J-3_DD_Form_254_180109.docx

CONTRACT

N00019-95-G-0242

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

1. CLEARANCE AND SAFEGUARDING

b. LEVEL OF SAFEGUARDING REQUIRED

H92222-18-R-0001

10 Oct 2017

Date (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? |_| YES |X| NO If YES, complete the following

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract

5. IS THIS A FINAL DD FORM 254? |_| YES |X| NO If Yes, complete the following:

In response to the contractor’s request dated , retention of the classified material is authorized for the period of

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE

b. CAGE CODE

c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE

b. CAGE CODE

c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION

SEE CONTINUATION PAGE

b. CAGE CODE

c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT. USSOCOM Enterprise Wide Training and Exercises Program (UEWTEP). The UEWTEP provides a full range of training and exercise support from design and execution at the HQ USSOCOM, Components RCCs, JTFs, C/JFSOCCs and SOJTFs related to execution of SOF Core Operations: Unconventional Warfare, Stability Operations, Foreign Internal Defense, Counter Insurgency Operations, Security Force Assistance, Counter Terrorism, Joint, Interagency, and Coalition operations and Civil-Military Operations and the following SOF Core Activities: Special Reconnaissance, Security Force Assistance, Military Information Support Operations, Civil Affairs Operations, Interdiction and Offensive CWMD Operations, Hostage Rescue and Recovery, SOF Service Combat Support, SOF Combat Support, Direct Action and Preparation of the Environment.

Period of Performance: (Date Required) (ANNUAL DD FM 254 REVIEW REQUIRED)

e. INTELLIGENCE INFORMATION

i. LIMITED DISSEMINATION INFORMATION

k. OTHER (Specify) NIPRNET/SIPRNET (JIANT)/JWICs access required at government facilities only.

DD Form 254, DEC 1999 PREVIOUS EDITION IS OBSOLETE

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the Industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release. Direct Through (Specify) X

No Public Release Is Authorized For Sensitive Compartmented Information (SCI) Or Special Access Programs (SAP).

All other requests must be forwarded through the certifying official (block 16), USSOCOM Office of Public Affairs (SOCS-PA), and the Contracting Officer.

To the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

* In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance, or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes. The contractor may also challenge guidance or the classification assigned to any information or material furnished or generated under this contract; and may submit questions for interpretation of the guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

The Program Manager listed in block 16 will provide a copy of all applicable security directives for this contract. Appropriate applicable command security directives, regulations, and standard operating procedures will be provided by the requiring agency (normally through the Performance Monitor or designated COR). Upon completion or termination of the classified contract, or sooner when the purpose of the release has been served, the contractor will return all classified information (furnished or generated) to the source from which received unless retention or other disposition instructions are authorized in writing by the USSOCOM Government Contracting Agency/Activity.

Furthermore, the contractor will account for and return to the appropriate issuing office, all Common Access Cards (CAC), security badges, installation entry passes/vehicle decals issued to contractor personnel upon completion or termination of the classified contract, termination of employment, or suspension of classified clearance or access of any contractor employee.

SEE CONTINUATION PAGE

Reviewed/Approved Michael Cauble USSOCOM Industrial Security

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. |_| YES |_| NO (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement, which identifies the additional requirements. Provide a copy of the requirements to the Cognizant Security Office. Use Item 13 if additional space is needed.)

SEE CONTINUATION PAGE

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the Cognizant Security Office. |_| YES |_| NO (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

SEE CONTINUATION PAGE

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL Glen Guillow

b. TITLE UEWTEP Program Manager

c. TELEPHONE (Include Area Code) 813-826-1343

HQ USSOCOM/SORDAC-AS

7701 TAMPA POINT BLVD

MACDILL AFB, FL 33621-5323

DD FORM 254 (BACK), DEC 1999

DD FORM 254 CONTINUATION PAGE

Ref 2b: Subcontracting of this effort must be approved by HQ USSOCOM prior to award. Forward requests and draft Subcontract DD FM 254s to the Certifying Official identified in Block 16 and USSOCOM Industrial Security (IndustrialSecurity@socom.mil). (IAW USSOCOM R 380-9, Industrial Security, please allow 10 duty days for review/approval).

Ref 7: See guidance in Ref 2b.

SECTION 8:

a. HQ USSOCOM

b. N/A

c. HQ USSOCOM/SOCS-Z-SM MacDill AFB, FL 7701 Tampa point Blvd.

MacDill AFB, FL 33621

a. MARSOC

b. N/A

c. MARSOC Camp Lejeune, NC ATTN: Security Manager or SSO PSC Box 20116 Camp Lejeune, NC 28542

a. AFSOC

b. N/A

c. 1st Special Ops Wing IP Office Hurlburt Field, FL 212 Lukasik Avenue, Ste 230 Hurlburt Field, FL 32544

a. USASOC

b. N/A

c. Commander, USASOC, AOIN-SOD Fort Bragg, NC 2929 Desert Storm Dr. Stop A Ft. Bragg, NC 28310

a. NSWC

b. N/A

c. Commander, Naval Special Warfare San Diego, CA 2000 Trident Way San Diego, CA 92155

a. NSWG 1

b. N/A

c. Commander, Naval Special Warfare Group One Little Creek, VA 1300 Helicopter Road Bldg. 3854 Virginia Beach, VA 23459-2944

a. JSOC

b. N/A

c. HQ JSOC Ft. Bragg, NC Attn: JSOC-SD P.O. Box 70239 Ft Bragg, NC 28307

a. SOCPAC

b. N/A

c. Special Operations Command Pacific Camp H.M. Smith, Hawaii SOJ24

BOX 64046

Camp H.M. Smith, HI 96861-4046

a. SOCCENT

b. N/A

c. Special Operations Command Central MacDill AFB, FL Attn: SOC-J2 7115 South Boundary Blvd.

MacDill AFB, Fl 33621-5101

a. SOCSOUTH

b. N/A

c. Special Operations Command South Homestead ARB, Fl 29350 Coral Sea Blvd.

Homestead ARB, Fl 33039

a. SOCEUR

b. N/A

c. Special Operations Command Europe Stuttgart, Germany ATTN: SOCEUR SSO Unit 30400

APO, AE 09131

a. SOCAFRICA

b. N/A

c. Special Operations Command Africa Stuttgart, Germany ATTN: SOCAFRICA SSO Unit 30401

APO, AE 09107

a. SOCKOR

b. N/A

c. SOCKOR J2 SSO Camp Kim, ROK HQ SOCKOR, Unit # 15622

APO AP 96205-0328

a. SOCNORTH

b. N/A

c. SSO NORTHCOM Peterson AFB, CO ATTN TRACY Hankinson 250 Vandenberg At Peterson AFB CO 89914

SECTION 13:

Numerous security classification guides may apply to this contract and will be issued to the contractor as needed by the cognizant government Program Manager. Each task order will identify the security service needed to perform the service and the security classification guide that governs the classification of the material to be handled.

All classified information generated under this contract will be derivatively classified IAW DODM 5200.01 Volume 2, utilizing existing classified source documents or applicable classification guides.

Ref. 10a: COMSEC security requirements apply. Contractor must forward requests for COMSEC material/information to the appropriate COMSEC officer through the program office. The contractor is governed by DoD 5220.22-M, NISPOM. Access to COMSEC material by personnel is restricted to U.S. citizens holding final U.S. Government clearances. Such information is not releasable to personnel holding only reciprocal clearances. The government program/project manager shall designate the number of personnel requiring cryptographic access. The number will be limited to the minimum necessary and will be on a strict need-to-know basis. Additional COMSEC requirements may be required at non USSOCOM locations/facilities (based on service/command requirements). The Performance Monitor or component command COR at these locations/facilities will provide specific information.

- Subcontracting of COMSEC material by a contractor requires prior approval of the contracting activity.

- Access to COMSEC material requires special briefings.

- Access to classified COMSEC material requires a final U.S. Government clearance at the appropriate level.

- Access to COMSEC material may require contractor to complete a counterintelligence (CI) scope polygraph examination.

Ref 10b: Contractor is permitted access to Restricted Data (RD) in the performance of this contract and requires a final U.S. Government clearance at the appropriate level.

Ref 10c: Contractor is permitted access to CNWDI in performance of this contract, requires a final U. S. Government clearance at the appropriate level, and requires special briefing prior to being granted access.

Ref 10d: Contractor is permitted access to Formerly Restricted Data (FRD) in the performance of this contract and requires a final U.S. Government clearance at the appropriate level.

Ref. 10e (1): See SCI Addendum.

Ref 10f: See SAP Addendum.

Ref 10g: The contractor is permitted access to North Atlantic Treaty Organization (NATO) information in performance of this contract. Access to NATO information requires a final U.S. Government clearance at the appropriate level. The government program/project manager is the designated representative that will ensure the contractor security manager and concerned employees are NATO briefed prior to access being granted. The contractor will maintain strict compliance in regards to NATO information IAW NISPOM Ch 10, Section 7. Prior approval from the contracting activity is required for subcontracting.

Ref. 10h: The contractor is permitted access to Foreign Government Information (FGI) in the performance of this contract. Access to FGI requires a final U.S.

Government clearance at the appropriate level. Contractor employees will be briefed, and acknowledge in writing, their responsibilities for handling FGI prior to being granted access. The contractor will maintain strict compliance with NSPOM Ch 10. Prior approval of the contracting activity is required for subcontracting.

Ref. 10j: FOUO information/provided under this contract shall be safeguard as specified in the attachment, Protecting for Official Use Only (FOUO) Information.

Ref 10k: Alternative Compensatory Control Measures (ACCM) Program information is governed by DoD M 5200.01-V3, “DoD Information Security Program: Protection of Classified Information,” Enclosure 2, Section 18; CJCS Manual 3213.02D, “Joint Staff Alternative Compensatory Control Measures (ACCM) Program Management Manual” and supporting documentation for each ACCM sub-system, including security classification guides, program security plans, and governing directives. Inspections of ACCM information in USSOCOM, Component (JSOC, AFSOC, NSWC, MARSOC, or USASOC), or Theater Special Operation Command (SOCNORTH, SOCAFRICA, SOCCENT, SOCEUR, SOCPAC, SOCSOUTH, or SOCKOR) owned and operated facilities are under the auspices of the respective Command or Component ACCM Coordinator/ACCM Program Control Officer (ACCM Coord/ACCM PCO). If applicable, ACCM material maintained by the Contractor within their facility must be afforded protection commensurate with DoD requirements and strictly controlled based on need to-know and required briefings. DSS personnel conducting inspections of the Contractor must be briefed on to the specific program by the appropriate government ACCM Coord/ACCM PCO responsible for the material prior to being granted access.

Ref 11a: Contractor performance is restricted to above listed performance locations under Section 8. Government agency or activity will provide security classification guidance for performance of this contract. Submit visit request to COR and/or Security Management Office for need-to-know verification.

SECTION 14:

While performing duties at USSOCOM, Component (JSOC, AFSOC, NSWC, MARSOC, or USASOC), or Theater Special Operation Command (SOCNORTH, SOCCENT, SOCEUR, SOCPAC, SOCSOUTH, SOCAFRICA, or SOCKOR) owned and operated facilities, the contractor will adhere to the applicable Information Security Program, ADP and DoDIIS Programs, Physical Security Program, Industrial Security Program, and SCI/SAP Program (if applicable). Prior approval of the contracting activity is required for subcontracting. Access to intelligence information requires special briefings and a U.S. Government clearance at the appropriate level.

Training Requirement: Contractors performing on this contract at military installations are required to conduct command and unit specific security training (Initial/Refresher INFOSEC, OPSEC, EMSEC, AT/FP, Etc.). This training will be provided by the responsible military organization.

IA requirements: Specific Information Assurance requirements may be mandated and are authorized by the responsible command/unit where primary performance location is identified.

Contractor will be authorized to courier classified information up to the SECRET level in performance of official duties upon approval of and designation by the COR, PM, and/or SSO.

Contractors are not authorized to conduct the following security related functions such as opening/closing of security containers, endof-day security checks for processing and safeguarding classified information/material, and arming/de-arming of government facilities.

SECTION 15:

Defense Security Service is relieved of all inspection responsibility within USSOCOM, Component (JSOC, AFSOC, NSWC, MARSOC, or USASOC), or Theater Special Operation Command (SOCCENT, SOCEUR, SOCPAC, SOCSOUTH, SOCAFRICA, SOCNORTH or SOCKOR) owned and operated facilities but retains responsibility for all non-SCI classified material released to or developed under the contract and held within the contractor's facility.

SCI ADDENDUM for DD Form 254 This supplement applies to:

Prime Contract Number: TBD Subcontract Number: N/A Delivery/Task Order Number: N/A Expiration Date:

The following controls will apply to Sensitive Compartmented Information (SCI) provided under this contract.

1. Item 10e (2): Security clearances for contractors working within SCIF spaces must be adjudicated meeting Intelligence Community Policy Guidance (ICPG) 704.1, 704.2, 704.3, 704.4, 704.5 eligibility requirements. Prior approval of the contracting activity is required for subcontracting.

Access to intelligence information requires special briefings and a final U.S. Government clearance at the appropriate level.

2. Item 13: Department of Defense (DoD) Manual 5105.21, Volumes 1-3, Intelligence Community Policy Guidance (ICPG) 704.1, 704.2, 704.3, 704.4, 704.5, Intelligence Community Standard (ICS) 705-1&2 including the Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities (IC Tech Spec-for ICD/ICS 705, and Headquarters, United States Special Operations Command (HQ USSOCOM) 380-6, provide the necessary guidance for physical and information security measures and are part of the SCI security specifications for the contract.

3. Item 13: Inquiries pertaining to classification guidance will be directed to the responsible USSOCOM contract monitor Mr. Glen Guillow, (Guillow@socom.mil, 813-826-1343).

4. Item 13: All SCI furnished to the contractor in support of this contract / delivery / task order remains the property of the DoD or the agency or command that releases the information. Upon termination of the contract, all furnished SCI will be returned to the HQ USSOCOM Special Security Office (SSO) or the prime contractor.

5. Item 14: This contract / delivery / task order requires that ONE EIGHTY ONE (181) contract billets be established in order to fulfill the contractual obligations incurred. Access will be granted by the government agency. Upon completion or cancellation of the contract, the Contractor SSO (CSSO) will debrief or notify the HQ USSOCOM SSO to debrief all personnel not required for contract closeout and those billets will be disestablished.

6. Item 14: Names of contractor personnel requiring access to SCI and justification for SCI billets will be submitted to HQ USSOCOM SSO after contract monitor coordination. Billet justifications will include the contract statement of work. If a Single-Scope Background (SSBI) Investigation has not been completed upon approval of billets by the HQ USSOCOM SSO, the CSSO will submit necessary forms to the Defense Industrial Security Clearance Office (DISCO) for an SSBI. An SSBI and access to SCI will comply with the National Industrial Security Program Manual. Upon completion of the SSBI, a nomination for SCI access will be submitted to HQ USSOCOM SSO.

7. Item 14: The CSSO will advise HQ USSOCOM SSO, through the contract monitor, upon reassignment of personnel to other duties not associated with this contract.

8. Item 14: The CSSO must coordinate with the SCI contract monitor before subcontracting any portion of SCI efforts involved in the contract. A separate DD Form 254 for the subcontractor will be processed and a copy provided to HQ USSOCOM SSO.

9. Item 14: The contractor will not use references to SCI access, even by unclassified acronyms, in advertisements, promotional efforts, or recruitment of employees.

10. Item 14: All SCI work will be performed at the locations specified below and in subsequent Task Orders.

a. Government SCIFs at the Performance Locations identified in Section 8 above.

11. Item 15: HQ USSOCOM SSO has exclusive security responsibility for all SCI released to the contractor or developed under this contract. DIA and HQ SSO SOCOM retain authority for all inspections of the contractor to ensure compliance with SCI directives, regulations, and instructions.

12. In accordance with DoDM 5105.21 Volume 1-3, the following activity is designated User Agency Special Security Office for SCI requirements:

HQ USSOCOM

Special Security Office 7701 Tampa Point Boulevard Telephone: DSN 299-1876 MacDill AFB, Florida 33621-5323 Commercial: (813) 826-1876

Reviewed/Approved Juan Soto Chief, HQ USSOCOM SSO Industrial Security 13 June 2017

PROTECTING SPECIAL ACCESS PROGRAM (SAP) INFORMATION

(Updated February 2016) Special Access Program (SAP) discussion, storage, and processing associated with this effort will be conducted in SAP Facilities (SAPF) specifically approved, in writing, by the USSOCOM SAPCO or designated USSOCOM Government Program Security Officer (GPSO). Contact the individual in Block 16 for approved SAPF locations.

SAP activities are governed by Department of Defense Overprint, Revision I, to the National Industrial Security Program Operating Manual (NISPOM) Supplement, DoD Manual 5200.01 (DoD Information Security Program) Volumes 1-4, DoD 5205.07, DoD Manual 5205.07 Volumes 1,2,3 and 4, DoD Instruction 5205.11, Joint SAP Implementation Guide (JSIG), USSOCOM Manual 380-2 (SAP Security Guide), USSOCOM Manual 380-7 (USSOCOM Arms Control Readiness Inspection Program), and applicable program security classification guides and subsequent versions. Applicable documents will be provided to the contractor by the GPSO under separate cover.

Access to SAP information requires employees undergo additional personnel security screening and meet the requirements of DoD SAP accessing directives and policies in accordance with DoDM 5205.07, Volume 2. The individual must hold the applicable eligibility (final Secret or Top Secret), depending on the level of access required. Program Access Requests (PAR) for contractor personnel must be submitted by the CPSO to the GPSO for approval by the designated Access Approval Authority (AAA). Personnel approved for access will receive a program indoctrination briefing and sign a SAP Indoctrination Agreement (PIA) prior to receiving access to program information or material. The CPSO will maintain the signed PIA and forward a copy to the GPSO for pem1anent retention.

SAP inspections and security oversight while in USSOCOM or Component-managed facilities are under the cognizance of the USSOCOM or PSO, as appropriate. Additional SAP security requirements may apply at non HQ USSOCOM locations/facilities based on service/component command requirements. The Performance Monitor or component command COR at these locations/facilities will provide specific and additional guidance. SAP inspections conducted at approved contractor facilities are under the security oversight of the Defense Security Service (DSS) unless officially relieved of their oversight responsibilities. CPSOs should contact the SOCOM PSO for further guidance.

All classified program communications will be conducted via GPSO approved secure channels. Voice communications will be via GPSO approved secure telephone equipment within the SAPF. Transmission of documents via secure facsimile between terminals within SAPFs may be approved by the GPSO. Only the U.S. Postal Service Register or Certified mail will be used to mail program material unless an alternate method is approved by the GPSO prior to transmission. Briefed personnel are authorized to courier classified information within the continental United States with written approval from the CPSO or GPSO. Two (program briefed) personnel are required to courier Top Secret material unless prior approval is obtained from the GPSO. Also, all couriers will be in the possession of the required courier authorization letters prior to travel. All material, to be mailed or carried, will be wrapped and transmitted in accordance with DoDM 5205.07, Volume 1.

Prior to processing SAP information on any Automated Information System (AIS), the contractor will provide the GPSO with a System Security Plan (SSP) and other documentation required in JSIG for Assessment & Authorization (A&A) from the Authorizing Official (AO), or subsequent policy. The GPSO will issue program specific Security Authorization following verification of the A&A process.

Destruction of program material will be conducted only by program indoctrinated personnel using destruction equipment and procedures approved by the GPSO. A single person may destroy non-accountable classified material. Accountable material must be destroyed, and documented, by two program cleared individuals.

The GPSO will be advised of any reports which affect the baseline facility clearance or any incident that has an adverse impact on a personnel security clearance. All briefed personnel are required to report any information that could have an impact on their ability to protect classified information. Reportable items include: foreign travel, contacts, or associations; criminal, civil, financial, or mental health issues; and changes in personal status such as marriage, divorce, or employment. CPSOs are reminded of their responsibilities to diligently report any significant action or change in an employee’s eligibility to the GPSO immediately.

A security violation is any incident that involves the loss, compromise, or suspected compromise of classified information. All security violations will be reported to the CPSO/GPSO within 24 hours of discovery. A security infraction is any other incident that is not in the best interest of security, but is not a violation as defined above. Security infractions will be documented in the individuals personal security file and made available for review during GPSO visits.

Reviewed/Approved For James A. Torre Chief, HQ USSOCOM SAPCO 13 June 2017

PROTECTING "FOR OFFICIAL USE ONLY" (FOUO) INFORMATION

(Updated June 2014)

1. GENERAL:

a. The "For Official Use Only" (FOUO) marking is assigned to information at the ti.me of its creation in a DoD User Agency. It is not authorized as a substitute for a security classification marking but is used on official government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act (FOIA).

b. Other non-security markings, such as "Limited Official Use" and "Official Use Only" are used by non-DoD User Agencies for the same type of information and should be safeguarded and handled in accordance with instruction received from such agencies.

c. Use of the above markings does not mean that the information cannot be released to the public under FOIA, only that it must be reviewed by the Government prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions of it

2. MARKINGS:

a. Unclassified documents containing FOUO information will be marked "UNCLASSIFIED//For Official Use Only" or "U//FOUO" at the bottom of the front cover (if any), on the first page, on each page containing FOUO information , on the back page, and on the outside of the back cover (if any). Each paragraph containing FOUO information shall be marked as such.

b. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification of information appearing on the page. Individual paragraphs shall be marked at the appropriate level be it classified, unclassified, or FOUO. An individual page that ONLY contains FOUO and unclassified information shall be marked “FOR OFFICIAL USE ONLY” or the highest classification of the entire document at the top and bottom of the page. If an individual portion contains FOUO information but no classified information, the portion will be marked, "FOUO."

c. Mark other records, such as computer print outs, photographs, films, tapes, or slides "FOR OFFICIAL USE ONLY" so that the viewer knows the record contains FOUO information.

d. Removal of the "For Official Use Only" marking can only be accomplished by the originator or other competent authority. When the "For Official Use Only" status is terminated, all known holders will be notified to the extent practical.

3. DISSEMINATION: "For Official Use Only" information may be disseminated between officials of DoD Components, DoD contractors, consultants, and grantees to conduct official business for the DoD. FOUO information may also be passed to officials in other departments and agencies of the executive and judicial branches to fulfill a government function. Recipients shall ·be made aware of the special handling instructions detailed in this document and that it's exempt from public disclosure under the FOIA utilizing the following statement: "This document contains information EXEMPT FROM MANDATORY DISCLOSURE UNDER THE FOIA Exemptions apply."

4. STORAGE: During working hours, "For Official Use Only" information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During nonworking hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks, is adequate when internal building security is provided during nonworking hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after- hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

5. TRANSMISSION: "For Official Use Only" information may be sent in the following ways:

a. Mail - FOUO may be sent via first-class mail or parcel post. Bulky shipments may be sent by fourth-class mail.

b. Fax - Nom1ally FOUO may be sent over facsimile equipment. To prevent unauthorized disclosure the following should be considered:

Use of special cover sheets, location of fax machines {both ends), and whether authorized persoru1el are around to receive FOUO information.

c. E-Mail/Websites E-mail may be used on approved secure communication systems or systems utilizing other protective measures such as Public Key Infrastructure (PK1) or transport layer security (e.g., https).

**Make sure documents/methods that transmit FOUO material call attention to any FOUO attachments. **

6. DISPOSITION: When no longer needed, FOUO information must be disposed of in a way that will preclude its disclosure to unauthorized individuals.

7. UNAUTHORIZED DISCLOSURE: Unauthorized disclosure of "For Official Use Only" information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions and disciplinary action may be taken against those responsible