Att_9_JPO_CUI_Information_Policy_May_2021.pdf

F-35 JOINT PROGRAM OFFICE (JPO) POLICY ON IDENTIFYING AND PROTECTING

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

(May 2021)

1. Background. Controlled Unclassified Information (CUI) is defined in Section 2002.4 of Title

32 CFR as "information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls." All unclassified information throughout the executive branch that requires any safeguarding or dissemination control is CUI.

2. References.

(a) DoDI 5200.48 Controlled Unclassified Information dated 6 March 2020

(b) b. Controlled Unclassified Information Markings Aid dated 3 September 2020

(c) Implementation of New F-35 Dissemination List Control Marking on Unclassified

Information memo, dated 16 March 2021

3. Scope. DoDI 5200.48 Controlled Unclassified Information (CUI), dated 6 March 2020, establishes policy, assigns responsibilities, and prescribes procedures for CUI throughout the DoD in accordance with Executive Order (E.O.) 13556; Part 2002 of Title 32, Code of Federal Regulations (CFR); and Defense Federal Acquisition Regulation Supplement (DFARS) Sections 252.204-7008 and 252.204-7012.

4. Applicability. Guidance contained herein are applicable to all personnel granted access to F- 35 JPO CUI information.

5. CUI Phased Implementation. As part of the phased DoD CUI Program implementation process endorsed by the CUI Executive Agent (EA) pursuant to Information Security Oversight Office (ISOO) Memorandum dated August 21, 2019, the designation, handling, and decontrolling of CUI (including CUI identification, sharing, marking, safeguarding, storage, dissemination, destruction, and records management) will be conducted in accordance with this issuance and Sections 252.204-7008 and 252.204-7012 of the DFARS when applied by a contract to non-DoD systems.

6. Threat. While not classified, CUI has value. Evidence that this is the case is reflected in the collection strategies of foreign intelligence services that, in recent years, have turned increasingly to the overt collection of UNCLASSIFIED information vice the covert collection of classified information.

7. Identifying JSF CUI. CUI is the designation that is applied to unclassified information that may be exempt from mandatory release to the public under the Freedom of Information Act (FOIA) (5 U.S.C. 552).

(a) The FOIA specifies nine exemptions that may qualify certain information withheld from release to the public if, by its disclosure, a foreseeable harm would occur. They are:

i. Information that is currently and properly classified. (Note: Because CUI is not a security classification, this FOIA exemption does not apply.)

ii. Information that pertains solely to the internal rules and practices of the Agency. (This exemption has two profiles, "high" and "low." The "high" profile permits withholding of a document that, if released, would allow circumvention of an Agency rule, policy, or statute, thereby impeding the agency in the conduct of its mission. The 'low" profile permits withholding if there is no public interest in the document, and it would be an administrative burden to process the request.)

iii. Information specifically exempted by a statute establishing particular criteria for withholding. The language of the statute must clearly state that the information will not be disclosed.

iv. Information such as trade secrets and commercial or financial information obtained from a company on a privileged or confidential basis that, if released, would result in competitive harm to the company, impair the Government's ability to obtain like information in the future, or protect the Government's interest in compliance with program effectiveness.

v. Inter-Agency memoranda that are deliberative in nature; this exemption is appropriate for internal documents that are part of the decision making process and contain subjective evaluations, opinions and recommendations.

vi. Information, the release of which could reasonably be expected to constitute a clearly unwarranted invasion of the personal privacy of individuals.

vii. Records or information compiled for law enforcement purposes that:

1. Could reasonably be expected to interfere with law enforcement proceedings;

2. Would deprive a person of a right to a fair trial or impartial adjudication;

3. Could reasonably be expected to constitute an unwarranted invasion of the personal privacy of others;

4. Disclose the identity of a confidential source;

5. Disclose investigative techniques and procedures; or

6. Could reasonably be expected to endanger the life or physical safety of any individual.

viii. Certain records of Agencies responsible for supervision of financial institutions.

ix. Geological and geophysical information concerning wells.

(b) Information that is currently and properly classified can be withheld from mandatory release under the first exemption category. "CUI" is applied to information that is exempt under one of the other eight categories. So, by definition, information must be unclassified in order to be designated CUI If an item of information is declassified, it can be designated CUI if it qualifies under one of those other categories. This means:

i Information cannot be classified and CUI at the same time and information that is declassified may be designated CUI, but only if it fits into one of the last eight exemption categories.

ii The FOIA provides that, for information to be exempt from mandatory release, it must fit into one of the qualifying categories and there must be a legitimate Government purpose served by withholding it. Simply because information is marked CUI does not mean it automatically qualifies for exemption. If a request for a record is received, the information must be reviewed to see if it meets this dual test. On the other hand, the absence of the CUI marking does not automatically mean the information must be released. Some types of records (for example, personnel records) are not normally marked CUI, but may still qualify for withholding.

8. CUI Marking. Information that has been determined to qualify for CUI status should be indicated by markings when included in documents and similar material. Markings should be applied at the time documents are drafted, whenever possible, to promote proper protection of the information. See reference b for overall making guidance of CUI documents.

(a) Unclassified documents and material containing CUI shall be marked as follows:

i. CUI Banner Line: At a minimum, CUI markings for unclassified DoD documents will include the acronym “CUI” in the banner and footer of the document. If utilized, a front cover, title page, and back cover also require CUI markings. Each document shall be covered with a SF 901, CUI coversheet.

ii. The CUI designation indicator must be readily apparent and shall appear only on the first page or cover. It is placed at the bottom right side of all documents containing CUI. CUI Designation Indicator Block will have the following information in it:

Controlled by: [Name of DoD Component] (Only if not on letterhead) Controlled by: [Name of Office] CUI Category: (List category or categories of CUI) Distribution/Dissemination Control:

POC: [Phone or email address]

iii. Pages of the document that contain CUI shall be marked "CUI" at the bottom.

iv. Material other than paper documents (for example, slides, computer media, films, etc.) shall bear markings that alert the holder or viewer that the material contains CUI.

(b) Classified documents and material containing CUI shall be marked as required by proper marking guidelines with CUI identified as follows:

i. Portions of the document shall be marked with their classification as required by classified information marking requirements. If there are unclassified portions that contain CUI, they shall be portioned marked with "(CUI)" in parentheses at the beginning of the portion.

ii. Transmittal documents that have no classified material attached, but do have CUI attachments shall be marked with a statement similar to this one:

iii. Attachment is “CUI"

iv. An electronically transmitted message (email) containing be CUI shall be marked "CUI" prior to the text of the message and the abbreviation --CUI will be reflected in the subject line as well. The JVE email system is in the process of being updated to reflect the new CUI marking requirements.

9. CUI Access. JSF CUI may be disseminated within the DoD and to DoD Contractors as necessary when conducting official business. CUI may also be released to officials in other Departments and Agencies of the Executive and Judicial Branches in performance of a valid Government function. Dissemination outside of the DoD and DoD Contractors, e.g., Congressional Staff, must be approved by the JSF/PAO. If approved, the following expanded marking should be used: "This document contains information exempt from mandatory disclosure under the FOIA. Exemption 5 applies." JSF CUI can be released to international partners within the JSF program in accordance with the current Delegation of Disclosure Letter (DDL).

10. CUI Storage. During working hours, reasonable steps will be taken to minimize the risk of access to CUI by unauthorized personnel. After working hours, CUI will be stored to preclude unauthorized access (i.e., stored in overhead bins, desks or cabinets).

11. CUI Transmission.

(a) Document Transmission.

i. Mail (First Class, Parcel Post or Fourth Class for bulk shipments). CUI may be transmitted via the US Post Office overnight service or a U.S.

Government contract overnight carrier (i.e., Federal Express). Double wrapping of CUI is not required.

ii. Hand Carry. Do not read, study or display CUI in any manner that may result in unauthorized disclosure.

iii. Facsimile. CUI may be faxed via non-secure fax as long as the recipient is present to receive the fax on the other end.

(b) Electronic Transmission. JSF CUI will be encrypted via DoD PKI-based encryption and transmitted in accordance with established JSF Information Technology Policies.

If requirements dictate or when DoD PKI-based encryption is unavailable, JSF Information Assurance shall be contacted for additional guidance.

12. CUI Destruction. CUI may be destroyed by shredding or by being placed in an approved and properly marked bum bag. Under no circumstances is CUI material to be placed in regular trash containers for disposal.

13. CUI Foreign Disclosure. CUI on US Government automated information systems for JSF

Program use must be reviewed for release to our partners and FMS customers when created on the system or imported from another source.

(a) Personnel authorized to Release. JSF Program personnel are required to complete

Foreign Disclosure Training within 20 days of receiving their initial account on the JSF Virtual Enterprise (JVE) automated information system. Once this Foreign Disclosure training has been accomplished these individuals are authorized to release CUI program information to JSF international partners. The JSF program individual releasing CUI must ensure the following:

• That the material is correctly marked and identified as CUI by current program classification guidance;

• That the information is releasable per current disclosure guidance; and

• That the recipient has a need-to-know

(b) Marking Releasable CUI Material. See reference (c).

(c) CUI Generated by CPP. CUI authored by Cooperative Program Personnel (CPP) assigned to the JSF Program must be correctly marked and identified as CUI by current program classification guidance; include in the release statement the appropriate partners to whom the information may be released; and corresponding permissions applied.