(U) ATTCH 6 - CUI Handling Guidance.pdf

Attachment 6 – CUI Handling Guidance H92240-21-R-0002

Controlled Unclassified Information (CUI) Handling Guidance

1. There is a shared responsibility between the Department of Defense (DoD) and Industry, when established by contract, grants, or other legal agreements or arrangements, in the identification, creation, sharing, marking, safeguarding, storage, dissemination, decontrol, disposition, destruction, and records management of CUI documents and materials. It is essential to identify and apply the general dissemination principles and guidance as prescribed by the CUI EA in accordance with Part 2002 of Title 32, CFR. Contracts containing CUI shared from DoD or generated, managed, or transmitted by the contractor via their information systems, will be in accordance with this issuance, which will be incorporated into each DoD contract.

2. Industry Requirements for Handling of CUI:

a. DoD contracts must require contractors to monitor CUI for aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information. DoD contracts shall require contractors to report the potential classification of aggregated or compiled CUI to a DoD representative.

b. DoD personnel and contractors, pursuant to mandatory DoD contract provisions, will submit unclassified DoD information for review and approval for release in accordance with the standard DoD Component processes and DoDI 5230.09.

c. All CUI records must follow the approved mandatory disposition authorities whenever the DoD provides CUI to, or CUI is generated by, non-DoD entities in accordance with Section 1220-1236 of Title 36, CFR, Section 3301a of Title 44, U.S.C., and this issuance.

d. Attachment 1, PWS and Attachment 2, Qualification Matrix shall be handled in accordance with the guidance at https://www.archives.gov/cui and per Attachment 6, CUI Handling Guidance.

Should a Contractor receive a copy and decide not to participate, they must ensure proper disposal in accordance with the guidance at https://www.archives.gov/cui and confirm destruction to the email addresses above.

3. Additional Security Requirements

a. Contractor shall establish appropriate administrative, technical, and physical safeguards to protect all nonpublic Government data to ensure the confidentiality, integrity, and availability of Government data.

b. Controlled Unclassified Information (CUI):

i. Unclassified information related to this acquisition is considered CUI. CUI is information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies but is not classified under Executive Order 13526 or the Atomic Energy Act, as amended. The contractor shall not release to anyone outside the Contractor’s organization any unclassified information, regardless of medium (e.g., film, tape, document, contractor’s external website, newspaper, magazine, journal, corporate annual report, etc.), pertaining to any part of this contract or any program related to this contract, unless the Contracting Officer has given prior written approval. Dissemination authorized only to those individuals, organizations, or entities included on an accompanying dissemination list. Note: Use of this limited dissemination control supersedes other limited dissemination controls, but cannot supersede dissemination stipulated in federal law, regulation, or Government-wide policy. Regulatory instructions and guidance can be located at the following link: https://www.archives.gov/cui/about.

Furthermore, any release of information which associates USSOCOM, Special Operation Forces (SOF), or any component command with an acquisition program, contractor, or this contract is prohibited unless specifically authorized by USSOCOM.

ii. Request for approval shall identify the specific information to be released, the medium to be used, and the purpose for the release. The contractor shall submit the request to the

Attachment 6 – CUI Handling Guidance H92240-21-R-0002

Contracting Officer at least 45 days before the proposed date for release for approval. No release of any restricted information shall be made without specific written authorization by the Contracting Office.

iii. The protection of sensitive but unclassified data reflecting Special Operations technologies, personnel, plans, and business associations requires due diligence on the part of those in possession of such information. The application of appropriate security measures to ensure the safekeeping of USSOCOM and company proprietary data, intellectual property, and personnel data is the responsibility of all parties who have access to such information. All contractors supporting USSOCOM are required to inform the Contracting Officer within three business days of when there has been a breach or successful penetration of the contractor’s network(s) or information system(s). Breaches include unauthorized intrusions of the contractor’s server(s) from external parties whether through introduction of malware, hacking, the compromise of access passwords, or any other unauthorized access or compromise. Breaches also include the physical loss of storage media such and disks, hard drives, thumb drives, laptops or other devices which contain duplicates of information contained on the contractor’s data systems, or the willful or accidental transmission, copying or posting of contract information which has not been specifically authorized by the Contracting Officer. Estimates of damage and mitigation strategies will be submitted to the Contracting Officer within a period following the breach specified and agreed upon by the Contractor and the Contracting Officer.

iv. The Contractor further understands that Title 18 USC Section 701 specifically prohibits the use of the USSOCOM emblem or logo in any medium (e.g., corporate website, marketing brochure, newspaper, magazine, etc.) unless authorized in writing by USSOCOM. Forward any request to use the USSOCOM emblem or logo through the Contracting Officer.