Final Attachment B - Handling CUI.pdf

Attachment B - Page l

W912HV24R0005: REPAIR BUILDING SECURE SPACE, OKINAWA, JAPAN

Attachment B Instructions for Handling and Dissemination of Controlled

Unclassified Information (CUI)

Access to CUI

CUI may be disseminated within the DoD components and between officials of the DoD components and DoD contractors, consultants, and grantees as necessary in the conduct of official business. CUI may also be released to officials in other departments and agencies of the executive and judicial branches in performance of a valid government function.

Marking CUI

Unclassified documents and material containing CUI information shall be marked as follows:

• Documents will be marked CONTROLLED UNCLASSIFIED INFORMATION (CUI) at the bottom of the front cover (if there is one), the title page (if there is one), the first page, and the outside of the back cover (if there is one).

• Pages of the document that contain CUI shall be marked CONTROLLED UNCLASSIFIED INFORMATION at the bottom. -

• Each paragraph containing CUI shall be marked with the abbreviation CUI in parentheses at the beginning of the CUI portion.

• Material other than paper documents (for example, slides, computer media, films, etc.) shall bear markings which alert the holder or viewer that the material contains CUI information.

• CUI documents and material transmitted outside the Department of Defense must bear an expanded marking on the face of the document so that non-DoD holders understand the status of the information. A statement like this one should be used:

This document contains information exempt from mandatory disclosure under the FOIA.

Exemption(s) _ apply.

When CUI information is contained within a classified document, the same rules apply except that full pages that contain CUI, but no classified information shall be marked CONTROLLED UNCLASSIFIED INFORMATION at both the top and bottom of the page.

Safeguarding Controlled Unclassified Information

CUI should be handled in a manner that provides reasonable assurance that unauthorized persons do not gain access.

During working hours, reasonable steps should be taken to minimize risk of access by unauthorized personnel.

After working hours, CUI may be stored as a minimum in unlocked containers, desks, or cabinets if government or government-contract building security is provided. If government or government-contract building security is not provided, it must be stored at a minimum in a locked desk, file cabinet, bookcase, locked room, or similar place.

CUI documents and material may be transmitted via first class mail, parcel post, or -- for bulk shipments --fourth class mail.

Attachment B - Page 2

Fax or e-mail transmission of CUI (voice, data, or facsimile) must be by encrypted communications systems. CUI information may not be made publicly available (i.e., placed on the internet) and if maintained on a network, data must be encrypted at rest.

CUI documents must be destroyed by using a cross-cut shredder when no longer needed.

The Contractor is prohibited from further disclosure, dissemination, removal, or reproduction of this information without the expressed written authorization of the Contracting Officer or their representative.

The Contractor will maintain sufficient records to detail accountability for all copies of provided documents.

The Contractor requires written permission from the Contracting Officer or their designated representative to share CUI with Foreign Nationals.

Enforcement

Administrative penalties may be imposed for misuse of CUI. Criminal penalties may be imposed depending on the actual content of the information (privacy, export control, etc.).

Legal & Regulatory Authorities

5 USC 30l - Departmental Regulations DoD Manual 5200.0l-V4 - The Information Security Program: Controlled Unclassified Information DoD Directive 5400.7 - The Freedom of Information Act (FOIA) Program DoD Regulation 5400.7-R - The DoD Freedom of Information Act Program DoD Regulation 5400.ll-R - Department of Defense Privacy Program

Signature Printed Name Date

Organization (Provide Name, Address, and Phone Number)

I acknowledge and understand my responsibilities for the handling and protection of CUI.

Attachment l - Page l

Attachment 1

Operations Security (OPSEC) Addendum

(U) Operations Security (OPSEC). Contractor must develop and implement processes and procedures to protect unclassified and sensitive aspects of the project from disclosure to unauthorized personnel (i.e., anyone operating outside the scope of the project). Information that must be protected falls into three categories: administration / organization, operations, and facility design. The contractor must protect organizational data that includes unit mission, organizational structure, administrative & operational support relationships with higher headquarters and host nation organizations. The contractor must protect operations data that includes installation activities & operations, construction activities & operations, and installation & construction security procedures and protocols.

The contractor must also protect facility design information reflecting sensitive capabilities and vulnerabilities.

The critical information list highlights other unclassified and sensitive information that may require protection from disclosure to unauthorized personnel.

(U) Contractors may be required to sign the non-disclosure agreements indicating that they will not reveal or discuss project or installation details with unauthorized personnel. Unless authorized by installation security officer, cameras, and communications devices (e.g., cell phones, laptops, thumb drives) are prohibited on installation.

Attachment 2 - Page l

Attachment 2 Critical Information List (U)

l. (U) Administration / Organization Information

• Installation tenant unit names or designators, unit missions or functions, organizational structure, administrative & operational support relationships with higher headquarters and host nation organizations

• Numbers, specialties, names, and contact information of personnel assigned / working on site

• Numbers and types of vehicles located on site

2. (U) Operations Information

• Installation activities & operations

• Construction activities & operations, such as equipment & material acquisition, delivery, & installation procedures & schedules

• Installation & construction security procedures and protocols, including strengths & weaknesses, layout, entry control procedures

• Personnel issues (e.g., disciplinary actions, alcoholism, and indebtedness)

• Security violations, on-going investigations, or investigation results

• Site visitors, especially distinguished visitors (e.g., agendas, visit purpose)

• Utility outages (scope / impact & schedule)

3. (U) Facilities Information

• Installation site plans (e.g., facilities layout, utilities & communications infrastructure)

• Building designs & specifications; specific types (make & model) of equipment and materials being installed in the facility

• Computer & communications systems designs & specifications

• Security system plans, capabilities, and vulnerabilities

Attachment 3 - Page l

Attachment 3

Additional Information for Prime Contractors

l. The Prime Contractor may make additional copies or reproductions of any part of the solicitation documents

(W9l2HV-24-R-0005) for its subcontractors and its suppliers. The Prime Contractor shall follow Instructions for Handling and Dissemination of Controlled Unclassified Information (CUI) (see Attachment B), Operations Security (OPSEC) Addendum (Attachment l), and Critical Information List

(U) (Attachment 2).

2. The Prime Contractor shall have its subcontractors and its suppliers sign and complete the following forms:

a. Controlled Unclassified Information Non-Disclosure Agreement (Attachment A)

b. Instructions for Handling and Dissemination of Controlled Unclassified Information (CUI)

(Attachment B)

3. The Prime Contractor shall design document control procedures and identify personnel with the Prime Contractor and all subcontractors and all suppliers, who will be responsible for maintaining document control records. These personnel shall be identified.

4. All subcontractors must also comply with all document control policies, and is prohibited from further disclosure, dissemination, removal, or reproduction of this information without notifying the Prime Contractor.

5. The Prime contractor-designated document control personnel shall maintain sufficient records to detail accountability for all copies of provided documents. At a minimum the records must contain the names of all persons issued documents along with a detailed description of the documents provided.

6. The Prime contractor document control personnel shall verify all documents are returned to their control when no longer needed by personnel within their organization or by its subcontractors.

7. The Contractor shall limit dissemination of all information based on a "need-to-know" basis. The Prime Contractor is responsible for controlling all forms of information, including documents, drawings, sketches, photographs/exposed negatives, written descriptions of work requirements, electronic media, and similar information. Upon request, return such information, including copies, promptly to the Contracting Officer / Contracting Officer's Representative (COR), or Site Security Manager (SSM).

8. At any time, the Government may request for the Spreadsheet for Vetting from the Prime Contractor, as well as the completed and signed Instruction for Handling and Dissemination of CUI and the completed and signed Controlled Unclassified Information Non-Disclosure Agreement.