(U) NGAI 5200.1_Info Security_Update_1.pdf

UNCLASSIFIED

National Geospatial-Intelligence Agency

INSTRUCTION

NUMBER 5200.1

26 October 2020

Administrative Update 1, 19 August 2021

SI

SUBJECT: Information Security

References: See Enclosure 1.

1. PURPOSE. This Instruction:

a. Establishes policy, assigns responsibilities, and provides procedures for the protection of classified national security information (CNSI) and unclassified information, including controlled unclassified information (CUI), at NGA in accordance with (IAW) References (b), (c), (g), (p), and (r) through (u).

b. Addresses specific components of information security that comprise the NGA

Information Security Program (ISP).

c. Rescinds NGA Instruction 5200.1, “Information Security,” 30 May 2017.

2. APPLICABILITY. This Instruction applies to all NGA civilian employees, military service members, other Government agency personnel assigned to NGA, and contractors, hereinafter referred to as personnel.

3. DEFINITIONS. See Glossary.

4. POLICY. It is NGA policy to:

a. Identify and protect CNSI, CUI, and unclassified information IAW References (g), (p), and (s) through (u).

b. Promote information sharing, facilitate judicious use of resources, and simplify management through implementation of uniform and standardized processes.

c. Classify and declassify CNSI IAW References (b), (d), and (r).

(1) Not classify, continue to maintain as classified, or fail to declassify information in order to:

(a) Conceal violations of law, inefficiency, or administrative error.

NGAI 5200.1

(b) Prevent embarrassment to a person, organization, or agency.

(c) Restrain competition.

(d) Prevent or delay the release of information that does not require protection in the interest of national security.

(2) Classify basic scientific research and its results when related to national security.

d. Prescribe protection for, proper use and handling of, and enforce standards for marking all CNSI, CUI, and unclassified information IAW References (b), (d), (j), (p), (s), and (t).

e. Facilitate information sharing and restriction by applying dissemination markings when warranted.

f. Employ, maintain, and enforce standards for safeguarding, storing, destroying, transmitting, and transporting classified information.

g. Promote and implement information security education and training.

h. Investigate reports of security incidents (infractions or violations), potential compromises, actual compromises, or unauthorized disclosures (UDs) of CNSI, CUI, or unclassified information not approved for public release IAW References (f), (p), and (t).

i. Protect CUI from UD by marking, safeguarding, disseminating, and destroying information appropriately.

j. Disclose and/or release classified or unclassified information after appropriate review and approval granted by authorized disclosure and release officials IAW References (e) and (ap ao).

k. Subject NGA personnel to administrative sanctions as well as criminal penalties under applicable Federal Statutes, if they knowingly, willfully, or negligently violate the provisions of this Instruction IAW References (f), (r), and (am al).

l. Hold personnel accountable for safeguarding CNSI, CUI, and unclassified information IAW References (p) and (am al).

5. RESPONSIBILITIES. See Enclosure 2.

6. PROCEDURES. See Enclosures 3 through 15.

7. EFFECTIVE DATE. This Instruction is effective on the date of signature.

Ernest B. Markham Chief of Staff

Enclosures

1. References

2. Responsibilities

3. Proper Marking of Information Procedures

4. Safeguarding Procedures

5. Storage and Destruction Procedures

6. Unauthorized Disclosures

7. Security Incident Procedures

8. Original and Derivative Classification Authorities

9. Declassification Procedures

10. Fundamental Classification Guidance Review Procedures

11. Classification Challenge Procedures

12. Self-Inspection Program Procedures

13. Agency Security Classification Program and Cost-Gathering Procedures

14. Security Education and Training

15. Controlled Unclassified Information Procedures

Glossary

UNCLASSIFIED

TABLE OF CONTENTS

CHANGE LOG

ENCLOSURE 1: REFERENCES

ENCLOSURE 2: RESPONSIBILITIES

Director, NGA

Director, Security and Installations

Director, Office of Security

Chief, Information Security Branch

Director, Counter Insider Threat Office

Director, Office of Counterintelligence

Director, Human Development

Director, NGA Operations Center

Director, Office of Corporate Communications

Director, Chief Information Officer and Information Technology Services

General Counsel

Inspector General

Director, Mission Oversight and Compliance

Chief, NGA Disclosure and Release Office

Chief Analysis Security Branch

Directorate Heads and Agency Element Leads

Original Classification Authorities

Chair, Classification Management Working Group

Classification Management Working Group Members

Declassification Authorities

Personnel

ENCLOSURE 3: PROPER MARKING OF INFORMATION PROCEDURES

ENCLOSURE 4: SAFEGUARDING PROCEDURES

ENCLOSURE 5: STORAGE AND DESTRUCTION PROCEDURES

ENCLOSURE 6: UNAUTHORIZED DISCLOSURES

ENCLOSURE 7: SECURITY INCIDENT PROCEDURES

ENCLOSURE 8: ORIGINAL AND DERIVATIVE CLASSIFICATION AUTHORITIES

ENCLOSURE 9: DECLASSIFICATION PROCEDURES

ENCLOSURE 10: FUNDAMENTAL CLASSIFICATION GUIDANCE REVIEW

PROCEDURES

ENCLOSURE 11: CLASSIFICATION CHALLENGE PROCEDURES

ENCLOSURE 12: SELF-INSPECTION PROGRAM PROCEDURES

ENCLOSURE 13: AGENCY SECURITY CLASSIFICATION PROGRAM AND COST-

GATHERING PROCEDURES

ENCLOSURE 14: SECURITY EDUCATION AND TRAINING

ENCLOSURE 15: CONTROLLED UNCLASSIFIED INFORMATION

PROCEDURES

GLOSSARY

FIGURES

Figure 1. Classification Challenge Process

CHANGE LOG

Change Change

Date Revised

By Pages

Affected Change Description

1-1 08/19/2021 DXCI 4-5 Updated Table of Contents

1-2 08/19/2021 DXCI 7-8

Updated reference enclosure, including replacing DoDM 5220.22 M with 32 CFR Part 117.

1-3 08/19/2021 DXCI Throughout Updated references.

1-4 08/19/2021 OPR 18 Updated links.

1-5 08/19/2021 OPR 19 Updated link.

1-6 08/19/2021 DXCI 36

Updated LIMDIS notice based on new language in NGAI 8995.1 (Reference (ak)).

1-7 08/19/2021 DXCI 36

Updated language based on new language in NGAI 8995.1 (Reference (ak)).

ENCLOSURE 1

REFERENCES

(a) Executive Order (EO) 12829, “National Industrial Security Program,” 06 January 1993, as amended

(b) EO 13526, “Classified National Security Information,” 29 December 2009

(c) EO 13556, “Controlled Unclassified Information,” 04 November 2010

(d) 32 Code of Federal Regulations (CFR), Parts 2001 and 2003, “Classified National

Security Information,” 25 June 2010

(e) Intelligence Community (IC) Directive (ICD) 403, “Foreign Disclosure and Release of Classified National Intelligence,” 13 March 2013, Administrative Change, 07 November 2014

(f) ICD 701, “Unauthorized Disclosures of Classified National Security Information,” 22 December 2017

(g) ICD 703, “Protection of Classified National Intelligence, Including Sensitive Compartmented Information,” 21 June 2013

(h) ICD 705, “Sensitive Compartmented Information Facilities,” 26 May 2010

(i) ICD 710, “Classification Management and Control Markings System,” 21 June

(j) IC Standard Number 700-1, “Glossary of Security Terms, Definitions, and

Acronyms,” 04 April 2008

(k) Office of the Director of National Intelligence, Strategy & Engagement, Information

& Data, Information Management Division, Classification Management Branch, “Intelligence Community Markings System Register and Manual,” 30 August 2019

(U//FOUO)

(l) DoD Directive (DoDD) 5210.50, “Management of Serious Security Incidents Involving Classified Information,” 27 October 2014, Incorporating Change 2, 18 September 2020

(m) DoD Instruction (DoDI) 3224.03, “Physical Security Enterprise and Analysis Program (PSEAP),” 04 June 2020

(n) DoDI 5030.59, "National Geospatial-Intelligence Agency (NGA) LIMITED DISTRIBUTION Geospatial Intelligence (GEOINT)," 10 March 2015, Incorporating Change 2, 24 September 2020

(o) DoDI 5200.01, “DoD Information Security Program and Protection of Sensitive Compartmented Information (SCI),” 21 April 2016, Incorporating Change 2, 01 October 2020

(p) DoDI 5200.48, “Controlled Unclassified Information (CUI),” 06 March 2020

(q) DoDI 8320.03, “Unique Identification (UID) Standards for Supporting the DoD

Information Enterprise,” 04 November 2015, Incorporating Change 2, 31 August

(r) DoD Manual (DoDM) 5200.01, Volume 1, “DoD Information Security Program:

Overview, Classification, and Declassification,” 24 February 2012, Incorporating Change 2, 28 July 2020

(s) DoDM 5200.01, Volume 2, “DoD Information Security Program: Marking of Information,” 24 February 2012, Incorporating Change 4, 28 July 2020

UNCLASSIFIED

(t) DoDM 5200.01, Volume 3, “DoD Information Security Program: Protection of Classified Information,” 24 February 2012, Incorporating Change 3, 28 July 2020

(u) DoDM 5200.45, “Instructions for Developing Security Classification Guides,” 02 April 2013, Incorporating Change 2, 15 September 2020

(v) DoDM 5205.07, Volume 1, “DoD Special Access Program (SAP) Security Manual:

General Procedures,” 18 June 2015, Incorporating Change 2, 30 September 2020

(w) DoDM 5205.07, Volume 4, “Special Access Program (SAP) Security Manual:

Marking,” 10 October 2013, Incorporating Change 2, 08 September 2020

(x) DoDM 5220.22-M, “National Industrial Security Program Operating Manual,” 28 February 2006, Incorporating Change 2, 18 May 2016

(y)(x) DoDM 8570.01-M, “Information Assurance Workforce Improvement Program,” 19 December 2005, Incorporating Change 4, 10 November 2015

(z)(y) Office of the Under Secretary of Defense for Intelligence Memo, “Derivative Classification Training,” 31 January 2019

(aa)(z) NGA Directive 1025, “Mandatory Training,” 06 May 2015, Administrative Update 4, 09 May 2018

(ab)(aa) NGA Instruction (NGAI) 5200.4, “Operations Security,” 11 August 2016, Administrative Update, 10 February 2020

(ac)(ab) NGAI 5205.1, "Controlled Access Programs; Special Access Programs and Alternative Compensatory Control Measures; and Code Word, Nickname, and Exercise Term System,” 24 August 2017, Administrative Update 1, 15 January

(ad)(ac) NGAI 5205.5, Volume 1, “Sensitive Compartmented Information Security Administration: Information Security and Cybersecurity,” 07 November 2018, Administrative Update 1, 30 June 2021

(ae)(ad) NGAI 5210.8, "Physical Security Program," 17 October 2019 (U//FOUO) (af)(ae) NGAI 5240.2, “Insider Threat Program,” 19 September 2016 (U//FOUO) (ag)(af) NGAI 5401.1, “Privacy and Civil Liberties Program,” 26 January 2020 (ah)(ag) NGAI 5720.1, “Clearance for Public Release,” 12 May 2015 (ai)(ah) NGAI 5750.1, “Freedom of Information Act / Privacy Act Requests / Mandatory

Declassification Review Program,” 06 July 2018 (aj)(ai) NGAI 8040.2, “Records Management Program,” 21 October 2020 (ak)(aj) NGAI 8900.4, “The Intelligence Oversight Compliance and Awareness

Program,” 18 July 2019 (al)(ak) NGAI 8995.1, “Limited Distribution of Unclassified Geospatial Intelligence,”

02 August 2018 10 May 2021 (am)(al) NGA Manual 1455.1, “Disciplinary and Adverse Actions,” 19 February 2015, Administrative Update 11, 12 April 2019 (an)(am) NGAI Manual 7410.11, “Inspector General Operations,” 02 June 2014, Administrative Update 1, 16 November 2016 (U//FOUO) 23 May 2021 (ao)(an) “NGA Declassification Guide,” latest version (S//NF) (ap)(ao) NGA Memorandum C-2013-1188, "Designation of National Geospatial-

Intelligence Agency Senior Foreign Disclosure and Release Authority", 29 April

2013 (U//FOUO)

(ap) 32 CFR, Part 117, “National Industrial Security Program (NISPOM),” 21 December 2020

UNCLASSIFIED

ENCLOSURE 2

RESPONSIBILITIES

1. Director, NGA (D/NGA).

a. Oversees the overall management, functioning, and effectiveness of the ISP at NGA IAW Reference (r).

b. Identifies, programs, and commits necessary resources to effectively implement the requirements for the protection of CNSI, and unclassified information, including CUI, as part of the NGA ISP IAW References (p) and (r).

c. Designates the Director, Security and Installations (D/SI), as the Senior Agency

Official (SAO) responsible for overseeing, directing, and administering NGA’s ISP IAW References (o) and (r).

2. D/SI.

a. Oversees, directs, and administers the NGA ISP as the SAO IAW References (p), and (r) through (t).

b. Designates the Director, Office of Security (D/SIS), responsible for overall management, functioning, and effectiveness of the ISP IAW Reference (t).

c. Designates Director, Counter Insider Threat Office (D/SII), as the NGA point of contact responsible for conducting investigations on serious CNSI security incidents and referring and reporting those incidents and actual or suspected UDs likely to damage national security and NGA interests IAW References (r) and (af ae).

3. D/SIS.

a. Is responsible for overall management, functioning, and effectiveness of the ISP IAW Reference (t).

b. Develops and implements the ISP areas of self-inspection, declassification, training (original and derivative classification), the Original Classification Authority (OCA) program, Fundamental Classification Guidance Reviews, classification challenges, and CUI IAW References (b), (p), and (r) through (t).

c. Ensures foreign, industry, and interagency arrangements involving classified information comply with classification guidance that is current and sufficiently detailed to protect the information IAW References (b), (e), and (x ap).

d. Provides ISP guidance to Directorates, Agency Elements, and subordinate offices.

UNCLASSIFIED

e. Manages the day-to-day execution of the ISP and ensures effective ISP implementation by means of a self-inspection program as required by References (r) and (t).

f. Reports UDs and serious security incidents to SII as appropriate.

g. Provides security education and awareness products, guidance, and content for information security training IAW References (r) and (t).

h. Administers the NGA OCA Program including managing OCA delegations and tracking training.

i. Ensures OCA development of security classification guides (SCGs), including the

Consolidated NGA (CoNGA) SCG, for each NGA production and development system, program, or project that uses, exploits, or creates classified information in its processes IAW References (r), (u), and Enclosure 10 of this Instruction, and ensures final, approved SCGs are widely disseminated and available to NGA personnel.

j. Implements an effective Classification Management Program focused on the protection of NGA CNSI by overseeing the development, coordination, and dissemination of approved SCGs, including the CoNGA SCG.

k. Provides training during the New Employee Orientation Seminar (NEOS) and annual refresher training to enhance the prevention, identification, and reporting of UDs and serious security incidents, as required by References (f), (l), and (r).

l. Implements NGA’s declassification programs IAW References (r) and (t).

m. Verifies that requirements for the protection of CNSI are incorporated into contract specifications IAW References (r) and (x ap).

n. Manages the Workforce Support Centers (NGA Campus East and West) which provide initial information security education and training for contractors.

o. Chairs the Classification Management Working Group (CMWG).

4. Chief, Information Security Branch (SISGC).

a. Initiates the initial or annual training requirement for each OCA.

b. Manages the classification challenge process.

c. Manages the self-inspection program.

d. Manages the Agency security classification program and cost-gathering procedures.

e. Delivers security training to the NGA workforce.

f. Implements, manages, and oversees the CUI program.

5. D/SII.

a. Oversees the detection and investigation of security incidents involving NGA information systems (ISs) and protects NGA information technology (IT) resources in collaboration with the Director, Chief Information Officer and IT Services (D/CIO-T).

b. Ensures protection of CNSI by directing a security inquiry and/or a security investigation for incidents involving classified information as follows:

(1) Investigating all spills of classified information and violations of NGA IT and cybersecurity policy on NGA ISs IAW References (t) and (ad ac).

(2) Assisting with classified messaging incident clean up on affected ISs.

(3) Investigating reports of misuse and UDs involving NGA network resources.

(4) Providing support to the Inspector General (IG) by initiating a security inquiry into cyber- or IS-related fraud, waste, and abuse cases.

(5) Coordinating with the IG on findings of an ongoing inquiry or investigation for their potential investigative consideration.

(6) Investigating all matters involving the mishandling of classified information, including hardcopy documents or materials.

(7) Managing investigations, reporting, and mitigation of security incidents, violations, and infractions IAW Reference (f) and (t).

(8) Conducting investigations into security violations and infractions, as appropriate IAW Reference (f) and (t).

(9) Conducting security inquiries and investigations into the unauthorized introduction or inappropriate removal of items or equipment from NGA-accredited SCI Facilities (SCIFs) as authorized by law, policy, or regulation.

(10) Providing investigative support to Department of Justice (DOJ) and law enforcement agencies as required.

(11) Distributing reports of findings and investigative results within NGA. Liaises and provides reports of findings to DOJ and law enforcement agencies or other entities concerning the outcome of inquiries and investigative issues in coordination with the IG.

UNCLASSIFIED

(12) Serving as the NGA representative to the Intelligence Community Security Coordination Center.

c. Manages the UD program and serious security incidents through the following:

(1) Establishing a process for responding to and reporting UDs to the Office of the Under Secretary of Defense for Intelligence and Security (OUSD(I&S)) and Office of the Director of National Intelligence (ODNI) IAW References (f), (l), (r) and (t).

(2) Ensuring the opening and conducting of an inquiry for a reported potential UD or serious security incident and conducting a CNSI damage assessment.

(3) Maintaining a Case Management email address to receive reports of UDs and serious security incidents.

(4) Conducting security inquiries into UDs of CUI, including incidents involving personally identifiable information (PII).

(5) Reporting each actual or suspected UD of CNSI to OUSD(I&S) IAW

Enclosure 6 of Reference (t) via the Joint Worldwide Intelligence Communications System (JWICS) and to the ODNI IAW Reference (f).

(6) Ensuring that all UDs are reported and managed IAW with References (f) and

(t).

(7) Referring matters to OUSD(I&S) when the responsibility for investigation of a

UD or serious security incident is unclear or is shared with another DoD Component IAW Reference (l).

(8) Coordinating reporting of serious security incidents involving an intelligence activity or intelligence personnel with the General Counsel IAW Reference (ak aj).

(9) Taking measures to prevent the recurrence of UDs and serious security incidents.

(10) Establishing internal NGA communications with appropriate Directorates and

Agency Elements to ensure awareness and enable reporting of potential UDs.

(11) Keeping the IG apprised of findings of an ongoing inquiry or investigation supported by SII personnel.

d. Oversees the identification, reporting, investigation, and referral of UDs and serious security incidents referred to SII by the OIG or SIS.

UNCLASSIFIED

e. Coordinates with the Director, Mission Oversight and Compliance (D/MOC), when inquiry or investigation reveals compromise, loss, or UD of protected information including PII.

6. Director, Office of Counterintelligence (D/SIC), coordinates with SII as appropriate to review NGA CNSI that is suspected of being a UD to ensure it was not previously authorized for release.

7. Director, Human Development, ensures that NGA personnel assigned to an external assignment that do not have access to NGA’s mandatory training courses are granted appropriate reciprocal training credit if they complete the host agency training and provide the training certificate.

8. Director, NGA Operations Center, communicates notifications of UD information from Directorates/Agency Elements or SII, to the D/NGA, as appropriate.

9. Director, Office of Corporate Communications, addresses all inquiries from the news media related to UDs and communicates information to D/NGA and the workforce.

10. D/CIO-T oversees the detection of security incidents involving NGA ISs and protects NGA IT resources in collaboration with D/SII.

11. General Counsel coordinates with the D/SII on the reporting of serious security incidents involving an intelligence activity or intelligence personnel.

12. Inspector General investigates any UDs that are criminal in nature when the Federal Bureau of Investigation and defense criminal investigative organizations have declined to investigate. The Inspector General then forwards results of all investigations to the DOJ or other law enforcement agencies as appropriate. IAW (Reference (an am)).

Refers UDs and serious security incidents to D/SII as appropriate.

13. D/MOC.

a. Reports security incidents that involve Questionable Intelligence Activities (QIAs) or Significant or Highly Sensitive Matters (S/HSM) to the Defense Senior Intelligence Oversight Official IAW Reference (ak aj).

b. Reports security incidents that involve the compromise, loss or UD of PII to the

Defense Privacy, Civil Liberties and Transparency Division IAW Reference (ag af).

14. Chief, NGA Disclosure and Release Office (C/NDRO), coordinates with D/SII and Chief, Analysis Security Branch (C/APXA) as appropriate to review NGA CNSI that is suspected of being a UD to ensure it was not previously authorized for release.

15. C/APXA coordinates with D/SII and C/NDRO as appropriate to review NGA CNSI that is suspected of being a UD to ensure it was not previously authorized for release.

16. Directorate Heads and Agency Element Leads.

a. Support the SAO in the management and functioning of the ISP.

b. Provide respective expertise to assess UDs and serious security incidents.

c. Ensure UD reviews are added to applicable standard operating procedures and duty descriptions for positions that review open-source material.

d. Initiate a disciplinary or adverse action against personnel who disclose CNSI, CUI, and unclassified information that has not been approved for release IAW References (p) and (am al).

e. Comply with D/SIS tasking to provide information in support of Standard Form-

311, “Agency Information Security Program Data,” data collection IAW Enclosure 13.

f. Ensure that their assigned personnel complete and/or receive security education and training IAW Reference (t).

17. OCAs.

a. Complete annual training in original classification IAW References (b) and (t).

b. Certify authorities, in writing, through a signed OCA agreement indicating that they are aware of limitations of their authority, sanctions that may be imposed, and their duties and responsibilities IAW Reference (b) and Enclosure 5 of Reference (t).

c. Ensure proper security classification, avoidance of over/under-classification, and review of classified information for declassification.

d. Classify information up to the TOP SECRET level and identifies specific classification category(ies) and reason(s) for classifying the information IAW References (r), (t), and (u).

e. Make original classification determination and considers whether the UD of that information reasonably could be expected to cause identifiable or describable damage to national security IAW References (b), (r), and (t).

f. Issue new or updates to an existing SCG, including the CoNGA SCG for each IS, plan, program, or project involving classified information and ensure it is declared current at least once every five years IAW References (r) and (u).

g. Adjudicate classification challenges, whether formal or informal.

h. Serve as a Declassification Authority (DA) IAW References (b) and (r).

18. Chair, CMWG (C/CMWG).

a. Leads the CMWG as a networking organization made up of OCAs or their designees for the purpose of standardizing SCGs, including the CoNGA SCG, and discussing other related topics of interest.

b. Coordinates with CMWG members to ensure their respective Directorate or

Agency Element complies with information security requirements IAW Reference (r).

19. CMWG Members support the C/CMWG by standardizing SCGs, including the CoNGA SCG, and discussing other related topics of interest.

20. DAs carry out declassification responsibilities for NGA equity information up to TOP SECRET IAW References (b) and (r).

21. Personnel.

a. Properly protect CNSI, CUI, and unclassified information under their custody and control IAW this Instruction and References (p), and (r) through (t). All NGA officials who hold command, management, or supervisory positions have specific, non-delegable responsibility for the quality and effectiveness of implementing and managing the ISP within their areas of responsibility.

b. Complete all mandatory training requirements IAW Enclosure 14 of this

Instruction.

c. Report all IS incidents, known or suspected classified data spill incidents, as well as classified material mishandled in any other ways, such as physical classified material leaving a SCIF without appropriate approval, immediately to SII.

d. Report to SII, the appearance of any CNSI, CUI, or unclassified information not approved for public release in the public media (e.g., Internet sites, newspapers, television, radio, magazines, etc.) or any questioning by a media representative regarding UDs.

e. Ensure proper classification of CNSI, CUI, and unclassified information and, as appropriate, challenge information believed to be improperly classified.

f. Observe and respect original classification decisions and the requirements for derivative classification as a Derivative Classification Authority (DCA), IAW References (b), (i), and (r), and Enclosure 8 of this Instruction.

ENCLOSURE 3

PROPER MARKING OF INFORMATION PROCEDURES

1. Purpose. This Enclosure provides the main responsibilities for NGA personnel with regard to marking CNSI and CUI. Appropriate marking of CNSI and CUI is key to preventing UDs and protecting national security.

2. Requirement. It is the responsibility of all NGA personnel to ensure they are knowledgeable of the security requirements for marking CNSI and CUI IAW References (i), (k), and (s).

3. General Guidelines.

a. The proper marking of classified information is the specific responsibility of all personnel. DCAs refer to the source document(s), SCG(s), or other guidance issued by an OCA when determining the markings to apply. The highest level of classified information contained in a document appears in a way that distinguishes it clearly from the informational text and is conspicuous enough to alert anyone handling the document that it is classified.

b. The holder of an improperly marked document contacts the document originator to obtain correct markings and applies those markings as required.

c. No classification or other security markings may be applied to any article or portion of an article that has appeared in a newspaper, magazine, or other public medium. If an article is evaluated to see whether it contains classified information, the results of the review are to be recorded separately. The article and the results of the review may be filed together IAW Reference (s).

d. To facilitate information sharing and declassification processes, when practicable, a classified attachment, addendum, annex, enclosure, or similar section is used when classified information constitutes only a small portion of an otherwise unclassified document. Alternately, a separate product that permits dissemination at the lowest level of classification possible or in unclassified form may be prepared.

e. If a classified document has components likely to be removed and used or maintained separately, mark each component as a separate document. Examples are annexes or appendices to plans, major parts of reports, or reference charts in a program directive. If an entire major component is unclassified, it may be marked on its face, top, and bottom “UNCLASSIFIED,” and a statement added: “All portions of this (annex, appendix, etc.) are UNCLASSIFIED.” No further markings are required on such a component.

f. Particular attention must be given to information intended for display on websites to ensure that the information carries all appropriate markings. Since web technologies

UNCLASSIFIED

permit data access without viewing the initial and/or cover pages, page and portion markings are especially important to ensure users are alerted to the presence of classified information and the level of protection it requires.

g. Metadata and/or other tags are applied to electronic data. Metadata and tags are used to the greatest extent possible to facilitate electronic handling and dissemination of classified and CUI information. (Reference (q))

(1) Security metadata for classified and CUI electronic information, to the extent possible, identifies the classification level and any control and dissemination caveats required.

(2) Documents released in electronic format have their metadata and other electronic tags and labels reviewed for classified information prior to release. Metadata and other electronic tags and labels associated with information in electronic format is updated or deleted, as necessary, to reflect the actual classification and other attributes of declassified or downgraded information. Care must be taken to ensure the metadata accurately reflects the information it describes and that classified attributes are not released with unclassified data.

h. Dissemination control and handling markings identify limitations on releasability of, or distribution of the information IAW References (e) and (ap ao). These markings are in addition to and separate from the level of classification.

(1) Only those intelligence dissemination control and handling markings approved by the Information Security Oversight Office (ISOO) or, with respect to the IC by the Director of National Intelligence for intelligence and intelligence-related information, may be used by NGA to indicate dissemination controls of classified information IAW References (b), (i), and (s). Personnel can refer to the marking guidance on the SBU at https://www.intranet.nga.mil/org/SI/SitePages/CoNGA.aspx and on NGANet at https://www.intranet.nga.ic.gov/org/si/Sitepages/GEOINT_Protection_Doc_Viewer.aspx.

(2) When used, intelligence dissemination controls and handling markings appear at the top and bottom of each page after the level of classification, and within portion markings for classified information.

https://www.intranet.nga.mil/org/SI/SitePages/CoNGA.aspx https://www.intranet.nga.ic.gov/org/si/Sitepages/GEOINT_Protection_Doc_Viewer.aspx

ENCLOSURE 4

SAFEGUARDING PROCEDURES

1. Purpose. Appropriate safeguarding of CNSI, CUI, and unclassified information is key to preventing UDs and protecting national security.

2. Requirement. Personnel are responsible for the proper safeguarding of CNSI, CUI, and unclassified information in their possession. In general, personnel must ensure:

a. Classified and CUI information is only shared with individuals who have the appropriate clearance and accesses, a signed Non-Disclosure Agreement, and a need-to-know for a specific and official US Government purpose. Sharing of information poses a dual responsibility not only on the individual disclosing the information, but on the recipient as well.

b. All unclassified information is reviewed and approved for release through the NGA public release process before it is provided to the public IAW References (p) and (ah ag).

c. CNSI, CUI, and unclassified information is only introduced into and processed on

ISs accredited for such use.

d. TOP SECRET/Sensitive Compartmented Information (SCI) is only processed on a network that resides on JWICS or other properly accredited IS. The NGANet is an example of a properly accredited IS. Controlled Access Programs (CAPs) and Special Access Programs (SAPs) may require processing on separate physical or logical networks.

e. Collateral SECRET-level information is processed on a network that resides on the Secure Internet Protocol Router Network (SIPRNet) or JWICS. SECNet resides on the SIPRNet. NOTE: Secret-level SCI information may NOT be processed on either SIPRNet or NGA SECNet.

f. All unclassified information and CUI is processed on the Non-classified Internet

Protocol Router Network (NIPRNet), SIPRNet, and JWICS. The Sensitive but Unclassified (SBU) network resides on NIPRNet.

g. All CNSI, CUI, and unclassified information that does not comprise permanent records is destroyed when no longer needed IAW Reference (aj ai). If the physical media is classified, it should be destroyed following the guidance provided by the National Security Agency at:

https//www.nsa.gov/resources/everyone/media-destruction https://www.nsa.gov/Resources/Media-Destruction-Guidance/ (link available via SBU).

See the SI Webpage for local NGA procedures at:

file://///Titanium/office/office11/Corporate_Operations/DXCI_Policy_&_Support_Agreements/CPO%20Non-Records/KC%20Working%20Folders/SI/NGAI_5200_1_Information_Security/2_Draft/https/www.nsa.gov/resources/everyone/media-destruction https://www.nsa.gov/Resources/Media-Destruction-Guidance/

UNCLASSIFIED

https://ngaonline/sites/si/Pages/Classified%20Materials%20Handling.aspx.

https://www.intranet.nga.mil/org/SI/SitePages/Classified_Material_Handling.aspx.

h. Storage of CNSI, CUI, and unclassified information is IAW References (p) and (t).

Storage of SCI must be IAW References (g), (h), (o), and (t).

i. Transporting and/or mailing of classified collateral information and CUI is done

IAW References (p) and (t). Transport and/or mail of SCI must be IAW References (g) and (t) and follow the guidance provided on the SI Webpage at:

https://ngaonline/sites/SI/Pages/Classified%20Materials%20Handling.aspx https://www.intranet.nga.mil/org/SI/SitePages/Classified_Material_Handling.aspx, Classified Material Handling.

j. Procedures for establishment, oversight, and safeguarding requirements of SAP information are followed as described in References (v) and (w).

3. Creation, Handling, and Safeguarding of Working Papers. Working papers are defined as documents or materials, regardless of the media, which are expected to be revised prior to the preparation of a finished product for dissemination or retention.

a. Working papers containing classified information are dated when created, marked with the highest classification of any information contained in them, protected at that level, and if otherwise appropriate, destroyed when no longer needed.

b. When any of the following conditions applies, working papers are controlled and marked in the same manner prescribed for a finished document at the same classification level:

(1) Released by the originator outside the originating activity;

(2) Retained more than 180 days from the date of origin; or

(3) Filed permanently.

4. Bulky material, equipment, and facilities, etc., are clearly identified in a manner that leave no doubt about the classification status of the material, the level of protection required, and the duration of classification.

https://ngaonline/sites/si/Pages/Classified%20Materials%20Handling.aspx https://www.intranet.nga.mil/org/SI/SitePages/Classified_Material_Handling.aspx https://ngaonline/sites/SI/Pages/Classified%20Materials%20Handling.aspx https://www.intranet.nga.mil/org/SI/SitePages/Classified_Material_Handling.aspx

ENCLOSURE 5

STORAGE AND DESTRUCTION PROCEDURES

1. Purpose. This Enclosure describes procedures for appropriate storage and secure destruction of CNSI, CUI, and unclassified information by authorized means to prevent UDs and protect national security.

2. Requirement. It is the responsibility of all personnel to ensure they are knowledgeable of the security requirements for the storage and destruction of CNSI, CUI, and unclassified information IAW References (b), (g), (p) and (t).

3. General Guidelines.

a. Classified information is secured under conditions adequate to deter and detect access by unauthorized persons IAW Reference (t). The requirements specified in Reference (t) represent acceptable security standards. Holdings of classified material should be reduced to the minimum required to accomplish the mission. (Reference (t))

b. The General Services Administration establishes and publishes minimum standards, specifications, and supply schedules for containers, vault doors, modular vaults, alarm systems, and associated security devices suitable for storing and protecting classified information. Reference (m) describes requirements for acquiring physical security equipment for use within DoD. (Reference (t))

c. ODNI establishes security requirements for SCIFs (Reference (h)), which are expanded upon for NGA within Reference (ae ad).

d. Reference (p) specifies storage and destruction requirements for CUI.

ENCLOSURE 6

UNAUTHORIZED DISCLOSURES

1. Purpose. This Enclosure describes procedures for responding to UDs.

2. A UD is a communication or physical transfer of CNSI, CUI, or unclassified information to an unauthorized recipient, such as uncleared individuals or the media.

3. Personnel finding classified information in the public media (e.g., newspapers, magazines, and books) and on public internet sites report it to the UD mailbox at NGASIII@coe.ic.gov. Examples of other types of disclosures may include, but are not limited to:

a. UDs to an international organization, foreign power, agent of foreign power, or terrorist organization.

b. Loss or compromise of classified information storage media or equipment.

c. Loss or compromise of classified information revealing NGA intelligence sources or methods or US intelligence requirements, capabilities, and relationships with the US Government.

4. Personnel notify SII of a UD via secure email to NGASIII@coe.ic.gov. SII provides a copy of the NGA CNSI suspected of being leaked in the UD to the D/SIC, C/NDRO, and C/APXA who reviews the information to ensure it was not previously authorized for release. SII also provides a copy to the Deputy Director/NGA and D/SI for situational awareness. SII refers UDs to D/MOC, as appropriate, to ensure reportable incidents are communicated to the Defense Senior Intelligence Oversight Official IAW References (ag

af) and (ak aj). Any incidents rising to the level of a QIA or S/HSM are reported to the MOC Intelligence Oversight Division by the most expeditious means IAW Reference (ak aj).

5. Any UD of classified information regardless of the cause requires immediate reporting, investigation, and submission of a damage assessment describing the impact on national security.

6. If the subject of a UD investigation is a member of another intelligence agency, the case is referred to the appropriate investigative entity.

7. All SAP and CAP UDs will be handled IAW Reference (ac ab).

ENCLOSURE 7

SECURITY INCIDENT PROCEDURES

1. Purpose. This Enclosure describes procedures for responding to security incidents.

2. Personnel.

a. Personnel must properly handle and protect CNSI, CUI, and unclassified information in their possession or control, prevent security incidents, and report all instances of compromise or potential compromise of CNSI and CUI IAW References (l), (p), (r), and (t).

b. Report all IS incidents, known or suspected CNSI and CUI data spill incidents, as well as CNSI and CUI material mishandled in any other ways, such as physical classified material leaving a SCIF without appropriate approval, immediately to SII.

c. Report incidents via secure email to NGASIII@coe.ic.gov; secure phone at

578-9009; or unclassified email at NGASIII@nga.mil or unclassified phone at 571-557-9009; after hours telephone number is 571-557-1000 (SIP).

d. Fully cooperate during the investigative process and provide complete, prompt, accurate, and truthful responses for testimony and related documents.

3. Security Incident Terminology. A security incident is an act that constitutes a threat to a security program or is a deviation from existing governing security regulations.

Security incidents may be portrayed as security infractions or security violations.

(Reference (j))

4. All security incidents are thoroughly investigated by SII.

5. Any loss of CNSI regardless of the cause requires immediate reporting, investigation, and submission of a damage assessment describing the impact on national security. An incident rising to the level of a QIA or S/HSM is reported to the MOC Intelligence Oversight Division by the most expeditious means IAW Reference (ak aj). Reportable incidents are communicated to the Defense Senior Intelligence Oversight Official IAW Reference (ak aj).

6. All SAP and CAP security incidents will be handled IAW Reference (ac ab).

ENCLOSURE 8

ORIGINAL AND DERIVATIVE CLASSIFICATION AUTHORITIES

1. Purpose. This Enclosure describes the OCAs within NGA and the responsibility of each with respect to the ISP.

2. An OCA is a specific position authorized by the Secretary of Defense with the responsibility and authorization to determine the original classification of information collected, processed, or analyzed by NGA. An OCA makes the initial classification determination of NGA information that, in the interest of national security, requires protection against UD. (Reference (r))

a. OCAs make classification determinations within their respective areas of responsibility, up to TOP SECRET, IAW References (b) and (r); these classification determinations must be communicated to the workforce via a memorandum or in a SCG, including the CoNGA SCG, assembled and organized IAW References (r) and (u). The responsibilities of the OCA cannot be redesignated or delegated further.

Additional OCAs may be requested or cancelled by the Secretary of Defense IAW Reference (r).

b. Prior to exercising their authority, and annually thereafter, each OCA must receive training in original classification unless a waiver has been granted IAW Reference (t).

(1) OCAs certify, by signing the OCA agreement that they have received training in the fundamentals of proper security classification (including the avoidance of over-classification) and declassification, the limitations of their authority, the sanctions that may be imposed, and OCA duties and responsibilities IAW Enclosure 5 of Reference (t).

(2) OCAs who do not complete the mandatory annual training will have their classification authority suspended by D/NGA IAW References (r) and (t). The suspension will be lifted when the OCA completes the training.

c. When making an original classification determination, the OCA considers whether the UD of the information could result in damage to national security, and the OCA is able to identify or describe the potential damage IAW References (b), (r), and (t).

3. D/SIS ensures that delegation letters and OCA training certifications are maintained and can be retrieved by the office assigned that responsibility when requested by appropriate authorities IAW References (r), (t), and (aj ai).

4. D/SIS is responsible for tracking the training status of NGA OCAs. At the appropriate time, SISGC initiates the initial or annual training requirement for each OCA.

5. A DCA is any individual with the authority to make derivative classification decisions for information they are producing for an official government purpose. All NGA

UNCLASSIFIED

personnel who possess a security clearance, need-to-know, have executed a Classified Information Non-Disclosure Agreement (SF-312), have completed derivative classification training, and have authorized access to NGA classified ISs are DCAs.

(References (r) and (t))

a. Derivative classification is the process of incorporating, paraphrasing, restating, or generating in new form information that is already classified, and marking the newly developed material consistent with the classification markings that apply to the source information. This includes the classification of information based on classification guidance. The duplication or reproduction of existing classified information is not derivative classification. (Reference (r))

b. It is the responsibility of all DCAs to follow the requirements for derivative classification when generating classified information. Failure to comply with these requirements may result in security incidents.

c. DCA initial training requirements are met for government employees and military personnel during NEOS scheduled for completion within 30 days of arrival to NGA.

d. DCA initial training requirements are met for contractor personnel through completion of Annual Security Awareness Training online within 30 days of hiring.

e. DCA recurring training requirements are met when NGA employees, military personnel, and contractors complete the Annual Security Awareness Training online.

f. DCAs will complete mandatory security awareness training requirements in order to maintain accesses to classified information and ISs IAW References (y x), (z y), and (aa z).

ENCLOSURE 9

DECLASSIFICATION PROCEDURES

1. Purpose. This Enclosure describes the declassification procedures for DAs.

2. Classified NGA equities may be declassified by the D/NGA or the cognizant OCA.

The D/NGA and D/SI, as the SAO for the NGA ISP, may designate DAs for NGA equities.

a. DAs are required to carry out declassification procedures IAW References (b), (i), and (r), as well as NGA’s latest Interagency Security Classification Appeals Panel (ISCAP)-approved Declassification Exemption Guide.

b. NGA DAs declassify NGA information up to TOP SECRET.

3. The SIS Declassification Team, IAW Reference (r), conducts an automatic, systematic, or mandatory declassification review (described below) of permanent records containing NGA predecessor information, including referral of non-NGA equity classified information to other departments and agencies, and identification and exclusion from declassification of restricted data and formerly restricted data in the event of its discovery IAW Reference (b).

a. Automatic declassification is the declassification of information based solely upon the occurrence of a specific date or event as determined by the OCA unless an exemption is issued by the D/NGA or OCA IAW Reference (b). See Reference (ai ah) for additional information.

b. A systematic declassification review is a review of permanent historical classified records that were previously deemed exempt from automatic declassification. After a thorough review, the records are accessioned and transferred to the National Archives and Records Administration. Before NGA records that were exempted from automatic declassification are declassified, they must be reviewed by a DA. (References (b) and (d))

c. Mandatory declassification review is the review of records requested by the general public, presidential libraries, and IC partner agencies for classified information originating within NGA. DAs conduct line-by-line reviews and determine whether the records can be declassified in full or in part, or must be withheld in their entirety; DAs provide their response to the requestor IAW References (b), (d), and (r). See Reference (ai ah) for detailed procedures.

d. The OCA, IAW procedures provided in Reference (ao an), may direct discretionary declassification actions.

UNCLASSIFIED

4. Declassification guides are updated every five years and submitted to the ISOO for File Series Exemption every 10 years IAW Reference (r).

5. Any information that is inadvertently subject to declassification without proper authority, as determined by an OCA with jurisdiction over the information, remains classified and administrative action must be taken to restore banner and portion markings and any dissemination controls, as appropriate.

6. Any determination that information has been declassified without proper authority must be promptly reported in writing to the ISOO.

ENCLOSURE 10

FUNDAMENTAL CLASSIFICATION GUIDANCE REVIEW PROCEDURES

1. Purpose. This Enclosure describes procedures for the responsible OCA to maintain timely and precise classification guidance--a prerequisite IAW References (b) and (r) to effectively and efficiently secure information and ensure that security resources are expended to protect only that information warranting protection in the interests of national security. The OCA issues an SCG, including the CoNGA SCG for each IS, plan, program, or project involving classified information and ensures it is reviewed and updated at least once every five years, or as needed, IAW Reference (r).

2. The tasking to complete the Fundamental Classification Guidance Review is generated by D/SIS no later than four years after the last classification review (or as warranted by changes in the guidance or the evolution of the information).

a. SIS initiates the review and solicits input from NGA Directorates and Agency

Elements, and external organizations that have an interest in the subject matter of the SCG, including the CoNGA SCG.

b. Input provided by subject matter expert updates the contents of the SCG, including the CoNGA SCG. The updated SCG is routed through the appropriate NGA Directorates and Agency Elements, and external organizations for coordination/concurrence.

c. The final SCG, including the CoNGA SCG is signed by the appropriate OCA who has authority over the SCG subject matter.

d. Signed SCGs, including the CoNGA SCG are submitted to the OUSD(I&S), ODNI, and the Defense Technical Information Center for posting/record keeping based on the classification of the guide. The updated SCG, including the CoNGA SCG, is also posted to NGA’s Classification Management web page and the CoNGA SCG is posted to the NGA’s Security Management and Resource Tool available here:

https://intelshare.intelink.ic.gov/sites/smrt/SitePages/SMRT%20Home.aspx.

https://intelshare.intelink.ic.gov/sites/smrt/SitePages/SMRT%20Home.aspx

ENCLOSURE 11

CLASSIFICATION CHALLENGE PROCEDURES

1. Purpose. This Enclosure provides the procedures to follow when information is suspected to be misclassified (over-classified or under-classified). Figure 1 illustrates the classification challenge process.