Q and A.pdf

Questions and Answers for Solicitation Number: FHF-25-Q-0053

# QUESTION RESPONSE

Is there an incumbent or vendor who recently provided these services or similar services? If so, could you please provide the previous contract number?

Yes, Mortgage Banker’s Association

FHF20D0001

The RFQ and Performance Work Statement require that all Information and Communication Technology (ICT) delivered under the contract be Section 508 compliant (RFQ, Attachment A, Section 12.0 and 6.223). Will the agency consider a quotation technically acceptable if, instead of full Section 508 compliance, the quoter proposes a plan to provide reasonable accommodations and support for participants with disabilities, subject to agency approval?

As long as the vendor provides the deliverables in the prescribed format it will be Section 508 compliant.

The Performance Work Statement incorporates agency specialty clause 6.205 (Nondisclosure of Controlled Unclassified Information, including FHFA Non-Public Information), could you please confirm whether the awardee will receive Controlled Unclassified Information (CUI) during the performance of the contract?

Yes, i.e., during the course, the vendor may receive CUI information to use as a training example, etc.

The Performance Work Statement incorporates agency specialty clause 6.205 (Nondisclosure of Controlled Unclassified Information, including FHFA Non-Public Information), could you please provide a copy of the agency’s CUI Policy and Procedures referenced in the above clause?

Yes, they are attached.

FEDERAL HOUSING FINANCE AGENCY

Controlled Unclassified Information Policy

Approved:

4/21/2021

X Kevin Smith Kevin Smith Chief Information Officer, by delegation Signed by: KEVIN SMITH

FHFA Policy No: 222 Date: 04/20/2021

Revision: 1 Page: 2 of 10

Controlled Unclassified Information Policy

Table of Contents

I. Policy

II. Definitions

III. Scope

IV. Controlled Unclassified Information Program

V. Responsibilities

VI. Authorities and References

VII. Records Retention

Revision: 1 Page: 3 of 10

I. Policy

The Controlled Unclassified Information (CUI) Policy establishes the principles governing the appropriate designation, management, and protection of all information created by or in the possession of the Federal Housing Finance Agency (FHFA).

II. Definitions

A. Breach. The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where a person accesses or potentially accesses CUI that the person is not authorized to access.

B. Controlled Unclassified Information (CUI). Information the federal government creates or possesses, or that an entity creates or possesses for or on behalf of the federal government, that a law, regulation, or government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. NARA has established an online repository, the CUI Registry,1 which identifies and describes all CUI as one of two types: CUI Basic or CUI Specified.

C. Confidential Supervisory Information. As defined in 12 CFR 1214.1, information prepared or received by FHFA that meets all of the following criteria:

1. The information is not a document prepared by a Regulated Entity or the Office of Finance for its own business purposes that is in its possession;

2. The information is exempt from the Freedom of Information Act; and

3. The information:

a. Consists of reports of examination, inspection and visitation, confidential operating and condition reports, and any information derived from, related to, or contained in such reports, or

b. Is gathered by FHFA in the course of any investigation, suspicious activity report, cease-and-desist order, civil money penalty enforcement order, suspension, removal or prohibition order, or other supervisory or enforcement orders or actions taken under the Federal Housing Enterprises Financial Safety and Soundness Act of 1992, Public Law 102-550, 122 Stat. 2654.

D. CUI Basic. Information that a law, regulation, or government-wide policy requires or permits agencies to protect, but the law, regulation, or government-wide policy does not set out specific handling or dissemination controls. All FHFA Information designated as CUI Basic is subject to the same uniform set of safeguarding/dissemination controls, which are addressed in the CUI Procedures.

1 The CUI Registry is available at https://www.archives.gov/cui/registry/category-list.

https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=19b8ff5bc66d467e0ac42f3462f443e2&term_occur=1&term_src=Title:12:Chapter:XII:Subchapter:A:Part:1214:1214.1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=62d7140c789fdff0a6ba64a0dc87d7a2&term_occur=1&term_src=Title:12:Chapter:XII:Subchapter:A:Part:1214:1214.1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=19b8ff5bc66d467e0ac42f3462f443e2&term_occur=2&term_src=Title:12:Chapter:XII:Subchapter:A:Part:1214:1214.1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=8ce3b7986e30f410d832f06c88a31926&term_occur=1&term_src=Title:12:Chapter:XII:Subchapter:A:Part:1214:1214.1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=609d06788d5e69e197797972a33c2b8f&term_occur=1&term_src=Title:12:Chapter:XII:Subchapter:A:Part:1214:1214.1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=609d06788d5e69e197797972a33c2b8f&term_occur=1&term_src=Title:12:Chapter:XII:Subchapter:A:Part:1214:1214.1 https://www.congress.gov/public-laws/102nd-congress#550 https://www.law.cornell.edu/rio/citation/122_Stat._2654 https://www.archives.gov/cui/registry/category-list

Revision: 1 Page: 4 of 10

E. CUI Registry. The online repository for all NARA-issued information, guidance, policy, and requirements on handling CUI. Among other information, the CUI Registry identifies all approved CUI categories, provides general descriptions for each, establishes markings, and includes guidance on handling procedures. The CUI Registry also identifies the laws, regulations, and government-wide policies that contain the specific handling and dissemination controls for CUI Specified information.

F. CUI Specified. Information that a law, regulation, or government-wide policy requires or permits agencies to protect using specific handling or dissemination controls that differ from the uniform set of controls for CUI Basic. CUI Specified information is subject to specific marking requirements which may be more stringent than or may simply differ from those required for CUI Basic. The distinction is that the underlying authority sets forth specific controls for CUI Specified information but does not for CUI Basic information.

G. Decontrol. Decontrol occurs when the Information Owner, in conjunction with the Office of General Counsel (OGC), determines that information marked as CUI no longer requires protection as CUI. However, decontrolled CUI may be released to a third party or the public only if authorized in writing by the Director or a delegate.

H. Disclosure/Dissemination. The release or divulgence of information by any FHFA employee or contractor personnel to any person or entities outside of FHFA.

I. FHFA Contractor Personnel. Any current or former contractor or its personnel, including directors, officers, employees, subcontractors, agents, or consultants, to the extent that the protection of CUI or Non-Public Information is addressed in their contract.

J. FHFA Employee. Any person employed by FHFA, including any current or former officer, intern, agent, or detailee of FHFA.

K. FHFA Information. Information created by, obtained by, or communicated to an FHFA employee (or an FHFA contractor or its personnel) in connection with the performance of official duties, regardless of who is in possession of the information.

L. Information Owners. Division and office heads are the owners of FHFA Information that their divisions or offices create or obtain from a third party.

M. Non-Public Information. As defined in 12 CFR 1214.1, information that FHFA has not made public that is created by, obtained by, or communicated to an FHFA employee or contractor personnel in connection with the performance of official duties, regardless of who is in possession of the information. This includes Confidential Supervisory Information as defined above. It does not include information or documents that are customarily furnished to the public in the course of the performance of official FHFA https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=19b8ff5bc66d467e0ac42f3462f443e2&term_occur=8&term_src=Title:12:Chapter:XII:Subchapter:A:Part:1214:1214.1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=01e5d9dbc2caee100586792aafb6087b&term_occur=1&term_src=Title:12:Chapter:XII:Subchapter:A:Part:1214:1214.1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=0ab5e18ebbc291fc07744a9fb99b18cf&term_occur=1&term_src=Title:12:Chapter:XII:Subchapter:A:Part:1214:1214.1 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=0ab5e18ebbc291fc07744a9fb99b18cf&term_occur=1&term_src=Title:12:Chapter:XII:Subchapter:A:Part:1214:1214.1

Revision: 1 Page: 5 of 10 duties. It also does not include information or documents that FHFA has disclosed under the Freedom of Information Act or Privacy Act of 1974.

N. Personally Identifiable Information (PII). Information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual.

O. Public Information. FHFA Information that has been approved for public release and made available to the public. Public Information has no legal restrictions on access or use. Public Information has low sensitivity, and the risk to FHFA from loss, theft, unauthorized access or disclosure, compromise or inappropriate use is negligible.

P. Regulated Entities. Federal National Mortgage Association (Fannie Mae) and any affiliate thereof (including Common Securitization Solutions), the Federal Home Loan Mortgage Corporation (Freddie Mac) and any affiliate thereof (including Common Securitization Solutions), and any Federal Home Loan Bank.

III. Scope

This Policy applies to all information created by, obtained by, or communicated to FHFA employees or contractor personnel in connection with the performance of official duties, regardless of the medium in which the information resides. This Policy applies to all FHFA employees and to contractor personnel to the extent specified by their contract.

IV. Controlled Unclassified Information Program

Executive Order (E.O.) 13556, Controlled Unclassified Information, dated November 4, 2010, designates the National Archives and Records Administration (NARA) to oversee the CUI Program for the executive branch of the federal government.

As part of that responsibility, NARA issued 32 CFR Part 2002, Controlled Unclassified Information, effective November 14, 2016, which established a government-wide policy governing the management and oversight of CUI.

A. Categories of Information and CUI Marking

FHFA Information generally falls into one of two categories: Public Information or CUI.

1. Public Information is information that has been approved for public release and made available to the public. Public Information has no legal restrictions on access or use.

Public Information has low sensitivity, and the risk to FHFA from loss, theft, https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=19b8ff5bc66d467e0ac42f3462f443e2&term_occur=9&term_src=Title:12:Chapter:XII:Subchapter:A:Part:1214:1214.1

Revision: 1 Page: 6 of 10 unauthorized access or disclosure, compromise, or inappropriate use is negligible. No explicit designations or markings are required for Public Information.

2. CUI is any information that a federal agency creates or possesses, or that an entity creates or possesses for or on behalf of a federal agency, that is subject to any safeguarding or dissemination controls under federal law, regulation, or government-wide policy. CUI can in turn be divided into one of two overarching types: CUI Basic or CUI Specified.

3. All FHFA Information designated as CUI Basic or CUI Specified must be handled according to controls as defined in 32 CFR Part 2002 and the CUI Registry and must be marked as provided in the CUI Procedures and related training.

B. Safeguarding Measures and Dissemination Controls

Most FHFA Information is CUI and reasonable precautions must be taken to guard against unauthorized disclosure of CUI by properly securing systems, controlling dissemination, and applying CUI markings to documents. In safeguarding CUI, FHFA employees and contractor personnel are required to mark documents appropriately.

Detailed instructions for protecting, disseminating, and marking CUI are provided in the CUI Procedures.

1. Disclosure of CUI – Except as described below, only the Director or a delegate2 may authorize the disclosure of CUI to entities or individuals outside of FHFA.

Unauthorized disclosure of CUI by an FHFA employee may result in disciplinary action, up to and including removal from federal service or, for FHFA contractor personnel, other appropriate action, including contract termination.3 An employee or contractor personnel who improperly discloses CUI may also be subject to civil and/or criminal penalties, depending on the nature of the information disclosed.

2. Disclosure of CUI to other FHFA employees, the Regulated Entities, or the Office of Finance – Current FHFA employees and contractor personnel may disclose or permit the disclosure of CUI to other FHFA employees or contractor personnel, the Regulated Entities, or the Office of Finance when necessary and appropriate for the performance of their official duties. CUI disclosed to the Regulated Entities or the Office of Finance must be properly marked to ensure the recipient is aware of the information’s status as CUI.

2 See FHFA Order No. 31, Delegations of Authority to Sign, On Behalf of FHFA, Memoranda of Understanding and Agreements, and Other Information Sharing Documents, and to Disclose Non-Public Information, Including Confidential Supervisory Information.

3 CUI markings or lack of markings do not determine whether the information may be properly released pursuant to the Freedom of Information Act or the Privacy Act of 1974. Disclosure determinations under the Freedom of Information Act and the Privacy Act are based solely on application of the criteria set forth in those laws.

http://ims.fhfa.gov/o/2238751/Order%2031_DelegSignMOUs-Agrmnts-InfoShar%20and%20ToDiscloNPI%20(10-27-13).pdf

Revision: 1 Page: 7 of 10

3. Safeguarding and Handling CUI – FHFA employees and contractor personnel are responsible for preventing unauthorized access to or disclosure of CUI in both physical and electronic environments, including while teleworking, traveling, or working at field locations by securing physical CUI behind at least one locked barrier when not under their direct control.

4. Decontrolling CUI – Decontrolling refers to the process by which FHFA determines that FHFA Information designated as CUI no longer requires protection as CUI. The decision to decontrol CUI is made by the Information Owner and OGC. However, the process of decontrolling CUI affects only the safeguarding required for the decontrolled information not the dissemination of the information. CUI that is decontrolled may be released to a third party or the public only if authorized by the Director or a delegate.

5. Whistleblowing Activity Not Restricted – With respect to FHFA employees, nothing in this Policy or any related procedures prohibits or restricts an employee from disclosing to Congress, the Office of Special Counsel, the Inspector General, or any other Agency component responsible for internal investigation or review, any information that relates to any violation of law, rule, or regulation, or mismanagement, a gross waste of funds, an abuse of authority, or a substantial and specific danger to public health or safety, or any other whistleblower protection.

Pursuant to the Whistleblower Protection Enhancement Act of 2012, as amended, employees are provided the following notice with respect to this Policy:

These provisions are consistent with and do not supersede, conflict with, or otherwise alter the employee obligations, rights, or liabilities created by existing statute or Executive order relating to (1) classified information, (2) communications to Congress, (3) the reporting to an Inspector General or the Office of Special Counsel of a violation of any law, rule, or regulation, or mismanagement, a gross waste of funds, an abuse of authority, or a substantial and specific danger to public health or safety, or (4) any other whistleblower protection. The definitions, requirements, obligations, rights, sanctions, and liabilities created by controlling Executive Orders and statutory provisions are incorporated into this agreement and are controlling.

C. Training

FHFA employees are required to complete mandatory initial training, as well as mandatory annual training on identifying, protecting, and marking CUI. Contractor personnel shall be required to complete CUI training as specified by their contract.

D. Incident Management and Breach Response

FHFA employees and contractor personnel are required to immediately report suspected or confirmed breaches of CUI to the FHFA Help Desk at HelpDesk@FHFA.gov or mailto:HelpDesk@FHFA.gov

Revision: 1 Page: 8 of 10

(202)-649-3990. The CUI Procedures address reporting and investigating the misuse of CUI, as well as reporting mislabeled or unlabeled CUI.

E. Self-Inspection Program

FHFA will conduct a self-inspection review of its CUI Program on an annual basis. This self-inspection review will incorporate methods to evaluate CUI Program effectiveness and measure compliance.

F. Agency Reporting

Annual reports on the status of FHFA’s CUI Program implementation, FHFA’s self-inspection program, and any additional requested reports will be provided to NARA as required.

V. Responsibilities

A. Director is responsible for delegating roles and responsibilities for the CUI Program.

Except as provided for in this Policy, only the Director or a delegate may authorize the disclosure of CUI to third parties or the public.

B. Chief Information Officer is designated as the SAO for CUI and is responsible for implementing and overseeing FHFA’s CUI Program to include compliance, management, and establishing policies, procedures and processes for the CUI Program. The SAO for CUI is the primary point of contact for official correspondence, accountability reporting, and other matters of record related to CUI.

C. General Counsel is responsible for providing legal advice and counsel on this Policy as well as legal advice relating to the disclosure and decontrol of CUI.

D. Chief Information Security Officer (CISO) is responsible for implementing security policies and procedures for handling and protecting CUI; developing any necessary contract clauses and associated prescriptions with respect to information security;

providing information security guidance and training; responding to breaches;

maintaining reports of confirmed or suspected breaches, threats, and malfunctions that may have a security impact on FHFA Information, including CUI; and complying with requirements to report breaches to the United States Computer Emergency Readiness Team (US-CERT).

E. Senior Agency Official for Privacy is responsible for establishing and implementing policies for handling and protecting Personally Identifiable Information (PII); responding to PII breaches; maintaining reports of confirmed or suspected breaches of PII; and complying with requirements to report breaches to the US-CERT.

Revision: 1 Page: 9 of 10

F. Records Officer is designated as the CUI Program Manager and serves as the official representative to NARA for CUI-related activities. The CUI Program Manager is responsible for developing and implementing CUI policies and procedures, providing guidance and training, responding to incidents, reporting, and working with the CISO to establish safeguards and information technology procedures for handling and protecting CUI. The CUI Program Manager also coordinates FHFA’s CUI self-inspection program activities.

G. Division and Office Heads are the owners of FHFA Information that their division or office creates or obtains from a third party. They are responsible for:

1. Complying with FHFA CUI requirements, policies, and procedures;

2. Identifying individuals/positions on their staff that need access to CUI;

3. Ensuring that their staff complete any required CUI training;

4. Designating the secured areas where CUI must be stored;

5. Working together to ensure that appropriate controls are in place to protect CUI; and

6. Ensuring that all confirmed or suspected breaches are reported immediately in accordance with this Policy.

H. Contracting Officers are responsible for ensuring that contracts and other agreements with third parties contain appropriate clauses and language requiring the protection of CUI, including any necessary clauses and prescriptions provided by OTIM.

I. Contracting Officers’ Representatives are responsible for monitoring contractor compliance with any contract requirements regarding CUI and ensuring CUI training compliance.

J. Supervisors and Managers are responsible for:

1. Reviewing and ensuring that all CUI is properly marked in accordance with this Policy and the CUI Procedures; and

2. Ensuring that all personnel under their purview complete all required CUI training.

K. FHFA Employees and FHFA Contractor Personnel are responsible for following all policies and procedures for marking, handling, and protecting CUI; maintaining awareness of CUI in their possession regardless of location (e.g., desk, office, laptops, home office, mobile devices); attending annual CUI training; and ensuring that all confirmed or suspected breaches are reported immediately to FHFA’s Help Desk at HelpDesk@FHFA.gov or (202)-649-3990, in accordance with this Policy and related FHFA procedures.

mailto:HelpDesk@FHFA.gov

Revision: 1 Page: 10 of 10

VI. Authorities and References

A. Controlled Unclassified Information, 32 CFR Part 2002, effective November 14, 2016.

B. Controlled Unclassified Information, Executive Order 13556, dated November 4, 2010, (75 FR 68675).

C. NIST Special Publication 800-171, Revision 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, dated February 21, 2020.

D. FHFA Policy No. 209 – Information Technology Security Policy, dated July 23, 2020 (Signed 8/7/2020).

E. FHFA Policy No. 301 – Use and Protection of Personally Identifiable Information Policy, dated August 22, 2010.

F. FHFA Policy No. 701 – Facility Management Policy, dated September 14, 2018.

G. FHFA Order No. 30, Delegations and Designations Related to Information Technology and Records Management.

H. FHFA Order No. 31, Delegations of Authority to Sign, On Behalf of FHFA, Memoranda of Understanding and Agreements, and Other Information Sharing Documents, and to Disclose Non-Public Information, Including Confidential Supervisory Information.

I. FHFA Order No. 53, Delegation of Agency Research Officer and Delegation of Authority to Decontrol and Release Controlled Unclassified Information (CUI) Related to Research Products of the Federal Housing Finance Agency.

J. Controlled Unclassified Information Procedures.

K. FHFA Office of Technology and Information Management and Office of General Counsel Privacy Office Information Security Incident and Personally Identifiable Information Breach Response Plan, dated August 1, 2019.

VII. Records Retention

Agency records that result from this Policy are retained in accordance with FHFA’s Comprehensive Records Schedule. FHFA’s Comprehensive Records Schedule is available on FHFA’s intranet and on www.FHFA.gov in the About Us section under FHFA Policies/Records and Information Management.

http://intranet.fhfa.gov/downloader.ashx?objectid=4951467 http://ims.fhfa.gov/o/2236909 http://ims.fhfa.gov/o/3576505/Facility-Management-Policy.pdf http://ims.fhfa.gov/o/2238750/Order%2030_Deleg%20Desig%20Related%20to%20InfoTech%20and%20Recds%20Mgmt%20(10-27-13).pdf http://ims.fhfa.gov/o/2238751/Order%2031_DelegSignMOUs-Agrmnts-InfoShar%20and%20ToDiscloNPI%20(10-27-13).pdf http://intranet.fhfa.gov/downloader.ashx?objectid=4517698 http://intranet.fhfa.gov/downloader.ashx?objectid=4049863 http://intranet.fhfa.gov/downloader.ashx?objectid=4049863 http://intranet.fhfa.gov/downloader.ashx?objectid=4049863 http://intranet.fhfa.gov/downloader.ashx?objectid=2343140

FEDERAL HOUSING FINANCE AGENCY

Controlled Unclassified Information (CUI) Procedures

Approved:

4/21/2021

X Kevin Smith Kevin Smith Senior Agency Official for CUI Signed by: KEVIN SMITH

FHFA Procedures No: 222

Revision: 1 Page: 2 of 29

Table of Contents

I. Purpose

II. Scope

III. Procedures

IV. Records Retention

Appendix A – CUI Definitions

Appendix B – Responsibilities

Appendix C – Authorities and References

Appendix D – CUI Inventory

Revision: 1 Page: 3 of 29

I. Purpose

These Controlled Unclassified Information (CUI) Procedures (Procedures) set forth the requirements necessary to manage and monitor FHFA’s CUI Program as provided in FHFA Policy No. 222 – Controlled Unclassified Information Policy.

II. Scope

The CUI Procedures apply to all information created by, obtained by, or communicated to an FHFA employee or contractor personnel in connection with the performance of official duties, regardless of the medium in which the information resides. These Procedures apply to all FHFA employees and to contractor personnel to the extent specified by their contract.

III. Procedures

The Office of Technology and Information Management (OTIM) is responsible for administering the CUI Program. These Procedures set forth the requirements for protecting and handling CUI.

A. Background

The National Archives and Records Administration (NARA) is the CUI Executive Agent for the federal government and issued 32 CFR Part 2002, Controlled Unclassified Information, dated November 14, 2016, which governs the management and oversight of CUI and provides program implementation guidelines.

NARA established the CUI Registry, an online repository, which identifies and describes all CUI categories and links them to supporting laws, regulations, and government-wide policies. CUI does not pertain to nor does FHFA handle National Security Classified Information.

FHFA Information generally falls into one of two categories: Public Information or CUI (see Appendix A – Definitions). The types of CUI most likely to be encountered at FHFA include but are not limited to those listed on the CUI Inventory (see Appendix D – CUI Inventory).

B. Marking CUI

1. Public Information – No explicit designations or markings are required for Public Information.

http://intranet.fhfa.gov/downloader.ashx?objectid=4207894

Revision: 1 Page: 4 of 29

2. Marking Documents Containing CUI – Employees or contractor personnel who create, modify, or receive documents (electronic or hard copy) containing CUI are responsible for ensuring that the information is properly marked. The requirement to apply CUI markings has been waived for documents received from third parties, including the regulated entities (see section III.B.3.a). However, CUI received from third parties needs to be marked as CUI prior to dissemination outside of the Agency.

CUI information must contain two marking elements:

a. Banner Markings – Include one of the banner markings below centered in the header on a line by itself:

i. CUI Basic – “CONTROLLED”; or

ii. CUI Specified – “CONTROLLED//SP-” followed by CUI markings that indicate each category of CUI information. External emails containing CUI Specified must include in the subject line each category marking (see Appendix D – CUI Inventory).

b. Designating Agency – Include identification of FHFA as the designating agency on the first page of the document. Examples of Agency designation include the Agency logo, letterhead, an FHFA email address, or “Controlled by FHFA” in the center of the footer. While not required by FHFA Policy or the CUI Rule, where there is a business need, there is the option to add “Controlled by FHFA” to the footer of every page of the document.

3. Exceptions to CUI Document Markings

a. In accordance with 32 CFR 2002.38, the Senior Agency Official (SAO) for CUI has waived the requirement to mark CUI in the following circumstances:1

i. Documents Received from Third Parties including the regulated entities – Employees are not required to mark CUI received from third parties including the regulated entities and Office of Finance. However, such documents must be marked with the correct CUI markings if they are later disseminated outside of the Agency (see section III.B.3.b below for appropriate alternative marking methods) or if CUI from a third-party document is used to create a new FHFA document. Contractor personnel working on-site at FHFA are not required to mark CUI received from third

1 The SAO for CUI may issue marking waivers in addition to those discussed above. See section III.J for additional information regarding CUI waivers.

Revision: 1 Page: 5 of 29 parties. Off-site contractor personnel shall mark CUI as stated in their contract.

ii. Documents Containing Legacy Markings – All FHFA Information marked (“Non-Public,” “Non-Public Restricted,” or any other markings) prior to the September 30, 2019 launch date of FHFA’s CUI Program constitutes CUI that shall be protected in accordance with these Procedures. However, employees and contractor personnel do not need to update legacy markings with “CONTROLLED” and the Agency designation unless the document is modified, a new document with the correct markings is created using CUI from an existing document, or the document needs to be approved for dissemination outside of FHFA.

iii. Internal FHFA Emails – A waiver will apply to FHFA emails that contain CUI (Basic or Specified) sent or received by FHFA employees or contractor personnel to an FHFA email address (hereinafter referred to as “internal emails”). This waiver only applies to internal FHFA emails while the CUI remains within FHFA’s control. CUI markings will be required when FHFA CUI is shared outside of the Agency (e.g., with third parties, the regulated entities, other agencies). CUI, including Non-Public Information and Confidential Supervisory Information, may not be released to a third party or to the public unless authorized as reflected in section III.D.3 of these Procedures.

b. Alternative Marking Methods for Documents Requiring Preservation in their Original State – In certain circumstances, it may be necessary to maintain an unmarked CUI document or a document with legacy markings in its original, unmodified state, even when that document is disseminated outside the Agency. Employees and contractor personnel shall not remove legacy markings from or add CUI markings to documents that are:

i. Subject to a litigation hold, until the litigation hold has been lifted;

ii. Produced in response to a subpoena, discovery request, or other litigation proceeding;

iii. Produced in response to a Congressional request or subpoena; or

iv. Obtained from the regulated entities where it is necessary to maintain the document in its unaltered state.

In circumstances where CUI must be disseminated to a third party but the removal of legacy markings or the addition of CUI markings is not appropriate, employees and contractor personnel shall use alternative methods

Revision: 1 Page: 6 of 29 to notify the recipient of the information’s status as CUI. Such alternative methods may include the use of a transmittal letter, a CUI coversheet explaining the information’s status as CUI, or including the CUI in an email attachment with an explanation in the email text as to the information’s CUI status.

4. Marking Transmittal Documents, Packages, Equipment, and Removable Media

a. Internal and external transmittal documents (e.g., cover letters, CUI coversheets) should indicate that the transmitted information contains CUI by using the appropriate banner markings on the transmittal document. If the transmittal letter does not contain CUI, include the following language:

“Enclosure contains CUI. When the enclosure is removed, this page is not subject to handling or dissemination controls.”

b. Removable media (e.g., DVDs, USB storage devices, external hard drives) must be marked with “CONTROLLED” or “CUI” and identify FHFA as the designating agency on the exterior. If space allows, applicable CUI Specified markings should be included. OTIM will add the appropriate CUI markings before providing the removable media to the requestor.

c. Packages containing CUI must include instructions to deliver only to the identified recipient. Employees and contractor personnel should maintain tracking information using automated tools when possible. The package exterior must not include any CUI markings.

5. Marking Information Systems Containing CUI – As part of FHFA’s risk-based CUI compliance approach, FHFA’s strategy is to mark only those new systems that the Agency determines require additional protections for CUI “over and above” existing controls due to the particularly sensitive information contained in the system. FHFA existing controls for the marking of FHFA systems and protection of CUI within those systems include:

a. All FHFA network users are notified upon signing into the network that FHFA’s information system contains CUI;

b. FISMA Reportable systems that manage CUI are assessed and rated at the moderate confidentiality impact level in accordance with Federal Information Processing Standard Publication 199 (FIPS 199), Standards for Security Categorization of Federal Information and Information Systems;

http://intranet.fhfa.gov/downloader.ashx?objectid=4922450 http://intranet.fhfa.gov/downloader.ashx?objectid=4922450 http://intranet.fhfa.gov/downloader.ashx?objectid=4922450

Revision: 1 Page: 7 of 29

c. FHFA’s Rules of Behavior incorporate CUI protection requirements and are reviewed and signed annually by all employees and contractor personnel with network access;

d. Access controls (e.g., limited permissions, authorized users, tokens) are in place based on a business “need to know” and are reviewed annually;

e. System owners are accountable for reviewing access logs and taking specific action when system access issues occur;

f. Project, business unit, or workgroup “boundaries” (e.g., documented business processes, defined information flows, limited access) are in place to protect information;

g. Non-Disclosure Agreements (NDAs) are required before system access is granted to contractor personnel;

h. Training on how to manage, mark, protect, and securely dispose of CUI is in place; and

i. Reminders are reinforced in other training (e.g., Privacy, Security, RIM, and CUI Specified training, Fresh Facts articles), as well as in user agreements, warning signs, banners, and acknowledgement pages.

For some information systems it may be impractical to individually mark CUI contained in the system due to the quantity or nature of the information.

Employees and contractor personnel who are authorized users of a system will be notified that the system contains CUI. Authorized users are required to protect CUI contained in the system from unauthorized use or disclosure in accordance with these Procedures. It is the responsibility of employees and contractor personnel to ensure that all files or documents (e.g., ad hoc reports, printouts) containing CUI that are extracted from such systems are marked in accordance with these Procedures.

6. Administrative Markings – Administrative markings are non-CUI markings used to indicate the non-final status of documents. Administrative markings are not CUI markings and may not be used to indicate that a document is subject to safeguarding or dissemination controls. The only administrative marking permitted for use at FHFA is the term “Draft.” “Draft” may be used in a document footer, in the subject line, in the title of a document, or as part of the file name. If “Draft” is in the header of the document, it must be underneath “CONTROLLED” on a separate line.

http://intranet.fhfa.gov/downloader.ashx?objectid=5538429

Revision: 1 Page: 8 of 29

7. Prohibition on Other Markings – Only the CUI markings provided for under these Procedures may be used at FHFA to indicate that a document or information is subject to safeguarding or dissemination controls. Likewise, only the administrative marking “Draft” provided for under these Procedures may be used to indicate a document’s non-final status. Other markings, such as “Confidential,” “Confidential Draft,” “Sensitive,” “Privileged,” “For Internal Discussion Purposes Only,” or other similar or synonymous markings shall not be used.

8. Explanation of CUI Markings – Although not required, when providing CUI to third parties, employees and contractor personnel may include with the CUI an explanation of the CUI marking. Sample explanatory language for various categories of CUI will be made available on FHFA’s intranet, subject to revision.

9. CUI Received from Other Federal Agencies

a. FHFA employees and contractor personnel must protect CUI Basic and CUI Specified received from other federal agencies in accordance with the requirements for the category of information indicated.

b. Any person with authorized access to CUI who believes that another federal agency’s information is improperly designated as CUI or is incorrectly marked as CUI, may contact the agency that provided the information, FHFA’s CUI Program Manager, or complete a CUI Challenge Form.

Employees and contractor personnel shall protect (but not mark) the information at issue in accordance with these Procedures until the issue is resolved.

C. Safeguarding Measures

All FHFA employees and contractor personnel are responsible for preventing unauthorized access to or disclosure of CUI in both physical and electronic environments when employees or contractor personnel are working on-site as well as in other locations (e.g., when teleworking, traveling, or working at field locations).

1. Physical Environment

a. Employees and contractor personnel must ensure that:

i. CUI in their possession is kept under their direct control or protected behind one physical barrier (e.g., a locked file cabinet, locked office door, or a locked file room) when left unattended during business hours Monday through Friday and after business hours Monday through Thursday;

http://intranet.fhfa.gov/downloader.ashx?objectid=4207875 https://ims.fhfa.gov/o/5577356/FHFA%20Form%20222-A%20CUI%20Challenge%20Form.pdf

Revision: 1 Page: 9 of 29

ii. After business hours on Friday (or on the last day of the week that the employee or contractor personnel is in the office), CUI must be removed from desktops and credenzas and secured in a locked file cabinet or file room prior to departure;

iii. Unauthorized individuals cannot see CUI in the employees’ or contractor personnel’s possession and cannot overhear conversations if CUI is being discussed; and

iv. CUI sent to a non-desktop printer is retrieved promptly.

2. Electronic Environment

a. Employees and contractor personnel must ensure that:

i. Electronic files containing CUI are stored only on approved FHFA drives, with permissions to electronic folders limited only to authorized personnel;

ii. Emails containing CUI are not sent to personal email or webmail accounts, including contractor personnel’s non-FHFA work email accounts if the contractor personnel have been provided FHFA email accounts;

iii. External emails containing CUI Specified must be marked with each CUI Specified category listed in alphabetical order in the subject line.

Employees do not need to mark emails to external parties containing CUI Basic as these emails are automatically marked with the “CONTROLLED” marking near the top margin as the first text in the body of the email. Additional marking in the signature block is optional;

iv. CUI may be transferred to removable media (e.g., DVDs, USB storage devices, external hard drives) only after a Form 082, FHFA Information Removal Waiver Request, has been completed and approved (the Help Desk will encrypt the CUI on the removable media); and

v. Removable media containing CUI is kept under their direct control or protected with at least one physical barrier. Removable media containing CUI may be transferred to authorized recipients in accordance with these Procedures.

b. OTIM shall ensure that all electronic FHFA information systems containing CUI, including information systems operated on behalf of FHFA by a third party, are minimally rated at the moderate confidentiality impact level in accordance with FIPS 199, Standards for Security Categorization of Federal

Revision: 1 Page: 10 of 29

Information and Information Systems. OTIM shall apply the appropriate security requirements and controls from FIPS 200, Minimum Security Requirements for Federal Information and Information Systems, and NIST SP 800-53, Assessing Security and Privacy Controls in Federal Information Systems and Organizations. Systems will be developed and managed according to FHFA Policy No. 205 – System Development Lifecycle Policy and FHFA Policy No. 209 – FHFA Information Technology Security Policy.

Contractor information systems that contain FHFA CUI but are not operated on behalf of the Agency shall be required to be protected in accordance with NIST SP 800-171, Revision 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

3. Safeguarding CUI Specified – Information that is CUI Specified may have specific safeguarding controls that are required by law, regulation or government-wide policy. Employees and contractor personnel who handle or create CUI Specified are responsible for being aware of and complying with these specific safeguarding controls. See Appendix D – CUI Inventory for additional information regarding the types of CUI Specified likely to be encountered at FHFA and the associated controls.

4. Safeguarding and Handling CUI while Teleworking – FHFA Information that is CUI and must be handled as such even at home or another location. Securely store and protect CUI in any format including storing physical CUI in a secure locked location when not in use. FHFA employees and contractor personnel are responsible for preventing unauthorized access to or disclosure of CUI in both physical and electronic environments even when working in other locations including teleworking, traveling, or working at field locations.

5. Limit Printing to Extenuating Circumstances – Hardcopy CUI materials should not be disposed of in recycling or trash receptacles. All hardcopy documents containing CUI must be destroyed in a manner that makes the information unreadable, indecipherable, and unrecoverable.

D. CUI Access, Dissemination, and Decontrol2

1. Access to CUI within FHFA – FHFA employees and contractor personnel who create or maintain CUI may provide other FHFA employees and contractor personnel with access to that CUI to the extent specified by their contract. If an employee or a contractor personnel is unsure whether providing access to another FHFA employee or to contractor personnel is appropriate, the employee or contractor personnel shall seek guidance from his or her supervisor or COR.

2 The procedures set forth in this section do not govern whether the information may be properly released pursuant to the Freedom of Information Act or the Privacy Act of 1974. Disclosure determinations under the Freedom of Information Act and the Privacy Act are based solely on application of the criteria set forth in those laws.

Revision: 1 Page: 11 of 29

Further, FHFA employees and contractor personnel have an affirmative duty to refrain from accessing CUI where such access is not authorized or otherwise necessary for the performance of their official FHFA duties.

2. Dissemination of CUI to the Regulated Entities or the Office of Finance – FHFA employees may provide CUI to the regulated entities or the Office of Finance where doing so is required for the performance of official FHFA duties.

If an employee is unsure whether disseminating CUI to a regulated entity or the Office of Finance is appropriate, the employee shall seek guidance from his or her supervisor. If contractor personnel are unsure if such dissemination is appropriate, they shall seek guidance from the relevant COR. CUI provided to the regulated entities or the Office of Finance remains CUI and must be properly marked in accordance with these Procedures to ensure that the recipient is aware of the information’s status as CUI.

3. Dissemination of CUI to Third Parties other than the Regulated Entities/Office of Finance – Other than as described in these Procedures, only the Director or a delegate may authorize the disclosure of CUI to entities or individuals outside of FHFA.3 Any individual who releases FHFA Information to the public is responsible for ensuring that it has been approved for public release by the appropriate FHFA official. Unauthorized disclosure of CUI by an FHFA employee may result in disciplinary action in accordance with FHFA’s Conduct and Discipline Policy or other appropriate action for contractor personnel including contract termination. Employees or contractor personnel who improperly disclose CUI may also be subject to civil and/or criminal penalties, depending on the nature of the information disclosed. CUI properly authorized for dissemination to a third party must be marked in accordance with these Procedures to ensure that the recipient is aware of the information’s status as CUI.

If employees or contractor personnel identify a need to disseminate CUI to a third party other than a regulated entity or the Office of Finance, they must obtain approval for the dissemination from 1) the head of the Division or Office that created or obtained the information (the Information Owner), and 2) the Director or a delegate. If the Information Owner concurs in writing that the information is appropriate for dissemination, the dissemination request shall be sent to the Director or a delegate for approval.

4. Releasing Information that is Customarily Provided to the Public as Part of Official FHFA Duties – Information that is customarily furnished to the public in

3 See FHFA Order No. 31– Delegations of Authority to Sign, On Behalf of FHFA, Memoranda of Understanding and Agreements, and Other Information Sharing Documents, and to Disclose Non-Public Information, Including Confidential Supervisory Information and FHFA Order No. 53 – Delegation of Agency Research Officer and Delegation of Authority to Decontrol and Release Controlled Unclassified Information (CUI) Related to Research Products of the Federal Housing Finance Agency.

http://ims.fhfa.gov/o/2238751/Order%2031_DelegSignMOUs-Agrmnts-InfoShar%20and%20ToDiscloNPI%20(10-27-13).pdf http://intranet.fhfa.gov/downloader.ashx?objectid=4517698

Revision: 1 Page: 12 of 29 the course of official FHFA duties (e.g., publicly-released FHFA reports, solicitations for contracts, vacancy announcements)—once finalized and approved for public release—does not constitute Non-Public Information and therefore is not CUI. However, until such information is finalized and properly approved for public release, the information is CUI and shall be handled and marked accordingly in accordance with regulations, orders, policies, and other official guidance. The FHFA official who approves the release of the information is responsible for ensuring that it is appropriate for public release. CUI markings must be removed from all information before it is released to the public.

5. Decontrolling CUI – Decontrolling refers to the process by which FHFA determines that FHFA Information designated as CUI no longer requires protection as CUI. The decision to decontrol CUI is made by the Information Owner in conjunction with the Office of General Counsel (OGC). The Deputy Director of the Division of Research and Statistics (DRS) is also authorized to decontrol CUI related to research purposes as defined in FHFA Policy No. 1501 – Research Dissemination Policy. The Information Owner will notify the SAO for CUI once information is decontrolled to indicate that it is no longer required to be marked as CUI and it is not subject to the applicable CUI safeguarding requirements set forth in these Procedures. However, the process of decontrolling CUI affects only the safeguarding required for the decontrolled information, not the dissemination of the information. CUI that is decontrolled may not be released to a third party or the public without prior authorization by the Director or a delegate.

If employees or contractor personnel identify FHFA CUI that they believe should be decontrolled, they should contact the Information Owner.

Third parties that are authorized recipients of FHFA CUI may also request that FHFA decontrol the CUI in their possession. The CUI Program Manager shall refer such requests to the Information Owner. A determination whether or not to decontrol the information shall be made in accordance with these Procedures.

6. Special Considerations for CUI Specified – Information that is CUI Specified may have specific access and/or dissemination controls that are required by law, regulation or government-wide policy and that are in addition to the controls identified in these Procedures. See Appendix D – CUI Inventory for additional information regarding the types of CUI Specified likely to be encountered at FHFA and the associated access and dissemination controls.

7. Whistleblowing Activity Not Restricted – With respect to FHFA employees, nothing…