Controlled Unclassified Information Guide.docx

Controlled Unclassified Information Guide

Program: Personalized Protective Biosystem (PPB) Program Manager: Eric Van Gieson, PhD Program Email: PPB@DARPA.mil Program Security Officer: Michael Langerman

Date: January 28th 2020 Version: 1

UNCLASSIFIED

UNCLASSIFIED

Controlled Unclassified Information Guide Personalized Protective Biosystem (PPB)

UNCLASSIFIED

Version 11.0, 201 Page 4 of 4

UNCLASSIFIED//FOR OFFICIAL USE ONLY

1. Background

The Personalized Protective Biosystem (PPB) program will develop an integrated system that simultaneously reduces protective equipment needs, while increasing protection for the individual against existing and future chemical and biological (CB) threats. The capability to provide unburdened CB protection will maximize time on target for the warfighter and the stability operator, provide operational flexibility, and enable military operations in remote and diverse threat environments regardless of the threat. PPB technologies should function in austere environments. PPB technologies will thus extend long-term missions by adding nearly zero burden to warfighters beyond their standard combat uniforms/mission-related equipment. PPB will consist of lightweight materials that can be worn to protect the warfighter from exposure to any CB threat while simultaneously providing a second layer of tissue barrier protection with bio-molecular, commensal organisms, or other technologies that protect the skin, eyes, and airway from CB threats. The tissue barrier component will be self-administered with a small device, such as an inhaler, eye-dropper, and/or lotion. PPB will improve mission execution by solving the current (“state of the art”) protective equipment limitations including threat-specific vulnerabilities, thermal/logistical burdens, exposure risks during equipment removal/decontamination, and on-demand availability during unexpected threat situations.

2.Purpose

This guide identifies aspects of the program that performers must handle as Controlled Unclassified Information (CUI). In addition, each performer must determine and assert the export controls (either Export Administration Regulations or International Traffic in Arms Regulations) relevant to their project, and communicate that assertion to their Contracting Officer and to the DARPA Program Manager.

Questions concerning the content and interpretation of this guide and/or recommendations for changes due to current conditions, progress made in program research, scientific technological developments, advances in state of the art, or other factors should be directed to the DARPA Program Manager. All users of this guide are encouraged to assist in improving its currency and adequacy. No changes to what is defined as CUI are approved until DARPA issues an official modification to this guide.

3. Definition of Controlled Unclassified Information (CUI) for the Program and Fundamental Research

Personalized Protective Biosystem program will generate technical information. DOD considers “technical information” to be technical data or computer software, as those terms are defined in Defense Federal Acquisition Regulation Supplement clause 252.227-7013, "Rights in Technical Data - Noncommercial Items" (48 CFR 252.227-7013). Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software code. Note that such technical information may or may not be controlled (i.e., Controlled Technical Information [CTI]), depending on whether it has military or space application. All unclassified technical data with military or space application in the possession of, or under the control of, a DoD Component that may not be exported lawfully without an approval, authorization, or license under E.O. 12470 or the Arms Export Control Act and are considered CUI (FIOA Exemption 3 DODD 5230.25 cite 5 U.S.C. 522(b)(3)).

For the PPB Program, DARPA has defined the below topics as CTI/CUI for this program. More specific definitions may be put in place depending on the proposed solutions accepted for award. Please provide any additional topics that you believe should be considered CUI and/or more narrowly define topics that better fit your technology. The final draft will be provided upon award.

4. Handling Aspects of the Program that Will Generate CUI

Performers must be able to meet all CUI safeguarding requirements. CUI Information must be handled according to DoDM 5200.01, Volume 4, DoDD 5230.25.

Per DoDD 5230.25 and DoDD 5230.20 CUI controlled by the DoD is only releasable to U.S. citizens, and permanent U.S. resident aliens unless a formal agreement between the U.S. government and the receiving foreign organization has been signed or an export license has been obtained. Per DoDM 5200.01, Volume 4-CUI: Prior to authorizing access, to a permanent U.S. resident alien the non U.S. citizen must sign a non-disclosure agreement (NDA) and have their access limited to information that is only within the scope of their assigned duties and only when access furthers the execution of a lawful and authorized DoD mission or purpose, and would not be detrimental to the interests of the Department of Defense or the U.S. Government.

Prior to authorizing access to CUI EACH TEAM must provide a letter of compelling need to DARPA explaining why each individual should be granted access. The letter should include the person’s full name, DoB, PoB, and citizenship. DARPA will review the letter and provide approval or deny the request.

CUI and CTI are to be marked with one of the distribution statements B through F, in accordance with Department of Defense Instruction 5230.24, "Distribution Statements on Technical Documents."

The terms CUI and CTI does not apply to information that is lawfully publicly available without restrictions.

The performer shall protect CUI in accordance with DFARS 252.204-7012.

Performer information systems shall be subject to the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations.”

If the performer proposes to vary from any of the security requirements specified by NIST SP 800-171 and that are in effect at the time the solicitation is issued or as authorized by the Contracting Officer, the performer shall submit to the Contracting Officer a written explanation of:

(A) Why a particular security requirement is not applicable; or

(B) How an alternative but equally effective security measure is used to compensate for the inability to satisfy a particular requirement and achieve equivalent protection The Contracting Officer will coordinate with the DoD CIO to adjudicate if a performer requests to vary from NIST SP 800-171 requirements is acceptable. This MUST be done in writing PRIOR to contract award. Any accepted variance from the NIST SP 800-171 shall be incorporated into the resulting contract.

Proposers are required to complete a CUI Management Plan that is due with the proposal.

The provided template is to act as guidance. The proposer may fill it out the template or utilize their own template as long as all of the areas outline in the template provided by DARPA and any additional required as outlined in the BAA are addressed.

4. Publication In accordance with contract requirements, prior to publishing material related to this project, all performers (both academic and non-academic), who worked with CUI, as defined in this document, must submit any and all papers, manuscripts, posters, public presentation materials to DARPA for 1) review and 2) approval in order to ensure that no CUI is disclosed. DARPA will verify if CUI is present and if it is, indicate which sections need to be removed from publication, in accordance with Department of Defense Instruction 5230.24, "Distribution Statements on Technical Documents."

If there is no CUI in the document, DARPA will approve above listed materials for public release and Distribution Statement A should be added to the first page of the document.

image1.png