NN801 Rev 5.pdf

NN-801 (March 2022) Revision 05

CONTROL AND PROTECTION

OF UNCLASSIFIED

NAVAL NUCLEAR PROPULSION INFORMATION

This page intentionally left blank

TABLE OF CONTENTS

Section Page

1. General Notes.………………………………………………………………..….…… 1

2. Definitions……………………………………………………………………………… 3

3. Disclosure Policy……………………………………………………………………… 6

4. Naval Nuclear Propulsion Information Control Officer (NNPICO)………………. 9

5. DOD Certification of Seller's Eligibility to Receive NNPP Information…………. 9

6. Control and Storage of Unclassified NNPI…………………………………....…… 10

7. Control of Visitors…………………………………………………………………….. 11

8. Transmittal and Shipment of Unclassified NNPI…………………………………... 12

9. Reproduction and Disposal of Unclassified NNPI…………………………………. 13

10. Unclassified NNPI Information Systems (IS) Protection Requirements………… 14

11. Guidance for Identifying Unclassified NNPI………………………………………... 33

Enclosure (1) Agreement for Protection of Unclassified Naval Nuclear Propulsion Program

Information (U-NNPI) as Part of an Inquiry Enclosure (2) NN-801 Information System Security Plan Template Enclosure (3) Seller Certification of Compliance for the Control and Protection of Unclassified

Naval Nuclear Propulsion Information (U-NNPI) Enclosure (4) Acronyms Enclosure (5) Systems and Components

This page intentionally left blank

NN-801 (March 2022) Page 1

1. GENERAL NOTES

a. NN-801 requirements are applicable to all procurements that involve Unclassified Naval Nuclear Propulsion Information (U-NNPI) and Unclassified Controlled Nuclear Information (UCNI). For the purpose and implementation of NN-801, the term "U-NNPI" shall include UCNI and provide the same level of information protection requirements.

b. Adhering to the guidelines of NN-801 (Control and Protection of Unclassified Naval Nuclear Propulsion Information), as obligated under contract, fulfills Seller and subcontractor requirements of OPNAVINST N9210.3 for the protection of U-NNPI. OPNAVINST N9210.3 identifies this relationship in Chapter 7, Section 5.

c. The Seller shall establish a Security Plan in accordance with the requirements set forth in NN-801.

The Security Plan shall include all policies, procedures, controls and documentation delineated in all sections of NN-801 and shall be submitted to CNO (N00N) for approval. Any further references to written plans and policies in this document are referring to the Security Plan. The Seller shall review the Security Plan and update as necessary but not to exceed every five years.

d. Sellers that choose to store and process U-NNPI on an information system shall meet the requirements in Section 10 of NN-801. The Seller shall complete Enclosure (2), which provides a description of the Seller information system, key roles and responsibilities, a list of requirements for control and protection of U-NNPI on information systems, and a description of how the Seller meets these requirements on the information system. The Seller shall sign and submit Enclosure (2) to CNO (N00N) for approval as part of the Seller Security Plan. Note: When Enclosure (2) is completed, it is marked as CUI. Sellers that choose not to store and process U-NNPI on an information system are not required to complete Enclosure (2).

e. Seller personnel (including on-site subcontractor personnel) with potential access to U-NNPI shall receive a local security briefing on the requirements for the protection of U-NNPI before being granted unescorted access to an area that contains U-NNPI. This requirement also applies to system administrators for systems processing U-NNPI. Even though these individuals may not access U- NNPI on those information systems, the potential for access to U-NNPI exists. Initial training shall ensure that personnel processing U-NNPI understand the security risks associated with their activities and the applicable laws, Executive Orders, directives, policies, standards, instructions, regulations, or procedures related to the protection of U-NNPI. Thereafter, refresher training shall be administered to applicable Seller personnel (including on-site subcontractor personnel) on an annual basis. Both initial and annual refresher training shall include information regarding Insider Threat Awareness as well as U-NNPI awareness and protection training. The Seller shall maintain recipient signed records of the initial training and the latest refresher training.

Seller personnel recommended for, or possessing a Department of Energy (DOE) or Department of Defense (DOD) security clearance, who are denied the clearance or have an active clearance suspended shall not be granted access to classified information or U-NNPI. The Seller shall identify to the Buyer, in the Security Plan, the personnel responsible for the implementation and enforcement of these requirements.

f. Military technology that is Naval Nuclear Propulsion technology is protected under United States (U.S.) Federal statutes and export control regulations. NN-801 provides protection of U-NNPI in accordance with the requirements identified herein.

g. During the performance of this contract, U-NNPI may be created and/or used. Appropriate safeguards must be implemented by the Seller to prevent release of U-NNPI in any form. These

NN-801 (March 2022) Page 2 safeguards shall ensure that access to U-NNPI is limited to those governmental and Seller parties (including subcontractors) that have an established Need-to-Know (NTK), and then only under conditions which assure that the information is properly protected. Access to U-NNPI by foreign nationals or representatives of foreign interests is not permitted. In addition, all issuances or releases of information beyond such necessary parties, including administrative or judicial tribunals, shall be brought to the attention of CNO (N00N).

CNO (N00N) shall be immediately notified of any litigation, subpoenas, or requests which either seek or may result in the release of U-NNPI. In the event that a court or administrative order makes immediate review by CNO (N00N) impracticable, the Seller agrees to take all necessary steps to notify the court or administrative body of Naval Reactors’ (NR) interest in controlling the release of such information through review and concurrence of any release.

CNO (N00N) reserves the right to review the Seller’s facility and Security Plan for compliance with requirements of NN-801. Exceptions or equivalencies to the requirements of NN-801 shall be formally requested in writing by the Seller and may only be obtained with written approval from CNO (N00N).

The Seller shall inform CNO (N00N) in writing of their intent to maintain U-NNPI within 90 days following completion of a contract and the date by when, or the circumstances under which, the material would be destroyed in accordance with Section 9, Reproduction and Disposal of Unclassified NNPI. Alternatively, U-NNPI may be returned to the Buyer.

h. The Seller agrees to insert NN-801, unmodified and in its entirety, in all subcontracts involving U-NNPI (including this sentence). The Seller shall notify the Buyer and Prime Contractor in writing of all subcontracts in which NN-801 is invoked. When invoked by Sellers on subcontractors, all responsibilities in NN-801 for “Seller” shall apply to the subcontractor for control and protection of U- NNPI at the subcontractor’s location.

i. The Seller agrees that prior to providing any U-NNPI to a prospective subcontractor, they shall obtain signed copies of the subcontractor’s DD Form 2345 and NN-677 (Enclosure (1)). Proof of current/active registration through the Defense Logistics Agency (DLA) Joint Certification Program (JCP) is also acceptable. Validation of registration through the DLA JCP is in lieu of the completed DD Form 2345 only. The registration is not in lieu of the signed NN-677 (Enclosure (1)).

j. The Seller shall certify compliance to the requirements contained herein by completing and submitting

Enclosure (3) of this document to the Buyer and Prime Contractor prior to contract award. Enclosure

(3) is also required to be submitted for subcontractors.

k. The Seller shall develop and enforce a policy to mitigate the use of controlled items in their facility which may result in the compromise of U-NNPI. Controlled items or Personal Electronic Devices (PEDs) may be present in unclassified or open access spaces. Sound judgement is required prior to discussing topics which may include U-NNPI in unsecure areas. Each employee is responsible to ensure that U-NNPI is not inadvertently exposed to unauthorized personnel. This policy shall also be applicable to visitors.

l. The Seller shall develop and conduct an annual physical and cyber security self-assessment to ensure U-NNPI is afforded adequate control and protection as required by NN-801. The Seller shall describe their self-assessment process in the site Security Plan. Completed self-assessments shall be provided to the Buyer annually for information.

m. All requirements for the marking of documents, media, equipment, etc. are included in the Naval

Nuclear Propulsion Program (NNPP) Marking Guide or other contractually-invoked applicable

NN-801 (March 2022) Page 3 documents.

n. The Seller shall report loss, compromise, or suspected compromise of U-NNPI to the Buyer within 24 hours. U-NNPI material that cannot be located within a reasonable period of time shall be presumed to be lost until an investigation determines otherwise.

2. DEFINITIONS

a. Buyer - For the purpose of NN-801, a Buyer is any organization contracting with the Seller to provide services or perform work involving NNPI.

b. Controlled Items - Possession and appropriate use of devices or equipment capable of recording, transmitting, or exporting information. Limited use of these items in approved spaces is subject to the Seller’s discretion and annotated in the Seller’s Security Plan.

c. CNO (N00N) – Chief of Naval Operations; specifically the Director of the Naval Nuclear Propulsion Program (N00N). I.e., Naval Reactors (NR), also known as NAVSEA 08. For the purpose of NN- 801, CNO (N00N) is NR or their formally authorized designee.

d. Controlled Unclassified Information (CUI) - Information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. CUI does not include classified information or information a non-Executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an Executive branch agency or an entity acting for an agency.

Law, regulation, or Government-wide policy may require or permit safeguarding or dissemination controls in three ways: (1) requiring or permitting agencies to control or protect the information but providing no specific controls, which makes the information CUI Basic; (2) requiring or permitting agencies to control or protect the information and providing specific controls for doing so, which makes the information CUI Specified; or (3) requiring or permitting agencies to control the information and specifying only some of those controls, which makes the information CUI Specified, but with CUI Basic controls where the authority does not specify. U-NNPI is a Specified category of CUI.

e. Contract - For the purpose of NN-801, a contract is any legally enforceable agreement between the Buyer and a Seller.

f. Document – Any recorded information, regardless of the nature of the medium, or the method or circumstances of recording.

g. Dual Citizen - Individual who holds both a U.S. citizenship and the citizenship of another country.

h. Equipment - All supplies, component parts, and models of such supplies and component parts that are to be delivered under this contract. For the purpose of NN-801, equipment does not include standard commercial supplies, component parts, and models.

i. Foreign Interest - Any foreign government, agency of a foreign government, or representative of a foreign government; any form of business enterprise or entity organized under the laws of a country other than the United States (U.S.) or its possessions. This includes the foreign parent and subsidiaries for Sellers that are owned or controlled by a foreign-owned parent organization.

j. Foreign National - For the purpose of NN-801, a foreign national is any person that is not a U.S.

citizen or U.S. national. As such, non-U.S. citizens or non-U.S. nationals (e.g., Green Card holders)

NN-801 (March 2022) Page 4 permanently residing in the U.S. are considered foreign nationals.

k. Government - For the purpose of NN-801, the Government is considered to be NR and its field offices.

l. Government Procurement Agent – The use of Government Procurement Agent has been removed and is replaced with the term "Prime Contractor" as this term provides better clarity. It is noted that the NN-802 Revision 4 still uses the term Government Procurement Agent and will be addressed during its next revision.

m. Information System (IS) - A discrete system or set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

n. Media Center – Collection of one or more computers that are operated for the purpose of loading, offloading, or transferring files.

o. Mobile Device - A mobile computing device that has a small form factor such that it can easily be carried by a single individual; is designed to operate without a physical connection (e.g., wirelessly transmit or receive information); possesses local, non-removable or removable data storage; and includes a self-contained power source. Mobile devices may also include voice communication capabilities, on-board sensors that allow the device to capture information, or built-in features for synchronizing local data with remote locations. Examples of mobile devices include smart phones, e-readers, and tablets.

p. Naval Nuclear Propulsion Information (NNPI) - NNPI is all information, classified or unclassified, concerning the design, arrangement, development, manufacture, testing, operation, administration, training, maintenance, and repair of the propulsion plants of Naval Nuclear Powered ships and prototypes including the associated shipboard and shore-based nuclear support facilities.

The term “NNPI”, when used without qualifiers (such as “classified” or “unclassified”) shall be taken to include both classified and unclassified NNPI.

Technology (including basic research, test data, evaluation methods, behavior models, etc.)

developed to support the Naval Nuclear Propulsion Program (NNPP) applications should be considered to be NNPI regardless of either direct or indirect application, unless otherwise identified.

Technology that is applicable to both naval nuclear and conventional propulsion plants is considered to be NNPI when an association with the NNPP exists. The designation of the information as NNPI is mandatory.

Instructions for making U-NNPI determinations applicable to a specific contract, including further discussion of what constitutes association, is provided in Section 11, Guidance for Identifying Unclassified NNPI.

As used in NN-801, the designation (U-NNPI) indicates that although the information is unclassified, it is subject to special dissemination controls, restricted access, export controls, and marking requirements. U-NNPI is not releasable to the general public without prior approval of CNO (N00N).

q. Need-to-know (NTK) - A determination by a person having responsibility for protection of information or material that a proposed recipient's access to such information or matter is necessary in performing official or contractual duties of employment.

NN-801 (March 2022) Page 5

r. Personal Electronic Devices (PEDs) - An easily transportable electronic device which has a capability to record, copy, store, and/or transmit data, digital images, video, and/or audio. The following list is not all-inclusive, but highlights how prolific and prevalent PEDs have become.

Examples include: laptop computers, cellular telephones, cellular smartphones, radios (AM/FM, Satellite), compact disc, cassette players and recorders, portable data assistants, digital tablets of any kind (iPads), digital audio devices (MP3 players, iPods), sound reducing headphones/earphones (e.g., Bose, Sony, Quietpoint), digital cameras, cameras, camcorders, programmable calculators, electronic book readers (Kindle, Nook, Neo), electronic watches with smartphone capabilities, input capability and/or reminder recorders, and digital recording and remote computing devices (Google Glass), luggage trackers and other GPS or RFID trackers (including but not limited to GPS watches).

s. Prime Contractor – The organization directly contracted by the Government responsible for obtaining Government approval for the disclosure of NNPI.

t. Public - The public is any person or organization that does not represent the Seller, the Buyer, the Prime Contractor, or the Government (NR and its field offices) in the performance of this contract.

u. Remediation – The act of correcting a vulnerability in an information system. There are three primary methods of remediation; installation of a software security patch, adjustment of a configuration setting, and removal of affected software.

v. Representative of a Foreign Interest - For the purpose of NN-801, a representative of a foreign interest is any person (regardless of citizenship), functioning (in an individual capacity or on behalf of any corporation, person or government entity), as an official representative, agent, or full-time employee of a foreign interest. A U.S. citizen appointed by a U.S. employer to act as a representative in the management of a foreign subsidiary, of a U.S. corporation is not considered a representative of a foreign interest.

w. Seller - For the purpose of NN-801, a Seller is any organization that is contracted by a Buyer to supply services or perform work involving NNPI.

x. Subcontractor – For the purpose of NN-801, a subcontractor is any organization that is contracted by the Seller to supply services or perform work involving NNPI.

y. Technical Data –

(1) Information, other than software, which is required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modifcation of defense articles.

This includes information in the form of blueprints, drawings, photographs, plans, instructions or documentation.

(2) Classified information relating to defense articles and defense services on the U.S. Munitions List and 600-series items controlled by the Commerce Control List.

(3) Information covered by an invention secrecy order.

(4) Software directly related to defense articles.

z. Two-person controls – Controls in place to prevent one person, acting alone, from removing information from a U-NNPI system.

aa. Unclassified Information – Information not requiring control, but requiring review before public release.

bb. Unclassified Controlled Nuclear Information (UCNI) - Certain unclassified Government information concerning nuclear facilities, materials, weapons, and components whose dissemination is controlled under section 148 of the Atomic Energy Act.

NN-801 (March 2022) Page 6

The designation (UCNI) indicates that this information is subject to special handling controls, restricted distribution, and marking requirements and is not releasable to the general public without prior approval of CNO (N00N).

cc. United States - The fifty States, District of Columbia, Puerto Rico, American Samoa, the U.S. Virgin Islands, Guam, the Northern Mariana Islands, and territories and areas subject to the complete sovereignty of the U.S.

dd. Visitor - Any person who visits the Seller’s plant, office or facility, is not employed by the Seller, and does not represent the Buyer, Prime Contractor, or the Government in the performance of this contract. This includes subcontractor personnel with access to the Seller’s plant who are not directly contributing to the completion of the NNPP product, and foreign nationals whose visits may require additional controls above and beyond those necessary for visits by U.S. Citizens.

ee. Visitor Security Plan (VSP) - A procedure that when properly implemented by the Seller, will preclude the release of U-NNPI to visitors (including foreign nationals). A VSP is a required component of a Security Plan.

3. DISCLOSURE POLICY

U-NNPI shall not be disclosed in any manner that results in release to the public, foreign nationals, or representatives of a foreign interest. Access to U-NNPI shall be limited to individuals who are U.S.

citizens, authorized dual citizens, and have a NTK for performing assigned work as determined by the Seller. The Seller shall caution authorized recipients of U-NNPI against the release of this information to the aforementioned individuals, or those without a NTK. Any exception to the disclosure policy for U-NNPI must be requested and requires prior written approval of CNO (N00N).

a. Foreign Disclosure - Release of U-NNPI to foreign nationals (or to representatives of foreign interests) is not authorized. All dual citizens with a need to access U-NNPI must be reported to CNO (N00N) prior to being provided access to U-NNPI. If a dual citizen maintains a citizenship with a sensitive country (as defined by the Secretary of Energy memorandum dated 29 May 2014 “Sensitive Countries List,” or its successor), reporting must be performed to CNO (N00N) at least 10 business days prior to being granted such access.

If the Seller is owned or controlled by a foreign parent organization, release of U-NNPI to the Seller’s corporate foreign parent is prohibited without written approval of CNO (N00N). U-NNPI is subject to export control regulations. Release of U-NNPI to a foreign-owned organization is a violation of export controls under the DD Form 2345 agreement.

The Seller shall report all foreign nationals (including on-site subcontractor personnel) currently employed at the Seller’s facility where U-NNPI material is processed, stored, or disposed of to the Buyer annually. The report shall be consistent with those required for foreign national visitors in Section 7, Control of Visitors.

b. Disclosure to Personnel in the Executive Branch of the U.S. Government - Disclosure of U-NNPI to personnel in the Executive Branch of the U.S. Government (to include Federal regulators), except for those involved in the NNPP, requires the approval of CNO (N00N) in each instance. The fact that an individual is employed by a U.S. Government activity is not in itself sufficient justification for release of U-NNPI to that individual.

c. Disclosure Outside the Executive Branch of the U.S. Government - Disclosure of U-NNPI to personnel outside the Executive Branch of the U.S. Government, including State regulators, U.S.

industry, private individuals or other interests, except when required in the performance of

NN-801 (March 2022) Page 7 unclassified NNPP tasks, requires CNO (N00N) approval for each instance.

d. Disclosure in Judicial or Administrative Proceedings - When access to U-NNPI is solicited as part of a judicial or administrative proceeding, CNO (N00N) shall be apprised to ensure that proper protective mechanisms are put in place to prevent unauthorized disclosure of the information. These mechanisms may include formal protective orders (or legal filings), and may result in the denial of access to U-NNPI, if such access is judged to be inappropriate or unnecessary.

e. Requirements for Sellers and Subcontractors - Firms organized under the laws of the U.S., regardless of potential foreign ownership can receive contracts requiring access to U-NNPI if the firm formally agrees to protect the information. Sellers shall protect and control U-NNPI (electronic and document form) to prevent release beyond the U.S. and its possessions; i.e., release of U- NNPI to a Seller’s foreign-owned corporate parent or subsidiaries is prohibited.

(1) Unclassified Subcontracts - It is noted that if the material furnished to a subcontractor is (1) unclassified and not U-NNPI and (2) is not directly identifiable to any NNPP application, it may be handled as unclassified without the need to disseminate the U-NNPI disclosure restrictions identified herein. The Seller shall not include U-NNPI in subcontracts unless it is specifically required. When the contract does not involve access to U-NNPI, the contract should not include contractual stipulation for its protection.

Where the contract requires flow down of provisions to subcontractors to protect technical data or equipment against transmittal abroad, such provisions shall be modified as needed to avoid any direct statements that would relate the information to the NNPP per Section 11.

(2) U-NNPI Subcontracts - Sellers that procure material, equipment, components, or services involving access to U-NNPI shall ensure that NN-801 is invoked in any contract or subcontract to ensure the control and protection of U-NNPI at a subcontractor’s facility. The Seller shall certify compliance to all requirements contained in NN-801 by completing and submitting Enclosure (3) of this document to the Buyer prior to contract award.

When providing a specification, drawing, or other technical document (containing U-NNPI), to a prospective subcontractor for the purpose of soliciting bids, and no contract yet exists, the Seller shall obtain a copy of the subcontractor’s DD Form 2345 (or electronic certificate), and the prospective subcontractor's agreement to control and protect the specification or document, using a protection agreement (Enclosure (1), Form NN-677, Agreement for Protection of U-NNPI as Part of an Inquiry), until subsequent contractual controls are established. In all cases, the document and all copies shall either be returned to the Buyer or certified to have been properly destroyed per Section 9 after the bid or solicitation process is complete.

f. Unauthorized Release of U-NNPI - Any release, including those at a subcontractor, of U-NNPI in violation of the disclosure policy outlined in NN-801 shall be reported within 24 hours to CNO (N00N).

g. Public Disclosure – U-NNPI shall not be disclosed in any manner which may result in direct or indirect release to the public. No public comment should be made which would confirm or deny whether U-NNPI has been inadvertently released to the public. Release of information which reaches the public is considered tantamount to foreign disclosure. In order to ensure that U-NNPI is not inadvertently released to the public, the Seller must submit to the Buyer for review all proposed public releases of information (e.g., advertisements, promotions, papers, presentations) regarding the work that the Seller is performing for the Buyer. CNO (N00N) approval must be obtained prior to public release of information related to contracts. Release approval will be handled on a case-by-case basis. The Seller’s employees traveling to or participating in technical conferences shall be given a defensive briefing by the Seller's security personnel or designee prior to attendance to ensure that U-

NN-801 (March 2022) Page 8

NNPI is not disclosed. The defensive briefing may be accomplished as part of the annual refresher briefing.

(1) Web Pages and Email – Public facing web pages and unencrypted email are considered to be publicly accessible and public disclosures. Public facing web pages which contain information related to work the Seller is performing for the Buyer shall be approved by CNO (N00N) prior to making publicly accessible.

U-NNPI shall not be transmitted unencrypted beyond the Seller site network boundaries. U-NNPI shall be encrypted per the requirements contained in Section 10.

(2) Documents Containing U-NNPI - U-NNPI shall not be used in documents with the potential for public release or uncontrolled distribution. Whenever possible, general information such as procedures, sketches, drawings, etc., shall not be described in any manner which would directly disclose its association with the NNPP. The absence of U-NNPI shall not by itself be interpreted as authorization for public release of information; CNO (N00N) approval is required in accordance with the provisions of NN-801 and the contractual terms and conditions. In cases where the usefulness of a document with the potential for public release requires reference to U-NNPI, the information shall be removed from the body of the document and issued as a separate supplement or enclosure. The use of an enclosure for U-NNPI allows appropriate distribution of the document while maintaining control of non-releasable information. However, where this cannot be accomplished within practical limits, access to such U-NNPI shall be controlled as noted herein.

(3) Information Concerning the Environment and Occupational Safety and Health - Environmental information and Occupational Safety and Health (OSH) information is not U-NNPI unless presented in such a way that it reveals information concerning the design, arrangement, development, manufacture, testing, operation, administration, training, maintenance, or repair of the propulsion plants of Naval nuclear-powered ships and prototypes, (including the associated shipboard and shore-based nuclear support facilities). Special care shall be taken to avoid or minimize the inclusion of U-NNPI in documents that pertain to environmental or OSH matters since such documents are more likely to require public release.

Other requirements, such as privacy protection, may apply to environmental or OSH information;

therefore the absence of U-NNPI shall not by itself be interpreted to authorize public release of this information; CNO (N00N) approval to release publicly is required in accordance with Public Release of Information article of the terms and conditions of the contract.

h. Dissemination of U-NNPI

(1) Without prior written consent of CNO (N00N), the Seller shall not, at any time during or after performing this contract, transmit or authorize transmittal of any U-NNPI (e.g., documents, equipment or technical data):

(a) Outside the U.S. (U.S. Navy ships are considered a sovereign extension of U.S. soil and therefore, a transmission of U-NNPI to U.S. nuclear-powered warships is not considered to be “Outside of the U.S.”).

(b) Irrespective of location:

To any foreign national or (representative of a foreign interest) To any foreign organization (including foreign subsidiaries and affiliates of Seller) To any foreign government To any international organization

(2) Seller agrees to insert in all subcontracts (involving U-NNPI) these contract provisions which shall

NN-801 (March 2022) Page 9 conform substantially to the language of this article, (including this paragraph).

(3) Notwithstanding any other provisions of this article, this article shall not apply where:

(a) The transmittal (or authorization for the transmittal), of U-NNPI (e.g., documents, equipment or technical data), is to be made pursuant to a contract or agreement to which the U.S.

Government is a party (e.g., the 1958 US/UK Mutual Defense Agreement); and

(b) The transmittal is to be of U-NNPI which CNO (N00N) has declared in writing to the Seller to be thereafter exempt from this article.

4. NAVAL NUCLEAR PROPULSION INFORMATION CONTROL OFFICER (NNPICO)

The Seller shall designate a manager familiar with NNPI protection procedures as the NNPICO. The Seller shall ensure that the NNPICO is technically qualified or a technically qualified individual is available for consultation with the NNPICO as needed. The NNPICO shall ensure that appropriate procedures and policies are included in the Security Plan to control, and to prevent unauthorized access to U-NNPI data or material. The NNPICO shall ensure the Seller complies with NN-801 requirements and the approved Security Plan, and shall be responsible for determining if documents are correctly marked as U-NNPI. The NNPICO shall be identified in the Seller’s security plan.

5. DOD CERTIFICATION OF SELLER'S ELIGIBILITY TO RECEIVE NNPP INFORMATION

Department of Defense (DoD) Directive 5230.25 promulgates regulations to ensure the protection of sensitive unclassified technical information (e.g., U-NNPI) is controlled pursuant to export control regulations. As a condition of receiving export-controlled DoD technical data, which includes NNPI, the DoD Directive requires all contractors (Sellers) who will receive such information to obtain Defense Logistics Agency (DLA) Joint Certification Program (JCP) acceptance of the Seller's certification of eligibility.

This certification is accomplished by completing DD Form 2345 entitled “Militarily Critical Technical Data Agreement” for all facilities where U-NNPI will be located. The DD Form 2345 is Commercial and Government Entity (CAGE) code-specific and must be completed for each facility that stores and/or processes U-NNPI, even if separate facilities are owned and operated by the same company. The Seller shall submit the original completed copy to the DLA JCP in accordance with the instructions contained on the reverse side of the DD Form 2345. The description of relevant business activity required by Block 4 shall include a generic unclassified description of the component/equipment/service being performed.

Once submitted and approved by DLA JCP, the DD Form 2345 is effective, unless revoked, for a period of 5 years and provides authorization for the Seller to receive applicable U-NNPI on a procurement related to the NNPP. The Seller is responsible for ensuring this certification is revalidated every 5 years to expiration. In addition to revalidating the DD Form 2345 certification every 5 years, Sellers are required to update and submit the Security Plan at least every 5 years for CNO (N00N) approval and provide the most current signed Enclosures (1) and (3).

The Seller is required to confirm to the Buyer that their certification has been accepted by the DLA JCP and that they have an approved copy of DD Form 2345 currently on file (identified by certification number and date) or that action has been taken to obtain DLA JCP acceptance of their certification through submittal of the properly completed form by forwarding a copy of the submittal to the Buyer. The Seller shall submit a copy of the approved DD Form 2345 to the Buyer upon receipt of DLA JCP acceptance.

The requirement to have an accepted DD Form 2345 is a pass-down requirement in all subcontracts that involve access to U-NNPI. The Seller shall also take appropriate action with any subcontractor who will

NN-801 (March 2022) Page 10 require access to U-NNPI to ensure that their subcontractor’s certification has been accepted by the DLA JCP. The Seller shall either maintain an approved copy of the subcontractor’s DD Form 2345 on file (identified by certification number and date) or shall maintain a copy of a properly executed DD Form 2345 that was submitted by the subcontractor to DLA JCP for acceptance of their certification. In the case where the DLA JCP has not yet accepted a subcontractor’s certification, the Seller shall request the subcontractor to submit a copy of the approved DD Form 2345 to the Buyer upon receipt of DLA JCP acceptance to complete the documentation and ensure compliance. The Seller shall ensure the subcontractor understands the subcontractor is responsible to ensure recertification every 5 years to continue to receive and retain U-NNPI information related to procurements.

6. CONTROL AND STORAGE OF UNCLASSIFIED NNPI

Access to NNPI is controlled principally by identifying and isolating areas within the facility that reveal NNPI. The security measures required to protect NNPI will depend on the type of work being performed and the access control procedures employed. Control and storage methods and procedures for U-NNPI shall be detailed in the CNO (N00N)-approved Security Plan.

U-NNPI shall be controlled so individuals without a NTK cannot obtain visual or physical access. Visual and physical access by foreign national Seller personnel or visitors is not permitted. When in use by authorized individuals, U-NNPI documents are considered to be under the direct custody of the individual authorized to use them. This individual must exercise appropriate protection measures needed to prevent access by individuals without the required NTK as stipulated above.

Access to documents containing U-NNPI in unsupervised areas shall be controlled by placing the documents in a locked repository, locked container (e.g., desk, file cabinet, or bookcase) or in a locked area. U-NNPI may remain in an unlocked area during normal working hours provided the area is regularly monitored to preclude unauthorized access of U-NNPI documents. U-NNPI that is not physically stored within a locked desk, repository, file cabinet, etc., cannot be considered secure (e.g., after-hours cleaners, maintenance personnel, etc.) when the area is not supervised. The Seller shall document in their security plan how they protect U-NNPI when it is not under direct supervision or during non-working hours.

Access to U-NNPI (documents, components or component parts) in shop areas shall be controlled through shop practices that limit visual and physical access to U-NNPI to those authorized and with a NTK. Shop practices that preclude visual and physical access to U-NNPI shall be included in the Seller’s security plan. The Seller shall implement methods of covering the U-NNPI material that would preclude unauthorized review of the material. To prevent the compromise of U-NNPI, all shop personnel having access to U-NNPI shall be trained to maintain situational awareness and report any unauthorized individuals (e.g., non-employees without an escort or employees without NTK) within the shop area to the Facility Security Officer (FSO) and/or NNPICO.

Sellers should establish and maintain a system to deter and detect unauthorized introduction or removal of U-NNPI material from their facility. The objective is to discourage the introduction or removal of U- NNPI material without proper authority. Personnel who have a legitimate need to remove or transport U- NNPI material outside of the facility should be provided appropriate authorization by the FSO and/or NNPICO for passing through designated entry/exit points.

a. Off-site Handling of U-NNPI - U-NNPI may be removed from a Seller’s site, subject to implementation of CNO (N00N)-approved controls as part of the Security Plan, that ensures information is protected (consistent with the disclosure requirements of NN-801), and the information is promptly returned when no longer needed off-site. U-NNPI shall not be reproduced or destroyed offsite but must be returned on-site for destruction.

NN-801 (March 2022) Page 11

b. U-NNPI Information Systems (IS) - Information systems containing U-NNPI shall be protected in accordance with the requirements specified in Section 10, Unclassified NNPI Information Systems (IS) Protection Requirements.

c. Safeguarding Oral Discussion - Sellers shall ensure that all personnel are aware of the prohibition against discussing U-NNPI in public conveyances or places, or in any other manner that permits interception by unauthorized persons.

d. Ingress/Egress Inspections - Random ingress/egress inspections of employees’ hand-carried items should also be accomplished and documented on a quarterly basis, at a minimum. Ingress inspections should include looking for the presence of controlled items, while egress inspections should include looking for unauthorized egress of documents and material.

7. CONTROL OF VISITORS

The following outlines the policy for the control of visitors to the Seller’s facility. The term visitor as defined in Section 2, Definitions, also includes foreign nationals or representatives of a foreign interest:

a. The Seller shall not permit visitors to have physical or visual access to documents, components, assemblies or subassemblies provided for or delivered under contracts without the visitor being a U.S. citizen and having a NTK. Further, visitors shall not obtain information or data concerning such documents, components, assemblies or subassemblies under this contract.

When the potential for visual access of U-NNPI exists through windows or glass doors, the window or door shall be covered by any practical method. During non-working hours, the windows or doors shall be closed and securely fastened to preclude entry by unauthorized personnel.

All visitors shall be asked to identify any controlled items in their possession prior to obtaining facility access. Sellers shall identify the frequency and method used to randomly inspect visitors’ hand carried items for controlled articles prior to entering the facility. A sign shall be conspicuously posted identifying this policy to visitors. Inspections are not required of wallets, change purses, clothing, cosmetic cases, or other objects of an unusually personal nature.

b. When visitors who are foreign nationals or representative of a foreign interest are permitted access to the Seller's facility to conduct business involving non-NNPP work, adequate controls shall be in place to ensure they are not permitted physical or visual access to U-NNPI documents, components, assemblies, or subassemblies provided for or delivered under this contract.

c. A VSP applicable to all visitors shall be submitted with the Security Plan and shall, at a minimum:

(1) Identify the methods established to ensure visitors are not permitted physical or visual access to U-NNPI documents, data, information, equipment (including computing equipment), components, assemblies, or subassemblies provided for or delivered under this contract.

To protect U-NNPI from unauthorized personnel, the VSP shall identify:

access controls escort procedures visitor control procedures (to include searches of hand-carried items) customer notification responsibilities

The VSP shall address the following special conditions:

NN-801 (March 2022) Page 12

(a) The Visitor shall be kept under close and continuous surveillance at all times while in the physical confines of the facility. Visual and oral disclosures of U-NNPI shall be prevented or limited (as appropriate), by the isolation of areas, materials or personnel that would divulge

U-NNPI.

(b) The visit shall be accomplished without adverse effect on the facility’s NNPP workload, scheduling, or other critical factors.

If all of these conditions cannot be satisfied, the visit shall be diverted to an area not engaged in NNPP work.

(2) To the maximum extent practical, Sellers shall notify the Buyer in writing at least one week before all visits by foreign nationals or representatives of a foreign interest to the Seller's plant, office or facility where the foreign nationals or representatives of a foreign interest may have the potential to have access to the Buyer’s information or product. In addition, the Seller shall notify the Buyer in writing within one week after the visit regarding changes to any of the following areas. The notifications shall include:

visitor’s first, middle and last name date of birth citizenship (including dual citizenship, if applicable) job title company name (i.e., notification of foreign interest status) complete description of purpose for the visit area visited start and end dates for the visit other data applicable to the visit

The notifications shall include a statement of compliance with the approved VSP and shall be signed by cognizant personnel responsible for implementing NN-801 requirements at the Seller’s facility.

8. TRANSMITTAL AND SHIPMENT OF U-NNPI

The sender of U-NNPI shall ensure the intended recipient is authorized (i.e., has an appropriate NTK, U.S. citizenship, etc.) to access U-NNPI prior to transmitting, shipping, or discussing U-NNPI.

Transmission or shipment of U-NNPI outside the U.S. is prohibited without prior written consent of CNO (N00N).

The contents of each package/carton of a multiple shipment shall be packaged and marked according to its specific content; i.e., if a complete shipment consists of several packages/cartons, some of which contain no U-NNPI material, only the contents of those packages/cartons containing U-NNPI material shall be marked.

a. Document or Component Transmittal or Shipment - Documents containing U-NNPI shall be, at a minimum, transmitted or shipped in a wrapping or an envelope that:

(1) does not allow visual access of the contents

(2) is not marked in a manner that would reveal the contents of the envelope or package to an unauthorized individual

Components designated as U-NNPI shall be shipped in a sealed container where size permits or

NN-801 (March 2022) Page 13 covered using a tarpaulin or other weather resistant means so that the component remains screened from view during shipment.

b. Use of Telecommunications Equipment - U-NNPI may be transmitted to authorized recipients using non-secure telephones and stand-alone fax machines within the U.S., using devices issued, owned or leased by the Seller.

When transmitting via non-secure phone, no remnant of U-NNPI can exist after the transmission is completed. For example, telephones or mobile phones shall not be used to leave voicemails, text messages, or any other stored data that contains U-NNPI.

Transmission of U-NNPI to U.S. citizens (with a valid NTK) outside of the U.S. and its territories (foreign country) must meet the FIPS 140-2 encryption requirements contained in Section 10, Unclassified NNPI Information Systems (IS) Protection Requirements.

When faxing U-NNPI, the person completing the transmission shall verify that the receiving equipment is attended by personnel authorized to receive U-NNPI, or if unattended, the receiving facility security arrangements will preclude unauthorized access to the transmitted material.

Fax machines and multifunction devices authorized to print, fax and/or scan U-NNPI material shall not be interconnected to any network that is not authorized to store and process U-NNPI without cybersecurity protections in place (e.g., VLANs) to segment the device(s) from the non-U-NNPI-approved segment. Equipment shall be appropriately marked in accordance with Section 10 requirements.

9. REPRODUCTION AND DISPOSAL OF UNCLASSIFIED NNPI

Sellers should establish a control system to ensure that reproduction of U-NNPI material is held to a minimum consistent with contractual and operational requirements. U-NNPI reproduction shall only be accomplished by authorized personnel knowledgeable of the procedure and on approved equipment (printers and copiers).

U-NNPI shall be disposed of or destroyed in a manner that precludes the recognition, reproduction, or reconstruction of U-NNPI.

a. Disposal of U-NNPI Documents - Disposal of unclassified documents containing U-NNPI shall ensure the information is not easily retrievable. Recycling of paper (or easily shredded material) containing U-NNPI is authorized, provided the documents are shredded to crosscut particles that are 1 mm x 5 mm (0.04 inch x 0.2 inch) in size (or smaller) or pulverize/disintegrate paper materials using disintegrator devices equipped with a 3/32 inch (2.4 mm) security screen. Further, non-paper products (e.g. Mylar or microfilm/microfiche) not sufficiently destroyed by shredding must be disposed of in a manner which will provide reasonable protection against unauthorized diversion or recovery of the information. All disposal and recycling methods/processes for U-NNPI material shall be identified in the Security Plan.

Requests for alternative disposal and/or recycling methods which ensure an adequate degree of control during and after disposal shall be identified in the Security Plan and approved by CNO (N00N).

b. Disposal of Components and Equipment which Reveal U-NNPI - Prior to disposal of components and equipment which reveal U-NNPI, all markings (such as stock number, name plate data, Special Material Identification Code (SMIC), tags, stickers, transfer documents, meter face markings, etc.)

which associate the equipment or component with a nuclear propulsion plant application shall be removed or obliterated. If after removal or obliteration of such markings the equipment or components

NN-801 (March 2022) Page 14 still reveal U-NNPI, the items shall be disposed of by a method which prevents later recognition or reconstruction of the U-NNPI. If questions exist regarding appropriate destruction methods, the Seller shall review DOD Instruction 4160.28-M-V3 (or latest version) for applicability and discuss with the Prime Contractor’s lead technical contact.

In view of stringent controls for the disposal of radioactive waste, and in order to minimize radiological work, components or equipment to be disposed of as radioactive waste need not have markings removed or obliterated.

Disposal of unused but no longer required reactor plant equipment and components provided as Government Furnished Equipment (GFE) shall be in accordance with specific instructions obtained from the Buyer.

c. Disposal of Computing Equipment and Media Containing U-NNPI – All non-volatile user addressable storage/memory materials must be disposed of (or erased) in a manner that provides protection against unauthorized diversion or recovery of the information. This also applies to such materials involved in unauthorized disclosures, spills or inadvertent disclosure of U-NNPI data. See Section 10 (Media Protection – Sanitization, Reuse and Destruction) for additional guidance.

10. UNCLASSIFIED NNPI INFORMATION SYSTEMS (IS) PROTECTION REQUIREMENTS

Safeguards shall be applied such that U-NNPI is (1) accessed only by authorized individuals, (2) processed only on approved Information Technology (IT) systems, (3) processed only within authorized workspaces or environments, (4) used only for its authorized purpose(s), and (5) properly handled, encrypted, marked, labeled, stored and disposed.

The requirements in this section of NN-801 are applicable to all Sellers that store,…