Addendum 5 for RFP Attachment 1- DD254 - Amendment 0002.pdf

Addendum 5 to DD Form 254 Solicitation Contract Number: M95494-20-R-0008

ADDENDUM 5 - CONTROLLED UNCLASSIFIED INFORMATION (CUI)

1. General: In addition to classified information, certain types of unclassified information also require application of access and distribution controls and protective measures for a variety of reasons. Such information is referred to collectively as Controlled Unclassified Information (CUI). This CUI Addendum identifies the controls and protective measures developed for DoD CUI (i.e., For Official Use Only (FOUO), Law Enforcement Sensitive (LES), DoD Unclassified Controlled Nuclear Information (DoD UCNI), and LIMITED DISTRIBUTION), Distribution Statements, as well as some of those developed and used by other Executive Branch agencies of the U.S. Government.

a. For Official Use Only (FOUO): FOUO is a dissemination control applied by the Department of Defense to unclassified information when disclosure to the public of that particular record, or portion thereof, would reasonably be expected to cause a foreseeable harm to an interest protected by one or more of Freedom of Information Act (FOIA) Exemptions 2 through 9, DoD 5400.7-R, and the Privacy Act of 1974, as amended.

b. Law Enforcement Sensitive (LES): LES is a marking sometimes applied, in addition to the marking “For Official Use Only,” by the Department of Justice and other activities in the law enforcement community, including those within the Department of Defense to denotes that the information was compiled for law enforcement purposes and should be afforded security in order to protect certain legitimate Government interests.

c. DoD Unclassified Controlled Nuclear Information (DoD UCNI): DoD UCNI is unclassified information on security measures (including security plans, procedures, and equipment) for the physical protection of DoD Special Nuclear Material (SNM), SNM equipment, SNM facilities, or nuclear weapons in DoD custody. Information is designated DoD UCNI in accordance with DoDD

5210.83 only when it is determined that its unauthorized disclosure could reasonably be expected to have a significant adverse effect on the health and safety of the public or the common defense and security by increasing significantly the likelihood of the illegal production of nuclear weapons or the theft, diversion, or sabotage of DoD SNM, SNM equipment, SNM facilities, or nuclear weapons in DoD custody.

d. LIMITED DISTRIBUTION (LIMDIS): LIMDIS is a caveat used by the National Geospatial- Intelligence Agency (NGA) to identify a select group of sensitive, unclassified imagery or geospatial information and data created or distributed by NGA or information, data, and products derived from such information. DoDI 5030.59 contains details of policies and procedures regarding use of the LIMITED DISTRIBUTION caveat.

e. Distribution Statements for Technical Data: Distribution statements are to be placed on classified and unclassified scientific and technical documents created under the DoD Scientific and Technical Information Program (reference DoDD 3200.12). These statements are intended to facilitate control, secondary distribution, and release of these documents without the need to repeatedly obtain approval or authorization from the controlling DoD office. Distribution statements are to be applied to all newly created technical documents generated by DoD-funded research, development, test, and evaluation programs and to newly created technical documents and other technical information (e.g., test plans, computer software) that can be used or adapted

Addendum 5 to DD Form 254 Solicitation Contract Number: M95494-20-R-0008 for use in development, manufacture, or operation of any military or space equipment or related technology. Documents containing export-controlled technical data shall be marked with the applicable export-control statement, as specified in DoD Directive 5230.24, “Distribution Statements on Technical Documents.”

f. Sensitive But Unclassified (SBU): SBU is information originated within the Department of State which that agency believes warrants a degree of protection and administrative control and meets the criteria for exemption from mandatory public disclosure in accordance with the provisions of the FOIA.

g. DEA Sensitive (DSEN): DSEN is unclassified information that the Drug Enforcement Agency (DEA) originates and that requires protection against unauthorized disclosure to protect sources and methods of investigative activity, evidence, and the integrity of pretrial investigative reports.

2. CUI Markings: Prescribed marking of CUI documents and other media containing CUI will be in accordance with DoDM 5200.01, Volume 4.

3. Access to CUI: No person may have access to information designated as CUI unless that person has been determined to have a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose. Refer to DoDM 5200.01 Volume 4 for specific access requirements for each type of CUI.

4. Protection of CUI: During working hours, reasonable steps shall be taken to minimize the risk of access by unauthorized personnel (e.g., not reading, discussing, or leaving CUI material unattended where unauthorized personnel are present). After working hours, CUI may be stored in unlocked containers, desks, or cabinets if Government or Government-contract building security is provided.

If such building security is not provided or is deemed inadequate, the information shall be stored in locked desks, file cabinets, bookcases, locked rooms, etc. Refer to DoDM 5200.01 Volume 4 for specific requirements for each type of CUI.

5. Dissemination of CUI: Each category of CUI has specific requirements for how that information can be disseminated via mail, e-mail, posted on a websites, etc. Refer to DoDM 5200.01, Volume 4 for specific requirements for how each type of CUI can be disseminated.

6. Destruction of CUI: CUI material shall be disposed of according to the provisions of DoDM 5200.01, Volume 4. Any method approved for the destruction of classified can be used to destroy

CUI.

7. Unauthorized Disclosure of CUI: Unauthorized disclosures of CUI information does not constitute a security violation however, appropriate management action shall be taken to fix responsibility for unauthorized disclosure of CUI whenever feasible or required by other guidance. Appropriate disciplinary action shall be taken against those responsible. Unauthorized disclosure of some CUI, e.g., information protected by “The Privacy Act of 1974, as amended” or export-controlled technical data may also result in civil and criminal sanctions against responsible persons. All unauthorized disclosures of CUI will be immediately reported to the Security Manager of the Government Agency sponsoring the contractor.