BPL_Controlled_Unclassified_Information_Guide__CUIG__V3_Final_PM_PSOsigned_20230321.pdf

Distribution Statement A

(U) Controlled Unclassified Information Guide

(U) Program: Business Process Logic (BPL)

(U) Program Manager: Mr. John-Francis Mergen

(U) Program Security Officer: Mr. Troy Blackburn

Date: March 2023 Version: 1

Mr. John-Francis Mergen Mr. Troy Blackburn I2O Program Manager I2O Program Security Officer ii

(U) FOREWORD

1. (U) DESCRIPTION

2. (U) AUTHORITY

3. (U) DISTRIBUTION

(U) GENERAL

1. (U) PURPOSE

2. (U) APPLICABILITY AND SCOPE

3. (U) OFFICE OF PRIMARY RESPONSIBILITY

4. (U) CONTROLLED UNCLASSIFIED INFORAMTION (CUI) CHALLENGES

5. (U) OPERATION SECURITY (OPSEC)

6. (U) CUI CATAGORIES

7. (U) EXPORT CONTROL RESTRICTED INFORMATION

8. (U) FREEDOM OF INFORMATION ACT (FOIA) EXEMPT INFORMATION

9. (U) DISCLOSURE OF CUI

10. (U) CUI PROTECTION REQUIREMENTS

11. (U) NOTIFICATION OF UNAUTHORIZED DISCLOSURE

iii

(U) FOREWORD

1. (U) DESCRIPTION

(U) BPL will develop tools to identify vulnerabilities in business systems that control and manage defense-critical workflows for governments and businesses around the world to protect such systems.

2. (U) AUTHORITY

(U) CUI elements referenced in this guide are under the authority of DoDI 5200.48, “Controlled Unclassified Information,” March 6, 2020.

3. (U)DISTRIBUTION.

(U) Approved for public release: distribution unlimited.

1. (U) PURPOSE

a. (U) The purpose of this CUI guide is to ensure the protection of BPL information IAW DoDI 5200.48. BPL information should be controlled and stored consistent with federal requirements and guidance from the National Institute for Standards and Technology (NIST).

Sensitive information does not include information in the public domain.

b. (U) This guide is not for classified national security information as defined in

Executive Order 13526, but identifies specific elements of sensitive information that are unclassified in nature requiring protection. This information is not classified national security information, but it is covered by the legislation at large for the Freedom of Information Act (FOIA) and the exemptions therein.

2. (U) APPLICABILITY AND SCOPE

(U) This guide applies to all DARPA personnel, support contractors, mission partners, and industrial performers who support BPL. This guide should be cited as the basis for identifying, protecting, and marking of information and material designated as a type of controlled unclassified information (CUI) associated with BPL. As defined at 32 CFR Section 2002.4(h), CUI is information that the government creates or possesses – or that an entity creates or possesses on behalf of the government that law, regulation, or government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. It is to be used in conjunction with related security classification guides and guidance documents associated with the overall effort of BPL, in compliance with Executive Orders and related DoD guidance. The scope of this guide is based on BPL as planned at the date of this guide, and may expand or change as strategic decisions are made over the course of BPL.

3. (U) OFFICE OF PRIMARY RESPONSIBILITY (OPR)

(U) This CUI guide is issued by DARPA. All inquiries concerning content, interpretations, and clarification of this document should be addressed to DARPA at I2Osecurity@darpa.mil with any questions.

4. (U) CONTROLLED UNCLASSIFIED INFORMATION (CUI) CHALLENGES

(U) CUI Challenges: Authorized holders of CUI who, in good faith, believe that a designation of information as CUI within this guide is improper or incorrect, or who believe they have received unmarked CUI, should notify DARPA at I2Osecurity@darpa.mil. Until the challenge is resolved, the challenged CUI, including challenges to unmarked CUI, will continue to be safeguarded and disseminated at the appropriate control level indicated in the markings or presumed category.

5. (U) OPERATIONS SECURITY (OPSEC)

a. (U) OPSEC is a process that identifies and mitigates adversarial risk to our operations by looking at our operations through the eyes of our adversaries. The application of the OPSEC methodology includes identifying critical information, analyzing threats and vulnerabilities, analyzing, and assessing adversarial risk, and implementing OPSEC measures that reduce this risk.

b. (U) BPL critical information falls under the following index of CUI:

1) (U) Critical Infrastructure: Information Systems Vulnerability Information (ISVI)

2) (U) Defense: Controlled Technical Information (CTI)

3) (U) Export Control: Export Controlled (EXPT)

4) (U) Export Control: Export Controlled Research (EXPTR).

5) (U) Procurement and Acquisition: General Procurement and Acquisition

(PROCURE)

6) (U) Procurement and Acquisition: Small Business Research and Technology

(SBIZ)

7) (U) Procurement and Acquisition: Source Selection (SSEL)

8) (U) Proprietary Business Information: General Proprietary Business Information

(PROPIN)

9) (U) Proprietary Business Information: Proprietary Manufacturer (MFC)

6. (U) CUI Categories

a. (U) Critical Infrastructure: Information Systems Vulnerabilities Information (ISVI). Related to information that if not protected, could result in adverse effects to information systems. Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

b. (U) Defense: Controlled Technical Information (CTI). Means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination.

Controlled technical information is to be marked with one of the distribution statements B through F, in accordance with Department of Defense Instruction 5230.24, "Distribution Statements of Technical Documents." The term does not include information that is lawfully publicly available without restrictions. "Technical Information" means technical data or computer software, as those terms are defined in Defense Federal Acquisition Regulation Supplement clause 252.227-7013, "Rights in Technical Data - Noncommercial Items" (48 CFR 252.227-7013). Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

c. (U) Export Control: Export Controlled (EXPT). Unclassified information concerning certain items, commodities, technology, software, or other information whose export could reasonably be expected to adversely affect the United States national security and nonproliferation objectives. To include dual use items; items identified in export administration regulations, international traffic in arms regulations (ITAR) and the munitions list; license applications; and sensitive nuclear technology information.

d. (U) Export Control: Export Controlled Research (EXPTR). Related to the systematic investigation into and study of materials and sources in order to establish facts and reach new conclusions.

e. (U) Procurement and Acquisition: General Procurement and Acquisition

(PROCURE). Material and information relating to, or associated with, the acquisition and procurement of goods and services, including but not limited to, cost or pricing data, contract information, indirect costs, and direct labor rates.

f. (U) Procurement and Acquisition: Small Business Research and Technology

(SBIZ). Relating to certain "Small Business Innovation Research Program" and "Small Business Technology Transfer Program" information in a government database, as referenced in 15 USC 638(k)(2).

g. (U) Procurement and Acquisition: source Selection (SSEL). Per FAR 2.101: any of the following information that is prepared for use by an agency for the purpose of evaluating a bid or proposal to enter an agency procurement contract, if that information has not been previously made available to the public or disclosed publicly.

h. (U) Proprietary Business Information: General Proprietary Business Information

(PROPIN). Material and information relating to, or associated with, a company's products, business, or activities, including but not limited to financial information; data or statements;

trade secrets; product research and development; existing and future product designs and performance specifications.

i. (U) Proprietary Business Information: Proprietary Manufacturer (MFC). Relating to the production of a consumer product to include that of a private labele

7. (U) EXPORT CONTROL RESTRICTED INFORMATION

a. (U) Export Administration Regulations (EAR) may apply to specific Defense Industrial Base (DIB) Systems being assessed for vulnerabilities, Business Logic (BL) code, processes for DIB manufacturing, and DIB manufacturing process systems test bed. It is the responsibility of BPL performers to ascertain the potential export controls of their technology.

8. (U) FREEDOM OF INFORMATION ACT (FOIA) EXEMPT INFORMATION

a. (U) The Freedom of Information Act (FOIA), 5 U.S.C. § 552, is a federal law that defines agency records subject to public disclosure, outlines mandatory disclosure procedures, and defines nine exemptions that prohibit certain types of information from being released to the public. In addition to the FOIA, the Code of Federal Regulations (October 2016), 45 CFR § 5.31 specifies the type of information that falls under each of the nine exemptions that preclude release of information to the public under the FOIA. In accordance with 5 U.S.C. § 552(a)(8), DARPA will withhold records or information exempt from disclosure under the FOIA whenever disclosure would harm an interest protected by a FOIA exemption or disclosure is prohibited by law. The most relevant exemptions for BPL are listed below; however other exemptions could apply:

1) (U) Exemption 2: Internal Matters. Exemption 2 protects from disclosure records that relate to internal personnel rules and practices of the agency. This exemption protects internal documents, the disclosure of which would risk circumvention of a statute or agency regulation, or impede the effectiveness of an agency’s activities.

2) (U) Exemption 3: Information Protected by Other Statutes. Exemption 3 incorporates the disclosure prohibitions that are contained in other statutes. A statute must require withholding without permitting any discretion, or establish particular criteria for withholding or refer to particular types of matter to be withheld.

3) (U) Exemption 5: Privileged Information. Exemption 5 protects inter-agency or intra-agency memoranda or letters 5 that would not be available by law to a party in litigation with the agency. The three most frequently invoked privileges are the deliberative process, the attorney work-product and the attorney-client. [Insert common FOIA exemption from your Project.

9. (U) DISCLOSURE of CUI.

a. (U) Public Disclosure .Information from this CUI guide does not allow automatic public release of this information. DoD information requested by the media or members of the public or proposed for release to the public by DoD civilians or military personnel or their contractors will be processed in accordance with DARPA Instruction 65 and DoD Instructions 5230.09, 5230.29; Volume 3 of DoD Manual 5200.01; and DoD Manual 5400.07, as applicable. Proposed public disclosures of unclassified information shall be submitted using the public release form located at https://www.darpa.mil/work-with-us/contract-management/public-release.

b. (U) Freedom of Information Act (FOIA) Requests. All personnel with knowledge of this Project must coordinate with the DARPA PSO prior to providing a response to requests for information under the provisions of the FOIA.

c. (U) Proprietary Information (PROPIN). Additional safeguards may become necessary if a contract requires the transfer of PROPIN. The holder of the information must clearly identify any and all PROPIN prior to its disclosure and release, the release will be coordinated with the PROPIN owner.

d. (U) Foreign Disclosure. CUI controlled by DARPA, as part of a DARPA funded project, may be shared with a U.S. organization’s (i.e., the U.S. DIB, U.S. academia, or U.S research, institutions) and non-U.S. citizen employees of those U.S organizations under specific conditions. Note, this guidance is separate from the CUI foreign disclosure process for foreign government personnel as outlined in DoDD 5230.11 and contracting with a foreign company or university.

1) (U) Policy: This is based on DoD CUI policy defined in 32 CFR Part 2002, DoDI

5200.48. DoDD 5230.11, 22 CFR 120.15-120.16.

2) (U) It is important to understand that a non-U.S. citizen can either be a foreign person or a U.S. person.

i. (U) A foreign person is any person who is not a lawful permanent resident of the Unites

States, e.g., students or employees legally in the U.S. with a valid student or work visa.

ii. (U) A U.S. person, which includes those known as “Green Card holders”, is a person who is a lawful permanent resident of the United States or who is a protected individual as defined by 8 U.S.C.1101(a)(20) or 8 U.S.C.1324b(a)(3).

https://www.darpa.mil/work-with-us/contract-management/public-release https://www.darpa.mil/work-with-us/contract-management/public-release

3) (U) CUI may be disclosed to a foreign person employed by the U.S. organizations if:

i. They are operating under a formally issued solicitation or awarded DARPA S&T project that; Clearly defines the U.S. organization’s responsibilities to comply with DoD CUI policies and procedures as detailed in either DoD 5200.48, DFARS 252.204-7012, 7019, and 7020, or similarly acceptable guidance and direction, the CUI is not Export Controlled or NOFORN, access to such information is within the scope of their assigned duties and access to such information would help accomplish a lawful and authorized DoD mission or purpose and would not be detrimental to the interests of the DoD or the U.S. Government.

4) (U) CUI that is Export Controlled may be disclosed to foreign persons employed by U.S.

organizations when (export license, technical assistance agreement (TAA), or exemption/exception) is granted from either the Department of State or the Department of Commerce. The U.S. entity, the company or university on contract, who is granting access to the information is responsible for obtaining the appropriate authorization.

5) (U) CUI that is NOFORN may be shared with U.S. persons, but will not be provided, in any form, to foreign governments (including coalition partners), international organizations, foreign nationals, or other non-U.S. persons without the originator’s approval in accordance with E.O.s 13526 and 13556.”

6) (U) CUI controlled by DARPA, to include CUI that is NOFORN or EXPORT CONTROLLED, may be disclosed to U.S. Persons if they are a performer on a DARPA S&T proposal team or, if they are a performer who has been awarded a DARPA S&T project and their sponsoring institution has agreed to comply with DoD CUI policies and procedures as detailed in either DoD 5200.48, DFARS 252.204-7012, 7019, and 7020, or similarly acceptable guidance and direction.

10. (U) CUI PROTECTION REQUIREMENTS

a. (U) BPL CUI (e.g., confidential business information, PII, USPI, vulnerability test results, DIB system assessments, DIB manufacturing processes) regardless of media or format, will be protected from disclosure to unauthorized persons or groups, by properly storing in locked offices, cabinets, and drawers in accordance with DoDI 5200.48.

b. (U) CUI may only be processed on DIB systems that are compliant with DFARS 252.204-7012 requirements as detailed in NIST 800-171.

11. (U) NOTIFICATION OF UNAUTHORIZED DISCLOSURE

a. (U) Personnel must immediately report all unauthorized disclosures or suspected and known security incidents, privacy breaches, and suspicious activities involving CUI to the BPL PSO and PSR at I2Osecurity@darpa.mil.

b. (U) Data breaches of DIB networks and systems involving [PROJECT NAME] CUI material must be reported IAW DFARS 252.204-7012 requirements. In addition, all breaches must be reported to the DARPA Project contracting officer and program security officer (PSO) upon discovery.

13. (U) INFORMATION PROTECTION GUIDANCE CHARTS

(U) These charts are provided to assist in identifying what types of information associated with the BPL effort may be sensitive, provide guidance on the relevant markings for this information to control dissemination, and provide guidance on when these dissemination controls no longer apply. If at any time there are questions regarding which category of information something falls under, or what dissemination controls apply, individuals should request guidance from DARPA at I2Osecurity@darpa.mil.

Element of Information

Index Category Reason LDC or Distribution Statement

Table is UNCLASSIFIED Remarks

Identification of specific DIB systems being assessed for vulnerabilities

Intelligence Operations Security (OPSEC)

NSPM 28 FEDCON Identified DIB systems are UNLCASSIFIED, assessed vulnerabilities will be CUI

Statements of Work (SOW) for BPL

Procurement and Acquisition

PROCURE 32 CFR 2002 DL Distribution UNCLASSIED and not CUI when handled by originating source.

BPL Program Funding

Financial BUDG Office of Management Budget (OMB) Circular A-11 Section 22.1

FEDCON Total per year program funding is UNCLASSIFIED.

Detailed Funding is CUI.

Test beds replicating DIB manufacturing process

Critical Infrastructure

CRIT PPD-21 FEDCON Replicate DIB software is UNCLASSIFIED, variant test bed results are CUI

BL code or processes for DIB manufacturing processes

Defense SP-CTI DFARS 252.227-7013

FEDCON DIB Coding is CUI

Vulnerabilities identified in BL code not specific to the DIB adversary or

Critical Infrastructure

ISVI 447 USC 3554

(OMB M-21-02)

44 USC 2333 (f)

FEDCON Not CUI if identified by fundamental research performers. All others must coordinate public release of

U.S. critical infrastructure processes all vulnerability information via the PSO. Protect CUI until release is approved.

Patches or remediation techniques for BL vulnerabilities

Critical Infrastructure

ISVI 447 USC 3554

(OMB M-21-02)

44 USC 2333 (f)

FEDCON Not CUI if identified by fundamental research performers. All others must coordinate public release via the PSO. Protect CUI until release is approved.

The Following Are Not CUI/CTI by Technical Area

Table is UNCLASSIFIED Specifics

TA1: Represent and Charitie BL Status • Fundamental research performed under this technical area.

• All documentation, system outputs, test results and work products that are generated from

1) open-source projects OR 2) program-developed algorithm, technique, or capability; AND are applied to open-source software or non-military platforms/datasets.

• The following are not considered CUI: 1) Products and artifacts that are for commercial application only 2) Open-source software and its artifacts that do not reflect military application.

Distribution control: DISTRO A.

TA2: Resolving Vulnerabilities • Fundamental research performed under this technical area.

• All documentation, system outputs, test results and work products that are generated from

1) open-source projects OR 2) program-developed algorithm, technique, or capability; AND are applied to open-source software or non-military platforms/datasets.

• The following are not considered CUI: 1) Products and artifacts that are for commercial application only 2) Open-source software and its artifacts that do not reflect military application.

Distribution control: DISTRO A.

TA3: Test & Evaluation – Defense-critical workflows • Fundamental research performed under this technical area.

• All documentation, system outputs, test results and work products that are generated from

1) open-source projects OR 2) program-developed algorithm, technique, or capability; AND are applied to open-source software or non-military platforms/datasets.

• The following are not considered CUI: 1) Products and artifacts that are for commercial application only 2) Open-source software and its artifacts that do not reflect military application.

Distribution control: DISTRO A.