementation efforts for the CUI program including, ensuring assigned military, civilian and contractor personnel complete all mandated training, investigating unauthorized disclosures, address risks associated with the program, and support data collection requirements. (T-0) Commanders may appoint security assistants to manage the administrative functions of this program in accordance with DoDM 5200.01, Volume 1 and AFMAN 16-1404, Volume 1.

b. (Added)(AF) Commanders at all levels will integrate CUI program compliance into the self-assessment and Management Internal Control Toolset processes.

SECTION 3: PROGRAMMATICS 18

SECTION 3: PROGRAMMATICS

3.1. BACKGROUND

The CUI EA at NARA, through the Information Security and Oversight Office (ISOO), published and released Part 2002 of Title 32, CFR, which provides implementing requirements for E.O. 13556.

a. Part 2002 of Title 32, CFR established a CUI EA office under NARA’s ISOO for implementing and overseeing the CUI Program.

b. Designed as a response to the information sharing challenges from inconsistent definitions and marking requirements applied to CUI, Part 2002 of Title 32 CFR standardized the definition of CUI and codified the identification, sharing, safeguarding, marking, storage, distribution, transmission, decontrol, destruction, training, monitoring, and reporting requirements across the Executive branch of government.

c. In accordance with Part 2002 of Title 32, CFR, CUI requires safeguarding or dissemination controls identified in a law, regulation, or government-wide policy for information that does not meet the requirements for classification in accordance with E.O. 13526.

d. Unlike classified information, an individual or organization generally does not need to demonstrate a need-to-know to access CUI, unless required by a law, regulation, or government-wide policy, but must have a lawful governmental purpose for such access. One example of a requirement for need-to-know established by law, regulation, or government-wide policy is

Section 223.6 of Title 32, CFR, which requires a person to have a need-to-know to be granted access to DoD Unclassified Nuclear Information (UCNI).

3.2. LEGACY INFORMATION REQUIREMENTS

This legacy information guidance applies to information contained across DoD in, among other documents, security classification guides (SCGs), various policies, and other legacy materials falling under the Science and Technology Information Program (DoDI 3200.12), in either electronic or hardcopy format. The CUI Program does not require the redacting or re-marking of documents bearing legacy markings. However, any new document created with information derived from legacy material must be marked as CUI if the information qualifies as CUI.

a. DoD legacy material will not be required to be re-marked or redacted while it remains under DoD control or is accessed online and downloaded for use within the DoD. However, any such document or new derivative document must be marked as CUI if the information qualifies as CUI and the document is being shared outside DoD. DoD legacy marked information stored on a DoD access-controlled website or database does not need to be remarked as CUI, even if other agencies and contractors are granted access to such websites or databases.

SECTION 3: PROGRAMMATICS 19

a. DoD legacy information does not automatically become CUI. It must be reviewed by the owner of the information to determine if it meets the CUI requirements. If it is determined the specific legacy information meets the CUI requirements, it will be marked in accordance with this issuance and corresponding manual.

b. For federal systems, IS storing information identified as CUI must meet the minimum network security standard in Part 2002 of Title 32, CFR. For nonfederal systems, IS must meet the standards in the NIST SP 800-171, when established by contract.

c. When DoD legacy information is incorporated into, or cited in, another document or material, it must be reviewed for CUI and marked in accordance with this issuance.

3.3. HANDLING REQUIREMENTS

The DoD CUI Information Security Program will promote, to the maximum extent possible, information sharing, facilitate informed resource use, and simplify its management and implementation while maintaining required safeguarding and handling measures.

a. In accordance with DoDI 5230.09 and the August 14, 2014 Deputy Secretary of Defense

Memorandum:

(1) The DoD originator or authorized CUI holder must ensure a prepublication and security policy review is conducted, pursuant to the standard DoD Component process, before

CUI is approved for public release, which includes publication to a publicly accessible website.

(2) Decontrolling and releasing CUI records will be executed by the originator of the information, the original classification authority (OCA) if identified in a security classification guide, or designated offices for decontrolling CUI pursuant to the procedures for the review and release of information under the FOIA in accordance with the November 19, 2018 ISOO Notice.

There are no specific timelines to decontrol CUI unless specifically required in a law, regulation, or government-wide policy. Decontrol will occur when the CUI no longer requires safeguarding and will follow DoD records management procedures.

b. OCAs will determine if aggregated CUI under their control should be classified in accordance with Volume 1 of DoDM 5200.01 and will confirm the relevant SCGs address the compilation.

c. DoD information systems processing, storing, or transmitting CUI will be categorized at the “moderate” confidentiality impact level and follow the guidance in DoDIs 8500.01 and

8510.01. Non-DoD information systems processing, storing, or transmitting CUI will provide adequate security, and the appropriate requirements must be incorporated into all contracts, grants, and other legal agreements with non-DoD entities in accordance with DoDI 8582.01. See

Section 5 of this issuance for more information on CUI and its application to industry.

SECTION 3: PROGRAMMATICS 20

d. The DoD CUI Registry provides an official list of the Indexes and Categories used to identify the various types of DoD CUI. The DoD CUI Registry mirrors the National CUI

Registry, but provides additional information on the relationships to DoD by aligning each Index and Category to DoD issuances.

(1) The official DoD CUI Registry of categories can be accessed on Intelink at https://intelshare.intelink.gov/sites/ousdi/hcis/sec/icdirect/information/CUI/Forms/AllItems.aspx

(2) The site will be updated as changes to the DoD CUI Registry are made based on official notification from the CUI EA through the CUI Registry Working Group; changes to law, regulation, or government-wide policy; or notification that the information no longer meets the requirements for CUI.

e. (Added)(AF) DAF personnel have a personal responsibility to protect CUI, at all times.

(T-0) Personnel must keep CUI under their control at all times or protect it with at least one physical barrier to reasonably ensure the CUI is protected from unauthorized access, disclosure or observation. This can be done by placing a coversheet (Standard Form (SF) 901) on top of the document(s), turning off the computer monitor, or using a computer monitor screen cover to prevent others from viewing the CUI information. (T-0) The SF 902, CUI Label, is available for marking media and peripheral equipment. Hard copy CUI will be allowed to be stored outside of a government workplace or approved contractor facility workplace when approved in advance.

CUI hardcopy documents can only be removed from the workplace for official government business. Ultimately, the decision to allow CUI to be removed from the workplace to help sustain mission readiness rests with each commander/director, and individuals doing so must adhere to local CUI policy and procedures. It is the supervisor’s responsibility to ensure the removal of hardcopy CUI documents from the workplace is kept to a minimum and sufficient oversight and accountability processes are in place for its control and safeguarding. DAF personnel with a requirement to remove CUI hardcopy documents from the workplace must adhere to the following procedures, at a minimum: (T-0)

(1) (Added)(AF) Immediately notify your supervisor when the need to remove hardcopy

CUI documents from the workplace arises. (T-0) Make sure the documents are properly marked and protect the CUI documents with at least one physical barrier (e.g., place the document in a folder, opaque envelope, or brief case) to avoid unauthorized disclosure or observation while in transit. (T-0) Note: there is no requirement to have a courier authorization to transport hardcopy

CUI documents.

(2) (Added)(AF) Do not view CUI documents in public settings, or while using public transportation. (T-0)

(3) (Added)(AF) When not under continuous monitoring or physical control, store hardcopy CUI documents in a locked desk, file cabinet, or similar means, where only authorized personnel have access. (T-0)

(4) (Added)(AF) Prior to removing hardcopy CUI documents from the workplace, DAF personnel must complete the required CUI training. (T-0)

SECTION 3: PROGRAMMATICS 21

3.4. MARKING REQUIREMENTS

This paragraph covers the essential marking requirements for initial phased implementation of the DoD CUI Program. (Added)(AF) Markings shall be immediately apparent, alert holders to the presence of CUI, identify the office of origin, identify the category(ies) of CUI in the document, and provide guidance on distribution/dissemination. (T-1).

a. At minimum, CUI markings for unclassified DoD documents will include the acronym

“CUI” in the banner and footer of the document.

a. (Added)(AF) In addition to banner markings, all DAF correspondence containing CUI will have the CUI designation indicator on the cover or first page of the document. (T-0).

b. If portion markings are selected, then all document subjects and titles, as well as individual sections, parts, paragraphs, or similar portions of a CUI document known to contain

CUI, will be portion marked with “(CUI).” Use of the unclassified marking “(U)” as a portion marking for unclassified information within CUI documents or materials is required.

(1) There is no requirement to add the “U,” signifying unclassified, to the banner and footer as was required with the old FOUO marking (i.e., U//FOUO).

(2) Banners, footers, and portion marking will only be marked “Unclassified” or

“(U)” for unclassified information in accordance with the June 4, 2019 ISOO letter. If the document also contains CUI, it will be marked in accordance with Paragraph 3.4.a. and additional forthcoming guidance.

(3) (Added)(AF) Do not use the CUI portion marking in subject lines of memorandums or emails unless the information in the subject line contains CUI. Likewise, do not label file names with the CUI portion marking for the same reasons.

(4) (Added)(AF) Do not use former agency dissemination controls such as Law

Enforcement Sensitive (LES), DoD Unclassified Controlled Nuclear Information (DoD UCNI), Sensitive But Unclassified (SBU), and DEA Sensitive with CUI markings. These former markings should be represented accordingly as CUI categories in the CUI Designation Indicator block.

c. CUI markings in classified documents will appear in paragraphs or subparagraphs known to contain only CUI and must be portion marked with “(CUI).” CUI will not appear in the banner or footer.

(1) There will be an acknowledgement added to the warning box on the first page of multi-page documents to alert readers to the presence of CUI in a classified DoD document, as shown in Figure 1.

SECTION 3: PROGRAMMATICS 22

Figure 1. CUI Warning Box for Classified Material

This content is classified at the [insert highest classification level of the source data] level and may contain elements of controlled unclassified information

(CUI), unclassified, or information classified at a lower level than the overall classification displayed. This content shall not be used as a source of derivative classification; refer instead to [cite specific reference, where possible, or state

“the applicable classification guide(s)”]. It must be reviewed for both

Classified National Security Information (CNSI) and CUI in accordance with

DoDI 5230.09 prior to public release. [Add a point of contact when needed.]

(2) Volume 2 of DoDM 5200.01 requires DoD intelligence producers to follow DNI formats for intelligence production under the authority of the DNI. When DoD CUI is incorporated into a Digital Access Policy under the authority of the DNI, the information and the document will follow the Digital Access Policy standards established by the DNI.

(3) (Added)(AF) Classified documents containing CUI will include both the classification authority block and CUI designation indicator. (T-0).

(4) (Added)(AF) If all the sub-paragraphs or sub-bullet points carry the same classification as the main paragraph or bullet point, portion marking is not required for the sub-paragraphs or sub-bullet points. However, if any of the sub-paragraphs or sub-bullet points carry different classifications from the main paragraph or bullet point, portion marking is required for the sub-paragraphs or sub-bullet points. (T-0).

d. The dissemination marking “not releasable to foreign nationals (NOFORN or NF)” is an intelligence control marking used to identify intelligence information an originator has determined meets the criteria of Intelligence Community Directive 710 and Intelligence

Community Policy Guidance 403.1, which provides guidance for further dissemination control markings. It must be applied to controlled unclassified intelligence information that is properly characterized as CUI with appropriate CUI markings. CUI identified with this marking will not be provided, in any form, to foreign governments (including coalition partners), international organizations, foreign nationals, or other non-U.S. persons without the originator’s approval in accordance with E.O.s 13526 and 13556. If originator approval is required for further dissemination, the originator will mark the requirement on the information in accordance with

Section 4.1(i)(1) of E.O. 13526.

(1) The application of the control marking “not releasable to foreign nationals”

(NOFORN or NF) will only be applied, when warranted, to unclassified intelligence information properly categorized as CUI and reviewed by a Foreign Disclosure Officer to ensure there are no international agreements in place to prohibit its use and prohibiting sharing.

(a) (Added)(AF) If the use of NOFORN is authorized, the banner line will read

“CUI//NOFORN.” The “(CUI/NF)” portion marking is applied preceding the applicable portion.

(2) The control marking NOFORN or NF will be applied to Naval Nuclear

Propulsion Information (NNPI), Unclassified Controlled Nuclear Information (UCNI), National

SECTION 3: PROGRAMMATICS 23

Disclosure Policy (NDP-1), and cover and cover support information. When warranted, it can be applied to unclassified information properly categorized as CUI having a licensing or export control requirement. Before marking a document or material as NOFORN or NF, it will be reviewed by the Foreign Disclosure Officer to ensure there are no agreements in place to prohibit its use and sharing.

(3) The application of “Releasable to” (“REL TO”) can only be applied, when warranted and consistent with relevant law, regulation, or government-wide policy or DoD policy, to information properly categorized as CUI with an export control or licensing requirement with a foreign disclosure agreement in place.

(a) Export-controlled CUI transfers to foreign persons must be in accordance with the Arms Export Control Act, International Traffic in Arms Regulations, Export Control Reform

Act, Export Administration Regulations, and DoDI 2040.02. In accordance with DoDDs

5230.11 and 5230.20, a positive foreign disclosure decision must be made before CUI is released to a foreign entity.

(b) DoD operational CUI (not related to intelligence) may be marked as REL TO.

(3) (Added)(AF) For DAF information authorized for release to foreign nationals/representatives, “REL TO” will be placed in the banner line with the list of country trigraphs and/or tetragraphs (e.g., CUI//REL TO USA, XXX, XXX). “USA” is always listed first with the remaining trigraphs following in alphabetical order, followed by tetragraphs in alphabetical order.

(a) (Added)(AF) The applicable portion will be marked “CUI//REL,” if the information is releasable to the same countries in the banner line. If countries are different, the portion marking must list all countries that are applicable.

(b) (Added)(AF) When REL TO and NF portions are in the same document, NOFORN takes priority and will roll-up to the banner line. This rule applies to both unclassified and classified documents.

e. All classified documents, including legacy documents will be reviewed for CUI and properly marked upon changes in the document’s classification level, particularly if the documents are to be completely declassified.

f. The first page or cover of any document or material containing CUI, including a document with commingled classified information, will include a CUI designation indicator, as shown in Figure 2. This CUI designation indicator is similar to the classification-marking block used for CNSI documents and materials. Documents and materials containing CUI will require a generic “CUI” marking at the top and bottom of each page.

(1) In accordance with Part 2002 of Title 32, CFR, the CUI designation indicator must contain, at minimum, the name of the DoD Component determining that the information is

CUI. If letterhead or another standard indicator of origination is used, this line may be omitted.

SECTION 3: PROGRAMMATICS 24

(2) The second line must identify the office making the determination.

(3) The third line must identify all types of CUI contained in the document.

(4) The fourth line must contain the distribution statement or the dissemination controls applicable to the document.

(5) The fifth line must contain the phone number or office mailbox for the originating

DoD Component or authorized CUI holder.

Figure 2. CUI Designation Indicator for All Documents and Material

Controlled by: [Name of DoD Component] (Only if not on letterhead)

Controlled by: [Name of Office]

CUI Category: (List category or categories of CUI)

Distribution/Dissemination Control:

POC: [Phone or email address]

g. During DoD’s initial phased implementation of the CUI Program, there is no required distinction that must be made between Basic and Specified CUI. All DoD information will be protected in accordance with the requirements under the Basic level of safeguards and dissemination unless specifically identified otherwise in a law, regulation, or government-wide policy. Forthcoming guidance will address the distinction between the two levels of CUI, including a list of which categories are Basic or Specified, what makes the category one or the other, and the unique requirements, to include markings, for each.

3.5. GENERAL DOD CUI ADMINISTRATIVE REQUIREMENTS

Each DoD Component head must appoint, in writing, a CSAO for the Information Security

Program, who will:

a. Appoint, in writing, an official to serve as the CPM for CUI in accordance with ISSO

Notice 2019-02. To manage the DoD Component’s overall execution of the CUI program, the

CPM will:

(1) Coordinate directly with the USD (I&S) Information Security Directorate on CUI matters.

(2) Manage and oversee CUI implementation for the…