RAPIID_TA3_Attachment_G_RAPIID_CUI_Guide.pdf

UNCLASSIFIED

Distribution Statement A. Approved for public release: distribution is unlimited.

Controlled Unclassified Information Guide

Program: Resuscitation and Prevention of Ischemia- Induced Dysfunction

RAPIID

Program Manager: LCDR Robert Murray Program Security Officer: John Slawinski

Date: 05/01/2026 Version: 1

PM LCDR Robert Murray PSO John Slawinski BTO Program Manager BTO Program Security Officer

Local reproduction of this document is authorized only in its entirety.

ii

UNCLASSIFIED

Distribution Statement A. Approved for public release: distribution is unlimited.

FOREWORD

1. DESCRIPTION

2. AUTHORITY

3. DISTRIBUTION

GENERAL

1. PURPOSE

2. APPLICABILITY AND SCOPE

3. OFFICE OF PRIMARY RESPONSIBILITY

4. CONTROLLED UNCLASSIFIED INFORMATION (CUI) CHALLENGES

5. CUI CATEGORIES

6. EXPORT CONTROL RESTRICTED INFORMATION

7. FREEDOM OF INFORMATION ACT (FOIA) EXEMPT INFORMATION

8. DISCLOSURE OF CUI

9. CUI PROTECTION REQUIREMENTS

10. NOTIFICATION OF UNAUTHORIZED DISCLOSURE

11. INFORMATION PROTECTION GUIDANCE CHARTS

12. DEFINITIONS

iii

UNCLASSIFIED

Distribution Statement A. Approved for public release: distribution is unlimited.

FOREWORD

1. DESCRIPTION

(U) The Resuscitation and Prevention of Ischemia-Induced Dysfunction (RAPIID) program aims to deliver a far-forward, shelf-stable, scalable capability that is equivalent or superior to stored whole blood in early resuscitation, while removing dependence on cold chain and donor logistics. The RAPIID program will achieve this by focusing on SBCs in conjunction with ruggedized delivery formats, point-of-care (POC) diagnostics, and clinical practice guidelines (CPGs ).

2. AUTHORITY

CUI elements referenced in this guide are under the authority of Executive Order 13556, Controlled Unclassified Information, November 4, 2010 (as amended) and in accordance with DoDI 5200.48, “Controlled Unclassified Information,” March 6, 2020.

3. Distribution

Distribution Statement A. Approved for public release: distribution is unlimited.

UNCLASSIFIED

Distribution Statement A. Approved for public release: distribution is unlimited.

1. PURPOSE

a. The purpose of this CUI guide is to ensure the protection of RAPIID information IAW DoDI 5200.48. RAPIID information must be controlled and stored consistent with DFARS 252.204-7012 requirements as detailed in National Institute for Standards and Technology

(NIST) 800-171.

This guide is not for classified national security information as defined in Executive Order 13526, but identifies specific elements of sensitive information that are unclassified but require additional protections. This information is not classified national security information, but it is covered by the legislation at large for the Freedom of Information Act (FOIA) and the exemptions therein.

2. APPLICABILITY AND SCOPE: This guide applies information, material and processes generated by RAPIID. This guide is the basis for identifying, protecting and marking of information and material designated as a type of controlled unclassified information (CUI) associated with RAPIID. This guide is used in conjunction with related guidance (security classification guides, DoD Policy, etc.) associated with the overall effort of RAPIID. The scope of this guide is based on RAPIID as planned at the date of this guide and may change over the course of RAPIID.

3. OFFICE OF PRIMARY RESPONSIBILITY (OPR): This CUI guide is issued by DARPA.

All inquiries concerning content, interpretations, and clarification of this document should be addressed to DARPA at john.slawinski@darpa.mil with any questions.

4. CONTROLLED UNCLASSIFIED INFORMATION (CUI) CHALLENGES:

CUI Challenges: Authorized holders of CUI who, in good faith, believe that a designation of information as CUI within this guide is improper or incorrect, or who believe they have received unmarked CUI, should notify DARPA at michael.langerman@darpa.mil. Until the challenge is resolved, the challenged CUI, including challenges to unmarked CUI, will continue to be safeguarded and disseminated at the appropriate control level indicated in the markings or presumed category.

5. CUI Categories. The following CUI Categories are used to protect RAPIID.

a. Privacy: Personal Identifiable Information: Information referred to as Personally Identifiable Information (PII). PII embodies information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.

UNCLASSIFIED

Distribution Statement A. Approved for public release: distribution is unlimited.

1. General Privacy (PRVCY) - Refers to personal information, or, in some cases, "personally identifiable information," as defined in OMB M-17-12, or "means of identification" as defined in 18 USC 1028(d)(7).

2. Military Personnel Records (MIL) - Any member or former member of the armed forces or affiliated organization of the Department of Defense.

b. Provisional : Operations Security Information (OPSEC) - Unclassified information that could constitute an indicator of U.S. Government intentions, capabilities, operations, or activities or otherwise threaten/compromise operations security.

6. EXPORT CONTROL RESTRICTED INFORMATION: Each performer is responsible for assessing their technology and ensuring compliance with all export control laws and regulations. This CUI guide does not relieve any program participant from export control requirements.

7. FREEDOM OF INFORMATION ACT (FOIA) EXEMPT INFORMATION

a. The Freedom of Information Act (FOIA), 5 U.S.C. § 552, is a federal law that defines agency records subject to public disclosure, outlines mandatory disclosure procedures, and defines nine exemptions that prohibit certain types of information from being released to the public. In addition to the FOIA, the Code of Federal Regulations (October 2016), 45 CFR § 5.31 specifies the type of information that falls under each of the nine exemptions that preclude release of information to the public under the FOIA. In accordance with 5 U.S.C. § 552(a)(8), DARPA will withhold records or information exempt from disclosure under the FOIA whenever disclosure would harm an interest protected by a FOIA exemption or disclosure is prohibited by law. The most relevant exemptions for MBA are listed below; however other exemptions could apply:

1) Exemption (3) – Protects information exempted from release by statute.

2) Exemption (4) - Protects trade secrets and commercial or financial information which could harm the competitive posture or business interests of a company.

3) Exemption (6) – Privacy information

8. DISCLOSURE of CUI.

UNCLASSIFIED

Distribution Statement A. Approved for public release: distribution is unlimited.

a. Public Disclosure. Information from this CUI guide does not allow automatic public release of this information. DoD information requested by the media or members of the public or proposed for release to the public by DoD civilians or military personnel or their contractors will be processed in accordance with

DARPA Instruction 65 and DoD Instructions 5230.09, 5230.29; Volume 3 of DoD Manual 5200.01; and

DoD Manual 5400.07, as applicable. Proposed public disclosures of unclassified information shall be submitted using the public release form located at https://www.darpa.mil/work-with-us/contractmanagement/ public-release.

b. Freedom of Information Act (FOIA) Requests. All personnel with knowledge of this

Project must coordinate with the DARPA PSO prior to providing a response to requests for information under the provisions of the FOIA.

c. Proprietary Information (PROPIN). Additional safeguards may become necessary if a contract requires the transfer of PROPIN. The holder of the information must clearly identify any and all PROPIN prior to its disclosure and release, the release will be coordinated with the

PROPIN owner.

d. Foreign Disclosure. Disclosure of DARPA CUI to foreign nationals will be coordinated with the PSO, International Security, and International Cooperation. Disclosure approval must be granted by the Director, SID, who is the Foreign Disclosure Officer for

DARPA.

9. CUI PROTECTION REQUIREMENTS:

RAPIID CUI must be stored in accordance with DODI 5200.48. Processing of CUI is only authorized on systems compliant with DFARS 252.204-7012 as detailed in NIST 800-171.

10. NOTIFICATION OF UNAUTHORIZED DISCLOSURE

a. Personnel must immediately report all unauthorized disclosures or suspected and known security incidents, and suspicious activities involving CUI to the RAPIID PSO and PSR at john.slawinski@darpa.mil and randy.dixon.ctr@darpa.mil.

UNCLASSIFIED

Distribution Statement A. Approved for public release: distribution is unlimited.

b. Data breaches of Defense Industrial Base (DIB) networks and systems involving RAPIID CUI material must be reported IAW DFARS 252.204-7012 requirements. In addition, all breaches must be reported to the DARPA Project contracting officer and program security officer (PSO) upon discovery.

UNCLASSIFIED

Distribution Statement A. Approved for public release: distribution is unlimited.

11. INFORMATION PROTECTION GUIDANCE CHARTS

These charts are provided to assist in identifying what types of information associated with the RAPIID effort may be sensitive, provide guidance on the relevant markings for this information to control dissemination, and provide guidance on when these dissemination controls no longer apply. If at any time there are questions regarding which category of information something falls under, or what dissemination controls apply, individuals should request guidance from Randy Dixon, BTO PSR (randy.dixon.ctr@darpa.mil)

Table is Unclassified

Element of Information Index Category Reason LDC or Distribution Statement

Remarks

Physical blood samples

Privacy

Health Information

CUI//HLTH

And/Or

Military Personnel Records

CUI//MIL

Privacy Act of

FEDCON FOIA Exemption 6 If samples have been *de-identified the blood samples do not need to be treated as CUI.

*See section 12 for definition

Raw data and *pre-processed data from blood samples

*See section 12 for definition.

Health Information

CUI//HLTH

And/Or

Military Personnel Records

CUI//MIL

Privacy Act of

FEDCON FOIA Exemption 6 If samples have been *de-identified the data do not need to be treated as CUI.

*See section 12 for definition

Privacy

UNCLASSIFIED

Distribution Statement A. Approved for public release: distribution is unlimited.

Raw data and pre-processed data

Physical, physiological, and human performance phenotypic data

Privacy Health Information

CUI//HLTH

And/Or

Military Personnel Records

CUI//MIL

Privacy Act of

FEDCON FOIA Exemption 6

If samples have been de-identified the information is not considered CUI.

Personal Identifiable Information

Privacy Health Information

CUI//HLTH

And/Or

Military Personnel Records

CUI//MIL

Privacy Act of

FEDCON FOIA Exemption 6

12. INFORMATION PROTECTION GUIDANCE CHARTS

The following phrases and their definitions are listed here for the purposes of this program.

• De-identified samples o Samples that do not identify an individual and to which there is no reasonable basis to believe that the information can be used to identify an individual.

• Pre-processed data o Data from the intermediate step (i.e. QA/QC, data imputation, outlier detection, variable consolidation, dimensionality reduction) between generating raw data from a scientific instrument and fully analyzed data.

• Processed data o Data following the intermediate steps described above (i.e. QA/QC, data imputation, outlier detection, variable

UNCLASSIFIED

Distribution Statement A. Approved for public release: distribution is unlimited.

consolidation, dimensionality reduction) and initially connected to performance outcomes (i.e. used for feature engineering and down selection)