DD_Form_254_09-16-19.pdf

CONTROLLED UNCLASSIFIED INFORMATION (INCLUDES FOR OFFICIAL USE ONLY

INFORMATION)

Ref: (a) DoD Regulation 5200.01-V4, DoD Information Security Program

(b) SECNAV M-5510.36, DON Information Security Program Manual

Contractor may be required to handle Controlled Unclassified Information (CUI). There are numerous types of CUI, e.g. documents with limited distribution statements, documents marked as For Official Use Only (FOUO), etc. The minimum level of protection for all CUI is adherence to FOUO protection standards. Distribution Statements (DS) and warning labels, such as the Arms Export Control Act Warning, identify additional protection requirements for a given document. Minimum FOUO protection requirements/controls applicable to the performance of this contract for CUI are listed below. Additional protection requirements, as marked on a given CUI document, are in addition to the standards listed.

1. Handling/Storage: Access to FOUO is limited to those needing it to conduct official business for the Department of Defense (DoD). FOUO information is not classified information, but requires extra precautions to ensure it is not released to the public. During business hours, reasonable steps shall be taken to minimize risk of access by unauthorized personnel. After business hours, FOUO information shall be stored in unlocked containers, desks, or cabinets if Government or Government-contracted building security is provided. If it is not, store in locked desks, file cabinets, bookcases, locked rooms, or similar items.

2. Transporting/Transmitting/Release/Destruction: FOUO information shall be transported in a manner that prevents disclosure of the contents. FOUO information may be sent via USPS first-class mail, parcel post, or – for bulk shipments – 4th class mail. Electronic transmission of FOUO information (voice, data, or facsimile) shall be by approved secure communications systems. Transmission via unsecure fax is acceptable if an authorized person is standing by on the receiving end to take custody. All emails containing FOUO or attachments with FOUO must be digitally signed and encrypted when transmitted within a Navy network or to an approved contractor email address. Transmission of FOUO (i.e. any CUI) to personal email accounts (e.g. AOL, Yahoo, Hotmail, Comcast, etc.) is strictly prohibited. FOUO sent out of the contractor’s facility electronically must be encrypted (DoD FIPS 140-2 standard). FOUO material shall not be released outside the contractor’s facility except to representatives of DoD.

When no longer needed, destroy FOUO by a method that precludes its disclosure to unauthorized individuals.

3. Markings: Unclassified documents (paper or electronic) generated in support of this contract which contain FOUO are to be marked “For Official Use Only” at the bottom on the outside of the front cover (if any), on each page containing FOUO information, and on the outside of the back cover (if any). Each paragraph containing FOUO information shall be marked as such. Within a classified document, an individual page with both FOUO and classified information shall be marked at the top and bottom with the highest security classification of information appearing on the page. Individual paragraphs shall be marked at the appropriate classification level, as well as unclassified or FOUO, as appropriate. Within a classified document, an individual page that contains FOUO information but no classified information shall be marked “For Official Use Only” at the top and bottom of the page, as well as each paragraph that contains FOUO information. Other records, such as photographs, films, tapes, or slides, shall be marked “For Official Use Only” or “FOUO” in a manner that ensures that a recipient or viewer is aware of the status of the information therein. DS on technical documents identify access restrictions. DS “B” through “D” preclude public release and while not marked as FOUO, are subject to all FOUO protection requirements, including the prohibition on unencrypted transmission over the public Internet.

Attachment 1 to Solicitation # N00174-19-Q-0044

ATTACHMENT 2: Solicitation # N00174-19-Q-0044

EXPORT CONTROLLED ADDENDUM

1. HANDLING: Access to Export Controlled material shall be limited to those employees needing the material to conduct official business for the Department of Defense. Export Controlled is not a classification, but requires extra precautions to ensure it is not improperly released.

2. STORAGE: During normal duty hours, place Export Controlled material in an out-of-sight location if your work area is accessible to persons who do not have a valid need for the material. After normal duty hours, store Export Controlled material to prevent unauthorized access. File with other unclassified records in unlocked files or desks when internal building security is provided. When there is not internal security, locked buildings or rooms usually provide adequate after-hours protection. For additional protection, store Export Controlled material in locked containers such as file cabinets, desks or bookcases. Expenditure of funds for security containers solely for the protection of Export Controlled material is prohibited.

3. TRANSPORTING: Export Controlled information shall be transported in a manner that prevents disclosure of the contents. Export Controlled information may be sent via first-class mail or parcel post. Bulky shipments, such as distributions of Export Controlled Directives or testing materials, that otherwise qualify under postal regulation, may be sent by fourth-class mail.

4. TRANSMISSION: Export Controlled can be transmitted electronically within the contractor’s facility. Export Controlled sent out of the contractor’s facility must meet FIPS 140-2 encryption.

5. RELEASE: Export Controlled material shall not be released outside the contractor’s facility except to DoD employees. Subcontracting must be authorized by the COSR.

6. DESTRUCTION: When no longer needed, Export Controlled material shall be disposed of by a method that precludes its disclosure to unauthorized individuals.

7. MARKINGS:

a. For standard written or printed material, the following warning statement shall appear on the face of the document and title page. If the technical information is not in standard written or printed form and does not have a cover or title page, the distribution statement shall be conspicuously stamped, printed, or written by other means.

“WARNING – This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec. 2751 et seq.) or Executive Order 12470. Violators of these export laws are subject to severe criminal penalties.”

b. The following destruction statement will be applied to all technical documents containing Export Controlled information. “Destroy by any method that will prevent disclosure of contents or reconstruction of the document.”

c. Other records, such as photographs, films, tapes, slides, and AIS storage media shall also be marked with the above warning and destruction statement.

Attachment 3 Solicitation #N00174-19-Q-0044

NAVAL NUCLEAR PROPULSION INFORMATION (NNPI) PROTECTION REQUIREMENTS

Ref: SECNAV M-5510.36, OPNAVINST N9210.3

Naval Nuclear Propulsion Information (NNPI) is all information, classified or unclassified, concerning the design, arrangement, development, manufacture, testing, operation, and repair of the propulsion plants onboard naval nuclear powered ships and prototypes, including the associated shipboard and shore-based nuclear support facilities. NNPI may be in the form of documents, drawings, photographs, physical components, or electronic media.

a. Classified NNPI: Classified NNPI consists of two types of information – Restricted Data (RD) and National Security Information (NSI).

(1) RD: In the Naval Nuclear Propulsion Program, RD is information associated with the production of energy in the nuclear core. A need-to-know and a FINAL clearance at the appropriate level are required for access to RD.

(2) NSI: Information defined in Executive Order 12958, as amended, which, if disclosed could be expected to cause damage to national security. A need-to-know and an interim or final clearance are required for access to NSI.

b. Unclassified NNPI: U-NNPI is information related to sensitive military technology, i.e. naval nuclear propulsion technology. Access to U-NNPI is limited to U.S. citizens with a need-to-know. No clearance is required for access to U-NNPI. U-NNPI is marked and handled as “NOFORN.”

2. Definitions: (Per OPNAVINST N9210.3)

a. Dual Citizens. Individuals who are dual citizens (hold both a U.S. citizenship and the citizenship of some other country) shall have special controls.

b. Foreign Interest: Any foreign government, agency of a foreign government, or representative of a foreign government; any form of business enterprise or entity organized under the laws of any country other than the U.S. or its possessions, and any foreign national.

c. Foreign National: A foreign national is any person not a United States citizen. Non-U.S.

citizens permanently residing in the United States are considered foreign nationals.

d. Representative of a Foreign Interest. Any person, regardless of citizenship, functioning (in an individual capacity or on behalf of any corporation, person, or government entity) as an official, representative, agent, or employee of a foreign interest. One exception is that U.S. citizens appointed by their U.S. employer to act as a representative in the management of a foreign subsidiary of a U.S. corporation will not be considered representatives of a foreign interest.

3. Access/Use: When a contractor is provided documents (specifications, drawings, etc.) that are marked as containing NNPI/NOFORN, the information contained therein and generated as part of the contract shall be used only for the purpose stated in the contract. In no case shall such information be transmitted outside the company (unless such transmittals comply with the detailed guidance of the contract) or to any foreign national (as defined below) within the company. The documents shall be protected from unauthorized observation while in use and shall be kept secure so as to preclude access by any persons who do not have a legitimate need to view them. These documents shall not be copied unless done in conformance with the detailed guidance of the contract. All documents shall be promptly returned in their entirety, unless authorized for disposal or retention, following completion of the contract. Specific requirements for protecting NNPI are contained below.

4. Specific NNPI Protection Requirements:

a. All NNPI

(1) Only people who are U.S. citizens and have a “need-to-know” required to execute the contract shall be allowed access to NNPI. Only U.S. citizens (with a need-to-know) may access NNPI in any way, shape, or form.

(2) Documents will have the word NOFORN at the top and bottom of each page. The following

Attachment 3 Solicitation #N00174-19-Q-0044 warning statement will be on the cover sheet: “NOFORN - This document is subject to special export controls and each transmittal to foreign governments or foreign nationals may be made only with prior approval of the Naval Sea Systems Command.” Documents originated in the course of work that reproduce, expand or modify marked information shall be marked and controlled in the same way as the original. Media such as video tapes, Disks, etc., must be marked and controlled similar to the markings on the original information.

(3) NNPI, classified and unclassified, must be destroyed as classified material using means identified in DoD 5220.22-M (NISPOM), paragraph 5-705.

b. U-NNPI

(1) When not in direct control of an authorized individual, U-NNPI must be secured in a locked container (e.g. file cabinet, safe, etc.). Access to the container must be such that only authorized persons can access it and compromise of the container can be visually detected. Containers must not have labels that indicate the contents. If U-NNPI is stored on a local drive, the computer must be secured in a locked room. If removed from the site, U-NNPI must remain in the personal possession of the individual. At no time may U-NNPI be left unattended in a home, motel room, automobile, sent with baggage, etc.

(2) U-NNPI may not be posted on websites, including intranets, unless approved by NAVSEA.

(3) U-NNPI may not be processed on networked computers with outside access, or emailed from same, unless the system has been approved by the Naval Sea Systems Command. If emailed from a NAVSEA approved system, the information must be encrypted using Federal Information Processing Standards (FIPS) 140-2 certified method (software or hardware) or NSA Type I encryption. NNPI may not be processed on personal computers (i.e., non-government or unapproved contractor computers) or put on Personal Digital Assistants (PDAs).

(4) U-NNPI may be faxed within the continental U.S. and Hawaii provided there is an authorized individual waiting to receive the document and properly control it. U-NNPI may not be faxed to facilities outside the continental U.S., including military installations, unless encrypted per current DoD encryption requirements.

(5) U-NNPI may be sent within the continental U.S. and Hawaii via first class mail in a single opaque envelope that has no markings indicating the nature of the contents.

(6) Hand carrying outside the continental U.S. or Hawaii is prohibited since disclosure to foreign nationals cannot be ensured. A government property pass is required to hand carry U-NNPI off-station. A courier card is required to hand carry C-NNPI off-station.

5. Questions regarding the handling of NNPI may be directed to the Defense Security Service or the Naval Surface Warfare Center Indian Head Explosive Ordnance Disposal Technology Division (NSWC IHEODTD) Security Office (see Block 16 on the DD254 for contact information). Report any of the following to NSWC IHEODTD:

a. Attempts to elicit NNPI by unauthorized persons.

b. Compromises of NNPI by unauthorized persons. This includes intentional or unintentional public release via such methods as theft, improper disposal (e.g. material not shredded, disks lost), placement on website, transmission via email, or violation of the information system containing U-

NNPI.