Bidders Library Security - DoDM 5200 01 Vol 3.pdf

Department of Defense

MANUAL

NUMBER 5200.01, Volume 3 February 24, 2012

Incorporating Change 3, Effective July 28, 2020

USD(I&S)

SUBJECT: DoD Information Security Program: Protection of Classified Information

References: See Enclosure 1

1. PURPOSE

a. Manual. This Manual is composed of several volumes, each containing its own purpose.

The purpose of the overall Manual, as authorized by DoD Directive (DoDD) 5143.01 (Reference (a)) and DoD Instruction (DoDI) 5200.01 (Reference (b)), is to reissue DoD 5200.1-R (Reference (c)) as a DoD Manual to implement policy, assign responsibilities, and provide procedures for the designation, marking, protection, and dissemination of controlled unclassified information (CUI) and classified information, including information categorized as collateral, sensitive compartmented information (SCI), and Special Access Program (SAP). This guidance is developed in accordance with Reference (b), Executive Order (E.O.) 13526, E.O. 13556, and part 2001 of title 32, Code of Federal Regulations (CFR) (References (d), (e), and (f)). This combined guidance is known as the DoD Information Security Program.

b. Volume. This Volume:

(1) Provides guidance for safeguarding, storage, destruction, transmission, and transportation of classified information.

(2) Identifies security education and training requirements and processes for handling of security violations and compromise of classified information.

(3) Addresses information technology (IT) issues of which the security manager must be aware.

(4) Incorporates and cancels Assistant Secretary of Defense for Command, Control, Communications, and Intelligence Memorandums (References (g) and (h)).

2. APPLICABILITY. This Volume:

DoDM 5200.01-V3, February 24, 2012

Change 3, 07/28/2020 2

a. Applies to OSD, the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the Department of Defense, the Defense Agencies, the DoD Field Activities, and all other organizational entities within the Department of Defense (hereinafter referred to collectively as the “DoD Components”).

b. Does not alter existing authorities and responsibilities of the Director of National Intelligence (DNI) or of the heads of elements of the Intelligence Community pursuant to policies issued by the DNI. Consistent with Reference (b), SCI shall be safeguarded in accordance with the policies and procedures issued by the DNI, as implemented by DoD 5105.21-M-1 (Reference (i)) and other applicable guidance.

3. DEFINITIONS. See Glossary.

4. POLICY. It is DoD policy, in accordance with Reference (b), to:

a. Identify and protect national security information and CUI in accordance with national-level policy issuances.

b. Promote information sharing, facilitate judicious use of resources, and simplify management through implementation of uniform and standardized processes.

c. Employ, maintain and enforce standards for safeguarding, storing, destroying, transmitting, and transporting classified information.

d. Actively promote and implement security education and training throughout the Department of Defense.

e. Mitigate the adverse effects of unauthorized access to classified information by investigating and acting upon reports of security violations and compromises of classified information.

5. RESPONSIBILITIES. See Enclosure 2 of Volume 1.

6. PROCEDURES. See Enclosures 2 through 7.

7. INFORMATION COLLECTION REQUIREMENTS. All inspections, investigations, notifications, and audits referred to in this issuance do not require licensing with a Report Control Symbol in accordance with Paragraphs 1, 2, 4, and 7 of Volume 1 of DoD Manual

8910.01 (Reference (j)).

Change 3, 07/28/2020 3

8. RELEASABILITY. Cleared for public release. This Volume is available on the Directives Division Website at https://www.esd.whs.mil/DD/.

9. SUMMARY OF CHANGE 3. The change to this issuance updates references and organizational titles and removes expiration language in accordance with current Chief Management Officer of the Department of Defense direction.

10. EFFECTIVE DATE. This Volume is effective February 24, 2012.

Enclosures

1. References

2. Safeguarding

3. Storage and Destruction

4. Transmission and Transportation

5. Security Education and Training

6. Security Incidents Involving Classified Information

7. IT Issues for the Security Manager Glossary

CONTENT

Change 3, 07/28/2020 4

TABLE OF CONTENTS

ENCLOSURE 1: REFERENCES

ENCLOSURE 2: SAFEGUARDING

CONTROL MEASURES

PERSONAL RESPONSIBILITY FOR SAFEGUARDING

ACCESS TO CLASSIFIED INFORMATION

DETERMINING NEED FOR ACCESS

EMERGENCY AUTHORITY

ACCESS BY INDIVIDUALS OUTSIDE THE EXECUTIVE BRANCH

Congress Government Printing Office (GPO) Representatives of the Government Accountability Office (GAO) Historical Researchers Presidential or Vice Presidential Appointees and Designees Use of Classified Information in Litigation Special Cases

VISITS

PROTECTION WHEN REMOVED FROM STORAGE

END OF DAY SECURITY CHECKS

EMERGENCY PLANS

USE OF SECURE COMMUNICATIONS

REMOVAL OF CLASSIFIED INFORMATION FOR WORK AT HOME

Top Secret Secret and Confidential Residential Storage Equipment Classified IT Systems Foreign Country Restriction

WORKING PAPERS

EQUIPMENT USED FOR PROCESSING CLASSIFIED INFORMATION

REPRODUCTION OF CLASSIFIED MATERIAL

CLASSIFIED MEETINGS AND CONFERENCES

SAFEGUARDING FGI

North Atlantic Treaty Organization (NATO) Information Other FGI

ALTERNATIVE COMPENSATORY CONTROL MEASURES (ACCM)

DoD Proponents for ACCM ACCM Approval Guidance on ACCM Use Prohibited Security Measures Prohibited Uses of ACCM Documentation Annual Reports of ACCM Use

Change 3, 07/28/2020 5

Sharing ACCM-Protected Information Contractor Access to ACCM Program Maintenance Safeguarding ACCM Information Security Incidents ACCM Termination Transitioning an ACCM to a SAP

ENCLOSURE 3: STORAGE AND DESTRUCTION

GENERAL REQUIREMENTS

LOCK SPECIFICATIONS

STORAGE OF CLASSIFIED INFORMATION BY LEVEL OF CLASSIFICATION

Top Secret Secret Confidential

RISK ASSESSMENT

U.S. CLASSIFIED INFORMATION LOCATED IN FOREIGN COUNTRIES

SPECIALIZED STORAGE

Military Platforms IT Equipment Map and Plan File Cabinets Modular Vaults Bulky Material

PROCURING NEW STORAGE EQUIPMENT

SECURITY CONTAINER LABELS

EXTERNAL MARKINGS ON CONTAINERS

SECURITY CONTAINER INFORMATION

COMBINATIONS TO CONTAINERS, VAULTS AND SECURE ROOMS

Protecting and Storing Combinations Changing Combinations

ENTRANCES TO OPEN STORAGE AREAS FOR CLASSIFIED INFORMATION

INSPECTION OF STORAGE CONTAINERS PRIOR TO REMOVAL, REPAIR, ETC

NEUTRALIZATION AND REPAIR PROCEDURES

STORAGE OF FGI

RETENTION OF CLASSIFIED INFORMATION

DESTRUCTION OF CLASSIFIED INFORMATION

TECHNICAL GUIDANCE ON DESTRUCTION METHODS

Crosscut Shredders Pulverizers and Disintegrators Pulping

DESTRUCTION PROCEDURES

APPENDIX:

PHYSICAL SECURITY STANDARDS

Change 3, 07/28/2020 6

ENCLOSURE 4: TRANSMISSION AND TRANSPORTATION

TRANSMISSION AND TRANSPORTATION PROCEDURES

DISSEMINATION OUTSIDE THE DEPARTMENT OF DEFENSE

TRANSMISSION OF TOP SECRET INFORMATION

TRANSMISSION OF SECRET INFORMATION

TRANSMISSION OF CONFIDENTIAL INFORMATION

TRANSMISSION OF CLASSIFIED INFORMATION AND MATERIAL TO FOREIGN

GOVERNMENTS

SECURITY REQUIREMENTS FOR TRANSFERS OF DEFENSE ARTICLES TO

AUSTRALIA AND THE UNITED KINGDOM WITHOUT AN EXPORT LICENSE

OR OTHER WRITTEN AUTHORIZATION

Background Applicability Marking Transfer

USE OF SECURE COMMUNICATIONS FOR TRANSMISSION OF CLASSIFIED

INFORMATION

Computer-To-Computer Transmission Facsimile (Fax) Transmission Telephone

SHIPMENT OF BULK CLASSIFIED MATERIAL AS FREIGHT

PREPARATION OF MATERIAL FOR SHIPMENT

USE OF BRIEFCASES OR ZIPPERED POUCHES FOR HAND-CARRYING

CLASSIFIED MATERIAL

ESCORT, COURIER, OR HAND-CARRY OF CLASSIFIED MATERIAL

Authority Packaging Requirements Responsibilities Customs, Police and Immigration Disclosure Authorization

ESCORT, COURIER, OR HAND-CARRY AUTHORIZATION

HAND-CARRYING OR ESCORTING CLASSIFIED INFORMATION ON

COMMERCIAL AIRCRAFT

APPENDIX:

TRANSFER OF CLASSIFIED INFORMATION OR MATERIAL TO

FOREIGN GOVERNMENTS

ENCLOSURE 5: SECURITY EDUCATION AND TRAINING

REQUIREMENT

SECURITY EDUCATION AND TRAINING RESOURCES

INITIAL ORIENTATION

SPECIAL TRAINING REQUIREMENTS

OCA TRAINING

Change 3, 07/28/2020 7

DECLASSIFICATION AUTHORITY TRAINING

ANNUAL REFRESHER TRAINING

CONTINUING SECURITY EDUCATION AND TRAINING

TERMINATION BRIEFINGS

MANAGEMENT AND OVERSIGHT TRAINING

PROGRAM OVERSIGHT

ENCLOSURE 6: SECURITY INCIDENTS INVOLVING CLASSIFIED INFORMATION

INTRODUCTION

CONSEQUENCES OF COMPROMISE

REPORTING AND NOTIFICATIONS

CLASSIFICATION OF REPORTS

SPECIAL CIRCUMSTANCES

Security Incidents Involving Deliberate Compromise, a Foreign Intelligence Service or a Terrorist Organization

Security Incidents Involving Apparent Violations of Criminal Law Security Incidents Involving COMSEC or Cryptologic Information Security Incidents Involving SCI Security Incidents Involving RD and/or FRD Security Incidents Involving IT Security Incidents Involving FGI or NATO Information

Security Incidents Involving Classified U.S. Information Provided to Foreign Governments

Security Incidents Involving SAPs Security Incidents Involving Improper Transfer of Classified Information Security Incidents Involving On-Site Contractors Security Incidents Involving Critical Program Information (CPI) Security Incidents Involving ACCM-Protected Information Absence Without Authorization Coordination with Legal Counsel and the Department of Justice (DoJ)

SECURITY INQUIRIES AND INVESTIGATIONS

Requirement Coordination with Criminal Investigative Organization or Defense CI Component Coordination with OCA Security Inquiries Security Investigations

INFORMATION APPEARING IN THE PUBLIC MEDIA

RESULTS OF INQUIRIES AND INVESTIGATIONS

ACTIONS TO BE TAKEN BY THE OCA

DAMAGE ASSESSMENTS

VERIFICATION, REEVALUATION, AND DAMAGE ASSESSMENT TIME LINES

ACTUAL OR POTENTIAL COMPROMISES INVOLVING MORE THAN ONE

AGENCY

DEBRIEFING IN CASES OF UNAUTHORIZED ACCESS

REPORTING AND OVERSIGHT MECHANISMS

Change 3, 07/28/2020 8

APPENDIXES

1. SECURITY INCIDENT REPORTING FORMAT

2. DOJ MEDIA LEAK QUESTIONNAIRE

ENCLOSURE 7: IT ISSUES FOR THE SECURITY MANAGER

OVERVIEW

RESPONSIBILITY

IA ROLES AND FUNCTIONS

IA CONCEPTS

IA Attributes System Categorization Certification and Accreditation (C&A)

DATA SPILLS

DISPOSAL OF COMPUTER MEDIA

NON-TRADITIONAL WORK ENVIRONMENTS

REQUIREMENT FOR ENCRYPTION OF CERTAIN UNCLASSIFIED DATA

PII

NEW TECHNOLOGY AND EQUIPMENT

INTERNET-BASED SOCIAL NETWORKING SERVICES

MARKING REQUIREMENTS FOR ELECTRONIC INFORMATION

PROCESSING REQUIREMENTS FOR SPECIFIC TYPES OF INFORMATION

SCI

RD and Critical Nuclear Weapons Design Information (CNWDI)

SAP

Controlled Imagery NATO Information

CUI

COMPILATION AND DATA AGGREGATION

GLOSSARY

PART I. ABBREVIATIONS AND ACRONYMS

PART II. DEFINITIONS

FIGURES

1. Conditions Governing Access to Official Records for Research Historical Purposes

2. Report of Security Incident Inquiry or Investigation

ENCLOSURE 1

Change 3, 07/28/2020 9

REFERENCES

(a) DoD Directive 5143.01, “Under Secretary of Defense for Intelligence and Security

(USD(I&S)),” October 24, 2014, as amended

(b) DoD Instruction 5200.01, “DoD Information Security Program and Protection of Sensitive

Compartmented Information (SCI),” April 21, 2016, as amended

(c) DoD 5200.1-R, “Information Security Program,” January 14, 1997 (cancelled by Volume 1 of this Manual)

(d) Executive Order 13526, “Classified National Security Information,” December 29, 2009

(e) Executive Order 13556, “Controlled Unclassified Information,” November 4, 2010

(f) Part 2001 of title 32, Code of Federal Regulations

(g) Assistant Secretary of Defense for Command, Control, Communications, and Intelligence

Memorandum, “Revised Alternative Compensatory Control Measures (ACCM) Guidance,” April 18, 2003 (hereby cancelled)

(h) Assistant Secretary of Defense for Command, Control, Communications, and Intelligence Memorandum, “Classified Information at Meetings and Conferences,” October 26, 2001 (hereby cancelled)

(i) DoD Manual 5105.21, Volume 1, “Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration Of Information And Information Systems Security,” October 19, 2012, as amended

(j) DoD Manual 8910.01, Volume 1, “DoD Information Collections Manual: Procedures For DoD Internal Information Collections,” June 30, 2014, as amended

(k) DoD Instruction 5230.09, “Clearance of DoD Information for Public Release,” January 25,

(l) DoD Manual 5200.02, “Procedures For The DoD Personnel Security Program (PSP),” April 3, 2017

(m) DoD Instruction 5400.04, “Provision of Information to Congress,” March 17, 2009

(n) Department of Defense/Government Printing Office Security Agreement, 19811

(o) DoD Instruction 7650.01, “Government Accountability Office (GAO) and Comptroller

General Requests for Access to Records,” January 27, 2009, as amended

(p) DoD Directive 5405.2, “Release of Official Information in Litigation and Testimony by

DoD Personnel as Witnesses,” July 23, 1985

(q) DoD Directive 5230.20, “Visits and Assignments of Foreign Nationals,” June 22, 2005

(r) Committee on National Security Systems Instruction 4004, “Destruction and Emergency

Protection Procedures for COMSEC and Classified Material,” August 20062

(s) DoD Instruction 8510.01, “Risk Management Framework (RMF) for DoD Information

Technology (IT),” March 12, 2014, as amended

(t) Chapters 22 and 33 of title 44, United States Code

(u) DoD Instruction 5015.02, “DoD Records Management Program,” February 24, 2015, as amended

1 Contact Security Directorate, Office of the Deputy Under Secretary of Defense for Intelligence 2 Documents issued by the Committee on National Security Systems (CNSS) are available at www.cnss.gov/full-index.html

Change 3, 07/28/2020 10

(v) DoD Instruction 8500.01, “Cybersecurity,” March 14, 2014, as amended

(w) DoD 5220.22-M, “National Industrial Security Program Operating Manual,” February 28, 2006, as amended

(x) Parts 120 through 130 of title 22, Code of Federal Regulations (also known as “The

International Traffic in Arms Regulations”)

(y) DoD Directive 5230.11, “Disclosure of Classified Military Information to Foreign

Governments and International Organizations,” June 16, 1992

(z) DoD Instruction O-2000.16, “DoD Antiterrorism (AT) Program Implementation,”

November 17, 2016, as amended

(aa) DoD Instruction 5240.05, “Technical Surveillance Countermeasures (TSCM),” April 3, 2014, as amended

(ab) United States Security Authority for NATO Affairs Instruction 1-07, “Implementation of

NATO Security Requirements,” April 5, 20073

(ac) Department of Defense and United Kingdom Ministry of Defense, “Security Implementing

Arrangement,” January 27, 20034

(ad) Chairman of the Joint Chiefs of Staff Manual 3150.29C, “Code Word, Nickname, and

Exercise Terms Report (NICKA) System,” December 7, 20075

(ae) DoD Directive 5000.01, “The Defense Acquisition System,” May 12, 2003, as amended

(af) Chairman of the Joint Chiefs of Staff Manual 5720.01B, “Joint Staff Message Management and Preparation,” February 15, 20056

(ag) DoD Directive 5205.07, “Special Access Program (SAP) Policy,” July 1, 2010, as amended

(ah) DoD Directive 5210.56, “Arming and The Use of Force,” November 18, 2016

(ai) DoD Instruction 3224.03, “Physical Security Enterprise and Analysis Program (PSEAP),”

June 4, 2020

(aj) Federal Specification FF-L-2740, “Locks, Combination,” current edition7

(ak) Federal Standard 832, “Construction Methods and Materials for Vaults,” September 1, 20027

(al) Federal Specification FF-L-2937, “Combination Lock, Mechanical,” January 31, 2005, as amended7

(am) Federal Specification AA-F-358, “Filing Cabinet, Legal and Letter Size, Uninsulated, Security,” current edition8

(an) Federal Specification AA-V-2737, “Modular Vault Systems,” April 25, 1990, with Amendment 2, October 30, 20067

(ao) Federal Specification FF-P-110, “Padlock, Changeable Combination (Resistant To Opening By Manipulation and Surreptitious Attack),” current edition, as amended7

(ap) Section 1386 of title 18, United States Code

3 Available to authorized recipients from the Central U.S. Registry 4 Contact the Director, International Security Programs, Defense Technology Security Administration, Office of the Under Secretary of Defense for Policy 5 Restricted distribution. Contact J-3, Office of the Joint Chiefs of Staff 6 This document is For Official Use Only. It is available to authorized recipients at https://ca.dtic.mil/cjcs_directives/index.htm 7 Available through DoD Lock Program at https://locks.navfac.navy.mil at the Documents, Federal Specifications tab for Federal Specifications or Documents, Directives and Guidance tab for Federal Standards and Military Handbooks.

8 Available through GSA at http://www.gsa.gov/portal/content/103856#Federal Specifications

Change 3, 07/28/2020 11

(aq) Federal Standard 809, “Neutralization and Repair of GSA Approved Containers and Vault Doors,” current edition7

(ar) National Security Agency/Central Security Service Evaluated Product List 02-01, “NSA/CSS Evaluated Products List for High Security Crosscut Paper Shredders” (also Annex A to NSA/CSS Specification 02-01, “High Security Crosscut Paper Shredders”), current edition

(as) National Security Agency/Central Security Service Evaluated Product List 02-02, “NSA/CSS Evaluated Products List for High Security Disintegrators” (also Annex A to NSA/CSS Specification 02-02, “High Security Disintegrators”), current edition

(at) Military Handbook 1013/1A, “Design Guidelines for Physical Security of Facilities,” December 15, 19937

(au) Underwriters Laboratories Inc., Standard 634, “Standard for Connectors and Switches for Use with Burglar-Alarm Systems,” October 12, 20079

(av) National Security Agency/Central Security Service Policy Manual 3-16, “Control of Communications Security (COMSEC) Material,” August 200510

(aw) Executive Order 13549, “Classified National Security Information Program for State, Local, Tribal, and Private Sector Entities,” August 18, 2010

(ax) Committee on National Security Systems, National Security Telecommunications and Information Systems Security Instruction (NSTISSI) No. 7003, “Protective Distribution Systems (PDS),” December 13, 1996

(ay) DoD Instruction 5200.33, “Defense Courier Operations (DCO),” June 30, 2011, as amended

(az) DoD Manual 5220.22, Volume 2, “National Industrial Security Program: Industrial Security Procedures for Government Activities,” August 1, 2018

(ba)Chapter I of title 39, Code of Federal Regulations

(bb) DoD Instruction 8523.01, Communications Security (COMSEC), April 22, 2008

(bc) Intelligence Community Directive 503, “Intelligence Community Information Technology

Systems Security Risk Management, Certification and Accreditation,” September 15, 200811

(bd) Department of Defense Foreign Clearance Manual, September 5, 201112

(be) DoD Directive 5105.65, “Defense Security Cooperation Agency (DSCA),” October 26, (bf)DoD Directive 8140.01, “Cyberspace Workforce Management,” August 11, 2015, as amended

(bg) Dod Instruction 3305.13, “DoD Security Education, Training, and Certification,” February

13, 2014, as amended

(bh) DoD Instruction 5205.11, “Management, Administration, and Oversight of DoD Special

Access Programs (SAPs),” February 6, 2013, as amended

(bi) Section 2723 of title 10, United States Code

(bj) Intelligence Community Directive 701, “Security Policy Directive for Unauthorized

Disclosures of Classified Information,” March 14, 200713

9 Available from Underwriters laboratories Inc. at http://www.ul.com/global/eng/pages/solutions/standards 10 Available to authorized recipients at www.iad.nsa.smil.mil/resources/library/nsa_office_of_policy_section/index.cfm 11 Available at http://www.dni.gov/electronic_reading_room/ICD_503.pdf 12 Available at https://www.fcg.pentagon.mil

Change 3, 07/28/2020 12

(bk) Sections 102, 105, 55214 and 552a15 of title 5, United States Code

(bl) DoD Instruction 5230.24, “Distribution Statements on Technical Documents,” August 23, 2012, as amended

(bm) DoD Directive 5240.06, “Counterintelligence Awareness and Reporting (CIAR),” May 17, 2011, as amended

(bn) Committee on National Security Systems, National Security Telecommunications and

Information Systems Security Instruction (NSTISSI) No. 4003, “Reporting and Evaluating COMSEC Incidents,” December 2, 199116

(bo) Section 3161 of Public Law 105-261, “National Defense Authorization Act for Fiscal Year 1999,” as amended

(bp) DoD Directive 5240.02, “Counterintelligence,” March 17, 2015, as amended

(bq) DoD Directive 8000.01, “Management of The Department of Defense Information

Enterprise (DoD IE),” March 17, 2016, as amended

(br) Committee on National Security Systems Policy 18, “National Policy on Classified

Information Spillage,” June 200616

(bs) Committee on National Security Systems Instruction 1001, “National Instruction on

Classified Information Spillage,” February 200816

(bt) Assistant Secretary of Defense for Command, Control, Communications and Intelligence

Memorandum, “Disposition of Unclassified DoD Computer Hard Drives,” June 4, 2001

(bu) Assistant Secretary of Defense for Networks and Information Integration Memorandum, “Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and Removable Storage Media,” July 3, 2007

(bv) Assistant Secretary of Defense for Networks and Information Integration Memorandum, “Department of Defense (DoD) Guidance on Protecting Personally Identifiable Information (PII),” August 18, 2006

(bw) Director, Administration and Management Memorandum, “Safeguarding Against and Responding to the Breach of Personally Identifying Information,” September 25, 2008

(bx) DoD Instruction 8170.01, “Online Information Management and Electronic Messaging,” January 2, 2019

(by) DoD Instruction 8320.02, “Sharing Data, Information, and Technology (IT) Services in the Department of Defense,” August 5, 2013, as amended

(bz) DoD Instruction 5210.02, “Access to and Dissemination of Restricted Data and Formerly Restricted Data,” June 3, 2011, as amended

(ca) Deputy Secretary of Defense Memorandum, “Protection of NATO Classified Information Stored, Processed or Transmitted in U.S. Communication and Information (CIS) Systems and Networks,” September 8, 2000

(cb) Deputy Secretary of Defense Memorandum, “Web Site Administration,” December 7, 1998

(cc) Dod Instruction 5200.39, “Critical Program Information (CPI) Identification and Protection Within Research, Development, Test, and Evaluation (RDT&E),” May 28, 2015, as amended

13 Available on JWICS at http://www.intelink.ic.gov/sites/ppr/policyHome/default.aspx 14 Also known and referred to in this volume as “The Freedom of Information Act (FOIA),” as amended 15 Also known and referred to in this volume as “The Privacy Act of 1974, as amended” 16 NTISSI and documents issued by the Committee on National Security Systems (CNSS) are available at www.cnss.gov/full-index.html

Change 3, 07/28/2020 13

(cd) DoDD 5400.07, “DoD Freedom of Information Act (FOIA) Program,” April 5, 2019

(ce) Section 403 of title 50, United States Code (also known as “The National Security Act of

1947,” as amended )

(cf) Executive Order 12333, “United States Intelligence Activities,” December 4, 1981, as amended

(cg) Section 2162 of title 42, United States Code (also known as “The Atomic Energy Act of

1954,” as amended )

ENCLOSURE 2

Change 3, 07/28/2020 14

SAFEGUARDING

1. CONTROL MEASURES. DoD Components shall have a system of control measures that ensure access to classified information is limited to authorized persons. The control measures shall be appropriate to the environment in which access occurs and to the nature and volume of the information. The system shall include technical, physical, and personnel control measures.

Administrative control measures, which may include records of internal distribution, access, generation, inventory, reproduction, and disposition, shall be required when technical, physical, and personnel control measures are insufficient to deter and detect access by unauthorized persons. Except as otherwise specified, requests for waivers to the provisions of this Volume shall be submitted in accordance with section 16 of Enclosure 3 of Volume 1.

2. PERSONAL RESPONSIBILITY FOR SAFEGUARDING. Everyone who works with classified information is personally responsible for taking proper precautions to ensure that unauthorized persons do not gain access to classified information. Everyone granted access to classified information is personally responsible for protecting the classified information they know, possess, or control and for complying with the pre-publication security review processes specified in DoDI 5230.09 (Reference (k)). Classified information shall be protected at all times either by storing it as this Volume prescribes or by having it under the personal observation and control of an authorized individual.

3. ACCESS TO CLASSIFIED INFORMATION. Except as provided in sections 5 and 6 of this enclosure and in accordance with section 11 of Enclosure 3 of Volume 1, no person may have access to classified information unless that person has a security clearance in accordance with DoD Manual 5200.02 (Reference (l)) and has signed a Standard Form (SF) 312, “Classified Information Non-Disclosure Agreement” (NDA), and access is essential to the accomplishment of a lawful and authorized Government function (i.e., has a need to know).

4. DETERMINING NEED FOR ACCESS. The individual with authorized possession, knowledge, or control of the information has the final responsibility for determining whether a prospective recipient’s official duties requires them to possess or have access to any element or item of classified information, and whether that prospective recipient has been granted the appropriate security clearance by proper authority.

5. EMERGENCY AUTHORITY. In emergencies in which there is an imminent threat to life or in defense of the homeland, the Heads of the DoD Components may authorize the disclosure of classified information, including information normally requiring the originator’s prior authorization, to an individual or individuals who are otherwise not routinely eligible for access.

The disclosing authority shall:

Change 3, 07/28/2020 15

a. Limit the amount of classified information disclosed to the absolute minimum to achieve the purpose.

b. Limit the number of individuals who receive classified information.

c. Transmit the classified information through approved Federal government channels by the most secure and expeditious method consistent with this Volume, or by other means deemed necessary when time is of the essence.

d. Provide instructions about what specific information is classified and how it should be safeguarded. Information disclosed shall not be deemed declassified as of result of such disclosure or subsequent use by a recipient. Physical custody of classified information must remain with an authorized Federal government entity in all but the most extraordinary circumstances.

e. Provide appropriate briefings to the recipients on their responsibilities not to disclose the information to unauthorized individuals and obtain a signed SF 312.

f. Notify the agency or DoD Component originating of the information and the Deputy Under Secretary of Defense for Intelligence, and Security (DUSD(I&S)) within 72 hours of the disclosure of classified information, or at the earliest opportunity that the emergency permits but no later than 30 days after the release, by providing:

(1) A description of the disclosed information.

(2) Identification of individuals to whom the information was disclosed.

(3) How the information was disclosed and transmitted.

(4) Reason for the emergency release.

(5) How the information is being safeguarded.

(6) A description of the briefings provided.

(7) A copy of the signed SF(s) 312.

6. ACCESS BY INDIVIDUALS OUTSIDE THE EXECUTIVE BRANCH. Classified information may be made available to individuals or agencies outside the Executive Branch, as provided in this section, if such information is necessary for performance of a lawful and authorized function, and such release is not prohibited by the originating department or agency.

The Heads of DoD Components shall designate officials to ensure the recipient’s eligibility for access, prior to the release of classified information. (See Volume 1, Enclosure 3, section 11 for requirements for access by individuals inside the Executive Branch.)

Change 3, 07/28/2020 16

a. Congress. DoDI 5400.04 (Reference (m)) provides rules for access to classified information or material by Congress, its committees, members, and staff representatives.

Members of Congress, by virtue of their elected position, are not investigated or cleared by the Department of Defense.

b. Government Printing Office (GPO). Collateral documents and material of all classifications may be processed by the GPO, which protects the information according to a DoD/GPO Security Agreement (Reference (n)).

c. Representatives of the Government Accountability Office (GAO). DoDI 7650.01 (Reference (o)) sets forth rules for granting GAO representatives access to classified information that the Department of Defense originates and possesses when such information is relevant to the performance of the statutory responsibilities of that organization. Certifications of security clearances and the basis therefore, shall be accomplished under arrangements between the GAO and the relevant DoD Component. Personal recognition or presentation of official GAO credential cards are acceptable for identification purposes, but not for access to classified information.

d. Historical Researchers. Persons outside the Executive Branch who are engaged in historical research projects may be authorized access to classified information provided that the DoD Component Head or senior agency official with classification jurisdiction over the information:

(1) Determines, in writing, that such access is clearly consistent with the interests of national security in view of the intended use of the material to which access is granted by certifying that the requester has been found to be eligible for access pursuant to Reference (l) and section 3 of this enclosure.

(2) Limits access to specific categories of information over which the DoD Component has classification jurisdiction or for which the researcher has the written consent of the DoD Component or non-DoD agency with classification jurisdiction. The information contained within or revealed by the specified categories must be within the scope of the research.

(3) Maintains custody of the classified material at a DoD installation or activity or authorizes access to documents held by the National Archives and Records Administration

(NARA).

(4) Obtains the requester’s agreement to safeguard the information and to submit any notes and manuscripts intended for public release for review by all DoD Components or non- DoD departments or agencies with classification jurisdiction to determine whether classified information is contained therein. The agreement shall be documented by execution of a statement substantially similar to that in Figure 1.

Change 3, 07/28/2020 17

Figure 1. Conditions Governing Access to Official Records by Historical Researchers

To Whom It May Concern:

I understand that the classified information to which I have requested access for historical research purposes is concerned with the national defense or foreign relations of the United States. Unauthorized disclosure could reasonably be expected to cause damage, serious damage, or exceptionally grave damage to the national security depending on whether the information is classified Confidential, Secret, or Top Secret, respectively. If granted access, I therefore agree to the following conditions governing access to the [insert Component or activity] files:

1. I will abide by any rules and restrictions issued in your letter of authorization, including those of other Agencies whose information is interfiled with that of the [insert Component or activity].

2. I agree to safeguard the classified information to which I gain possession or knowledge in a manner consistent with Part 4 of Executive Order 13526, “Classified National Security Information,” and the applicable provisions of the DoD regulations concerning safeguarding classified information, including Volumes 1, 2, and 3 of DoD Manual 5200.01, “DoD Information Security Program.”

3. I agree not to reveal to any person or Agency any classified information obtained because of this access except as authorized in the terms of your authorization letter or a follow-on letter. I further agree that I shall not use the information for purposes other than those set forth in my request for access.

4. I agree to submit my research notes for review to determine if classified information is contained in them before their removal from the specific area assigned to me for research. I further agree to submit my manuscript(s) for a security review before its publication or presentation. In each of these reviews, I agree to comply with any decision of the reviewing official in the interests of the security of the United States, including the retention or deletion of any classified parts of such notes and manuscript whenever the Federal Agency concerned deems such retention or deletion necessary.

5. I understand that failure to abide by the conditions in this statement shall constitute sufficient cause for canceling my access to classified information and for denying me any future access and may subject me to criminal provisions of Federal Law as referred to in Item 6.

6. I have been informed that provisions of title 18 of the United States Code impose criminal penalties, under certain circumstances, for the unauthorized disclosure, loss, copying, or destruction of defense information.

THIS STATEMENT IS MADE TO THE UNITED STATES GOVERNMENT TO ENABLE IT TO EXERCISE

ITS RESPONSIBILITY FOR THE PROTECTION OF INFORMATION AFFECTING THE NATIONAL

SECURITY. I UNDERSTAND THAT ANY MATERIAL FALSE STATEMENT THAT I MAKE KNOWINGLY

AND WILLFULLY SHALL SUBJECT ME TO THE PENALTIES OF TITLE 18, U.S. CODE, SECTION 1001.

Signature:

Witness's Signature:

Date:

Change 3, 07/28/2020 18

(5) Authorizes access, in writing, for no more than 2 years from the date of issuance.

The DoD Component may renew access for 2-year periods in accordance with DoD Component-issued regulations.

e. Presidential or Vice Presidential Appointees and Designees. Persons who previously occupied senior policy-making positions to which they were appointed or designated by the President or Vice President may not remove classified information upon departure from office, as all such material shall remain under the U.S. Government’s security control. Such persons may be authorized access to classified information they originated, reviewed, signed, received, or that was addressed to them while serving as an appointee or designee, provided that the DoD Component Head or senior agency official with classification jurisdiction for such information:

(1) Determines, in writing, that such access is clearly consistent with the interests of national security in view of the intended use of the material to which access is granted and by certifying that the requester has been found to be eligible for access pursuant to section 3 of this enclosure.

(2) Limits access to items that the person originated, reviewed, signed, or received while serving as a Presidential or Vice Presidential appointee or designee.

(3) Retains custody of the classified material at a DoD installation or activity or authorizes access to documents in the custody of the NARA.

(4) Obtains the requestor’s agreement (SF 312) to safeguard the information and to submit any notes and manuscript for pre-publication review by all DoD Components and non- DoD departments or agencies with classification jurisdiction to determine that no classified information is contained therein.

f. Use of Classified Information in Litigation. DoDD 5405.2 (Reference (p)) governs the use of classified information in litigation.

g. Special Cases. When necessary in the interests of national security, the Heads of the DoD Components or their senior agency official may authorize access to classified information by persons outside the Federal government, other than those enumerated in section 5 of this enclosure and paragraphs 6.a through 6.f of this section. Prior to authorizing access, such official must determine that the recipient is reliable, loyal, and trustworthy for the purpose of accomplishing a national security objective; meets the requirements of section 3 of this enclosure; and can and will safeguard the information from unauthorized disclosure. The national security objective shall be stated in the authorization, which shall be in writing. This authority may not be further delegated.

7. VISITS. The Heads of the DoD Components shall establish procedures to accommodate visits to their Component facilities involving access to, or disclosure of, classified information.

As a minimum, these procedures shall include verifying the identity, personnel security clearance, access (if appropriate), and need to know for all visitors.

Change 3, 07/28/2020 19

a. Visit requests shall be processed and security clearance and access level verified using the Joint Personnel Adjudication System (JPAS) for DoD civilian, military, and contractor personnel whose access level and affiliation are reflected in JPAS. Fax, telephone, or other appropriate method shall be used for those personnel whose access level and affiliation are not reflected in

JPAS.

b. Visits by foreign nationals to DoD Components and facilities, except for activities or events that are open to the public, shall be handled in accordance with DoDD 5230.20 (Reference (q)) and documented in the Foreign Visits System Confirmation Module.

8. PROTECTION WHEN REMOVED FROM STORAGE. An authorized person shall keep classified material removed from storage under constant surveillance. Classified document cover sheets (SF 703, “Top Secret (Cover sheet);” SF 704, “Secret (Cover sheet);” or SF 705 “Confidential (Cover sheet)”) shall be placed on classified documents not in secure storage. The cover sheets show, by color and other immediately recognizable format or legend, the applicable classification level.

9. END OF DAY SECURITY CHECKS. The heads of activities that process or store classified information shall establish a system of security checks at the close of each duty and/or business day to ensure that any area where classified information is used or stored is secure. SF 701, “Activity Security Checklist,” shall be used to record such checks. An integral part of the security check system shall be the securing of all vaults, secure rooms, and containers used for storing classified material. SF 702, “Security Container Check Sheet,” shall be used to record such actions. SFs 701 and 702 shall be retained and disposed of as required by Component records management schedules.

10. EMERGENCY PLANS. Plans shall be developed to protect, remove, or destroy classified material in case of fire, natural disaster, civil disturbance, terrorist activities, or enemy action, to minimize the risk of compromise, and for the recovery of classified information, if necessary, following such events. The level of detail and the amount of testing and rehearsal of these plans shall be determined by assessing the risk of hostile action, foreign intelligence threats, natural disaster, or terrorist activity that may place the information in jeopardy.

a. Use the requirements of Committee on National Security Systems (CNSS) Instruction 4004 (Reference (r)) when developing plans for the emergency protection (including emergency destruction under no-notice conditions) of classified communications security (COMSEC) material.

b. When preparing emergency plans, consider:

(1) Reducing the amount of classified material on hand.

Change 3, 07/28/2020 20

(2) Storing less frequently used classified material at other secure locations.

(3) Creating regular back up copies of information in electronic formats for off-site storage.

(4) Transferring as much retained classified information to removable electronic media as possible, thereby reducing its bulk.

11. USE OF SECURE COMMUNICATIONS. In accordance with the requirements of Enclosure 4, classified information shall be transmitted only over secure communications circuits approved for transmission of information at the specified level of classification. This includes communication by telephone, facsimile, e-mail and other forms of electronic communications (e.g., messages, websites). See Volume 2 of this Manual for guidance on required markings.

12. REMOVAL OF CLASSIFIED INFORMATION FOR WORK AT HOME. When it is mission critical for individuals to remove classified information and materials (e.g., IT equipment and associated storage media) for work at home, specific security measures and approvals are required. Security measures appropriate for the level of classification must be in place to provide adequate protection and security-in-depth and to prevent access by unauthorized persons. Compliance with section 13 of Enclosure 4 of this Volume is also required.

a. Top Secret. Only the Secretary of Defense, the Secretaries of the Military Departments, the Chairman of the Joint Chiefs of Staff, the Combatant Commanders, or the senior agency officials appointed pursuant to section 5.4(d) of Reference (d) may authorize the removal of Top Secret information from designated working areas for work at home. Such officials may also authorize removal of information for work at home for any lower level of classification.

b. Secret and Confidential. The Heads of the DoD Components may authorize removal of Secret and Confidential information from designated working areas for work at home. This authority shall not be delegated below the major command or equivalent level.

c. Residential Storage Equipment. A General Services Administration (GSA)-approved security container shall be furnished for residential storage of classified information. Written procedures shall be developed to provide for appropriate protection of the information, including a record of the classified information that has been authorized for removal for work at home.

d. Classified IT Systems. See section 7 of Enclosure 7 of this Volume when classified IT equipment will be used. All residential classified network connections must be certified and accredited in accordance with DoDI 8510.01 (Reference (s)) requirements.

e. Foreign Country Restriction. Work at home may be authorized in foreign countries only when the residence is in a specific location where the United States enjoys extraterritorial status (e.g., on the embassy, chancery, or consulate compound) or on a U.S. military installation.

Change 3, 07/28/2020 21

13. WORKING PAPERS. Working papers are documents (e.g., notes, drafts, prototypes) or materials (e.g., printer ribbons, photographic plates), regardless of the media, created during development and preparation of a finished product. Working papers and materials are not intended or expected to be disseminated. Working papers and materials containing classified information shall be:

a. Dated when created.

b. Marked with the highest classification of any information contained therein.

c. Safeguarded as required for the assigned classification.

d. Conspicuously marked “Working Paper” on the cover and/or first page of the document or material (or comparable location for special types of media) in letters larger than existing text.

e. Destroyed in accordance with chapter 33 of title 44, U.S.C. (Reference (t)) as implemented by DoDD 5015.2 (Reference (u)) and appropriate DoD Component implementing directives and records schedules when no longer needed.

f. Marked and controlled the same way as this Manual requires for finished products of the same classification when retained more than 180 days from date of origin (30 days for SAPs), filed permanently, e-mailed within or outside the originating activity, or released outside the originating activity, except as provided in paragraph 13.g. of this section.

g. Shared between action officers, either physically or electronically, without controlling them as permanent documents only when:

(1) The working materials are shared informally (e.g., collaborative documents or coordinating drafts) in the development process.

(2) Transfer or transmission of the material is via secure means and, if electronic, by means other than e-mail.

(3) All copies held by other than the originator are marked and controlled as required for finished products when retained more than 180 days of origin (30 days for SAPs). Consult with the originator for correct markings.

14. EQUIPMENT USED FOR PROCESSING CLASSIFIED INFORMATION. The Department of Defense has a variety of non-COMSEC-approved equipment that is used to process classified information. This includes copiers, facsimile machines, computers and other IT equipment and peripherals, display systems, and electronic typewriters. Activities shall identify those features, parts, or functions of equipment used to process classified information that may retain all or part of the information. Activity security procedures shall prescribe the appropriate safeguards to:

Change 3, 07/28/2020 22

a. Prevent unauthorized access to that information, including by repair or maintenance personnel.

b. Ensure that repair procedures do not result in unauthorized dissemination of or access to classified information. Where equipment cannot be properly sanitized or appropriately knowledgeable escort provided, cleared maintenance technicians shall be used. Electronic repair or diagnostic equipment shall be maintained as classified material by the DoD Component if there is the potential for classified data transmission from the equipment being serviced. Use of remote diagnostic or repair capabilities shall be specifically approved and authorized in writing by the activity security manager; if the equipment retains or stores any classified information appropriate physical and logical protection must be provided on the remote end and secure communications are required.

c. Replace and destroy equipment parts in the appropriate manner when classified information cannot be removed. Removable disk drives, memory chips and boards, and other electronic components of copiers, fax machines, etc. may be sanitized or destroyed in the same manner as used for comparable computer equipment. Alternatively, the equipment shall be designated as classified and be retained and protected accordingly.

d. Ensure that appropriately knowledgeable, cleared personnel inspect equipment and associated media used to process classified information before the equipment is removed from protected areas to ensure there is no retained classified information. Classification markings and labels shall be removed from sanitized equipment and media after inspection, prior to removal from protected areas.

e. Ensure computers and other equipment used to process classified information or to transmit classified information across a network are certified and accredited in accordance with Reference (s) as required by DoDI 8500.01 (Reference (v)). Measures to protect against compromising emanations shall be implemented in accordance with Reference (v).

15. REPRODUCTION OF CLASSIFIED MATERIAL. Paper copies, electronic files, and other material containing classified information shall be reproduced only when necessary for accomplishing the organization’s mission or for complying with applicable statutes or Directives.

Use of technology that prevents, discourages, or detects unauthorized reproduction of classified information is encouraged.

a. Unless restricted by the originating agency, Top Secret, Secret, and Confidential information may be reproduced, including by e-mailing, scanning, and copying, to the extent operational needs require.

b. The DoD Components shall establish procedures that facilitate oversight and control of the reproduction of classified information and the use of equipment for such reproduction, including controls that ensure:

Change 3, 07/28/2020 23

(1) Reproduction is kept to a minimum consistent with mission requirements.

(2) Personnel reproducing classified information are knowledgeable of the procedures for classified reproduction and aware of the risks involved with the specific reproduction equipment being used and the appropriate countermeasures they are required to take.

(3) Reproduction limitations originators place on documents and special controls applicable to special categories of information are fully and carefully observed.

(4) Reproduced material is placed under the same accountability and control requirements as applied to the original material. Extracts of documents will be marked according to content and may be treated as working papers if appropriate.

(5) Reproduced material is conspicuously identified as classified at the applicable level and copies of classified material are reviewed after the reproduction process to ensure that the required markings exist.

(6) Waste products generated during reproduction are protected and destroyed as required.

(7) Classified material is reproduced only on approved and, when applicable, properly accredited systems. Section 14 of this enclosure provides additional guidance.

(8) Foreign government information (FGI) is reproduced and controlled pursuant to guidance and authority granted by the originating government.

16. CLASSIFIED MEETINGS AND CONFERENCES. Meetings and conferences involving classified information present special vulnerabilities to unauthorized disclosure. The Heads of the DoD Components shall establish specific requirements for protecting classified information at DoD Component-sponsored meetings and conferences, to include seminars, exhibits, symposia, conventions, training classes, workshops, or other such gatherings, during which classified information is disseminated.

a. DoD Component approval processes shall ensure that the following requirements are met:

(1) The meeting or conference serves a specified U.S. Government purpose.

(2) Use of other approved methods or channels for disseminating classified information or material are…