Attachment_0001_-_CUI_Distro_VERSION_A.pdf

W56HZV-15-A-0007

Call Order 0005 Attachment 001

Guidelines for Controlled Unclassified Information

Revised: 01 MARCH 2017 Page 1 of 3

GUIDELINES FOR CONTROLLED UNCLASSIFIED

INFORMATION

1. General: There are types of information that are not classified but that require application of access and distribution controls and protective measures for a variety of reasons. This information is known as “controlled unclassified information (CUI).” The types of information considered CUI for this program are information marked “For Official Use Only” by the U.S. Government and any technical data. When handling CUI material, all personnel are to comply with these requirements and follow their company policy and/or applicable Proprietary Information Agreements (PIA) concerning the protection of proprietary information in situations not clearly stated herein.

The Contractor shall provide a copy of their company’s CUI policy if so requested by the PCO.

2. Technical Data Description: Any recorded information related to experimental, developmental, or engineering works that can be used to define an engineering or manufacturing process, or can be used to design, procure, produce, support, maintain, operate, repair, or overhaul program material. The data may be graphic or pictorial delineations in media (e.g., computer software, drawings, or photographs), text in specifications, related performance or design documents, or computer printouts.

Examples of technical data include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, and related information, and computer software documentation.

3. For Official Use Only (FOUO) Information Description: “For Official Use Only (FOUO)” is a Government designation applied to unclassified information that may be exempt from mandatory release to the public under the Freedom of Information Act (FOIA). FOUO information includes information identified as such in the Security Classification Guide or information from a government document marked FOUO.

4. CUI Markings: Markings shall include the statements identified below. These statements shall appear on the first, title page or front cover of each document. This does not preclude additional mandated markings as may be required by the contract such as Competition Sensitive Information, Proprietary, etc.

DISTRIBUTION STATEMENT B. Distribution authorized to U.S. Government agencies only for

Administrative or Operational Use. Date of determination is date product is generated. Other requests for this document shall be referred to Deputy Under Secretary of the Army for Test and Evaluation, 102

ARMY PENTAGON WASHINGTON, DC 20310-0102.

Data is to be shared only with US Government personnel. Improper disclosure or use of the data is subject to criminal penalties. It is not releasable in any form without DUSA-T&E approval to any

Government contractor or third party. All information, whether survey derived or other, may only be stored on a U.S. Federal Government server system and not that of any contractor, FFRDC, non-profit or other entity (one exception: AT Kearney under contract to produce document).

FOR OFFICIAL USE ONLY

Attachment 001

Revised: 01 MARCH 2017 Page 2 of 3

This statement shall appear on internal pages:

5. Protection of CUI Information

A) Access: CUI may be released only to an individual who has a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose. Information in any media format may only be disseminated on a need-to-know basis. The need-to-know restricts the use or dissemination of CUI data to those individuals or organizations with direct affiliation with the given program or project.

Further dissemination of such information will be at the discretion of the Government Security Manager. Personnel no longer requiring access to CUI must delete or surrender any in their possession and terminate future access to it.

B) Storing/Handling: During working hours, take reasonable steps to minimize risk of access to CUI by unauthorized personnel. After working hours, store CUI information in locked desks, file cabinets, bookcases, locked rooms, or similar means. Do not display CUI in public places (e.g., airports, airplanes, restaurants).

Computers used to process CUI do not need to be accredited for classified use. Do not process CUI on public computers (e.g., those available for use by the general public in kiosks, hotel business centers) or computers that do not have access control.

Personally owned computers are not authorized to process CUI. Mobile devices used to store CUI electronically (e.g., company-issued laptops, personal electronic devices [PED], removable media) must be physically protected and use NIST/NIAP-approved cryptographic products. These are available at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/cryptval/.

C) Dissemination: CUI printed documents and material may be transmitted through mail channels or hand- carried without formal courier orders. FOUO information may be disseminated to DoD personnel and DoD contractors to conduct official business for the program. If dissemination is required outside of DoD personnel or DoD contractors, contact the Government Security Manager for approval. Technical data will follow the release instructions identified in the Distribution Statement. Use secure communications whenever possible; however, land-line telephones are more secure than cellular telephones and should be used whenever available for discussions involving CUI. Transmit voice and facsimile transmissions only when you have a reasonable assurance that only authorized recipients will have access to the transmission. Digital transmission shall comply with the below:

Improper disclosure or use of the data is subject to criminal penalties, see restrictions on title page.

FOR OFFICIAL USE ONLY

http://iase.disa.mil/pki/eca http://csrc.nist.gov/cryptval/

Attachment 001

Revised: 01 MARCH 2017 Page 3 of 3

All transmission and/or dissemination of CUI identified with a Distribution Statement or marked “FOUO” (i.e., email and file transfers) must use NIST/NIAP-approved cryptographic vendors and algorithms, e.g., DoD- approved Public Key Infrastructure Certification. These are available at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/cryptval/. This encryption requirement includes passcodes to teleconferences or web conferences where there is a reasonable expectation that CUI may be discussed. When encryption is not available, a government collaborative suite (aka Integrated Digital Environment [IDE]) must be used to transmit CUI. Encrypt all wireless external data connections.

Contractor-hosted collaborative suites may be used for digital transmission and/or dissemination of CUI by personnel not located on a government backbone (e.g., NIPRNET), provided the following conditions apply:

Use only NIST/NIAP-approved cryptographic vendors and algorithms. The latest validation lists may be obtained at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/cryptval/.

Use an internally hosted service that does not use a third-party collaborative suite service provider.

All computers containing CUI must be either protected by physical isolation from all personnel without a valid need for the information or protected using NIST/NIAP-approved cryptographic products. Discretionary access control measures must be used to preclude access to CUI by users who are not authorized access to CUI. After working hours, when not in physical possession of the owner, all electronic assets containing CUI must be afforded a reasonable degree of physical protection to prevent theft of program information (e.g., locking up laptops or cable locking them to a stationary base, storing in trunk, or storing out of sight).

Do not post CUI to web pages that are publicly available or have access limited only by domain/IP restrictions. As permitted by other contract provisions, CUI may be posted to web pages that control access through the use of a DoD approved Public Key Infrastructure Certification and that provide protection via use of secure sockets, or other equivalent technologies. These are available at http://iase.disa.mil/pki/eca.

As new technologies become available in the electronics arena, care should be given to providing a reasonable degree of protection from known vulnerabilities.

The Internet is “Public Access”. CUI must be reviewed and officially approved by the United States Army Chief of Public Affairs for public release before placing on the Internet. This is not applicable when the Internet is used for e-mail transmissions and encryption is used as noted above.

http://iase.disa.mil/pki/eca

Attachment 001

Revised: 01 MARCH 2017 Page 4 of 3

6. Disposal: Destroy CUI documents by any means approved for the destruction of classified information, i.e. cross-cut shredding or other means that would make it difficult to recognize or reconstruct the information. Clear, purge, or destroy CUI on removable media IAW BBP 03-PE-O-0003 Army Information Assurance Sanitization of Media to AR 25-2. This is available at https://informationassurance.us.army.mil.

7. Report of Loss of CUI: Report any loss of CUI or loss of CUI from a contractor information system that is known to the contractor within the period of performance of this contract to the Government Security Manager. Initial reports shall be made as expeditiously as possible in all cases within 72 hours of discovery. If additional information is required after submission and review of the initial report, guidance will be provided at that time. Mark any reports For Official Use Only, exemptions 2 and 5 apply. Initial report content shall include the following information as available.

Applicable dates, including dates of compromise and dates of discovery

Threat methodology, including all known resources used (e.g. IP addresses, domain names, software tools)

Account of what actions the threat(s) may have taken on victim system/network

What information may have been compromised, exfiltrated, or lost, and its potential impact on government programs

8. Report of Cyber Intrusions: Report cyber intrusions or other compromises of CUI to your supporting counterintelligence office, which will inform the DoD-DIB Common Information Sharing Environment (DCISE). Notify the Government Security Manager of any incidents as well. Refer to Report of Loss of CUI for what needs to be reported, when, and how.