RFQATTACH.SPE7L318Q0527.0001.DOCX

SECURITY GUIDANCE (BLOCK 13) CONTINUATION PAGES

FOR SOLICITATION OR CONTRACT #: SPE7L318Q0527

Per the DD Form 441, Department of Defense Security Agreement, Section VI, signed by the United States Government through the Defense Security Service and the Contractor, the government is not obligated to provide funds and shall not be liable for any security costs or claims of the Contractor arising out of the DD Form 441 Agreement, its instructions, or the requirements identified in the DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), and its changes/revisions.

The Contractor is required to flow-down all applicable requirements of the DD Form 254 to its Subcontractor(s).

Reporting Requirements:

The Contractor shall provide the following to the DLA PLFA Industrial Security Manager (PISM) (contact information listed in block 13 of page two of the DD Form 254):

· Courtesy copy the DLA HQ Industrial Security Program Office on any security incident report (initial and final) involving the loss, compromise, or suspected compromise of classified information sent to the Defense Security Service. The Contractor shall provide a copy to the DLA within the same reporting timeframe as is required by the Defense Security Service.

· Courtesy copy the DLA HQ Industrial Security Program Office on any report involving a cyber-intrusion of DLA program information sent to the Federal Bureau of Investigation and the Defense Security Service per NISPOM Chapter 1, Section 301 and Industrial Security Letter 2013-05.

· Provide a copy of any Defense Security Service letter that indicates a less than satisfactory security rating and/or that negatively impacts the Facility Clearance Level (FCL) of the company within 48-hours of receipt.

· Provide electronic copies of Subcontractor DD Form 254s issued by the Prime and the Subcontractor. The Prime Contractor shall act as the focal point for collecting their Subcontractor’s DD Form 254s and the Prime is responsible for forwarding these DD Form 254s to the DLA HQ Industrial Security Program Office.

· DLA HQ Industrial Security Program Office:

Subcontractor Classified Access Approvals:

The Prime Contractor and Subcontractor are authorized to flow access to and/or dissemination of classified information to the level specified in Block 1a to their Subcontractors. Dissemination is only authorized and applicable for information safeguarded at the Contractor’s facility. The Contractor shall provide the appropriate accesses to its Subcontractors as required per NISPOM 5-502. The Prime Contractor and Subcontractor must verify Facility Clearance, Safeguarding Capability and Access Authorizations prior to the dissemination of classified information. Certain accesses require GCA approval prior to subcontracting and are specified herein, if applicable.

Pre-Award Access

This section concerns the release of classified information to the contractor prior to the award of a DLA classified contract. DLA classified information may only be released to the Contractor for submission preparation purposes following verification of the Contractor’s facility clearance and safeguarding. The DD Form 254 shall act as security guidance for the safeguarding of program-related classified information at the Contractor facility. The Defense Security Service maintains security cognizance of classified information stored at a Contractor facility. However, the following stipulations apply:

· IAW NISPOM paragraphs 5-200 and 5-600, Contractors shall ensure full written accounting and control over all DLA classified information provided to the Contractor by DLA or created as copies by the Contractor.

· IAW NISPOM paragraphs 5-501 and 5-502, distribution of DLA classified information shall only be made to those cleared Contractor personnel working on the Contractor’s response to the request for information, unless otherwise authorized by the Program Manager (PM).

· IAW NISPOM paragraph 5-509, for purposes of this submission request, further distribution of DLA classified information shall only be authorized by the DLA PM overseeing this request for information.

· IAW NISPOM paragraphs 5-702, 5-703, and 5-704, all classified information provided for use in submission preparation shall be returned to DLA or destroyed.

Reference Item 4: All classified material or information associated with this contract is authorized to be transferred to the contract number cited in block 2a.

Reference Item 5: Insert specific instructions for the final disposition of all classified materials associated with this contract at the end of the specified retention period.

Reference Item 8.a. (continued) Government Locations:

Classified performance will occur at various DLA and/or government locations as directed by the contract via the Performance Work Statement, Statement of Work, or Statement of Objectives or other agreement. The Contractor shall abide by the host government security requirements per NISPOM Chapter 1, Section 200 and Chapter 6, Section 105c. The cognizant security office at the performance location is DLA or the host installation.

Reference Item 10.a and/or 11.h: The Contractor shall comply with the requirements of NISPOM Chapter 9, Section 4, National Security Agency/Central Security Service Policy Manual Number 3-16, Control of Communications Security (COMSEC) Material, and the Committee on National Security Systems Instruction (CNSSI) 4001, Controlled Cryptographic Items, for access to and safeguarding of COMSEC information. If the contractor is authorized to receive Government furnished cryptographic equipment, the guidance will state that fact. Access to classified COMSEC information requires a final U.S. Government clearance at the appropriate level. Further disclosure of COMSEC information by a contractor, to include subcontracting, requires prior approval of the GCA. Non-accountable COMSEC information, though not tracked in the COMSEC material control system, may still require a level of control within a document control system. If access to COMSEC information is required at Government facilities, contractor personnel will follow the security requirements of the host government activity.

(FRD ACCESS ONLY)

Reference Item 10.d: Contractors shall adhere to the requirements of DoDI 5210.02, “Access to and Dissemination of Restricted Data (RD) and Formerly Restricted Data (FRD),” 3 June 2011, for access and training requirements. Flow this requirement to subcontractors when applicable.

1. Contractors shall possess a valid DoD security clearance at a level commensurate with the information concerned and shall have a need-to-know for access. DoD contractors do not require a final security clearance for access to FRD information.

2. The Prime contractor and its subcontractors shall be required to complete training for access to FRD material. This training is provided by the Department of Energy (DOE) and can be accessed at the DOE website (http://energy.gov/hss/services/classification/classification-training-institute/training-other-agency-personnel). For individuals with access to FRD information, personnel shall complete the “Classification of Nuclear Weapons-Related Information (Restricted Data and Formerly Restricted Data)” course. The contractor company shall maintain a record of the training for each individual with access to FRD. These records shall be made readily available during security inspections or for other government purposes. Records shall be maintained for two years after an individual no longer requires access to FRD information.

OR

Reference Item 10.b & d: Contractors shall adhere to the requirements of DoDI 5210.02, “Access to and Dissemination of Restricted Data (RD) and Formerly Restricted Data (FRD),” 3 June 2011, for access and training requirements. Flow this requirement to subcontractors when applicable.

1. Contractors shall possess a valid DoD security clearance at a level commensurate with the information concerned and shall have a need-to-know for access. DoD contractors require a final Secret security clearance for access to Secret RD information. Contractors shall have a final Top Secret security clearance for access to Top Secret RD information. NISPOM section 2-211a. applies.

2. The Prime contractor and its subcontractors shall be required to complete training for access to RD/FRD material and for derivative classification of RD/FRD information. This training is provided by the Department of Energy (DOE) and can be accessed at the DOE website (http://energy.gov/hss/services/classification/classification-training-institute/training-other-agency-personnel).

a. For individuals with access to RD/FRD information, personnel shall complete the “Classification of Nuclear Weapons-Related Information (Restricted Data and Formerly Restricted Data)” course. The contractor company shall maintain a record of the training for each individual with access to RD/FRD. These records shall be made readily available during security inspections or for other government purposes. Records shall be maintained for two years after an individual no longer requires access to RD/FRD information.

b. For individuals who will conduct derivative classification, personnel shall complete the “Restricted Data Classifiers Course” provided by the DLA HQ Industrial Security Program Office. Upon completion of the course, the contractor company shall request a written exam from DLA. DLA will grade the written exam and will provide a certificate of completion. The contractor shall at a minimum obtain an 80% to successfully pass the exam. The contractor company shall maintain a record of the training for each individual designated as a RD Classifier. These records shall be made readily available during security inspections or for other government purposes. Records shall be maintained for two years after an individual is no longer designated as a RD Classifier.

3. Contractors should contact the DLA HQ Industrial Security Program Office listed in block 13 of the DD 254 (Reporting Requirements) for information and materials concerning the RD Classifier exam.

Reference Item 10.c: NISPOM Chapter 9, Section 2 requirements apply. Access to Critical Nuclear Weapons Design Information requires a final clearance.

Reference Item 10.e(1): This contract requires access to Sensitive Compartmented Information (SCI) material. The Contractor is not required to have an accredited SCI Facility but requires access to SCI at other locations. Additionally, the Facility Security Officer will ensure that when a Contractor with access to SCI is due for a Periodic Reinvestigation, the Periodic Reinvestigation request is conducted to meet SCI standards. Written U.S. Government approval by DLA/DI SSO is required prior to giving SCI access to a Subcontractor. Additional requirements are included in the attached SCI Supplement.

OR

Reference Item 10.e(1): This contract requires access to Sensitive Compartmented Information (SCI) material. The Defense Intelligence Agency (DIA) and the DLA, as the executive agent for DIA, have exclusive security responsibility for all SCI classified material released to, or developed under, the contract and held within the Contractor SCI Facility (SCIF). Defense Security Service does not have security inspection responsibility for any such material but retains responsibility for all non-SCI classified material released to, or developed under, the contract and held within the Contractor SCIF. The Contractor shall comply with applicable Intelligence Community Directives (ICDs). Additionally, the Facility Security Officer shall ensure that personnel with access to SCI are U.S. citizens and have a final security clearance that meets SCI standards. Written U.S. Government approval by DLA/DI SSO is required prior to giving SCI access to a Subcontractor. Additional requirements are included in the attached SCI Supplement.

Reference Item 10.e(2): NISPOM Chapter 9, Section 3 requirements apply.

Reference Item 10.f: Requirements are included in the attached SAP Supplement.

Reference Item 10.g: NISPOM Chapter 10, Section 7 requirements apply. Access to NATO information requires a final U.S. Government clearance at the appropriate level and a NATO access briefing/debriefing. A special briefing will be required for access to NATO information. Contact your Defense Security Service (DSS) Industrial Security Representative (ISR) for further instructions on the issuance of NATO briefings to employees. Prior approval of the GCA is required to impose NATO requirements upon a subcontractor. A NATO briefing may also be required in cases where a contractor does not require access to NATO information, but does require access to SIPRnet for the performance of the contract.

Reference Item 10.h: NISPOM Chapter 10, Section 3 requirements apply. Prior approval of the GCA is required prior to subcontracting. Access to FGI requires a final U.S. Government clearance at the appropriate level.

Reference Item 10.i: The Contractor is required to perform (TYPE OF WORK) that is covered under an (OFFICE OF PRIMARY RESPONSIBILITY) Alternative Compensatory Control Measures (ACCM). The Contractor shall execute the ACCM-related tasks per the Statement of Work/Performance Work Statement/Statement of Objectives.

Reference Item 10.j: See For Official Use Only/Controlled Unclassified Information (FOUO/CUI) Supplement below. The Contractor is required to provide the supplement to all uncleared Subcontractors requiring access to FOUO/CUI information.

Reference Item 11.a: Classified contract performance is restricted to DLA/government facilities and/or other Contractor company facilities. The host Contractor/government activity will provide required security classification guidance for the performance of this contract, consistent with work performed at that location. The Prime Contractor, as listed in Item 6.a, shall be required to follow all security policies and procedures and use Security Classification Guides of the host activity. This requirement shall be imposed on all subcontracts.

OR

Reference Item 11.b: All classified information received in performance of the contract is provided as reference only and will be properly stored and handled according to the markings on the material. All classified information received is the property of the U.S. Government. DLA shall be contacted at the expiration or termination of the contract for proper disposition instructions.

OR

Reference Item 11.c: The Contractor has a responsibility to understand and use all applicable Security Classification Guidance (SCG) provided by the government (reference NISPOM 4-102). The DLA has provided a list below of necessary SCGs required to conduct derivative classification. The Contractor shall request the required SCGs from the Contracting Officer, Contracting Officer’s Representative (COR) or designated representative. DLA has the obligation to review existing guidance periodically during the performance stages of the contract and to issue a revised DD Form 254 when a change to the SCGs occurs or when additional SCGs are needed (reference NISPOM Chapter 4, Section 103b.). All classified information received or generated is the property of the U.S. Government. At the termination or expiration of this contract, the GCA will be contacted for proper disposition instructions. The Contractor shall flow-down required SCGs on its Subcontractor DD Form 254s and shall provide copies of the SCGs to its Subcontractor. The following security classification guidance applies:

1. INSERT SCG TITLE AND DATE HERE

2. Other Security Classification Guides will be provided as required.

Reference Item 11.d: The Contractor is required to provide adequate storage and transportation for classified hardware to the level specified in Block 1b If the classified hardware is of such a size or quantity that it cannot be safeguarded in a regular-sized GSA-approved storage container, a Closed Area, Vault, or additional security containers may be required. Per the NISPOM, the Defense Security Service has responsibility for the authorization and approval of all Closed Areas and/or Vaults within the Contractor’s facility.

Reference Item 11.e: The contractor will be performing services only on this contract and will not be expected to produce deliverable items. The contractor will be required to provide services in secure Government facilities and may come into contact with Classified or Controlled Unclassified Information (CUI). Actual knowledge, generation, or production of classified information is not required for the performance of this contract. Cleared personnel are required to perform this service because access to classified information cannot be precluded by escorting personnel due to a high risk of aural or visual access to classified information. This access cannot be properly mitigated through other reasonable physical security measures.

Reference Item 11.f:

1. The Contractor shall require access to classified information overseas at areas designated in the Statement of Work, Performance Work Statement, or Statement of Objectives.

2. All Contractor personnel working at the designated location(s) and accessing classified information shall obtain an Area of Responsibility-specific travel briefing and Antiterrorism Level I Awareness training prior to departing on travel. Required training shall be received within 90 days prior to travel.

3. The Contractor shall submit foreign visit requests as dictated by the NISPOM, Chapter 10, Section 5. A Contractor shall submit the visit request through the Defense Security Service-designated security official.

4. The Contractor is not authorized per the NISPOM to establish a contractor facility outside of the U.S., its possessions, or its territories. Storage, custody, and control of classified information required by a U.S. Contractor employee abroad is the responsibility of the U.S. Government. Storage of classified information shall be at a U.S. military facility, a U.S. Embassy or Consulate, or another location occupied by a U.S. Government organization.

5. The contractor will require access to classified information at the following locations:

Reference Item 11.g: The Contractor is authorized to use the services of the Defense Technical Information Center (DTIC) or other secondary distribution center. As required, the Contractor will prepare and submit the DD Form 1540, “Registration for Scientific and Technical Information Services” and DD Form 2345, “Militarily Critical Technical Data Agreement” to the contracting office for approval. Subcontractors are required to submit requests through the Prime Contractor.

Reference Item 11.i: TEMPEST countermeasures within the Continental United States shall not be imposed unless recommended by a Certified TEMPEST Technical Authority (CTTA) (CTTA approved by the Service Element issuing a contract), approved by the DLA office of the Director of Technical Intelligence, and directed by the Contracting Officer.

Reference Item 11.j:

1. The Contractor is required to apply Operations Security (OPSEC) to enhance protection of classified and unclassified critical information pursuant to DoD Directive 5205.02, “DoD OPSEC Program; DoD 5205.02-M, “OPSEC Program Manual;” National Security Decision Directive Number 298, “National Operations Security Program;” DLA Instruction 5205.02, “Operations Security (OPSEC) Program,” April 15, 2015; and supplementary instructions. Service OPSEC guidance may also apply if the contracted activity is performed in a Service-level operational environment. Contractors are required to complete OPSEC refresher training on an annual basis and provide timely and appropriate responses to Agency OPSEC Managers, when necessary.

2. The contractor will accomplish the following minimum requirements in support of the DLA OPSEC Program. Protect those items of critical information, applicable to operations. Items of critical information are those facts, which individually, or in the aggregate, reveal sensitive details about the mission, operation, etc., and thus require protection from adversarial collection or exploitation.

3. Include OPSEC as part of its ongoing security awareness program and take all required OPSEC training provided by DLA.

4. Protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of operations performed by the contractor in support of the mission.

Reference Item 11.l:

Contractor’s Unclassified Automated Information System (AIS):

1. The Contractor shall safeguard and protect CUI provided by or generated for the Government (other than public information) that transits or resides on any non-Government information technology system IAW the procedures in DoDI 8582.01, “Security of Unclassified DoD Information on Non-DoD Information Systems,” June 6, 2012, Enclosure 3 and NIST SP 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations,” June 2015. Information shall be protected from unauthorized access, disclosure, incident or compromise by extending the safeguarding requirements and procedures in DFARS clause 252.204-7012, Safeguarding of Covered Defense Information and Cyber Incident Reporting. The NIST SP 800-171 security controls specified in 252.204-7012 were extended to include Controlled Unclassified Information (CUI) information which resides on, or transits through the contractor’s (prime and all sub-contractors) unclassified information technology systems.

2. The contractor shall ensure that all persons accessing CUI, which includes FOUO, meet the qualifications for an Automated Data Processing/Information Technology (ADP/IT)-III Position requirement) to access DLA unclassified AIS.

3. The “For Official Use Only/Controlled Unclassified Information Supplement” provides additional guidance for the handling, marking, transmission, reproduction, safeguarding, and disposition of FOUO/CUI.

4. DLA reserves the right to conduct compliance inspections of Contractor unclassified information systems and other repositories for the protection of FOUO/CUI.

Reference Item 12: The Prime Contractor shall forward all requests for public release authorization through the Contracting Officer or designated representative to the listed DLA program office. Per NISPOM section 5-511, the Contractor shall include all necessary information to assist with the decision of the DLA program office. Per NISPOM Chapter 7, Section 102c., the Prime Contractor shall act as the focal point for all Subcontractor requests for public release. A lack of response from the DLA program office does not constitute as public release authorization. The Prime Contractor shall not release information to the public prior to receiving written authorization from the DLA program office (this requirement includes any information system that provides public access).

Reference Item 13: List any other miscellaneous classification guidance such as classified source documents or materials the contractor will need in the performance of this contract as well as any other classification protection requirements for hardware, software, or data generated under this contract. Ensure all referenced documents are provided to the contractor under separate cover.

The following classified data /drawing is required in performance of this contract instrument:

Confidential Drawing 13020220A CAGE 19200 Revision NONE Revision Date 01/14/2008 Declassification Date: 01/14/2033 Date of Source: 04/10/2002

Demilitarization Code D Item DEMIL Integrity Code 1

(ADD ONLY IF A PPP EXISTS)

Reference Item 14: Program Protection is required for this contract. The interdisciplinary requirements associated with Program Protection are further addressed in Sections C & J of this contract and detailed in the Government issued Program Protection Plan (PPP). The contractor shall implement applicable security countermeasures to protect classified and/or unclassified Critical Program Information and Critical Components as outlined in the Statement of Work/Performance Work Statement/Statement of Objectives and refined in the PPP.

Block 13 Continuation Pages for Solicitation or Contract #: SPE7L318Q0527

FOR OFFICIAL USE ONLY/CONTROLLED UNCLASSIFIED

INFORMATION SUPPLEMENT

1. Definitions.

a. Controlled Unclassified Information (CUI). Unclassified information which requires access and distribution limitations prior to appropriate coordination and an official determination by cognizant authority approving clearance of the information for release to one or more foreign governments or international organizations, or for official public release. Per DoD Manual 5200.01, Volume 4 it includes the following types of information: "For Official Use Only" (FOUO); “Sensitive But Unclassified” (State Department information); “DEA Sensitive Information” (Drug Enforcement Agency information); “DoD Unclassified Controlled Nuclear Information”; “Sensitive Information” as defined in the Computer Security Act of 1987; and information contained in technical documents (i.e., Technical Data) as discussed in DoD 5230.24, 5230.25, International Traffic in Arms Regulation (ITAR), and the Export Administration Regulations (EAR). Other sensitive information includes Personally Identifiable Information (PII), information covered by the Privacy Act of 1974, and company proprietary information. DoDM 5200.01, Volume 4, DoDD 5205.02, DoDD 5230.9, and DoDI 8550.01 provide additional guidance on the handling of information described in this paragraph.

b. Dual Citizenship. A dual citizen is a citizen of two nations. For the purposes of this document, an individual must have taken an action to obtain or retain dual citizenship. Citizenship gained as a result of birth to non-U.S. parents or by birth in a foreign country to U.S. parents thus entitling the individual to become a citizen of another nation does not meet the criteria of this document unless the individual has taken action to claim and to retain such citizenship.

c. For Official Use Only (FOUO). FOUO is a dissemination control applied by the DoD to unclassified information that may be withheld from public disclosure under one or more of the nine exemptions of the Freedom of Information Act (FOIA) (See DOD 5400.7-R). FOUO is not a form of classification to protect U.S. national security interests.

d. National of the United States.Title 8, U.S.C. Section 1101(a)(22), defines a National of the U.S. as:

(1) A citizen of the United States, or,

(2) A person who, but not a citizen of the U.S., owes permanent allegiance to the U.S.

NOTE: 8 U.S.C. Section 1401, paragraphs (a) through (g), lists categories of persons born in and outside the U.S. or its possessions that may qualify as Nationals and Citizens of the U.S. This subsection should be consulted when doubt exists as to whether or not a person can qualify as a National of the U.S.

e. U.S. Person. Any form of business enterprise or entity organized, chartered, or incorporated under the laws of the United States or its possessions and trust territories and any person who is a citizen or national (see National of the United States) of the United States, or permanent resident of the United States under the Immigration and Nationality Act.

2. Access.

a. No person may have access to information designated as CUI unless that person has been determined to have a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose. The final responsibility for determining whether an individual has a valid need for access to information designated as CUI rests with the individual who has authorized possession, knowledge, or control of the information, not with the prospective recipient.

b. e. When CUI is to be provided to or generated by DoD contractors, the controls and protective measures to be applied shall be described in the pertinent contract documents (e.g., contract clause; statement of work; or DD Form 254, “Department of Defense Contract Security Classification Specification”). Solicitations and contracts shall use a non-disclosure of information clause that prohibits release of unclassified information to the public without approval of the contracting activity (e.g., clause 252.204-7000 of the Defense Federal Acquisition Regulation Supplement). The clause shall also be made applicable to subcontractors.

c. ALL DoD unclassified information MUST BE REVIEWED AND APPROVED FOR RELEASE through standard DoD Component processes before it is provided to the public (including via posting to publicly accessible websites) in accordance with DoDD 5230.09, Clearance of DoD Information for Public Release, and other applicable regulations. Unclassified information previously approved for release to the public may be shared with any foreign government or organization.

d. Release or disclosure of CUI to foreign governments or international organizations shall be in accordance with DoDD 5230.20, Visits and Assignments of Foreign Nationals, and other policy and procedures that may be established by the USD(P) and the Defense Logistics Agency.

e. Some CUI is export-controlled information which may additionally be protected by law, Executive order, regulation, or contract. DoD officials must pay particular attention to export control regulations and to access restrictions on each type of CUI to ensure compliance with export requirements, especially when non-U.S. citizens are assigned to or visit their organizations.

f. Release or disclosure of CUI to non-U.S. citizens employed by the Department of Defense is permitted, provided access is within the scope of their assigned duties; access would further the execution of a lawful and authorized DoD mission or purpose and would not be detrimental to the interests of the Department of Defense or the U.S. Government; there are no contract restrictions prohibiting access; and the access complies with the requirements of export control regulations, as applicable. In such cases, the non-U.S. citizen shall execute a nondisclosure agreement approved by appropriate DoD Component authorities.

g. CUI may be identified in security classification guides to ensure the information receives appropriate protection. If the security classification guide is subsequently cancelled, a separate memorandum or other guidance document may be issued to identify the declassified information, if any, that qualifies as CUI as well as any CUI previously cited in the guide.

h. For unauthorized disclosures of CUI, no formal security inquiry or investigation is required. However, appropriate management action shall be taken to fix responsibility for unauthorized disclosure of CUI whenever feasible or required by other guidance, and appropriate disciplinary action shall be taken against those responsible.

i. Non-Sensitive Positions (ADP/IT-III positions). Non-sensitive positions associated with FOUO/CUI are found at Contractor facilities processing such information on their (Contractor's) unclassified computer systems. All unclassified computer systems will be protected in accordance with DFARS 252.204-7012, Safeguarding of Covered Defense Information and Cyber Incident Reporting and NIST SP 800-171, with access to CUI/FOUO conducted in accordance with applicable policy. Personnel nominated to occupy ADP/IT-III designated positions must have at least a National Agency Check with Inquiries (NACI). The Contractor shall contact DLA Office of Personnel Security at DIPersonnelSecurity(PERSEC)Operations@dla.mil, and provide the requested information. DLA Office of Personnel Security will assist the Contractor complete the necessary paperwork and fingerprints.

3. Identification Markings. FOUO/CUI shall be marked in accordance with DoDM 5200.01, Volume 4, Enclosure 3, Section 2.c.

4. Handling. Storage of FOUO/CUI outside of Contractor facilities (i.e. residence, telework facility, hotel, etc.) shall be in a locked room, drawer, filing cabinet, briefcase, or other storage device, so that access to the material by unauthorized individuals. Continuous storage of FOUO/CUI outside of a Contractor facility shall not exceed 30 days unless government approval is granted.

5. Transmission/Dissemination/Reproduction.

a. Subject to compliance with official distribution statements, FOUO markings (e.g., Export Control, Proprietary Data) and/or Non-Disclosure Agreements which may apply to individual items in question; authorized Contractors, consultants and grantees may transmit/disseminate FOUO/CUI information to each other, other DoD Contractors and DoD officials who have a legitimate need to know in connection with any DoD authorized contract, solicitation, program or activity. The government Procuring Contracting Officer (PCO) will confirm with the Contracting Officer's Representative or Task Order Monitor "legitimate need to know" when required. Contractors shall employ Public Key Infrastructure (PKI) and Public Key (PK) enabling technologies for the electronic transmission of FOUO/CUI. The following general guidelines apply:

(1) In accordance with DoD Manual 5200.01, Volume 4, “Controlled Unclassified Information (CUI),” Enclosure 3, external electronic data transmissions of CUI/FOUO shall be only over secure communications means approved for transmission of such information.

(2) Encryption of e-mail to satisfy this requirement shall be in accordance with DoD Instruction 8582.01, “Security of Unclassified DoD Information on Non-DoD Information Systems,” June 6, 2012, being accomplished by use of DoD approved Public Key Infrastructure Certification or by the company’s participation in the “Federal Bridge.”

b. Failure of the Contractor to encrypt FOUO/CUI introduces significant risks to the DLA mission. It is essential for the Contractor to understand that mitigation options that are available. The Contractor must understand that failure to encrypt FOUO/CUI carries with it certain risks to the mission. These risks can be mitigated with the thoughtful application of processes, procedures, and technology. Some of the available mitigation tools include:

(1) Approved DoD PKI/CAC hardware token certificates or DoD trusted software certificates for encrypting data in transport.

(2) Industry best practice of Virtual Private Network (VPN) Internet Protocol Security (IPSEC) for intra-organization transport.

(3) Industry best practice of Secure Sockets Layer Portal Web Services for document sharing and storage.

(4) Approved DoD standard solutions for encrypting data at rest.

(5) Approved DoD E-Collaboration services via DLA Portal or Defense Information Systems Agency (DISA) Network Centric Enterprise Services (NCES).

(6) Any FIPS 140-2 validated encryption [e.g., IPSEC, Secure Socket Layer/Transport Layer Security (SSL/TLS), Secure/Multipurpose Internet Mail Extensions (S/MIME)].

(7) Procure and employ Secure Telephone Equipment (STE).

(8) Procure and employ secure facsimile (FAX) capability.

(9) Utilize secure VTC capabilities.

(10) Hand-carry FOUO/CUI.

(11) Utilize mailing through U.S. Postal Service.

(12) Utilize overnight express mail services.

c. FOUO/CUI shall be processed and stored internally on Automated Information Systems (AIS) or networks 1) when distribution is to an authorized recipient and 2) if the receiving system is protected by either physical isolation or a password protection system. Holders shall not use general, broadcast, or universal e-mail addresses to distribute FOUO/CUI. Discretionary access control measures may be used to preclude access to FOUO/CUI files by users who are authorized system users, but who are not authorized access to FOUO/CUI. External transmission of FOUO/CUI shall be secured using NIST-validated encryption. FOUO/CUI cannot be placed on any publically-accessible medium.

d. Reproduction of FOUO/CUI may be accomplished on unclassified copiers within designated government or Contractor reproduction areas.

6. Storage. During working hours, reasonable steps shall be taken to minimize the risk of access by unauthorized personnel (e.g., not reading, discussing, or leaving FOUO/CUI information unattended where unauthorized personnel are present). After working hours, FOUO/CUI information may be stored in unlocked containers, desks, or cabinets if contract building security is provided. If such building security is not provided or is deemed inadequate, the information shall be stored in locked desks, file cabinets, bookcases, locked rooms, etc.

7. Disposition.

a. When no longer required, FOUO/CUI shall be returned to the DLA office that provided the information or destroyed by any of the following means:

a. Burning (Use of burn bags and an authorized burn facility)

b. Cross-cut shredding (Shredders must be listed on the NSA Evaluated Products List)

c. Any method approved for the destruction of classified material.

b. Removal of the FOUO/CUI status can only be accomplished by the government originator. The DLA COR shall review and/or coordinate with proper authority the removal of FOUO/CUI status for information in support of contract activity.