Attachment_J-11_-_NN-801_Control_and_Protection_of_U-NNPI.pdf

OFFICIAL USE ONLY

NN-801 (05/12)

Revision 04

CONTROL AND PROTECTION

OF UNCLASSIFIED

NAVAL NUCLEAR PROPULSION INFORMATION

Official Use Only May be exempt from public release under the Freedom of Information Act (5 U.S.C. 552), exemption number and category: Exemption 2

Department of Energy review required before public release Name/Org: CS Lowell / BPMI Date: 23 May 2012

Guidance (if applicable): DOE Order 471.3

This page intentionally left blank

TABLE OF CONTENTS

Section Page

1. General Notes.…………………………………………………………………..….… 1

2. Definitions……………………………………………………………………………… 2

3. Disclosure Policy……………………………………………………………………… 5

4. Marking Requirements……………………………………………………………….. 9

5. DOD Certification of Seller's Eligibility to Receive NNPP Information…………… 10

6. Control and Storage of Unclassified NNPI…………………………………....……. 11

7. Control of Visitors……………………………………………………………………… 12

8. Transmittal and Shipment of Unclassified NNPI…………………………………… 13

9. Disposal of Unclassified NNPI………………………………………………………. 14

10. Unclassified NNPI Information Systems (IS) Protection Requirements…………… 15

11. Naval Nuclear Propulsion Information Control Officer (NNPICO)………………. 26

12. Guidance for Identifying Unclassified NNPI………………………………………… 26

Enclosure (1) Agreement for Protection of Unclassified Naval Nuclear Propulsion Program Information

(U-NNPI) as Part of an Inquiry Enclosure (2) Unclassified Naval Nuclear Propulsion Program Information (U-NNPI) Information System

Protection Requirements Checklist Enclosure (3) Seller Certification of Compliance for the Control and Protection of Unclassified Naval

Nuclear Propulsion Information (U-NNPI) Enclosure (4) Acronyms Exhibit (1) Marking Requirements and Distribution Warning Statements

NN-801 (05/12) Page 1 of 27

1. GENERAL NOTES

a. The requirements in the NN-801 are applicable to all unclassified procurements that involve Unclassified Naval Nuclear Propulsion Information (U-NNPI) at both the Seller and Seller’s subcontracted suppliers. The NN-801 has been prepared to assist in the identification and safeguarding of U-NNPI. The NN-801 is also applicable to procurements that involve other sensitive unclassified military information such as Unclassified Controlled Nuclear Information (UCNI). The term "U-NNPI" shall include UCNI.

b. Adhering to the guidelines of NN-801 (Control and Protection of Unclassified Naval Nuclear Propulsion Information), as obligated under contract, fulfills supplier and sub-tier supplier requirements of OPNAVINST N9210.3 for the protection of U-NNPI.

c. The Seller shall prepare a Security Plan incorporating the requirements set forth in NN-801. The Security Plan shall include all policies, procedures and documentation delineated in all sections of NN-801 and shall be submitted to the Buyer for approval. Any further references to written plans and policies are referring to the Security Plan.

d. All Seller personnel (including on-site subcontractor personnel) with the potential to access U-NNPI shall receive a security briefing on the requirements for the protection of U-NNPI before being granted unescorted access to an area that contains U-NNPI. Initial training shall ensure that personnel processing U-NNPI know the security risks associated with their activities and the applicable laws, Executive Orders, directives, policies, standards, instructions, regulations, or procedures related to the security of U-NNPI. Thereafter, refresher orientations shall be administered to all Seller personnel (including on-site subcontractor personnel) on an annual basis.

The Seller shall maintain recipient signed records of the initial training and afterwards the latest refresher training.

Seller personnel processed for, or possessing a Department of Energy (DOE) or Department of Defense (DOD) security clearance, who are denied the clearance or have an active clearance suspended shall not be granted access to classified or unclassified NNPI. The Seller shall identify to the Buyer, in the Security Plan, the personnel responsible for the implementation and enforcement of these requirements.

e. Sensitive unclassified military technology is protected by several Federal statutes and export control regulations. Naval Nuclear Propulsion technology is subject to these controls; hence, U-NNPI is protected in accordance with the requirements identified herein.

f. During the performance of this contract, U-NNPI may be developed and/or used. Appropriate safeguards must be implemented by the Seller to prevent release of U-NNPI in any form by the Seller or any subcontractor. These safeguards shall ensure that access to U-NNPI is limited to those governmental and Seller parties (including subcontractors), that have an established Need-to- Know (NTK), and then only under conditions which assure that the information is properly protected. Access by foreign nationals or representatives of foreign interests is not permitted. In addition, any and all issuances or releases of such information beyond such necessary parties, whether or not ordered through an administrative or judicial tribunal, shall be brought to the attention of the Buyer.

The Buyer and Government Procurement Agent shall be immediately notified of any litigation, subpoenas, or requests which either seek or may result in the release of U-NNPI. In the event that a court or administrative order makes immediate review by the Buyer and Government Procurement Agent impracticable, the Seller agrees to take all necessary steps to notify the court or

NN-801 (05/12) Page 2 of 27 administrative body of the Naval Reactors’ interest in controlling the release of such information through review and concurrence of any release.

The Buyer reserves the right to review the Seller’s facility and Security Plan for compliance with the requirements of the NN-801. Exceptions to the requirements of the NN-801 may only be obtained with written approval from the Buyer.

The Seller shall inform the Buyer of any decision to maintain U-NNPI following completion of the contract and the date by when, or the circumstances under which, the material would be destroyed in accordance with Section 9, Disposal of Unclassified - NNPI.

g. The Seller agrees to insert NN-801, unmodified and in its entirety, in all subcontracts involving U-NNPI (including this sentence).

h. The Seller agrees that prior to providing any U-NNPI to a prospective sub-tier supplier that they shall obtain signed copies of the sub-tier’s DD-2345 form and NN-677 (Enclosure (1)). Proof of current/active registration through Defense Logistics Information Services (DLIS) Joint Certification Program (JCP) is also acceptable.

i. Controlled items (see Section 2.b) are barred from entering the Seller’s facility unless they are specifically allowed by the Seller. The Seller should recognize the risks posed by controlled items and take steps to mitigate these risks.

j. The Seller shall certify compliance to all of the requirements contained herein by completing and submitting Enclosure (3) of this document to the Buyer prior to contract award. Any deviations from the requirements stated herein shall be documented in an attachment to Enclosure (3). Enclosure

(3) is also required for sub-tier contractors.

k. The Seller shall develop and conduct an annual self-assessment program to ensure U-NNPI is afforded adequate control and protection as required by NN-801. The Enclosure (2) checklist may be used as part of the cyber security portion of the (Section 10, Unclassified NNPI Information Systems (IS) Protection Requirements) self-assessment. The entire self-assessment program should be discussed in the site Security Plan. Completed self-assessments shall be provided to the Buyer for information.

2. DEFINITIONS

a. Buyer - For the purpose of the NN-801, a Buyer is the agency contracting with any other to provide services or perform work involving NNPI.

b. Controlled Items - For the purpose of the NN-801, controlled items include, but are not limited to:

cameras, cellular phones, Personal Electronic Devices (PEDs), recording devices, citizen band radios, computer equipment (hardware and software), data processing media (e.g., tapes, disks, CDs, thumb drives, flash memory), personal defense sprays, weapons, and the possession of any item that is a violation of the Seller’s Corporate Policy or Security Plan.

c. Contract - For the purpose of the NN-801, a contract is any legally enforceable agreement between the Buyer and a supplier. A contract may be a purchase agreement, a Purchase Order, or an Interagency Agreement.

d. Document - Any record of information, regardless of physical form or characteristics, including, but not limited to:

NN-801 (05/12) Page 3 of 27

(1) Handwritten, printed or typed matter;

(2) Painted, drawn, or engraved matter;

(3) Sound, magnetic, optical, or electro-mechanical recordings;

(4) Photographic prints exposed or developed film, still or motion pictures, and image retaining digital cameras;

(5) Automated data processing input, printouts, messages (e.g., email), and contents of equipment and/or media which may include memory, tapes, diskettes, and visual displays (e.g., web pages); and

(6) Reproductions of the foregoing by any process.

e. Dual Citizen - Individuals who hold both a U.S. citizenship and the citizenship of some other country.

f. Equipment - All supplies, component parts, and models of such supplies and component parts that are to be delivered under this contract. Equipment does not include standard commercial supplies, component parts, and models.

g. Foreign Interest - Any foreign government, agency of a foreign government, or representative of a foreign government; any form of business enterprise or entity organized under the laws of a country other than the United States (U.S.), or its possessions.

h. Foreign National - For the purpose of the NN-801, a foreign national is any person that is not a U.S. Citizen or U.S. National. As such, non-U.S. Citizens or non-U.S. Nationals permanently residing in the U.S. are considered to be foreign nationals.

i. Government - For the purpose of the NN-801, the Government is considered to be NR or its field offices.

j. Government Procurement Agent – The procurement agent directly responsible to the Government and for obtaining Government approval of the disclosure of NNPI.

k. Information System (IS) - Any electronic resource that stores, processes or transmits information.

An IS can be as simple as a Blackberry or stand-alone computer, or as complex as a large corporate network.

l. Naval Nuclear Propulsion Information (NNPI) - NNPI is all information, classified or unclassified, concerning the design, arrangement, development, manufacture, testing, operation, administration, training, maintenance, and repair of the propulsion plants of Naval Nuclear Powered ships and prototypes including the associated shipboard and shore-based nuclear support facilities.

The term “NNPI”, when used without qualifiers (such as “classified” or “unclassified”) shall be taken to include both classified and unclassified NNPI.

Information on design, development, manufacture, testing, administration, maintenance and repair (including supply support) of components is not NNPI unless there is an association with a Naval Nuclear Propulsion Plant or support facility through the use of a direct reference to a ship name, project designator, ship system identification, component nameplate data, component name (which reveals a reactor plant function), or a readily identifiable, sensitive reactor plant component.

Technology (including basic research, test data, evaluation methods, behavior models, etc.), developed to support the Naval Nuclear Propulsion Program applications should be considered to be NNPI regardless of either direct or indirect application, unless otherwise identified.

NN-801 (05/12) Page 4 of 27

Technology that is applicable to both naval nuclear and conventional propulsion plants is not considered to be NNPI when used in reference to conventional applications only, provided no association with Naval Nuclear Propulsion can be directly identified from the information in question. In cases where an association with Naval Nuclear Propulsion can be directly identified from the information in question, designation of the information as NNPI is mandatory.

A detailed definition of the NNPI applicable to a specific contract, including further discussion of what constitutes association, is provided in the contract specific guidance (See Section 12, Guidance for Identifying Unclassified NNPI).

As used in this guide, this designation (U-NNPI) indicates that although the information is unclassified, it is subject to special handling controls, restricted access and distribution (export controls) and marking requirements and is not releasable to the general public without prior approval of the Buyer and the Government Procurement Agent.

m. Need-to-know (NTK) - A determination by a person having responsibility for protection of information or material that a proposed recipient's access to such information or matter is necessary in performing official or contractual duties of employment.

n. Personal Electronic Devices (PEDs) -. Electronic devices that include but are not limited to handheld computers, Personal Digital Assistants (PDAs), two-way pagers, cellular telephones, scientific calculators with media or computer connection or transmit capability, and devices with storage capabilities (fixed or removable) such as digital photo frames.

o. Public - The public is any person or organization that does not represent the Seller, the Buyer, the Government Procurement Agent, or the Government (NR or its field offices) in the performance of this contract.

p. Representative of a Foreign Interest - For the purpose of the NN-801, a representative of a foreign interest is any person (regardless of citizenship), functioning (in an individual capacity or on behalf of any corporation, person or government entity), as an official representative, agent, or full-time employee of a foreign interest. A U.S. Citizen appointed by a U.S. employer to act as a representative in the management of a foreign subsidiary, of a U.S. corporation is not considered a representative of a foreign interest.

q. Seller/Supplier - For the purpose of the NN-801, a seller/supplier is any agency that is contracted by a Buyer to provide services or perform work involving NNPI.

r. Technical Data - All professional, scientific, and/or technical information, (and data) produced (or prepared), for the performance of this contract. This includes the operation, maintenance, evaluation, and testing of any contract item, whether or not the information (and data), is specified to be delivered under this contract. This further includes (without limitation), all writings, sound recordings, pictorial reproductions, drawings, or other graphical representations. However, "technical data" does not include information and data on standard commercial supplies and component parts to the extent that the information and data do not relate to the use, operation, maintenance, evaluation, and testing of such supplies (and component parts) in or connected to any item, (or component part), to be delivered under this contract.

s. Unclassified (U) - As used in this guide, this designation (U) indicates that this information requires no special handling and may be releasable to the general public with prior approval of the Buyer and the Government Procurement Agent.

t. Unclassified Controlled Nuclear Information (UCNI) - Any unclassified information pertaining to

NN-801 (05/12) Page 5 of 27 the protection and control of special nuclear material at the Naval Nuclear Propulsion Program laboratories, prototype sites, Moored Training Ships, or special nuclear material under transport or in storage.

The release of unclassified technical information concerned with design and design-related operational information could reasonably be expected to result in significantly increasing the likelihood of successful sabotage of a naval reactor. Since this information would also be U-NNPI, a separate marking is not required provided the information is controlled as NOFORN.

As used in this guide this designation (UCNI) indicates that this information is subject to special handling controls, restricted distribution, and marking requirements and is not releasable to the general public without prior approval of the Buyer and the Government Procurement Agent.

u. United States - The States, the District of Columbia, Puerto Rico, American Samoa, the Virgin Islands, Guam, and any areas subject to the complete sovereignty of the U.S.

v. Visitor - Any person who visits the Seller’s plant, office or facility and is not employed by the Seller and does not represent the Buyer (or the Government Procurement Agent or the Government), in the performance of this contract. This includes subcontractor personnel with access to the Seller’s plant (who require escorts), and foreign nationals whose visits may require additional controls above and beyond those necessary for visits by U.S. Citizens.

w. Visitor Security Plan (VSP) - A procedure that when properly implemented by the Seller, will preclude the release of sensitive unclassified military information (e.g., U-NNPI) to Visitors (including foreign nationals).

x. Visual Access - Casual - Access provided by being in the same general area of an item, but not having the item pointed out or having any specific information provided about the item. A casual visual access determination requires that no visible distinguishing markings or labels tie the item to the NNPP or provide access to any sensitive information.

y. Visual Access - Detailed - The ability to touch or closely examine an item, obtain detailed information based on close inspection of the item, or obtain sensitive information based on readily-visible aspects of the item. Hence, unescorted access provides detailed visual access.

3. DISCLOSURE POLICY

U-NNPI shall not be disclosed in any manner that results in release to the public, foreign nationals, or representatives of a foreign interest. Access to U-NNPI shall be limited only to individuals who are U.S.

Citizens and require a NTK for performing assigned work as determined by the Seller. The Seller shall caution authorized recipients of U-NNPI against the release of this information to the aforementioned individuals, or those without a NTK. Any exception to the disclosure policy for U-NNPI must have the prior written approval of the Government Procurement Agent. This must be obtained by working through the Buyer. For example, if the Seller requests written Buyer approval and the Buyer is not the Government Procurement Agent, then the Buyer must request written approval of the Government Procurement Agent prior to responding to the Seller request.

a. Foreign Disclosure - Release of U-NNPI to foreign nationals (or to representatives of foreign interests) is prohibited without the Government Procurement Agent’s approval in each instance. All dual citizens with a need to access U-NNPI must be reported to the Buyer prior to being provided access to U-NNPI.

The Seller shall report all foreign nationals (including on-site subcontractor personnel) currently

NN-801 (05/12) Page 6 of 27 employed at the Seller’s facility where U-NNPI material is processed, stored, or disposed of to the Buyer annually. The report shall be consistent with those required for foreign national visitors in Section 7, Control of Visitors.

b. Disclosure to Personnel in the Executive Branch of the U.S. Government - Disclosure of U- NNPI to personnel in the Executive Branch of the U.S. Government (to include Federal regulators), except for those involved in the Naval Nuclear Propulsion Program (NNPP), requires the approval of the Government Procurement Agent in each instance. The fact that an individual is employed by a U.S. Government activity is not in itself, sufficient justification for release of U-NNPI to that individual.

c. Disclosure Outside the Executive Branch of the U.S. Government - Disclosure of U-NNPI to personnel outside the Executive Branch of the U.S. Government, including State regulators, U.S.

industry, private individuals or other interests, except when required in the performance of unclassified NNPP tasks, requires Government Procurement Agent approval for each instance.

d. Disclosure in Judicial or Administrative Proceedings - When access to U-NNPI is solicited as part of a judicial or administrative proceeding, the Government Procurement Agent shall be apprised to ensure that proper protective mechanisms are put in place to prevent unauthorized disclosure of the information. These mechanisms may include formal protective orders (or legal filings), and may result in the denial of access to U-NNPI, if such access is judged to be inappropriate or unnecessary.

e. Requirements for Suppliers and Sub-tier Suppliers - Firms organized under the laws of the U.S., regardless of potential foreign ownership can receive contracts requiring access to U-NNPI if the firm formally agrees to protect the information.

(1) UNCLASSIFIED Sub-tier Contracts - It is noted that if the material furnished to a sub-tier supplier is (1) unclassified and not sensitive unclassified military information (e.g., U-NNPI) and

(2) is not directly identifiable to any Naval Nuclear Propulsion Plant application, it may be handled as unclassified without the need to disseminate the U-NNPI disclosure restrictions identified herein. The Seller should handle sub-tier supplier contracts as unclassified contracts that do not involve sensitive unclassified military information (e.g., U-NNPI), whenever possible.

The requirements for the protection of U-NNPI are needed only when the information (e.g., data, analysis, procedures) related to the contract is U-NNPI (per the contract specific guidance), or if there is a direct association with a Naval Nuclear Propulsion application. Where no such association exists, the contract does not involve access to U-NNPI and should not include contractual stipulation for its protection. Including a contractual stipulation for the protection of U-NNPI may by its nature, establish a direct association with a Naval Nuclear Propulsion application. Such a stipulation must not be included unless the aforementioned association exists separately (e.g., identification occurs through the use of a reference that directly associates the item with Naval Nuclear Propulsion, such as project designators, ship system identification, or a specific nuclear system component).

Where the contract requires flow down of provisions to protect technical data or equipment against transmittal abroad, such provisions shall be modified as needed to avoid any direct statements that would relate the information to the NNPP.

(2) Unclassified NNPI Sub-tier Contracts - Sellers who procure material, equipment, components, or services involving access to U-NNPI shall ensure that this document (NN-801) shall be invoked in any contract or subcontract to ensure the control and protection of U-NNPI at

NN-801 (05/12) Page 7 of 27 a sub-tier’s facility. The Seller shall certify compliance to all of the requirements contained in NN-801 by completing and submitting Enclosure (3) of this document to the Buyer prior to contract award.

When providing a specification, drawing, or other technical document (containing U-NNPI), to a prospective subcontractor for the purpose of soliciting bids, and no contract yet exists, the Seller shall obtain a copy of the sub-tier’s DD-Form-2345 (or electronic certificate), and the prospective sub-tier supplier's agreement to control and protect the specification or document, using a protection agreement (Enclosure (1), Form NN-677, Agreement for Protection of U- NNPI as Part of an Inquiry), until subsequent contractual controls are established. In all cases, the document and all copies shall either be returned, certified to have been properly disposed of, or the offeror shall formally request the Buyer’s approval to retain the U-NNPI for future use after the bid or solicitation process is complete.

f. Unauthorized Release of U-NNPI - Any release, including those at a sub-tier supplier, of U-NNPI in violation of the disclosure policy outlined in the NN-801 shall be immediately reported to the Buyer and the Government Procurement Agent..

g. Public Disclosure – U-NNPI shall not be disclosed in any manner which may result in direct or indirect release to the public. No public comment should be made which would confirm or deny whether U-NNPI has been inadvertently released to the public. Release of information which reaches the public is considered tantamount to foreign disclosure. In order to ensure that U-NNPI is not inadvertently released to the public, the Seller must submit to the Buyer for review all proposed public releases of information (e.g., advertisements, promotions, papers, presentations, etc.)

regarding the work that the Seller is performing for the Buyer. Buyer and Government Procurement Agent approval must be obtained prior to the release of information related to this contract to the public. Release approval will be handled on a case-by-case basis. The Seller’s employees traveling to or participating in technical conferences will be given a defensive briefing by the Seller's security personnel or designee prior to attendance to ensure that U-NNPI is not disclosed. The defensive briefing may be accomplished as part of the annual refresher briefing.

(1) Web Pages and Email – Unless controlled per the requirements herein, web pages and email are considered to be publicly accessible and public disclosures. Web pages and email which contain information related to work the Seller is performing for the Buyer can be communicated via open (unencrypted) internet without the Buyer’s approval as long as the information satisfies the criteria below. Otherwise, web pages and email which contain information related to work the Seller is performing for the Buyer must be approved by the Buyer and the Government Procurement Agent prior to sending the information or making available to non-NNPP personnel or sites, except as noted below.

Sensitive unclassified Naval Nuclear Propulsion Information (e.g., U-NNPI) cannot be transmitted unencrypted beyond the Seller site network boundaries. U-NNPI must be encrypted per the requirements contained in Section 10.b.12, U-NNPI Encryption Specifications.

Unless the information meets the “acceptable use” criteria below, unencrypted transmissions of unclassified (non-sensitive) NNPP information beyond the Seller site network boundaries, require Buyer and Government Procurement Agent approval. (When Buyer and Government Procurement Agent approval is required, it may be provided for individual or multiple Internet transmissions depending on the nature of the information).

The following are the criteria for “acceptable use” of the Internet for NNPP business in which unclassified (but not sensitive unclassified) information may be transmitted unencrypted without prior Buyer approval.

NN-801 (05/12) Page 8 of 27

(a) Administrative issues that do not reach the level of U-NNPI and satisfy the other disclosure requirements. U-NNPI is further explained in Section 11, Naval Nuclear Propulsion Information Control Officer (NNPICO).

(b) Low level technical information that does not reach the level of U-NNPI and does not indicate association with the NNPP or reveal any unique NNPP information such as technology, process, design, analysis, test methods or NNPP direction.

(2) Documents Containing U-NNPI - U-NNPI shall not be used in documents with a potential for public release or uncontrolled distribution. Whenever possible, general information such as procedures, sketches, drawings, etc., shall not be annotated in any manner which would directly disclose its association with the NNPP. The absence of U-NNPI shall not by itself be interpreted to authorize public release of the information; Buyer and Government Procurement Agent approval to release information publicly is required in accordance with the provisions of the Public Release of Information article of the terms and conditions of the contract. In cases where the usefulness of a document with the potential for public release requires reference to U-NNPI, the information should be removed from the body of the document and issued as a separate supplement or enclosure. The use of an enclosure for U-NNPI allows appropriate distribution of the document while maintaining control of non-releasable information. However, where this cannot be accomplished within practical limits, access to such U-NNPI shall be controlled as noted herein. Reference to documents containing U-NNPI in journals and other publications available to foreign governments or to the public shall be avoided.

(3) Information Concerning the Environment and Occupational Safety and Health - Environmental information and Occupational Safety and Health (OSH) information is not U-NNPI unless presented in such a way that it reveals information concerning the design, arrangement, development, manufacture, testing, operation, administration, training, maintenance, and repair of the propulsion plants of Naval nuclear-powered ships and prototypes, (including the associated shipboard and shore-based nuclear support facilities).

Special care shall be taken to avoid or minimize the inclusion of U-NNPI in documents that pertain to environmental or OSH matters since such documents are more likely to require public release. Other requirements, such as privacy protection, may apply to environmental or OSH information; therefore the absence of U-NNPI shall not by itself be interpreted to authorize public release of this information; Buyer and Government Procurement Agent approval to release publicly is required in accordance with Public Release of Information article of the terms and conditions of the contract.

h. Transmission Abroad of U-NNPI

(1) Without prior written consent of the Buyer and the Government Procurement Agent, or its designated representative, the Seller shall not, at any time during or after performing this contract, transmit or authorize transmittal, of any U-NNPI (e.g., documents, equipment or technical data):

(a) Outside the U.S. or

(b) Irrespective of location:

To any foreign national or (representative of a foreign interest)

To any foreign organization (including foreign subsidiaries and affiliates of Seller)

To any foreign government

To any international organization

NN-801 (05/12) Page 9 of 27

(2) Seller agrees to insert in all sub-tier contracts (involving U-NNPI) these contract provisions which shall conform substantially to the language of this article, (including this paragraph).

(3) Notwithstanding any other provisions of this article, this article shall not apply where:

(a) The transmittal (or authorization for the transmittal), of U-NNPI (e.g., documents, equipment or technical data), is to be made pursuant to a contract or agreement to which the U.S.

Government is a party; and

(b) The transmittal is to be of U-NNPI which the Buyer, the Government Procurement Agent, the Government, (or its designated representative), has declared in writing to the Seller to be thereafter exempt from this article.

4. MARKING REQUIREMENTS

Special handling and disclosure restrictions for U-NNPI have been in effect since the inception of the NNPP. Prior to 1986, a large majority of documents were not marked with special warning statements.

With the enactment of federal statutes mandating protective measures for a range of sensitive military technology (including U-NNPI), marking became necessary. This change in marking policy does not relieve any individual possessing U-NNPI of the responsibility to comply with the disclosure restrictions set forth in this guidance, whether or not the documents containing U-NNPI are marked with a warning statement.

a. Prospective Marking Requirement - All documents, per Section 2, Definitions, regardless of physical form (e.g., paper, photos, films, printouts, etc.) containing U-NNPI issued subsequent to the date of the NN-801 shall be marked in accordance with the NN-801. U-NNPI matter shall be conspicuously marked, stamped, printed, etched, written, engraved, painted, or affixed by means of a tag, sticker, decal, or similar device, Centered, Top and Bottom, with the appropriate marking. A single marking may be utilized if limited by available space. When portions of unmarked documents are revised or replaced, those portions (and the cover, index, and distribution pages) shall be marked in accordance with the NN-801. When an unmarked document is reissued in its entirety, all pages shall be marked in accordance with the NN-801. An older, unmarked document containing U-NNPI need not be marked if it is simply being copied for internal use and not for reissuance.

However, prior to off-site release of unmarked documents, they shall be marked and handled in accordance with the NN-801.

b. Markings and Distribution Statements:

UNCLASSIFIED NAVAL NUCLEAR PROPULSION INFORMATION (U-NNPI)

Markings NOFORN

Distribution Statement

NOFORN: This document is subject to special export controls, and each transmittal to foreign governments or foreign nationals may be made only with the approval of Naval Sea Systems Command.

Note: U-NNPI documents that also contain UCNI need only bear the appropriate U-NNPI markings.

NN-801 (05/12) Page 10 of 27

UNCLASSIFIED CONTROLLED NUCLEAR INFORMATION (UCNI)

Markings UNCLASSIFIED CONTROLLED NUCLEAR INFORMATION

Distribution Statement

UNCLASSIFIED CONTROLLED NUCLEAR INFORMATION:

Not for public dissemination. Unauthorized dissemination is subject to civil and criminal sanctions under Sec. 148 of the Atomic Energy Act of 1954, as amended (42 U.S.C. 2168).

Examples for marking U-NNPI and UCNI can be found in Exhibit (1).

c. Documents and Transmittal Documents – Documents and transmittal documents shall be marked in accordance with Exhibit (1) (for purposes of the NN-801, distribution pages shall be considered as transmittal documents).

d. Photographs, Audio and Audio Visual Materials – All photographic negatives, film or prints shall be marked and protected in a manner consistent with the associated photographs. Identification of the components in a photograph or audiovisual may aid in the application of proper markings.

All photographs, audio, and audio visual (e.g., videos, movies) materials which contain/reveal U-NNPI shall be marked “NOFORN” and include the NOFORN warning statement identified in Item 4.b. In addition, "NOFORN" should be stated verbally at the beginning of any recording prior to discussion of the subject matter and at the end of the discussion. "NOFORN" shall appear for a minimum of 5 seconds at the beginning and end of each audio visual material that contains U-NNPI. Digital cameras used to photograph U-NNPI must also be marked in accordance with Item 4.b, if the image is retained in the camera's built in memory.

e. Electronic, Magnetic and Optical Media (e.g., CD ROMs/DVDs, Flash Memory Devices &

Thumb Drives, etc.) – Media that contains U-NNPI shall be marked (i.e., with a permanent or indelible pen/marker) or labeled (via an affixed media label) "NOFORN" and include the NOFORN warning statement identified in this instruction in Item 4.b, where space permits. The media and media cover/cases shall be similarly marked. In those cases where the size of the media does not support the application of NOFORN markings, the media shall be placed in a container that is marked “NOFORN” and includes the NOFORN warning statement identified in Item 4.b.

f. Web Pages and Email Messages - Web pages and email messages on information systems approved to process U-NNPI that contain U-NNPI, must have conspicuous "NOFORN" markings.

Attachments to email messages that contain U-NNPI shall be marked in accordance with Item 4.b.

(Note that publicly accessible web pages or email cannot contain any U-NNPI. See Section 3, Disclosure Policy)

g. Hardcopy Printouts - All hardcopy computer printouts generated on information systems approved to process U-NNPI that contain U-NNPI, must have conspicuous "NOFORN" markings and must be secured in accordance with Section 6, Control and Storage of Unclassified NNPI, of this document.

5. DOD CERTIFICATION OF SELLER'S ELIGIBILITY TO RECEIVE NNPP INFORMATION

Department of Defense (DOD) Directive 5230.25 promulgates regulations to ensure the protection of sensitive unclassified technical information (e.g., U-NNPI) controlled pursuant to export control regulations. As a condition of receiving Export Controlled DOD Technical Data, (which includes NNPI), the DOD Directive requires all contractors (Sellers) who will receive such information to obtain DLIS

NN-801 (05/12) Page 11 of 27 acceptance of the Seller's certification of eligibility.

This Certification is accomplished by completing DD-Form-2345 entitled “Militarily Critical Technical

Data Agreement” and submitting the original completed copy to the Commander, DLIS, in accordance with the instructions contained on the reverse side. The description of relevant business activity required by Block 4 shall include a generic unclassified description of the component/ equipment/service being performed, and it shall state that the item is for the “Naval Nuclear Propulsion Program”. For example: “Fabrication of steam generators for the Naval Nuclear Propulsion Program”.

Once submitted and accepted, DD-Form-2345 is effective, unless revoked, for a period of 5 years and is authorization for the Seller to receive applicable U-NNPI on a procurement related to the NNPP. It is the Seller’s responsibility to ensure this certification is revalidated every 5 years. The Seller must resubmit a completed DD-Form-2345 to the Commander, DLIS, in accordance with the instructions contained on the reverse side.

The Seller is required to confirm to the Buyer that their Certification has been accepted by the DLIS and that they have an approved copy of DD-Form-2345 currently on file (identified by Certification number and date) or that action has been taken to obtain DLIS acceptance of their Certification through submittal of the properly executed form by forwarding a copy of the submittal to the Buyer. The Seller shall submit a copy of the approved DD-Form-2345 to the Buyer upon receipt of DLIS acceptance.

The requirement to have an approved DD-Form-2345 is a pass-down requirement in all subcontracts that involve access to U-NNPI in performing the contract. The Seller shall also take appropriate action with any sub-tier contractor who will require access to U-NNPI to ensure that their sub-tier’s Certification has been accepted by the DLIS. The Seller shall either maintain an approved copy of DD-Form-2345 on file (identified by Certification number and date) or shall maintain a copy of a properly executed DD-Form-2345 that was submitted by the sub-tier to DLIS for acceptance of their Certification. In the case where the DLIS has not yet accepted a sub-tier’s certification, the Seller shall request the sub-tier contractor to submit a copy of the approved DD-Form-2345 to the Buyer upon receipt of DLIS acceptance to complete the documentation and ensure compliance.

6. CONTROL AND STORAGE OF UNCLASSIFIED NNPI

U-NNPI shall be controlled so individuals without a NTK cannot obtain visual or physical access which would permit detailed examination. Casual visual observation (under circumstances precluding detailed examination), of working documents or, component parts (designated as U-NNPI), by U.S.

citizen Seller personnel is not considered to be physical or detailed visual access. Casual visual access by foreign national Seller personnel is not permitted. When in use by authorized individuals, U-NNPI working documents are considered to be under the direct custody of the individual authorized to use them, who must exercise the protection needed to prevent access by individuals without the required NTK as stipulated above.

Access to documents containing U-NNPI in unsupervised areas may be controlled by placing the documents in a locked repository, locked container (desk, file, or bookcase) or in a locked office.

U-NNPI may remain in an unlocked area during normal working hours provided the area is regularly monitored to preclude unauthorized study of U-NNPI documents.

Access to U-NNPI (documents, components or component parts) in shop areas shall be controlled through shop practices that limit physical or detailed visual access to U-NNPI to those authorized and with a NTK. The Seller should consider methods of covering the U-NNPI material that would preclude unauthorized study of the material. Surveillance conducted by shop supervision and/or plant guards who routinely check to ensure that only authorized personnel are in the work areas constitutes the minimum control required to prevent study of U-NNPI by those not authorized.

NN-801 (05/12) Page 12 of 27

a. Off-site Handling of U-NNPI - U-NNPI may be removed from a Seller’s site, subject to implementation of Buyer approved controls, as part of the Security Plan, that ensures information is protected (consistent with the disclosure requirements of the NN-801), and the information is promptly returned when no longer needed off-site. U-NNPI shall not be destroyed off-site but must be returned on-site for destruction.

b. U-NNPI Information Systems (IS) - Information Systems containing U-NNPI shall be protected in accordance with the requirements specified in Section 10, Unclassified NNPI Information Systems (IS) Protection Requirements.

Control and storage methods and procedures for U-NNPI shall be detailed in the Buyer-approved Security Plan.

7. CONTROL OF VISITORS

Access to NNPI is controlled principally by identifying and isolating areas within the facility that reveal NNPI. The security measures required to protect NNPI will depend on the type of work being performed and the access procedures in place.

The following outlines the policy for the control of Visitors to the Seller’s facility. The term Visitor as defined in Section 2, Definitions, includes foreign nationals or representatives of a foreign interest:

a. The Seller shall not permit Visitors to the Seller's plant, office or facility to have physical or detailed visual access, to documents, components, assemblies or major subassemblies, provided for or delivered under this contract without the Visitor being a U. S. citizen and having a NTK.

Further, Visitors shall not obtain information or data concerning such documents, components, assemblies or major subassemblies under this contract. Any exception to this provision requires the written consent of the Buyer and the Government Procurement Agent. Requests for such exceptions shall be made to the Buyer with complete justification and shall be submitted at least two weeks in advance of the visit.

All Visitors shall be asked to identify any controlled items in their possession prior to obtaining facility access. At random, Visitors’ hand carried items will be searched for controlled articles prior to entering the facility. A sign shall be conspicuously posted identifying this policy to visitors.

b. Those Visitors who are foreign nationals or representative of a foreign interest can be permitted access to the Seller's facility to conduct business involving non-NNPP work provided adequate controls are in place to ensure that they are not permitted physical or visual access to documents, components, assemblies, or major subassemblies provided for or delivered under this contract.

Such facility access will be granted by the Buyer through the submittal and approval of a Security Plan incorporating a VSP. Approval shall be obtained prior to the issuance of invitations or other commitments.

c. A VSP applicable to all Visitors shall be submitted with the Security Plan and shall, at a minimum:

(1) Be prepared and submitted (with complete justification), to the security office at the Buyer’s facility (for approval), a minimum of thirty days prior to the first anticipated visit to the Seller's plant, office or facility where the Visitor could have physical or detailed visual access to any U-NNPI documents, or equipment (including computing equipment), or to any components, assemblies, or major subassemblies to be delivered under this contract.

(2) Identify the method established to ensure Visitors are not permitted physical or detailed visual access to any U-NNPI documents, or equipment (including computing equipment), or

NN-801 (05/12) Page 13 of 27 components, assemblies, or major subassemblies provided for or delivered under this contract.

In addition, the VSP shall identify the method established to ensure Visitors are not permitted to obtain information or data (concerning such documents) on components, assemblies, or major subassemblies.

To protect U-NNPI from unauthorized or foreign national personnel, the VSP shall identify:

access controls escort procedures visitor control procedures (to include searches of all hand-carried items) customer notification responsibilities

The VSP shall address the following special conditions:

(a) The Visitor shall be kept under close and continuous surveillance at all times while in the physical confines of the facility. Visual, oral, and documentary disclosures of U-NNPI shall be prevented or limited (as appropriate), by the isolation of areas, materials or personnel that would divulge U-NNPI.

(b) The visit shall be accomplished without adverse effect on the facility’s Naval Nuclear Propulsion workload, scheduling, or other critical factors.

If all of these conditions cannot be satisfied, the visit shall either be diverted to an activity not engaged in Naval Nuclear Propulsion work or be disapproved.

(3) To the maximum extent practical, require that the Seller notify the security office at the Buyer’s facility in writing at least one week before any visit by foreign nationals or representatives of a foreign interest to the Seller's plant, office or facility where the foreign nationals or representatives of a foreign interest will have the potential to have access to the Buyer’s information or product. In addition, the Seller shall notify the security office at the Buyer’s facility in writing within one week after the visit to ensure the Buyer is informed of any changes in the visitors. The notifications shall include:

the visitor’s first, middle and last name date of birth citizenship (including dual citizenship, if applicable) job title company affiliation complete description of purpose for the visit area visited duration and scope of the visit other data applicable to the visit

The notifications shall include a statement of compliance with the approved VSP and shall be signed by cognizant personnel responsible for implementing the NN-801 requirements (as discussed in Section 1, General Notes) at the Seller’s facility.

(4) The Seller shall submit revisions to the procedures should there be a change in the information previously provided. Any variations from the approved VSP shall be submitted in writing and approved by the Buyer prior to the Seller authorizing access to any visitor governed by the VSP.

NN-801 (05/12) Page 14 of 27

8. TRANSMITTAL AND SHIPMENT OF U-NNPI

Prior to transmitting, shipping, or discussing U-NNPI, the sender shall ensure that the recipient is authorized (i.e., has an appropriate NTK, U.S. citizenship, etc.) to access the U-NNPI.

The contents of each package/carton of a multiple shipment shall be packaged and marked according to its specific content, i.e., if a complete shipment consists of several packages/cartons, some of which contain no U-NNPI material, only the contents of those packages/cartons containing U-NNPI material shall be marked.

a. Document Transmittal or Shipment - Documents containing U-NNPI shall be (as a minimum) transmitted or shipped in a wrapping or an envelope, that:

(1) does not allow visual access of the contents

(2) is not marked in a manner that would reveal the contents of the envelope (or package) to an unauthorized individual

Components designated as U-NNPI shall be shipped in a sealed container (where size permits), or covered using a tarpaulin, or other approved means so that the component is screened from view during shipment.

Refer to Section 3.h for restrictions on transmission abroad of U-NNPI.

b. Use of Telecommunications Equipment - U-NNPI may be transmitted to authorized recipients using non-secure telephones and stand alone fax machines within the U.S., using devices issued, owned or leased by an NNPP activity. The person making the transmission shall verify that the receiving equipment is attended by personnel authorized to receive U-NNPI, or if unattended, the receiving facility security arrangements will preclude unauthorized access to the transmitted material. Communications with U.S. citizens (with a valid NTK) outside of the U.S. (foreign country) must meet the FIPS 140-2 encryption requirements contained in Section 10, Unclassified NNPI Information Systems (IS) Protection Requirements.

9. DISPOSAL OF UNCLASSIFIED NNPI

a. Disposal of Unclassified Documents Containing U-NNPI - U-NNPI shall be disposed of in a manner that precludes the recognition, reproduction, or reconstruction of U-NNPI. Disposal of unclassified documents containing U-NNPI shall ensure the information is not easily retrievable.

Recycling of paper (or easily shredded material) is authorized, provided the documents are shredded to 5/8" crosscut widths or less. Further, non-paper products (e.g. Mylar or microfilm/microfiche) not sufficiently destroyed by shredding must be disposed of in a manner which will provide reasonable protection against unauthorized diversion or recovery of the information. All disposal and recycling methods/processes for U-NNPI material should be identified in the facility Security Plan.

Requests for alternative disposal and/or recycling methods which ensure an adequate degree of control during and after disposal must be included in the…