DD254_SOLICITATION_VTC_SIGNED.pdf

CLASSIFICATION (When filled in): Official

DEPARTMENT OF DEFENSE OMB No. 0704-0567 CONTRACT SECURITY CLASSIFICATION SPECIFICATION OMB approval expires:

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this efforl involving classified information.) October 31, 2020

The public reporting burden for this collection of infonnation, 0704-0567, is estimated lo average 70 minutes per response, including tt.e time for reviewing instrucUons, searching existing data sources, gathering and maintaining the data needed, and complellng and reviewing the colleclion of information. Send comments regarding this burden estimate or any o!her aspect of this collection of infonnation, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, atwhs.rnc-alex.esd.rnbx.dd-dod-infomiation-collections@mall.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing lo comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/ (See Instructions) MATERIAL REQUIRED AT CONTRACTOR FACILITY

Secret None (See instructions)

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.) 3. THIS SPECIFICATION IS: (X and complete as applicable.)

D

a. PRIME CONTRACT NUMBER (See instructions.)

i:><J ORIGINAL (Complete date in afl cases.)

DATE (YYYYMMDD)

a.

20180621

D

b. SUBCONTRACT NUMBER b. REVISED (Supersedes all previous specifications.)

D REVISION NO. DATE (YYYYMMDD)

c. SOLICITATION OR OTHER NUMBER DUE DATE (YYYYMMDD) i:><J N00253- l 8-Q-0224 D

c. FINAL (Complete Item 5 in a/f cases.) DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? i:;;<j No D Yes ff yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow~on contract.

5. IS THIS A FINAL DD FORM 254? i:;;<j No D Yes ff yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO)

This DD254 is for Solicitation Pmposes Only. It must be (Name, Address, ZfP Code, Telephone required; Ema11 Address optional) returned to NUWCDIVKPT Secmity with a contract number and contractor's name when the contract is awarded for updating and an approval signature.

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (If applicable, (Name, Address, ZIP Code, Telephone required; Email Address optional) see Instructions.}

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

The contractor will provide video teleconference (VTC) suppo1t to Naval Undersea Warfare Center, Division-Keyport.

DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE.

CLASSIFICATION (IMJen filled in): Official

AEM LiveGycle Designer

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X al/ lhat apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

IXJ a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

0 b. RESTRICTED DATA

D c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRfCTED DA TA must also be marked.)

D d. FORMERLY RESTRICTED DATA

e. NATIONAL INTELLIGENCE INFORMATION:

D (1) Sensitive Compartmented Information (SCI)

D (2) Non-SCI

0 I. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

IV1 g. NORTH ATLANTIC TREATY ORGANIZATION l6J (NATO) INFORMATION

0 h. FOREIGN GOVERMENT INFORMATION

0 i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

IXJ j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

D k. OTHER (Specify) (See instructions.)

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X afl that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

IXJ ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See instructions.)

0 b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

D c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

0 d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

D e. PERFORM SERVICES ONLY

I. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

D THE U.S.,PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

12. PUBLIC RELEASE

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

0 TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

0 h. REQUIRE A COMSEC ACCOUNT

D i. HAVE A TEMPEST REQUIREMENT

IXJ j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

0 k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

I. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

1XJ INFORMATION (CUI).

(DoD Components: refer to DoDM 5200.01, Volume 4 only for specific CUI protection requirements. Non-DoD Components: see instructions.)

~ m. OTHER (Specify) (See instructions.)

Access to Government Unclassified and Classified Information Systems.

Any information (classified or unclassified) pertaining to this contract shall not be released fOr public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

D DIRECT ~ THROUGH (Specify below) Public Release Authority:

Commander, Naval Undersea Warfare Center Division, Keyport, (Attn: PAO), 610 Dowell Street, Keyport WA 98345-7610

13. SECURITY GUIDANCE

Phone: (360) 396-2699 Email: KYPT_PAO@navy.mil

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate tor the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field tor it to shrink after the text has been deleted. Also allows tor up to 6 internal reviewers to digitally sign. See Instructions tor additional guidance or use of the fillable PDF.)

--Item IO.a: A final U.S. Government clearance, at the appropriate level, is required prior to COMSEC access (i.e. STU-III Telephone).

Written approval of the Contracting Officer is required prior to subcontracting, for each subcontractor.

List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE.

CLASSIFICATION (When filled in): Official

AEM LiveCycle Designer

NAME & TITLE OF REVIEWING OFFICIAL SIGNATURE

'D<,D!l-;o,.,..lO, QUINTANA.WILLI ~~.~;i'.:.':;~~!~~;;'o'.,'!~.

AM.JR.1125469740 oo»Uw-U'11.

="<l!JINTA.~A-Wll.1.IA>U'-1 ll>m1'o D""O'll'"'-'11<l'<<:l-O'c"7

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

D No IZJ Yes If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions tor additional guidance or use of the fillable PDF.)

Protect Controlled Unclassified Information/For Official Use Only Infmmation per Item 13 remarks.

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

IZJ No D Yes If Yes, explain and identify specific areas and government activity responsible tor inspections. The field will expand as text is added or you can also use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field tor it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the tillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME c. ADDRESS (Include ZIP Code) d. POC NAME

NUWC Keypmt Contracting Department Naval Undersea Warfare Center Div Keyport Deborah A. Howard (COR) 610 Dowell St. e. POC TELEPHONE (Include Area Code)

b. ACTIVITY ADDRESS CODE (AAC) OF THE Keyport WA 98345-7610

+! (360) 315-8471 CONTRACTING OFFICE (See Instructions) f. EMAIL ADDRESS (See Instructions)

N00253 deborah.howardl@navy.mil

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 1 ?h, no changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle lnitiaQ d. AAC OF THE CONTRACTING OFFICE h. SIGNATURE (See Instructions) (See Instructions) Digitolly •igned b)•

Quintana, William N00253 QUINTAN:i~~~~~uA

b. TITLE e. CAGE CODE OF THE PRIME CONTRACTOR A. WILLIA ~~:;'.~~:i;;o.,D, (See Instructions.) M.JR.1125 ~~~~NWrr.r.

Security Contracting Officer 469740

IAMJR.112).!M7·!0

NIA D.11": 2013.06.21

14:40:54 -0700

c. ADDRESS (Include ZIP Code) f. TELEPHONE (Include Area Code) i. DATE SIGNED

Commander, Naval Undersea Warfare Center Division Keyport, +! (360) 396-2589 (See Instructions)

(Attn: Security Contracting Officer), 610 Dowell St., Keyport WA g. EMAIL ADDRESS (See Instructions) 20180621 98345-7610 william.quintana!@navy.mil

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

IXJ a. CONTRACTOR IXJ f. OTHER AS NECESSARY (It more room is needed, continue in Item 13 or on additional page if necessary.)

0 b. SUBCONTRACTOR

O c. COGNIZANT SECURITY OFFICE FOR PRIME AND

SUBCONTRACTOR

O d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

IZJ e. ADMINISTRATIVE CONTRACTING OFFICER

DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE. Page 3 of3 AEM LiveCycle Designer

00254 Continuation Sheet: Solicitation# N00253-l 8-Q-0224

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. 1f any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest !evel of classification assigned or recommended. {Fill in as appropriate for the classified effort. Attach, or fo1Ward under separate correspondence, any documents/guides! extracts referenced herein. Add additional pages as needed to provide complete guidance.}

•Item 10.g: Access to NATO information is not required for performance of this contract. However, access to the SIPRNET is required and current regulations require a NATO briefing prior to SIPRNET access.

•Item 10.j: Controlled Unclassified Information (CUI)) including For Official Use Only (FOUO) information, must be protected per DoDM 5200.01-V 4, as specified in the CUl/FOUO protection clause in the contract. It is emphasized that unencrypted transmission of CUl/FOUO via the Internet is strictly prohibited. Amplifying guidance is provided in Attachment 1.

•Item 11.a: Classified contract performance is restricted to NUWC Division, Keyport facilities located at Keyport, WA/Bangor WA and government activities/units as identified within the contract solicitation or on official travel orders generated in support of the contract, as approved by the government.

Security Classification of Equipment, Components, Spaces and Documents:

The Equipment, Space or Document may be classified and subject to the applicable provisions of DOD 5220.22-M, Industrial Security Program Operating Manual; SECNAV M-5510.36, DON Information Security Program Manual; SECNAV M-5510.30, Personnel Security Program Manual;

NUWCDIVKPT 5510.1, Information Security Program Manual;

NUWCDIVKPT 5530.2, Personnel Security Program Manual; NUWCDIVKPT 5530.1, Physical Security Program Manual; and NUWCDIVKPT 5239, Information Assurance Program. Security classification guidance will be provided on site by the government activity or contracting facility. Contractor personnel supporting work on-site at Keyport/Bangor/Hawthorne require a security clearance level of up to Secret.

• Item 11.j: Operations Security (OPSEC) requirements: Contractor personnel are subject to applicable provisions of NAVSEAINST 3432.1A OPSEC Program and NUWCDIVKPT 3432.1 OPSEC Program. Contractor personnel supporting this task order must complete annual government-provided OPSEC awareness training (arranged through the COR). Contractor personnel will have access to government Critical Information (Cl) and Indicators and Observables that may indirectly disclose Cl. Cl includes, but is not limited to: Ship movements and schedules, weapons and sensor system installations, capabilities, and configurations; specific platform installations and characteristics, test schedules, deficiencies and vulnerabilities.

Indicators and Observables may include, but are not limited to: Outdoors system testing; ship's external hull or superstructure modifications; shipboard equipment, ordnance, weapons, fuels, and/or stores loading/unloading operations, and/or personnel or aircraft embarkation. No Cl, Indicators, or Observables maybe divulged to third parties (including other company employees who are not subject to this contract) without approval of the local command Security Officer, or the NUWC Keyport OPSEC Program Manager.

00254 Continuation Sheet: Solicitation# N00253-18-Q-0224

• Item 11.1: Controlled Unclassified Information (CUI), including For Official Use Only (FOUO) information, must be protected per DoDM 5200.01-V4, as specified in the CUl/FOUO protection clause in the contract. It is emphasized that unencrypted transmission of CUl/FOUO via the Internet is strictly prohibited." Amplifying guidance is provided in Attachment 1.

•Item 11.m: Access to government IT systems. Personnel accessing Government IT systems in the performance of contract work must meet Department of Navy (DON) Personnel Security Program (PSP) Instruction. SECNAV M-5510.30 Paragraph 5-3, sub paragraphs b(6) (a), b(6) (e), b(6) (f), b(6) (g), and Exhibit 5A, Performance requirements are at the IT-1 Critical Sensitive position for contractors performing these functions. The IT-1 positions require full positive adjudication of a Single Scope Background investigation. Additionally, per DOD Manual 8570-1 M (Change 3):

C2.3.8 Contractor personnel supporting IA functions shall obtain the appropriate DOD approved IA baseline certification prior to being engaged. Additional training on local or system operating systems or procedures must be met within 6 months of engagement. C3.2.3.3 Contract personnel must comply with the DOD and Vendor CEU requirements to maintain their IA baseline certification. Tables C3.T4, C3.T5, Paragraphs C7 .3.4 and AP3.1.5, performance requirements will be set at the Information Assurance Technical (IAT) level II and all training and certification specification are required to be met for any contracted employee. Secretary of Navy Manual (SECNAVMAN) SECNAVMAN 5239.21A Workforce Management Manual provides additional amplifying policy and requirements.

14. ADDITIONAL SECURITY REQUIREMENTS: Contractor employees embedded in government work spaces will be included in the command security education program per SECNAV M-5510.36 (11-4.2.a) and must complete prescribed DoD/DoN training requirements. Contractor employees shall review each NUWCDIVKPT Security Training Bulletin online at the training website. Embedded employees with a Secret or above security clearance must annually attend a locally provided NCIS counterintelligence briefing. Derivative classifiers (i.e., those who create new documents, including e-mails, based on existing classification guidance) shall receive training in derivative classification as required by DoDM 5200.01 V-1 with an emphasis on avoiding over-classification, at least once every 2 years. Training is available on the DSS website.

• All classified documents must be destroyed using a national security agency (NSA) approved high Security crosscut shredder listed on the NSA/CSS evaluated products list for high security crosscut paper shredders, or other APPROVED method by the Command Security Officer for destroying classified information.

• Safeguarding of Unclassified Technical Information - Safeguarding requirements and procedures for unclassified controlled technical information.

The Contractor shall provide adequate security to safeguard unclassified controlled technical information from compromise. To provide adequate security, the Contractor shall follow FARS Clause 204.7300. Safeguarding Covered Defense Information and Cvber Incident Reoortina FARS Clause

204.7304 also will be followed and adhered to.

• Contractor will adhere to FARS Clauses: 52.224-1 & 52.224-2. Specifically, as Follows: Privacy Act Notification (Apr 1984) - The Contractor will be required to design, develop, or operate a system of records on individuals, to accomplish an agency function subject to the Privacy Act of 197 4, Public Law 93-579, December 31, 1974 (5 U.S.C.552a) and applicable agency regulations. Violation of the Act may involve the imposition of criminal penalties. The Contractor agrees to --(1) Comply with the Privacy Act of 1974

(the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies -

(i) The systems of records; and (ii) The design, development, or operation work that the contractor is to perform; (2) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and

(3) Include this clause, including this subparagraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a system of records. (b) In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency. (c) (1) "Operation of a system of records," as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records. (2) "Record," as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person's name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph. (3) "System of records on individuals," as used in this clause, means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

• All reports of contractor security violations associated with this contract shall be mailed by the Cognizant DSS field office directly to the certifying official in block 16 of this DD254.

• All classified information involved in security incidents shall be retained and provided to the certifying official in block 16 (a) of this DD 254 for

00254 Continuation Sheet: Solicitation# N00253- l 8-Q-0224 classification review.

• All security aspects of this contract fall under the cognizance of NUWC Keyport WA Command. Contact the NUWC Keyport Security Contracting Officer for any questions regarding the content of the DD form 254.

• Policy - All Personal Electronic Devices or equipment capable of recording, storing, transmitting, or exporting data such as photographic images or audible information of any kind are strictly prohibited in any NUWC Division, Keyport areas where classified, U-NNPI, or other CUI is exposed, processed, Or discussed. Electronic devices with these capabilities, are NOT authorized at any time in secure rooms, controlled access areas, classified conference rooms, or where classified information is processed, stored, or discussed.

• Contracting authority will provide security classification guidance on-site for the services to be performed. (To include Alternate Compensatory Control Measures where applicable).

• Classified or unclassified technical papers to be presented at classified symposiums must be approved by the Contracting Officer's Representative PRIOR TO presentation.

• All contractor requests for sharing of classified and other sensitive information between prime contractors must be forwarded in writing to the government security office identified in Item 16.d of this DD254 for approval.

• Copies of all subcontract DD254s must be provided to the government security office identified in Item 16.d of this DD254.

• Security Classification Guides (OPNAVINST 5513 Series) and unclassified limited distribution documents (e.g. FOUO, Distribution Statement Controlled) are not authorized for public release; therefore, they cannot be posted on a publicly accessible web server or transmitted over the Internet unless appropriately encrypted to current DoD standards. Requests for public release cannot be transmitted via the Internet until the contractor receives final approval from the government.

• Per the requirements stated in the National Industrial Security Program Operation Manual (NISPOM) Dated February 2006, Chapter 5, Section 5, Paragraph 5-502, the Facility Security Officer (FSO) on the prime contract is authorized to flow down access to each subcontractor. It is the prime contractor FSO's responsibility to ensure that all subcontractors have the appropriate access levels. It is also the prime contractor FSO's responsibility to ensure that they have documented paperwork for each subcontract. If the current prime contractor FSO is replaced, it is the responsibility of the new FSO to inform NUWC Division Keyport in writing to security and the COR.

Contract Expiration Date: 16 Dec 2019

•The Contracting Officer is: Monique Klose, NUWC Division, Keyport Code 023,

(360) 315-2215, monique.klose@navy.mil

•The Contracting Officer's Representative is: Debbie Howard, NUWC Division, Keyport Code 1081, (360)315-871,deborah.howard1@navv.mil

• The Contract Specialist is: TBD

• The Security Office Representative is: Mr. William Quintana, NUWC Keyport, Code 105,(360)-396-2589,william.quintana1@navy.mil

(END)

Attachment 1 to Solicitation #N00253-18-Q-0224

CONTROLLED UNCLASSIFIED INFORMATION

(INCLUDES FOR OFFICIAL USE ONLY INFORMATION)

Ref: (a) DoD Regulation 5200.01-V4, DoD Information Security Program

(b) SECNAV M-5510.36, DON Information Security Program Manual

Contractor may be required to handle Controlled Unclassified Information (CUI). There are numerous types of CUI, e.g. documents with limited distribution statements, documents marked as For Official Use Only (FOUO), etc. The minimum level of protection for all CUI is adherence to FOUO protection standards. Distribution Statements (DS) and warning labels, such as the Arms Export Control Act Warning, identify additional protection requirements for a given document. Minimum FOUO protection requirements/controls applicable to the performance of this contract for CUI are listed below. Additional protection requirements, as marked on a given CUI document, are in addition to the standards listed.

1. Handling/Storage: Access to FOUO is limited to those needing it to conduct official business for the Department of Defense (DoD). FOUO information is not classified information, but requires extra precautions to ensure it is not released to the public. During business hours, reasonable steps shall be taken to minimize risk of access by unauthorized personnel. After business hours, FOUO information shall be stored in unlocked containers, desks, or cabinets if Government or Government-contracted building security is provided. If it is not, store in locked desks, file cabinets, bookcases, locked rooms, or similar items.

2. Transporting/Transmitting/Release/Destruction: FOUO information shall be transported in a manner that prevents disclosure of the contents. FOUO information may be sent via USPS first-class mail, parcel post, or - for bulk shipments - 4th class mail. Electronic transmission of FOUO information (voice, data, or facsimile) shall be by approved secure communications systems. Transmission via unsecure fax is acceptable if an authorized person is standing by on the receiving end to take custody. All emails containing FOUO or attachments with FOUO must be digitally signed and encrypted when transmitted within a Navy network or to an approved contractor email address. Transmission of FOUO (i.e. any CUI) to personal email accounts (e.g. AOL, Yahoo, Hotmail, Comcast, etc.) is strictly prohibited. FOUO sent out of the contractor's facility electronically must be encrypted (DoD FIPS 140-2 standard). FOUO material shall not be released outside the contractor's facility except to representatives of DoD.

When no longer needed, destroy FOUO by a method that precludes its disclosure to unauthorized individuals.

3. Markings: Unclassified documents (paper or electronic) generated in support of this contract which contain FOUO are to be marked "For Official Use Only" at the bottom on the outside of the front cover (if any), on each page containing FOUO information, and on the outside of the back cover (if any). Each paragraph containing FOUO information shall be marked as such. Within a classified document, an individual page with both FOUO and classified information shall be marked at the top and bottom with the highest security classification of information appearing on the page. Individual paragraphs shall be marked at the appropriate classification level, as well as unclassified or FOUO, as appropriate. Within a classified document, an individual page that contains FOUO information but no classified information shall be marked "For Official Use Only" at the top and bottom of the page, as well as each paragraph that contains FOUO information. Other records, such as photographs, films, tapes, or slides, shall be marked "For Official Use Only" or "FOUO" in a manner that ensures that a recipient or viewer is aware of the status of the information therein. DS on technical documents identify access restrictions. DS "B" through "D" preclude public release and while not marked as FOUO, are subject to all FOUO protection requirements, including the prohibition on unencrypted transmission over the public Internet.