NUWCDIVKYPT 5510.1K.pdf

CUI

DEPARTMENT OF THE NAVY

N A V A L U N D E R S E A W A R F A R E C E N T E R D I V I S I O N

6 1 0 D O W E L L S T R E E T

K E Y P O R T , W A S H I N G T O N 9 8 3 4 5 - 7 6 1 0

Controlled by: Code 105

CUI Category: General Law Enforcement

Distribution/Dissemination Control: FED CON

POC: Kevin McPherson 360-396-2589

NUWCDIVKPTINST 5510.1K

Ser 105/

Mar 2022

NUWCDIVKPT INSTRUCTION 5510.1K

From: Security Director, Naval Undersea Warfare Center Division, Keyport

Subj: NAVAL UNDERSEA WARFARE CENTER DIVISION, KEYPORT INFORMATION

SECURITY PROGRAM

Ref: (a) Executive Order 13526 of 29DEC09 Classified National Security Information

(b) DoDM 5200.01-V1, February 24, 2012

(c) DoDM 5200.01-V3, February 24, 2012

(d) DoDM 5200.01-V4, February 24, 2012

(e) DoD Issuance 5200.48, March 6, 2020

(f) SECNAVINST 5510.36B

(g) OPNAVINST N9210.3

(h) NAVSEA M-5510.1 as of November 2016

(i) NAVSEA 5527.1, February 16, 2021

Encl: (1) Naval Undersea Warfare Center (NUWC) Division, Keyport Information Security

Program Manual

1. Purpose. To issue policy, identify responsibilities, and provide guidance for information security per references (a) through (g).

2. Cancellation. This directive supersedes NUWCDIVKPTINST 5510.1J CH-1.

3. Policy.

a. Mandatory policies directive in nature and provide standards, measures, or actions required, and are subject to inspection by higher headquarters and during Command Performance

Inspections begin with will or must. An inability to meet these requirements necessitates a request for a waiver or exception per the process outlined in reference (b), section 16 of

Enclosure (3).

b. Recommended policies required unless the responsible party has justifiable reason for not implementing the standards, measures, or actions indicated begin with should. At the command level, these reasons must be documented and submitted to the Security Director for review and concurrence.

c. Enabling policies permitting actions or measures within described parameters. These are not requirements, but are offered as possible actions or measures to take at the discretion of the responsible party begin with may or can.

d. Prohibitive policies limiting an individual’s or command’s authority to take actions or implement measures. These statements include terms such as should not if the action is advised against but left to the responsible party’s judgment. Statements including must not, will not, or may not are actions prohibited without prior authorization from an appropriate authority.

4. Scope. This instruction and accompanying manual encompasses all national security information classified under reference (a), and predecessor orders, and special types of classified and controlled unclassified information (CUI).

5. Responsibilities.

a. Core Information Security Program (ISP) responsibilities and duties for NUWC Division, Keyport managers, supervisors, and workforce personnel are listed in Enclosure 1, chapters 1 paragraph 3, and chapter 2 paragraph 3. Subject specific guidance is provided within each chapter of the corresponding manual.

b. Security Director/Security Manager will:

(1) Provide direction for the ISP to NUWC Division, Keyport managers, supervisors, and workforce personnel.

c. Information Security Program Manager will:

(1) Manage and coordinate the ISP to NUWC Division, Keyport managers, supervisors, and workforce personnel.

(2) Provide advice and assistance for ISP implementation and compliance.

d. Department/Division Heads and Officer-in-Charge (OIC) Pacific Detachment will:

(1) Ensure all assigned personnel are satisfactorily trained, and familiar with their ISP responsibilities as outlined in Chapter 1 of Enclosure (1).

(2) Monitor and ensure compliance with the ISP policies and procedures contained in

Enclosure (1).

e. All NUWC Division, Keyport personnel (military, civilian, and contractor) to include all visitors or guests will comply with the ISP policies and measures contained in this manual and cited higher directives.

6. Approved Waivers. All NUWC Division, Keyport employees must comply with the requirements of this directive, except as noted by an approved waiver on file in the NUWC

Division, Keyport directives library.

7. Releasability and Distribution. This instruction is cleared for command release only, and is available electronically only via NUWC Division, Keyport’s Code 106 Directives wiki website, https://wiki.navsea.navy.mil/display/kptdir.

8. Records Management. Records created as a result of this instruction, regardless of media and format, must be managed per Secretary of the Navy Manual 5210.1.

9. Review and Effective Date.

a. Per OPNAVINST 5215.17A, NUWC Division Keyport will review this directive annually on the anniversary of its effective date to ensure applicability, currency, and consistency with

Federal, DoD, SECNAV, and Navy policy and statutory authority. The annual review must be documented and approved via an OPNAV 5215/40, Instruction Review form. The approved

OPNAV 5215/40form will be maintained by the Command Directives Manager for a minimum of one year.

b. This directive will automatically expire 10 years after effective date unless reissued or canceled prior to the 10-year anniversary date, or an extension has been granted.

K. D. GLOVER

By direction https://wiki.navsea.navy.mil/display/kptdir

NUWC DIVISION, KEYPORT

INFORMATION SECURITY PROGRAM

MANUAL

REVIEW / REVISION HISTORY

Revision Date Brief Description of Change

A 27Jun2007 Changes to the DSC responsibilities

B 1Aug2007 Updated guidance on use of FOUO

C 4Dec2007 Updated forms table and SCGs

D 27Feb2008 Revised exhibit formats, identified additional existing classification management responsibilities. Deleted DD Form 254 biennial review responsibilities

E 6Oct2008 Additional formatting and added responsibilities for site DSCs

F 22Jun2009 Updated requirements for shredders and Top Secret Registers/Logs

G 13Aug2010 Added new requirements for SCGs based on higher authority, updated process for declassification of NNPI and made additional formatting changes

H 7Jun2011 Updated process for providing CUI to contractors, updated responsibilities for removable media, and added definition of “off station” handling of classified information

I 28Jul2016 Added NAVSEA requirement to conduct, account and inventory secret material on an annual basis, and updated requirements for filling out and maintaining SF700s

J 10Feb2020 Updated Derivative Classifier Training Information. Update Defense

Security Service with new name Defense Counterintelligence and

Security Agency. Updated ACCM and NNPI information. Added

Information Security Program Manager role and responsibilities.

Formatting changes of instruction and manual.

J CH-1 10Feb2020 Update Defense Security Service with new name Defense

Counterintelligence and Security Agency. Updated IT marking responsibility to make clear of all IT items need to be marked with proper markings determining its classification. Corrected revision history to show correct revision that have been archived.

J CH-2 27Jan2022 Updating CUI policy guidance. Updating responsibilities of Classified

Meeting Coordinator Checklist. Updating Security Accountability instruction in Chapter 11. DD Form 1907 reflected in the language of the instruction.

i

TABLE OF CONTENTS

CHAPTER 1 INTRODUCTION TO THE INFORMATION SECURITY PROGRAM 1-1

1. Purpose 1-1

2. Scope 1-1

3. Responsibilities 1-1

CHAPTER 2 INFORMATION SECURITY PROGRAM MANAGEMENT 2-1

1. Purpose 2-1

2. Scope 2-1

3. Responsibilities 2-1

Exhibit 2A Division / Detachment Security Coordinator Designation Letter Template 2-6

Exhibit 2B Certification Of Classified Use Copy Machines 2-8

Exhibit 2C Certification Of Classified Material Destruction Device Instructions 2-9

Exhibit 2D Certification Of Classified Material Destruction Device 2-11

Exhibit 2D Security Assist Visits 2-12

CHAPTER 3 SECURITY EDUCATION 3-1

1. Purpose 3-1

2. Scope 3-1

3. Responsibilities 3-1

4. Additional Information Security Education 3-1

CHAPTER 4 CLASSIFICATION MANAGEMENT 4-1

1. Purpose 4-1

2. Scope 4-1

3. Responsibilities/Action 4-1

4. General Derivative Classification Information and Guidance 4-1

5. 25-Year Classification Rule Exemption Codes. 4-2

CHAPTER 5 SECURITY CLASSIFICATION GUIDES 5-1

1. Purpose 5-1

2. Scope 5-1

3. Responsibilities 5-1

Exhibit 5A Security Classification Guide Standard Format (Sample) 5-2

CHAPTER 6 MARKING INFORMATION 6-1

1. Purpose 6-1

2. Scope 6-1

3. Responsibilities 6-1

4. General Marking Guidance 6-1

5. Cover and Page Markings 6-2

6. Portion Markings 6-2 ii

7. Classified By, Derived From, Downgrade To, And Declassify On Markings 6-3

8. Classification By Compilation 6-4

9. Correspondence and Letters of Transmittal 6-5

10. Marking Electronically Transmitted Classified Messages 6-7

11. Marking Documents Containing NATO and Foreign Government Information. 6-7

12. Marking Removable Information Technology (IT) Storage Media, IT Systems, and

Classified Documents Produced by IT Systems 6-9

13. Marking on Special Types of Material 6-10

14. Warning Notices and Associated Markings 6-13

15. Intelligence Control Markings 6-16

16. Remarking Upgraded, Downgraded, or Declassified Documents. 6-16

17. Marking Documents Releasable to Foreign Nationals 6-17

Exhibit 6A Examples Of Derivative Classification Markings 6-20

CHAPTER 7 SAFEGUARDING INFORMATION 7-1

1. Purpose 7-1

2. Scope 7-1

3. Responsibilities 7-1

4. Classified Custodian Guidance 7-4

5. Secret Document Control 7-8

6. Special Types of Classified and CUI 7-8

7. In-House Classified Meeting Process 7-9

8. External Classified Meeting Process (Co-sponsored, Non-Government, Multiple DoD

Activities, Foreign Attendance, or By Invitation) 7-9

Exhibit 7A Sample Security Container Information Sheet (SF700) 7-13

Exhibit 7B Sample Security Activity Checklist (SF 701) 7-14

Exhibit 7C Sample Security Container Check Sheet (SF 702) 7-15

Exhibit 7C Sending and Receiving Secret Information Process Flow: Incoming Secret – U.S.

Mail 7-16

Exhibit 7D In-House Classified Meeting Coordinator Checklist Form 7-18

CHAPTER 8 DISSEMINATION OF CLASSIFIED INFORMATION AND CUI 8-1

1. Purpose 8-1

2. Scope 8-1

3. Responsibilities 8-1

4. Basic Policy 8-2

5. Dissemination of Technical Documents 8-3

6. Prepublication Review 8-5

Exhibit 8A Notice To Accompany The Dissemination of Export Controlled Technical Data

8-6

Exhibit 8B Distribution Statements and their Corresponding Reasons For Use 8-7

Exhibit 8C Categories of Information Which Require Review and Clearance by the DOD

Office of Security Review Prior to Public Release 8-8 ii

CHAPTER 9 TRANSMISSION & TRANSPORTATION OF CLASSIFIED

INFORMATION/MATERIAL 9-1

1. Purpose 9-1

2. Scope 9-1

3. Responsibilities 9-1

4. Policy for Transmission and Transportation of Classified Information and CUI 9-1

5. Preparing, Addressing, and Receipting for Classified Information Shipments 9-5

6. Escorting or Handcarrying Classified Information 9-7

7. General Provisions for Escorting or Handcarrying Classified Information 9-8

8. Authorization to Escort or Handcarry Classified Information 9-9

9. Requesting a Courier Authorization Card (DD2501) 9-9

10. SOCAL and PACDET Division Heads 9-9

11. Nanoose Range Operations Section Head 9-10

12. Courier Responsibilities. 9-10

Exhibit 9A Information Security Protection Matrix 9-12

Exhibit 9B Authority and Documentation Required For Handcarrying Classified Information

9-13

CHAPTER 10 STORAGE AND DESTRUCTION OF CLASSIFIED AND CUI AND

MATERIAL 10-1

1. Purpose 10-1

2. Scope 10-1

3. Responsibilities 10-1

4. Storage Guidance for Classified Information and CUI and Material 10-3

5. Destruction Guidance for Classified Information and CUI 10-6

Exhibit 10A Desktop Guide for the Destruction of Classified Information and Controlled

Unclassified Information (CUI) 10-9

Exhibit 10B Paper Recycle Bag Station Warning Sign 10-10

CHAPTER 11 LOSS OR COMPROMISE OF CLASSIFIED INFORMATION 11-1

1. Purpose 11-1

2. Scope 11-1

3. Responsibilities 11-1

CHAPTER 12 MEDIA TRANSFER AGENT 12-1

1. Purpose 12-1

2. Scope 12-1

3. Responsibilities 12-1

APPENDIXES

APPENDIX A DEFINITIONS A-1

APPENDIX B INFORMATION SECURITY PROGRAM FORMS B-1

APPENDIX C REFERENCES C-1

1-1

CHAPTER 1 INTRODUCTION TO THE INFORMATION SECURITY PROGRAM

1. Purpose. To provide basic guidance for Information Security Program (ISP) functions, procedures, and responsibilities applicable to NUWC Division, Keyport personnel.

2. Scope. This directive encompasses all National Security Information (NSI) classified under

E.O. 13526 (as amended), predecessor orders, and special types of classified and CUI.

3. Responsibilities.

a. All Personnel (military, civil service, contractors, tenants, and visitors) will:

(1) Accomplish the initial, recurring, and job specific security training as stipulated at the

NUWC Division, Keyport Security training requirements website.

(2) Comply with ISP policies and measures as set forth in this manual, command email announcements, and the verbal/written guidance provided by supervisors, the NUWC Division, Keyport’s Security Officer/Security Manager and other appropriate authorities.

(3) Report ISP security violations including loss, compromise, or possible compromise of protected information to the NUWC Division, Keyport Duty Office (396-2244).

b. Supervisors will:

(1) Identify position sensitivity and determine which personnel under their authority have a need-to-know and require access to classified material.

(2) Incorporate ISP processes into standard practices while ensuring their personnel know and comply with classified and CUI handling procedures. If a requirement cannot be met, a

Waiver and Exception request must be submitted to the Security Manager.

c. Department/Division Heads (DH) and Detachment OIC will implement all aspects of security in the facilities/spaces assigned to the programs and projects under their cognizance.

Specifically they will:

(1) Identify clearance requirements for personnel working on their programs, and define disclosure constraints.

(2) Ensure personnel receive required security training as posted at the NUWC Division, Keyport’s security training requirements website while coordinating with Security to ensure all requirements are met.

(3) Appoint Division/Site Security Coordinators to facilitate implementation of security requirements.

d. The Security Manager promulgates local ISP guidance, provides ISP oversight, and ensures compliance with Command and higher authority policy.

1-2

e. The Information Security Program Manager will:

(1) Serves as ISP process owner.

(2) Develops local ISP procedures, and assists personnel with implementation.

(3) Implements and monitors the ISP on behalf of the Commanding Officer.

(4) Processes ISP security violations, reviewing and routing violation reports to the work center supervisor and Division or Department Head for response and corrective action.

2-1

CHAPTER 2 INFORMATION SECURITY PROGRAM MANAGEMENT

1. Purpose. To identify Information Security Program (ISP) requirements, assign responsibilities and provide guidance for: security processes, security servicing agreements, inspections, program reviews, and information security emergency planning.

2. Scope. This chapter governs the actions and responsibilities for implementation of the

Navy’s ISP at NUWC Division, Keyport.

a. The Commanding Officer has ultimate responsibility for management of the ISP within the command. The Commanding Officer assigns personnel to key security positions (designated below with an asterisk*). The other positions identified below are designated in writing, by the cognizant Detachment, Department, or Division Head unless otherwise indicated.

b. The Security Officer/Security Manager is the ISP process owner. The Security

Officer/Security Manager provides oversight and support to the Information Security Program

Manager, who manages these programs on a day-to-day basis. The Security Officer/Security

Manager and security office staff conducts the following actions, but not limited to:

(1) Reviews Security Servicing Agreements (SSAs) prior to Command review/approval.

The following SSAs are currently active (copies are available upon request):

(a) Hawthorne Army Depot NUWC Division, Keyport Hawthorne Detachment

Agreement: The U.S. Army provides security to NUWC Division, Keyport’s Code 30 operations at Hawthorne, NV.

(b) Canadian Forces Maritime Range (CFMETR) Agreement: CFMETR provides security for the joint U.S./Canada range at Ranch Point, Nanoose, Canada.

(c) Navy Region Northwest (NRNW) NUWC Division, Keyport’s Undersea Warfare

Annex Bangor Security Agreement: NRNW provides perimeter and property security services.

(2) Coordinates with NRNW and Naval Base Kitsap (NBK) security managers regarding mutual interest information security issues.

(3) Reviews and approves security plans for large group visits (such as public or family invitation events, employee appreciation celebrations, symposiums or large conferences) to ensure information security integrity.

(4) Ensures that security clearance issues are recorded, continuously evaluated, and that access to classified information is limited to appropriately cleared personnel with a need-to-know.

(5) Reviews purchases of material deemed to be from an international vendor which goes against the approved vendor and purchasing list.

2-2

(6) Makes final determination regarding security relevant events not addressed in established procedures.

c. The Information Security Program Manager (ISPM)* is the advisor to Security Officer in matters pertaining to the classification, safeguarding, transmission, and destruction of classified information. The ISPM is responsible for daily management of the following:

(1) Develops and maintains Command ISP directives.

(2) Ensures personnel performing ISP duties are kept abreast of changes in policies and procedures.

(3) Formulates, coordinates, and conducts the Command’s Security Awareness and

Education Program.

(4) Ensures security violations are reported, recorded, and investigated. The ISPM ensures loss or compromise of classified information is immediately reported to the Naval

Criminal Investigative Service (NCIS).

(5) Maintains liaison with the Public Affairs Officer to ensure proposed press releases and information intended for public release are subjected to a security review.

(6) Coordinates with other command officials regarding security measures for the classification, safeguarding, transmission, and destruction of classified information.

(7) Develops security measures and procedures regarding visitors who require access to classified information. Ensures (via supervisory personnel) classified information is secured, and controlled areas sanitized when visitors not authorized access to the information are present.

(8) Ensures security clearance issues are recorded, continuously evaluated, and access to classified information is limited to appropriately cleared personnel with a need-to-know.

(9) Conducts or supports security inspections or assist visits to include local security reviews.

d. The Top Secret Control Officer (TSCO)* is responsible for the receipt, custody, accounting, and disposition of Top Secret material within the Command area of responsibility.

The TSCO reports directly to the Security Manager.

e. A Top Secret Control Assistant (TSCA)* may be designated in writing by the

Commanding Officer, if needed.

f. The Communications Security Material System (CMS) Custodian* manages

Communications Security (COMSEC) material, and oversees security measures for its protection. He/she provides the Security Manager with COMSEC advice.

2-3

g. Supervisors provide direct support to the Security Manager regarding personnel clearance and/or behavior issues. Ensuring employees and security support personnel (within their area of responsibility) receive adequate training to perform assigned security duties.

h. A Division Security Coordinator (DSC) must be designated in writing by each department or division using the appointment template.

(1) DSC duties encompass all aspects of all security programs. He or she reports directly to the Division Head and Security Manager for security matters. The DSC monitors security programs to ensure all security requirements are implemented and met. The DSC reports noncompliance issues to the area supervisor, Division Head, and Security Manager. Security responsibilities include, but are not limited to, the following:

(a) Ensuring supervisors have properly identified employee position sensitivity based on classified access requirements, and verifying clearance levels match need-to-know access.

(b) Ensuring personnel are briefed on their security responsibilities.

(c) Knowing location(s) of security classification guides, and ensuring security references applicable to the division’s or department’s operations are available to all personnel.

(d) Tracking and reporting the location of classified copiers and shredders/disintegrators within their purview to the Security Office.

(e) Ensuring required security identifiers are affixed to classified copiers and shredders/disintegrators remain in place, and are not removed without Security Office’s concurrence.

(f) Ensuring combination changes and Security Container Check Sheet (SF702) are current. The Activity Security Checklist (SF701) is utilized, and completed daily in all work centers under their cognizance.

(g) Ensuring classified material handling procedures are in compliance with this manual and supporting directives.

(h) Conducting annual self-inspection of divisional information and personnel security program requirements. Submitting inspection results to the Security Manager upon completion within seven business days.

(i) Processing and returning Security Violation Notices within three business days of receipt. Actively participating in the Preliminary Inquiry (or formal investigation) process conducted by Security and/or the NCIS.

(j) Serving as divisional "classified contract point-of-contact" for the Security

Manager and/or inspection personnel. Maintains a current list identifying classified contracts/tasks, Contracting Officer name for each classified contract, and where contracted classified work/access is being performed.

2-4

(k) Maintaining and providing the Security Manager a current list of departmental or divisional building point(s) of contact to include building, name, code, and work telephone.

(This list is used by the Security Office and by Naval Base Kitsap alarm technicians to identify points-of-contact to discuss building security issues.)

(l) Providing the Security Office with information regarding changes in building function, work group reorganization, classification, access requirements, remodeling or construction plans, changes in occupancy, etc.

(m) Being prepared to execute DSC responsibilities for emergency destruction or transfer of classified information.

(n) Verifies separating employees have returned all keys, government property, and classified information in their custody.

(o) Directs employees to report to Security Building 74 to turn in badges, and complete a Security Termination Statement OPNAV Form 5511/14.

(2) A Division/Site Security Clerk is an optional collateral duty position. He or she may perform administrative functions under the direction of the DSC.

(3) Detachment Security Coordinators (DET SC) are designated at remote sites (Hawaii, San Diego, and Hawthorne). They have all the duties of DSCs identified above plus those listed below:

(a) Coordinating annual NCIS Counterintelligence (CI) training for site personnel with a SECRET or above clearance.

(b) Arranging area/country specific Foreign Travel Briefs for site personnel with official foreign travel orders employing one of the following methods:

1. DET SC conducts, but DET SC must be Anti-Terrorism (AT) Level II trained.

2. DET SC schedules with an individual at the site who is AT Level II trained.

3. DET SC schedules with another local area command’s AT Officer (ATO) or equivalent that has completed the AT Level II training requirement.

4. DET SC schedules with a local NCIS agent.

i. The Naval Warfare Library (NWL) Custodian is responsible for the management of the command’s NWL. He/she works directly with the Security Manager to complete Preliminary

Inquiry and Judge Advocate General Manual investigations when loss or compromise is known or suspected. He/she provides input to the Command Emergency Action Plan.

j. The Comptroller Department coordinates all Security Servicing Agreements (SSAs), both host and tenant, with the Security Manager before implementation.

2-5

k. The NUWC Division, Keyport’s Security Office and/or higher echelons conduct inspections, assist visits, and reviews. DET SCs coordinate site evaluations at their locations.

l. The Emergency Management Officer (EMO) maintains the Command Emergency

Management Plan. Emergency Action Plans (EAPs) for individual work centers direct securing of classified information during emergency evacuations, when it can be done with minimal risk to personnel safety. The EMO, IAM, and SM plan and execute measures for the protection of classified information in the event of a major catastrophe, natural disaster, or civil unrest as set forth in Emergency Action Plan. Remote sites (Hawaii, San Diego, and Hawthorne) establish and maintain emergency protection plans for classified information.

2-6

Exhibit 2A Division / Detachment Security Coordinator Designation Letter Template

SSIC

Code/ Serial #

Date

From: Division Head

To: DSC

Subj: APPOINTMENT AS DIVISION (or DETACHMENT) SECURITY COORDINATOR

Ref: (a) NUWCDIVKPT 5510, Information and Personnel Security Programs

(b) NUWCDIVKPT 5530, Physical Security and Force Protection Program

(c) KPT 5510.1, Information Security Program Manual, Chapter 2

1. You are hereby appointed Division / Detachment Security Coordinator (DSC) or (DET SC) for Code (XX) or Detachment. You are to familiarize yourself with references (a) and (b) and implementing directives. Also view the DSC training presentation at the Code 101 Workforce

Development System Website. Specific DSC or DET SC responsibilities are contained in reference (c), Chapter 2. Code 105 Program Managers located within Building 74 are available to support you as required in the execution of your DSC responsibilities.

2. DSC or DET SC duties encompass all aspects of all security programs. The DSC or DET SC reports directly to the Division Head or Detachment OIC and the Security Manager regarding security matters. You are responsible for monitoring the security program within your Division or Detachment to ensure all security requirements are implemented. Report areas found not in compliance to the area supervisor, the Division Head or Detachment, and the Security Manager.

Familiarity with the specific DSC or DET SC responsibilities listed in reference (c) is critical.

Responsibilities include but are not limited to:

a. Ensuring our personnel are thoroughly briefed on security responsibilities.

b. Ensuring security references applicable to division operations are available.

c. Knowing the location of security classification guides and classified use fax machines.

d. Ensuring security containers are inspected by Security prior to being put into service and combination changes are current and on file with the Security Office (SF700).

e. Ensuring Security Container Check Sheets (SF 702) and Activity Security Checklists (SF

701) are current/completed daily.

f. Verifying classified use copiers and shredders have been inspected/placarded by the

Security Office. Tracking and reporting locations of classified use copiers and shredders to the

Security Office on a monthly basis utilizing copier and shredder monthly report.

2-7

g. Coordinating the processing/returning of Security Violation Notices issued by the

Security Office. Actively participating in Preliminary Inquiries and any follow-on formal investigations.

h. Providing the Security Manager with an up-to-date list of division building points-of-contact (includes building number, name, code, work telephone).

i. Verifying that separating employee actions are completed.

Division Head or Detachment OIC Name/Signature

I acknowledge my appointment as Division or Detachment Security Coordinator.

Appointee Name/Signature

Copy to:

(Department Head) or (Detachment OIC)

Security Manager

Note: This is just an example. The verbiage within the letter can be adjusted to be per Command or Detachment administrative guidelines.

2-8

Exhibit 2B Certification of Classified Use Copy Machines

Using the copy machine’s user machine, specifications brochure, or company website, determine whether or not the machine can be certified for classified reproduction as follows (contact the leasing agency’s technical representative if need be):

1. Verify one of the following:

a. The machine does not have a hard drive and that all memory is volatile memory (i.e.

information in memory is lost when power is disconnected) or;

b. The machine has a hard drive but will be kept in a Security Office certified secure room.

The following statement must be added on the authorization placard or affixed as an additional placard:

“This copier must remain in a certified secure room at all times. Commercial copier service personnel must be escorted and may not access the hard drive. Cleared government personnel must remove, label, and ensure the HD is destroyed as classified material when the machine is taken out of classified service.”

2. Verify that the machine does not have wireless/infrared capabilities.

3. Verify the machine is not connected to a local area network (LAN) or any other device, e.g.

telephone/fax line. (Any interconnectivity, at any time, is prohibited.)

If all the above criteria is met, the machine may be certified and placarded using form NUWC

Keyport 5510/01-4, Classified Reproduction Authorization (request electronic file from the

Security Office, (360) 396-2589).

Complete the below data table:

Manufacturer:

Model Number: Manufacturer’s Serial Number:

Code the Copier is Assigned to:

Code Point-of-Contact (Name/Tel.#) Copier Location (Bldg & Floor or Room #)

Highest Classification Level Reproduced: Name of Certifying Security Coordinator: Date of Certification:

Signature of Certifying Detachment Security Coordinator: _____________________

PDF/email or fax this checklist to the NUWCDIVKPT Security Office. Email kypt_wa_internal security or Fax (Attn: ISP Specialist): (360) 396-7839

2-9

Exhibit 2C Certification of Classified Material Destruction Device Instructions

1. Purpose. The purpose of the Certification of Classified Material Destruction Devices certificate is to capture the destruction device information from the specific National Security

Agency/Central Security Service (NSA/CSS) Evaluated Products Lists (EPL), to include the date of the NSA/CSS EPL. This ensures the command is (1) compliant with the DoDM 5200.01, Volume 3, Enclosure 3 at Section 17d destruction device lifecycle management requirement; and

(2) synchronizing information security program costs via the plan of action and milestones which feeds into the Security Manager’s program objective memorandum for the replacement cost of destruction devices.

2. General.

a. The current approved NSA/CSS EPL for Paper Only, Punched Tape, Optical Media, Degaussers (Magnetic Media Sanitization), Storage Devices, High Security Disintegrators, and

Solid State Storage devices are available at the NSA/CSS website: https://www.nsa.gov/ resources/everyone/media-destruction/.

b. DO NOT place an SF-706, Top Secret Label; SF-707, Secret Label; SF-708, Confidential

Label; SF-709, Classified Label; SF-710, Unclassified Label; or an SF-712, Classified SCI Label on any destruction device as all NSA/CSS EPL listed destruction devices are authorized to destroy ALL classification and compartmented level information. These labels are for storage devices only (e.g., CDs, diskettes, computers, etc.) to clearly identify the classification level of the information located in or on that property.

3. Instructions. The following instructions are provided to assist the certification official in completing the Certification of Classified Material Destruction Devices certificate:

a. Block 1: NSA/CSS EPL. Insert the complete title of the EPL as it appears at the top of page 1 of the NSA/CSS EPL.

b. Block 2: Date of NSA/CSS EPL. Insert the date of the EPL as it appears at the top of page 1 of the NSA/CSS EPL.

c. Block 3: Re-evaluated Date. To compute the re-evaluation date, do the following: Per

DoDM 5200.01, Volume 3, Enclosure 3 at Section 17d(2), compute a date six years from the date of the EPL date. Example: If the EPL date is 18 May 2015, the sum of adding six years to

18 May 2015 is 18 May 2021 (the re-evaluation date). This would be the date that appears at

Block 3.

d. Block 4: Device Information. The following information is required:

(1) Block 4a: Device Name. The device name to be recorded here must match the

“Device Name” of the EPL. If the device name appears on the device itself, it too should also match the EPL.

(2) Block 4b: Model. The model/model number to be recorded here must match the EPL.

If the model number appears on the device itself, it too should also match the EPL.

2-10

(3) Block 4c: Serial Number. The serial number is unique to the device received.

Record the device serial number as it appears here. The serial number recorded here must match the device serial number.

(4) Block 4d: Sponsor/Manufacturer. The “Sponsor” or manufacturer name to be recorded here must match the EPL.

(5) Block 4e: Additional remarks. Include any additional command-specific requirements, limitations, or notes here.

e. Block 5: Custodian / Location of Destruction Device

(1) Block 5a: Department/Office/Code: Self-explanatory.

(2) Block 5b: Location

(a) Block 5b (1): Base/Facility: Record here the name of the Base/Facility, City, and

State.

(b) Block 5b (2): Building: Self-explanatory.

(c) Block 5b (3): Floor: Self-explanatory.

(d) Block 5b (4): Room: Self-explanatory.

f. Block 6: Certification Statement. The certification statement at Block 6 is a standard statement.

g. Certifying Official’s Signature and Date of the Certificate

(1) Certifying Official’s Signature. The individual (certifying official) signing this document must be authorized to do so by the commanding officer; furthermore, the signatory billet must appear on the certificate below the printed name. The authority to sign official documents will be included in the delegation of authority letter, normally for security matters or as further defined by the commanding officer. Typically, this authority will rest with either the command security manager or the command information security specialist.

(2) Date of the Document. The document will be dated the day it is signed by the certifying official, per paragraph 7-2.3a(3) of SECNAV M-5216.5.

2-11

Exhibit 2D Certification of Classified Material Destruction Device

[DD Mmm YY]

From: [Certifying Official’s Title, Activity]

Subj: CERTIFICATION OF CLASSIFIED MATERIAL DESTRUCTION DEVICE

1. The device identified below and for the location specified, is authorized for destruction of classified national security. Any change to this device, its operating status (i.e., requires maintenance), or its location, will require a new certification letter. Pen changes to this form are not authorized.

2. Device Information

a. Device Name:

b. Model:

c. Serial Number:

d. Sponsor/Manufacturer:

e. Additional remarks:

3. NSA/CSS EPL:

4. Date of NSA/CSS EPL:

5. Custodian/Location of Destruction Device

a. Department/Office/Code:

b. Location

(1) Base/Facility:

(2) Building:

(3) Floor:

(4) Room:

6. Re-evaluated Date:

[CERTIFYING OFFICIAL’S NAME]

2-12

Exhibit 2D Security Assist Visits

1. Purpose. Security Assist Visits (SAVs) are conducted to evaluate NUWC Division, Keyport buildings, work areas, and procedures to ensure compliance with security policies and regulations. Minimizing associated compliance costs and impact on work processes are important secondary issues. Department or Division Heads are provided a written report of site visit conclusions and recommendations.

2. Process.

a. The SAV process starts when the following occur:

(1) A departmental or divisional representative contacts the Security Office, and requests site or process evaluation

(2) The Security Officer identifies a need for a site visit or process evaluation.

Appropriate security specialists are assembled and a SAV is scheduled. The SAV team provides a written report of findings and recommendations. All required actions cited are supported by regulations or policies. Work area training, as needed, is provided to ensure adherence to correct procedures. The process ends when the requestor has reported correction of discrepancies or to the Security Officer.

b. As a matter of routine, a SAV is conducted on at least one Department or Site each year.

Written findings for each SAV are provided to the Department Head. Any major problems found are also reported to Command. Departments are responsible to develop and execute a

POA&M for correction of the discrepancies noted during a SAV.

a. The Security Officer approves SAV requests, appoints a SAV Coordinator, and schedules annual SAVs.

(1) The Security Officer reviews and approves all SAV findings and recommendations prior to distribution.

b. Security Specialist(s) perform site/process evaluations and inspections.

(1) Security Specialists make recommendations based on each specialist’s area of expertise.

c. The SAV Coordinator for a given SAV serves as the central point-of-contact between

SAV team members, the work area point(s)-of-contact, Division Security Coordinator, and management. He/she will do the following:

(1) Schedules SAV activities (request site-visits, process evaluations, meetings) as needed based on project, program, area, or work effort.

2-13

(2) Submits recommendations in the form of a draft SAV memorandum.

(3) Monitors status of pending actions through implementation.

(4) Maintains current building or site file records with SAV records.

d. Departmental management will provide the resources (time, personnel, funding, documents or material) necessary to respond to SAV evaluation, inspection, or recommendations.

e. SAV team involvement is initiated by notifying the Security Office of all:

(1) New construction and/or remodeling from initial planning through all construction phases. Provide blueprints, drawings, and other documentation related to all construction projects as early in the design process as possible. (Conceptual drawings should include measurements, wall rating, mixture, and as much detailed information as is known.)

(2) New or realignment of functions, processes, programs, or special projects.

(3) Advance information regarding moves, reorganization, and change in points of contact for scheduling inspections or site-visits.

(4) Requests for modification, installation, or removal of any security related features or requirements (card readers or intrusion detection systems).

f. Contracting Officer’s Representatives (CORs) serve as liaison between contractors and

Security Office concerning requests for SAV evaluation of task functions, areas, or procedures.

The CORs are encouraged to participate in SAV inspections.

g. SAVs are conducted at NUWC Division, Keyport buildings, sites, and/or work areas on a random basis. Security violation notices are sent to the cognizant department or division for any significant violations found.

3-1

CHAPTER 3 SECURITY EDUCATION

1. Purpose. To ensure all NUWC Division, Keyport personnel understand the need and procedures for protecting classified information. The goal is to develop fundamental security habits as a natural element of every process within the work environment.

2. Scope. This chapter applies to all NUWC Division, Keyport personnel with access to classified information or material.

a. The CNO (N09N), via reference (b), Chapter 4, provides detailed policy guidance, education requirements, and support for the Department of the Navy (DoN) Security Education

Program.

b. All NUWC Division, Keyport personnel are responsible for compliance with the core

DoN Security Education Program.

4. Additional Information Security Education.

a. In addition to the core security education requirements, specialized security training is required for the following:

(1) Original Classification Authorities (OCAs) and officials acting in their absence.

OCAs

(2) Derivative classifiers, security managers, security specialists, or any other personnel whose duties significantly involve the management and oversight of classified information.

(a) Derivative classifiers must be familiar with Chapter 4 of this manual. Completion of the following training course is required:

1. Total Workforce Management System (TWMS) NAVSEA Web-based

Training for Derivative Classifiers (TWMS-571920).

(b) The Security Manager and Security Specialists receive initial and continuing security training in support of the responsibilities documented in their position descriptions. The

Security Officer will identify and manage necessary training for the security staff.

(c) DSC are required to review the DSC training presentation within the Workforce

Development System website under Security Training.

(3) CUI is subject to numerous handling and control policies. The DoD CUI Training at the TWMS website under DoD Mandatory Controlled Unclassified Information CUI Training

(TWMS-686564). Security Training is mandatory training for all employees who handle CUI annually.

4-1

CHAPTER 4 CLASSIFICATION MANAGEMENT

1. Purpose. Provide guidance for derivative classification. Classification levels, classification authority (original and derivative), duration of classification, classification challenges, tentative classification, declassification reviews, and foreign government information are discussed in this chapter.

2. Scope. Executive Order 13526, Classified National Security Information, is the only basis for classifying national security information. This chapter governs derivative classification by

NUWC Division, Keyport personnel. All classified material we generate is derivatively classified.

3. Responsibilities / Action.

a. The Derivative Classifier is accountable for the accuracy of the classification assigned, and for placement of the proper markings on the document(s) or material. The Derivative

Classifier:

(1) Observes and respects original classification determinations made by OCAs, and as codified in classified source documents and security classification guides.

(2) Uses caution when paraphrasing or restating information extracted from a classified source document(s) to determine whether the classification may have been changed in the process.

(3) Carries forward the pertinent classification markings to any newly created information, and reviews or implements current CNO guidance for conversion of “derived from” and “declassify on” markings.

(4) Stands accountable for the accuracy of their classification decisions, and for applying proper classification markings.

Note: Officials with signature authority are also responsible for these decisions when exercising command signature authority.

b. The Contracting Officer’s Representative (COR) within a department provides derivative classification guidance to the contractor via the Contract Security Classification Specification

(DD254). This is done by listing the actual security classification guides required for contract performance.

c. The Security Manager (SM) provides assistance in all areas of classification management. The SM approves derivative classification decisions or initiates classification and declassification review requests to the OCA (via NAVSEA) when local challenges cannot be resolved.

4. General Derivative Classification Information and Guidance.

4-2

a. OCAs communicate classification decisions (and notification of classification changes) through security classification guides, notices, or letters to designate information as Top Secret, Secret, or Confidential.

b. 25-Year Classification Rule. The OCA attempts to establish a specific date or event for declassification based on E.O. 13526 not exceeding 25 years from the date of classification.

c. Exemption from 25-Year Classification Rule. The OCA may exempt certain information from the 25-year maximum duration of classification rule provided it falls into one of nine exemption categories explained in paragraph 5 below.

d. Security Classification Guides (SCGs) provide classification and declassification guidance, public release restrictions, and warning notice(s) for each system, plan, program, or project involving classified information. SCGs are intended to ensure proper and uniform derivative classification.

e. Letters or Notices from OCAs may be used to communicate new or revised guidance pending incorporation in SCGs.

f. Classified source document(s) used in the generation of a new document provide authority for classifying the new document. Classified markings are transferred from the reference document to the new document. Multiple sources have additional reference requirements.

g. Classification challenges are best resolved with the Program Manager or supervisor for the information in question. If the conflict is not resolved after consultation with local technical experts or if a formal challenge to the classification is desired, the Security Manager will be asked to initiate a classification review.

h. Tentative classification markings are used when there is a question about the appropriate level of classification. Tentatively mark the information with the classification considered appropriate and safeguard accordingly, pending a decision from the OCA in response to the classification review request.

i. Foreign Government Information (FGI) classified by a foreign government or international organization retains its original classification level or is assigned a U. S.

classification equivalent. FGI must not be declassified unless specified or agreed to by the foreign government.

5. 25-Year Classification Rule Exemption Codes. OCAs may exempt certain information from the 25-year maximum duration of classification rule mandated by Executive Order 13526, as amended, when originally classifying information expected to reveal the identity of a confidential source or human intelligence source, or when originally classifying information which is the subject of an Information Security Classification Appeals Panel (ISCAP) approved exemption. The nine exemption categories include the following:

4-3

a. Reveal the identity of a confidential human source, or reveal information about the application of a human intelligence source when the unauthorized disclosure of that source would clearly and demonstrably damage the national security interests of the U.S. (mark as

25X1).

b. Reveal information that would assist in the development or use of weapons of mass destruction (mark as 25X2).

c. Reveal information impairing U.S. cryptologic systems or activities (mark as 25X3).

d. Reveal information impairing application of state of the art technology within a U.S.

weapon system (mark as 25X4).

e. Reveal actual U.S. military war plans still in effect (mark as 25X5).

f. Reveal information seriously and demonstrably impairing relations between the U. S. and a foreign government, or seriously undermine diplomatic activities of the U.S. (mark as 25X6).

g. Reveal information clearly and demonstrably impairing the current ability of U. S.

Government officials to protect the President, Vice President, and other officials for whom protective services, in the interest of national security, are authorized (mark as 25X7).

h. Reveal information seriously and demonstrably impairing current national security emergency preparedness plans or reveal current vulnerabilities of systems, installations, infrastructures, or projects relating to the national security (mark as 25X8).

i. Violate a statute, treaty, or international agreement (mark as 25X9).

5-1

CHAPTER 5 SECURITY CLASSIFICATION GUIDES

1. Purpose. To provide information and guidance for the use of Security Classification Guides

(SCGs)

2. Scope. This chapter governs the actions and responsibilities of NUWC Division, Keyport personnel who use SCGs to derivatively classify and mark information or material.

a. The CNO identifies current and cancelled SCGs. These directives are listed on the directives website https://www.dtic.mil/.

b. An Original Classification Authority (OCA) approves SCGs for each DoN system, plan, program, or project under his/her cognizance. OCAs submit these guides and revisions, when required, to the CNO for inclusion in the SCG listings. OCAs are tasked to review their SCGs at least every 5 years for accuracy and completeness. OCAs are typically flag rank individuals.

The SCGs are prepared for their review and/or signature by the various DON program offices.

c. CUI will be identified in SCGs to ensure such information receives appropriate protection. If the SCG is canceled, a memorandum or other guidance document may be issued to identify CUI instead.

d. DoN Program offices are responsible for drafting and updating SCGs for their assigned programs. Program Managers provide Derivative Classifiers technical guidance regarding SCG interpretation as it applies to a specific program, project, plan, or system. Each SCG includes the following identifying data:

(1) OC: The code of the command subject matter experts responsible for day-to-day interpretations of the SCG. This may be more than one code.

(2) CA: The designation of the OCA who is responsible for, and has approved the classification determinations. This may be more than one OCA.

(3) CD: The date the guidance was last validated by a review or changed by the OCA

(entered by the CNO (N09N2).

4. Derivative Classifiers will:

a. Use the SCGs as authority for classifying, downgrading, upgrading, or declassifying

DON information.

b. Know where SCGs are stored in the work area and who controls the SCGs. Exhibit 5A addresses the standard SCG format, and provides guidance on how to use them.

5. The SM or IPSM provides guidance and assistance regarding use of SCGs, classification management, and proper document/material marking, as appropriate.

5-2

Exhibit 5A Security Classification Guide Standard Format (Sample)

1. The standard format for Security Classification Guides (SCG) includes the 10 paragraphs listed…