IMR_CUIG_SEP_2026_v1.0.pdf

i Distribution Statement A: Approved for public release, distribution unlimited.

Controlled Unclassified Information Guide

Intrinsic Market Resilience (IMR)

Date: September 2026 Version: 1

Dr. Matthew Wilding Justin Kokernak IPTO Program Manager IPTO Program Security Officer

Local reproduction of this document is authorized only in its entirety.

ii

FOREWORD

1. DESCRIPTION

2. AUTHORITY

3. DISTRIBUTION

GENERAL

1. PURPOSE

2. APPLICABILITY AND SCOPE

3. OFFICE OF PRIMARY RESPONSIBILITY

4. CONTROLLED UNCLASSIFIED INFORMATION (CUI) CHALLENGES

5. CUI CATEGORIES

6. EXPORT CONTROL RESTRICTED INFORMATION

7. DISCLOSURE OF CUI

8. CUI PROTECTION REQUIREMENTS

9. NOTIFICATION OF UNAUTHORIZED DISCLOSURE

10. INFORMATION PROTECTION GUIDANCE CHARTS

iii

FOREWORD

1. DESCRIPTION

Intrinsic Market Resilience (IMR) will develop methodology and software tools to identify design flaws in domestic online equity markets and recommend repairs that ensure resilience against different classes of attacks from non-economic actors. IMR aims to protect domestic market trade sequences and misuses of market coordination mechanisms that exploit equity market design vulnerabilities. IMR will incorporate resilience into domestic markets without restricting non-adversarial participant activity.

2. AUTHORITY

CUI elements referenced in this guide are under the authority of Executive Order 13556, Controlled Unclassified Information, November 4, 2010 (as amended) and in accordance with DoDI 5200.48, “Controlled Unclassified Information,” March 6, 2020.

3. DISTRIBUTION

GENERAL

1. PURPOSE

a. The purpose of this CUI guide is to ensure the protection of Intrinsic Market Resilience (IMR) information IAW DoDI 5200.48. IMR information must be controlled and stored consistent with DFARS 252.204-7012 requirements as detailed in National Institute for Standards and Technology (NIST) 800-171.

b. This guide is not for classified national security information as defined in Executive

Order 13526 but identifies specific elements of sensitive information that are unclassified but require additional protections.

c. IMR performers conducting work on a classified contract with a DD form 254, “Contract Security Classification Specification” must also consult the DARPA SCG listed in block 13 of their DD form 254 for guidance in making derivative classification determinations.

2. APPLICABILITY AND SCOPE

This guide applies to information, material and processes generated by IMR. This guide is the basis for identifying, protecting and marking information and material designated as a type of Controlled Unclassified Information (CUI) associated with IMR. This guide is used in conjunction with related guidance (security classification guides, DoW Policy, etc.) associated with the overall effort of IMR. The scope of this guide is based on IMR as planned at the date of this guide and may change over the course of IMR.

3. OFFICE OF PRIMARY RESPONSIBILITY (OPR)

The Office of Primary Responsibility is the Information Processing Techniques Office at IPTOSecurity@darpa.mil.

4. CONTROLLED UNCLASSIFIED INFORMATION (CUI) CHALLENGES

CUI Challenges are directed to the OPR. Information is protected in accordance with this guide until the challenge is resolved.

5. CUI CATEGORIES. The following CUI Categories are used to protect IMR:

a. Defense: Controlled Technical Information (CTI). Controlled Technical Information means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Controlled technical information is to be marked with one of the distribution statements B through F, in accordance with Department of Defense Instruction 5230.24, "Distribution Statements of Technical Documents." The term does not include information that is lawfully publicly available without restrictions. "Technical Information" means technical data or computer software, as those terms are defined in Defense Federal Acquisition Regulation Supplement clause 252.227-7013, "Rights in Technical Data - Noncommercial Items" (48 CFR 252.227-7013). Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

b. Financial: General Proprietary Business Information. Material and information relating to, or associated with, a company's products, business, or activities, including but not limited to financial information; data or statements; trade secrets; product research and development;

existing and future product designs and performance specifications.

c. Financial: General Financial Information. Related to the duties, transactions, or otherwise falling under the purview of financial institutions or United States Government fiscal functions. Uses may include, but are not limited to, customer information held by a financial institution.

d. Financial: Financial Supervision Information. Related to information connected to an agency's responsibilities to supervise, examine, and evaluate a financial institution.

e. Intelligence: Operational Security (OPSEC). Critical information determined to give evidence of the planning and execution of sensitive (frequently classified) government activities after going through a formal systematic vetting process in accordance with National Security Presidential Memorandum Number 298. This process identifies unclassified information that must be protected. It almost always results from an agency’s official OPSEC program or is otherwise commonly approved for use by the CUI Senior Agency Official.

6. EXPORT CONTROL RESTRICTED INFORMATION

Each performer is responsible for assessing their technology and ensuring compliance with all export control laws and regulations. This CUI guide does not relieve any program participant from export control requirements.

7. DISCLOSURE of CUI

a. Public Disclosure. Public Disclosure of any IMR information must follow the DISTAR process. Please contact the IMR OPR and Public_Release_Center@darpa.mil for additional guidance.

b. Freedom of Information Act (FOIA) Requests. All FOIA requests are directed to the

DARPA FOIA Office.

c. Foreign Disclosure. CUI controlled by DARPA may be shared with foreign nationals if access to such information would accomplish a lawful government purpose and would not be detrimental to national security.

8. CUI PROTECTION REQUIREMENTS

IMR CUI must be stored in accordance with DoDI 5200.48. Processing of CUI is only authorized on systems compliant with DFARS 252.204-7012 as detailed in NIST 800-171.

9. UNAUTHORIZED DISCLOSURE

a. Personnel must immediately report all unauthorized disclosures or suspected and known security incidents, and suspicious activities involving CUI to the IMR PSO and PSR at IPTOSecurity@darpa.mil.

b. Data breaches of Defense Industrial Base (DIB) networks and systems involving IMR

CUI material must be reported IAW DFARS 252.204-7012 requirements. In addition, all breaches must be reported to the DARPA Project contracting officer and program security officer (PSO) upon discovery.

10. INFORMATION PROTECTION GUIDANCE CHARTS

This CUI table is not to be used to make a derivative classification determination for classified national security information. IMR performers on contract for classified work must consult the DARPA SCG listed in block 13 of their DD form 254, for guidance in making derivative classification determinations.

The following charts do not apply to existing, unclassified, non-CUI artifacts that may be leveraged in the program. These charts are provided to assist in identifying what types of information developed under the IMR effort may be sensitive, provide guidance on the relevant markings for this information to control dissemination, and provide guidance on when these dissemination controls no longer apply. If at any time there are questions regarding which category of information something falls under, or what dissemination controls apply, individuals should request guidance from the IMR PSR at IPTOSecurity@darpa.mil.

Element of Information Index Category Reason LDC or Distribution Statement

Remarks

All documentation, system outputs, test results and work products related to the application of any program-developed algorithm, technique, or capability to US market systems.

Financial Financial Supervision Information

(FSI)

12 CFR 4.36

12 USC

1828(x)

FEDCON

Financial General Financial Information

(FNC)

12 USC

5322(d)(5)(A)

FEDCON

Performance metrics and evaluation data for IMR software integrated into, trained on or tested on any US market system.

Defense Controlled Technical Information

(CTI)

DFARS

252.204.7012 DoDI 5230.24

DISTRO C

Individual AI models or multi-agent AI model collectives trained or fine-tuned on data sets derived

Financial General Financial Information

(FNC)

12 USC

5322(d)(5)(A)

FEDCON

from US market systems sources.

Algorithms that contain logic specific to US market systems or applications.

Financial General Financial Information

(FNC)

12 USC

5322(d)(5)(A)

FEDCON

Data sets derived from private, commercial financial system or USG financial system sources that are not publicly available.

Financial General Financial Information

(FNC)

12 USC

5322(d)(5)(A)

FEDCON

Information detailing interdependencies between the financial sector and other critical sectors that are not publicly available.

Financial General Financial Information

(FNC)

12 USC

5322(d)(5)(A)

FEDCON PROPIN if derived directly from a commercial entity.

Descriptions of a market’s functioning with respect to its public interfaces derived from proprietary information.

Financial General Financial Information

(FNC)

12 USC

5322(d)(5)(A)

FEDCON PROPIN if derived directly from a commercial entity.

Information detailing proposed repairs to market design weaknesses.

Financial General Financial Information

(FNC)

12 USC

5322(d)(5)(A)

FEDCON

Information detailing financial market system functionality and design weaknesses.

Financial Financial Supervision Information

(FSI)

12 CFR 4.36 FEDCON

Digital models representing actual financial market systems.

Financial General Financial Information

(FNC)

12 USC

5322(d)(5)(A)

FEDCON

Identification of specific US market systems or applications IMR technology will be deployed in.

Intelligence Operational Security

(OPSEC)

NSDD 298 FEDCON