RFQATTACH.SPE4A618Q0482.0000.PDF

DEPARTMENT OF DEFENSE 1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION a. FACILITY CLEARANCE REQUIRED

CONFIDENTIAL

(The requirements of the DoD Industrial Security Manual apply to all aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

CONFIDENTIAL

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER a. ORIGINAL (Complete date in all cases) Date (YYYYMMDD)

b. SUBCONTRACT NUMBER b. REVISED (Supersedes all previous specs)

Revision No.

Date (YYYYMMDD)

c. SOLICITATION OR OTHER NUMBER Due Date (YYYYMMDD) c. FINAL (Complete Item 5 in all cases) Date (YYYYMMDD)

SPE4A6-18-Q-0482 20180116

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes complete the following

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes complete the following

In response to the Contractor's request dated , retention of the identified classified material is authorized for the period of .

6. CONTRACTOR (Include Commercial and Government Entity ( CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICES ( Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

CABLE ASSEMBLY, RADIO FREQUENCY

NSN 5995-01-467-4305

CAGE 68999

P/N AE12745-2

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC)

INFORMATION

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA: d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented Information (SCI) f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION i. HAVE A TEMPEST REQUIREMENT

h. FOREIGN GOVERNMENT INFORMATION j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. LIMITED DISSEMINATION INFORMATION k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION l. OTHER (Specify)

k. OTHER Specify)

Restrict Access to Contractor’s Unclassified

Automated Information System (AIS).

DD Form 254, DEC 1999 Previous editions are obsolete

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public release shall be submitted for approval prior to release

Direct

Through (Specify):

Defense Logistics Agency/Aviation.

Route Public Release request through COR.

to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the Contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein.

Add additional pages as needed to provide complete guidance.

Per the DD Form 441, Department of Defense Security Agreement, Section VI, signed by the United States

Government through the Defense Security Service and the Contractor, the government is not obligated to provide funds and shall not be liable for any security costs or claims of the Contractor arising out of the DD Form 441

Agreement, its instructions, or the requirements identified in the DoD 5220.22-M, National Industrial Security

Program Operating Manual (NISPOM), and its changes/revisions.

The Contractor is required to flow-down all applicable requirements of the DD Form 254 to its Subcontractor(s).

Direct all questions pertaining to the DD Form 254 to the DLA PLFA Industrial Security Manager (PISM) office by phone at 804-279-1680 or by email at Stephen.Robinson@dla.mil.

DLA PISM:

Stephen Robinson

Industrial Security Manager

DLA Aviation Richmond

See Continuation Pages

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes No

See Reference Items 10j, 11c, 11j, and 11l.

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.

Yes No

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

JEANNE PLASSMANN

b. TITLE

CONTRACTING OFFICER

c. TELEPHONE (Include Area Code)

804-279-5220

d. ADDRESS (Include ZIP Code) 17. REQUIRED DISTRIBUTION

Defense Supply Center Richmond/FAKA

a. CONTRACTOR

8000 Jefferson Davis Hwy

b. SUBCONTRACTOR

Richmond, VA 23297-5100

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY DLA DI Industrial Security

DSCC-VTC-Class

DD Form 254 Reverse, DEC 1999

Block 13 Continuation Pages for Solicitation #: SPE4A6-18-Q-0482

SECURITY GUIDANCE (BLOCK 13) CONTINUATION PAGES

FOR SOLICITATION #: SPE4A6-18-Q-0482

Reporting Requirements:

The Contractor shall provide the following to the DLA PLFA Industrial Security Manager

(PISM) (contact information listed in block 13 of page two of the DD Form 254):

Courtesy copy the DLA HQ Industrial Security Program Office on any security incident report (initial and final) involving the loss, compromise, or suspected compromise of classified information sent to the Defense Security Service. The Contractor shall provide a copy to the DLA within the same reporting timeframe as is required by the Defense Security

Service.

Courtesy copy the DLA HQ Industrial Security Program Office on any report involving a cyber-intrusion of DLA program information sent to the Federal Bureau of Investigation and the Defense Security Service per NISPOM Chapter 1, Section 301 and Industrial Security

Letter 2013-05.

Provide a copy of any Defense Security Service letter that indicates a less than satisfactory security rating and/or that negatively impacts the Facility Clearance Level (FCL) of the company within 48-hours of receipt.

Provide electronic copies of Subcontractor DD Form 254s issued by the Prime and the

Subcontractor. The Prime Contractor shall act as the focal point for collecting their

Subcontractor’s DD Form 254s and the Prime is responsible for forwarding these DD Form

254s to the DLA HQ Industrial Security Program Office.

DLA HQ Industrial Security Program Office:

Defense Logistics Agency

ATTN: DI / Industrial Security Program Manager

8725 John J. Kingman Road

Fort Belvoir, VA 22060-6221

Phone: (703) 767-4376

Email: erica.quinley@dla.mil

Subcontractor Classified Access Approvals:

The Prime Contractor and Subcontractor are authorized to flow access to and/or dissemination of classified information to the CONFIDENTIAL level to their Subcontractors. Dissemination is only authorized and applicable for information safeguarded at the Contractor’s facility. The

Contractor shall provide the appropriate accesses to its Subcontractors as required per NISPOM

5-502. The Prime Contractor and Subcontractor must verify Facility Clearance, Safeguarding

Capability and Access Authorizations prior to the dissemination of classified information.

This section concerns the release of classified information to the contractor regarding the government’s Request for Quotation. DLA classified information may only be released to the

Contractor for submission preparation purposes following verification of the Contractor’s facility clearance and safeguarding. The DD Form 254 shall act as security guidance for the safeguarding of program-related classified information at the Contractor facility. The Defense

Security Service maintains security cognizance of classified information stored at a Contractor facility. However, the following stipulations apply:

IAW NISPOM paragraphs 5-200 and 5-600, Contractors shall ensure full written accounting and control over all DLA classified information provided to the

Contractor by DLA or created as copies by the Contractor.

IAW NISPOM paragraphs 5-501 and 5-502, distribution of DLA classified information shall only be made to those cleared Contractor personnel working on the

Contractor’s response to the request for information, unless otherwise authorized by the Program Manager (PM).

IAW NISPOM paragraph 5-509, for purposes of this submission request, further distribution of DLA classified information shall only be authorized by the DLA PM overseeing this request for information.

IAW NISPOM paragraphs 5-702, 5-703, and 5-704, all classified information provided for use in submission preparation shall be returned to DLA or destroyed.

Reference Item 10.j: See For Official Use Only/Controlled Unclassified Information

(FOUO/CUI) Supplement below. The Contractor is required to provide the supplement to all uncleared Subcontractors requiring access to FOUO/CUI information.

Reference Item 11.c: The Contractor has a responsibility to understand and use all applicable

Security Classification Guidance (SCG) provided by the government (reference NISPOM 4-102).

The DLA will produce a list of necessary SCGs required to conduct derivative classification upon award. At that time the Contractor shall request the required SCGs from the Contracting Officer’s

Representative (COR). The DLA has the obligation to review existing guidance periodically during the performance stages of the contract and to issue a revised DD Form 254 when a change to the

SCGs occurs or when additional SCGs are needed (reference NISPOM Chapter 4, Section 103b.).

The Contractor shall flow-down required SCGs on its Subcontractor DD Form 254s and shall provide copies of the SCGs to its Subcontractor.

1. Other Security Classification Guides will be provided as required. (SEE REF ITEM 13)

Reference Item 11.j:

1. The Contractor is required to apply Operations Security (OPSEC) to enhance protection of classified and unclassified critical information pursuant to DoD Directive 5205.02, “DoD

OPSEC Program; DoD 5205.02-M, “OPSEC Program Manual;” National Security Decision

Directive Number 298, “National Operations Security Program;” DLA Instruction 5205.02, “Operations Security (OPSEC) Program,” April 15, 2015; and supplementary instructions.

Service OPSEC guidance may also apply if the contracted activity is performed in a Service-level operational environment. Contractors are required to complete OPSEC refresher training on an annual basis and provide timely and appropriate responses to Agency OPSEC Managers, when necessary.

2. The contractor will accomplish the following minimum requirements in support of the DLA

OPSEC Program. Protect those items of critical information, applicable to operations. Items of critical information are those facts, which individually, or in the aggregate, reveal sensitive details about the mission, operation, etc., and thus require protection from adversarial collection or exploitation.

3. Include OPSEC as part of its ongoing security awareness program and take all required

OPSEC training provided by DLA.

4. Protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of operations performed by the contractor in support of the mission.

Reference Item 11.l:

Contractor’s Unclassified Automated Information System (AIS):

1. The Contractor shall safeguard and protect CUI provided by or generated for the Government

(other than public information) that transits or resides on any non-Government information technology system IAW the procedures in DoDI 8582.01, “Security of Unclassified DoD

Information on Non-DoD Information Systems,” June 6, 2012, Enclosure 3 and NIST SP 800-

171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and

Organizations,” June 2015. Information shall be protected from unauthorized access, disclosure, incident or compromise by extending the safeguarding requirements and procedures in DFARS clause 252.204-7012, Safeguarding of Covered Defense Information and Cyber Incident

Reporting. The NIST SP 800-171 security controls specified in 252.204-7012 were extended to include Controlled Unclassified Information (CUI) information which resides on, or transits through the contractor’s (prime and all sub-contractors) unclassified information technology systems.

2. The contractor shall ensure that all persons accessing CUI, which includes FOUO, meet the qualifications for an Automated Data Processing/Information Technology (ADP/IT)-III Position requirement) to access DLA unclassified AIS.

3. The “For Official Use Only/Controlled Unclassified Information Supplement” provides additional guidance for the handling, marking, transmission, reproduction, safeguarding, and disposition of FOUO/CUI.

4. DLA reserves the right to conduct compliance inspections of Contractor unclassified information systems and other repositories for the protection of FOUO/CUI.

Reference Item 12: The Prime Contractor shall forward all requests for public release authorization through the Contracting Officer’s Representative to the listed DLA program office.

Per NISPOM section 5-511, the Contractor shall include all necessary information to assist with the decision of the DLA program office. Per NISPOM Chapter 7, Section 102c., the Prime

Contractor shall act as the focal point for all Subcontractor requests for public release. A lack of response from the DLA program office does not constitute as public release authorization. The

Prime Contractor shall not release information to the public prior to receiving written authorization from the DLA program office (this requirement includes any information system that provides public access).

Reference Item 13:

The following drawings are required for this contract instrument:

CONFIDENTIAL, 1038449, CAGE 49956, Revision C, Dated 01/08/1993, Declassification

Date: 09/01/2028, Date of Source: 09/01/2003

CONFIDENTIAL, 1038449, CAGE 49956, Revision D, Dated 01/13/2005, Declassification

Date: 09/01/2028, Date of Source: 09/01/2003

Items - Commerce Control List Items (CCLI) - Mutilation to the point of scrap required outside the United States. In the United States, mutilation requirement determined by the DEMIL integrity code. DOD trade security controls (TSC) required in the United States.”

FOR OFFICIAL USE ONLY/CONTROLLED UNCLASSIFIED

INFORMATION SUPPLEMENT

1. Definitions.

a. Controlled Unclassified Information (CUI). Unclassified information which requires access and distribution limitations prior to appropriate coordination and an official determination by cognizant authority approving clearance of the information for release to one or more foreign governments or international organizations, or for official public release. Per DoD Manual

5200.01, Volume 4 it includes the following types of information: "For Official Use Only"

(FOUO); “Sensitive But Unclassified” (State Department information); “DEA Sensitive

Information” (Drug Enforcement Agency information); “DoD Unclassified Controlled Nuclear

Information”; “Sensitive Information” as defined in the Computer Security Act of 1987; and information contained in technical documents (i.e., Technical Data) as discussed in DoD

5230.24, 5230.25, International Traffic in Arms Regulation (ITAR), and the Export

Administration Regulations (EAR). Other sensitive information includes Personally Identifiable

Information (PII), information covered by the Privacy Act of 1974, and company proprietary information. DoDM 5200.01, Volume 4, DoDD 5205.02, DoDD 5230.9, and DoDI 8550.01 provide additional guidance on the handling of information described in this paragraph.

b. Dual Citizenship. A dual citizen is a citizen of two nations. For the purposes of this document, an individual must have taken an action to obtain or retain dual citizenship.

Citizenship gained as a result of birth to non-U.S. parents or by birth in a foreign country to U.S.

parents thus entitling the individual to become a citizen of another nation does not meet the criteria of this document unless the individual has taken action to claim and to retain such citizenship.

c. For Official Use Only (FOUO). FOUO is a dissemination control applied by the DoD to unclassified information that may be withheld from public disclosure under one or more of the nine exemptions of the Freedom of Information Act (FOIA) (See DOD 5400.7-R). FOUO is not a form of classification to protect U.S. national security interests.

d. National of the United States. Title 8, U.S.C. Section 1101(a)(22), defines a National of the U.S. as:

(1) A citizen of the United States, or,

(2) A person who, but not a citizen of the U.S., owes permanent allegiance to the U.S.

NOTE: 8 U.S.C. Section 1401, paragraphs (a) through (g), lists categories of persons born in and outside the U.S. or its possessions that may qualify as Nationals and Citizens of the

U.S. This subsection should be consulted when doubt exists as to whether or not a person can qualify as a National of the U.S.

e. U.S. Person. Any form of business enterprise or entity organized, chartered, or incorporated under the laws of the United States or its possessions and trust territories and any person who is a citizen or national (see National of the United States) of the United States, or permanent resident of the United States under the Immigration and Nationality Act.

2. Access.

a. No person may have access to information designated as FOUO unless that person has been determined to have a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose. The final responsibility for determining whether an individual has a valid need for access to information designated as FOUO rests with the individual who has authorized possession, knowledge, or control of the information, not with the prospective recipient.

b. Access to FOUO/CUI must be limited to U.S. Persons that have been the subject of a favorably completed National Agency Check with Inquiries (NACI) or a more stringent personnel security investigation. Access approval by DLA Office of Personnel Security is pending completion of a favorable NACI or Contractor equivalent.

(1) Contractor Equivalent: Contractor equivalent includes various background checks such as those performed by employers during hiring process. Minimum checks shall include

Citizenship, Personal Identification (Social Security Number), Criminal, and Credit. Contractors shall submit a request for approval on company letter head to the DLA Office of Personnel

Security.

(2) Contractor personnel with dual citizenship that have an active U.S. security clearance

(interim Confidential or higher) can have access to FOUO/CUI material.

(3) Contractor personnel with dual citizenship that do not have an active U.S. security clearance (interim Confidential or higher), the following actions will be completed prior to authorizing access to FOUO/CUI material:

(a) The dual citizen shall surrender the foreign passport to the corporate facility security office;

(b) The Contractor Company shall provide a signed letter to the dual citizen informing them that if they request their passport be returned to them, or they obtain a new foreign passport, they will be immediately removed from the DLA contract. The dual citizen shall acknowledge by signing and dating the letter.

(c) The DLA Industrial Security Program Manager and DLA Office of Personnel

Security shall be notified and will provide written approval.

c. Non-Sensitive Positions (ADP/IT-III positions). Non-sensitive positions associated with

FOUO/CUI are found at Contractor facilities processing such information on their (Contractor's) unclassified computer systems. Personnel nominated to occupy ADP/IT-III designated positions

(applies to any individual that may have access to FOUO/CUI on the Contractor's computer system) must have at least a National Agency Check with Inquiries (NACI) or Contractor equivalent (company hiring practices reviewed and approved by DLA Office of Personnel

Security). When "Contractor equivalent" option is NOT authorized and there is no record of a valid investigation, the Contractor shall contact DLA Office of Personnel Security at

DIPersonnelSecurity(PERSEC)Operations@dla.mil, and provide the requested information.

DLA Office of Personnel Security will assist the Contractor complete the SF85, Position of Trust

Questionnaire, and fingerprints.

3. Identification Markings. FOUO/CUI shall be marked in accordance with DoDM 5200.01, Volume 4, Enclosure 3, Section 2.c.

4. Handling. Storage of FOUO/CUI outside of Contractor facilities (i.e. residence, telework facility, hotel, etc.) shall be in a locked room, drawer, filing cabinet, briefcase, or other storage device, so that access to the material by unauthorized individuals. Continuous storage of

FOUO/CUI outside of a Contractor facility shall not exceed 30 days unless government approval is granted.

5. Transmission/Dissemination/Reproduction.

a. Subject to compliance with official distribution statements, FOUO markings (e.g., Export

Control, Proprietary Data) and/or Non-Disclosure Agreements which may apply to individual items in question; authorized Contractors, consultants and grantees may transmit/disseminate

FOUO/CUI information to each other, other DoD Contractors and DoD officials who have a legitimate need to know in connection with any DoD authorized contract, solicitation, program or activity. The government Procuring Contracting Officer (PCO) will confirm with the

Contracting Officer's Representative or Task Order Monitor "legitimate need to know" when required. Contractors shall employ Public Key Infrastructure (PKI) and Public Key (PK) enabling technologies for the electronic transmission of FOUO/CUI. The following general guidelines apply:

(1) In accordance with DoD Manual 5200.01, Volume 4, “Controlled Unclassified

Information (CUI),” Enclosure 3, external electronic data transmissions of CUI/FOUO shall be only over secure communications means approved for transmission of such information.

(2) Encryption of e-mail to satisfy this requirement shall be in accordance with DoD

Instruction 8582.01, “Security of Unclassified DoD Information on Non-DoD Information

Systems,” June 6, 2012, being accomplished by use of DoD approved Public Key Infrastructure

Certification or by the company’s participation in the “Federal Bridge.”

b. Failure of the Contractor to encrypt FOUO/CUI introduces significant risks to the DLA mission. It is essential for the Contractor to understand that mitigation options that are available.

The Contractor must understand that failure to encrypt FOUO/CUI carries with it certain risks to the mission. These risks can be mitigated with the thoughtful application of processes, procedures, and technology. Some of the available mitigation tools include:

(1) Approved DoD PKI/CAC hardware token certificates or DoD trusted software certificates for encrypting data in transport.

(2) Industry best practice of Virtual Private Network (VPN) Internet Protocol

Security (IPSEC) for intra-organization transport.

(3) Industry best practice of Secure Sockets Layer Portal Web Services for document sharing and storage.

(4) Approved DoD standard solutions for encrypting data at rest.

(5) Approved DoD E-Collaboration services via DLA Portal or Defense Information

Systems Agency (DISA) Network Centric Enterprise Services (NCES).

(6) Any FIPS 140-2 validated encryption [e.g., IPSEC, Secure Socket Layer/Transport

Layer Security (SSL/TLS), Secure/Multipurpose Internet Mail Extensions (S/MIME)].

(7) Procure and employ Secure Telephone Equipment (STE).

(8) Procure and employ secure facsimile (FAX) capability.

(9) Utilize secure VTC capabilities.

(10) Hand-carry FOUO/CUI.

(11) Utilize mailing through U.S. Postal Service.

(12) Utilize overnight express mail services.

c. FOUO/CUI shall be processed and stored internally on Automated Information Systems

(AIS) or networks 1) when distribution is to an authorized recipient and 2) if the receiving system is protected by either physical isolation or a password protection system. Holders shall not use general, broadcast, or universal e-mail addresses to distribute FOUO/CUI. Discretionary access control measures may be used to preclude access to FOUO/CUI files by users who are authorized system users, but who are not authorized access to FOUO/CUI. External transmission of FOUO/CUI shall be secured using NIST-validated encryption. FOUO/CUI cannot be placed on any publically-accessible medium.

d. Reproduction of FOUO/CUI may be accomplished on unclassified copiers within designated government or Contractor reproduction areas.

6. Storage. During working hours, reasonable steps shall be taken to minimize the risk of access by unauthorized personnel (e.g., not reading, discussing, or leaving FOUO/CUI information unattended where unauthorized personnel are present). After working hours, FOUO/CUI information may be stored in unlocked containers, desks, or cabinets if contract building security is provided. If such building security is not provided or is deemed inadequate, the information shall be stored in locked desks, file cabinets, bookcases, locked rooms, etc.

7. Disposition.

a. When no longer required, FOUO/CUI shall be returned to the DLA office that provided the information or destroyed by any of the following means:

a. Burning (Use of burn bags and an authorized burn facility)

b. Cross-cut shredding (Shredders must be listed on the NSA Evaluated Products

List)

c. Any method approved for the destruction of classified material.

b. Removal of the FOUO/CUI status can only be accomplished by the government originator. The DLA COR shall review and/or coordinate with proper authority the removal of

FOUO/CUI status for information in support of contract activity.