ATTACHMENT_B.DOCX

ATTACHMENT B

ADDITIONAL GUIDELINES FOR CONTROLLED UNCLASSIFIED

INFORMATION (CUI)

1. Controlled Unclassified Information (CUI): CUI is unclassified information requiring application of access, distribution controls, and protective measures which meets the standards for safeguarding and dissemination controls pursuant to statute, and government-wide policies under Executive Order (EO) 13556. The types of information considered CUI for the program are technical data and information marked Unclassified//For Official Use Only (U//FOUO) by the U.S. Government. Examples of technical data consist of research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, and related information, and computer software documentation. The Contractor shall adhere to the below guidelines for handling U//FOUO information accompanied by DoDM 5200.01-V4, “DoD Information Security Program:

Controlled Unclassified Information (CUI)”, Army Regulation (AR) 25-55, “The Department of the Army Freedom of Information Act Program”, AR 25-2, “Information Assurance” and AR 25-1, “Army Information Technology”.

2. Definition of U//FOUO Information: Information that has not been given a security classification pursuant to the criteria of an EO, but which may be withheld from the public for one or more of the reasons cited in Freedom of Information Act (FOIA) Exemptions 2 through 9, shall be considered as being U//FOUO.

3. Identification of Markings: The U//FOUO marking is assigned to information at the time of its creation in a DoD User Agency. It is not authorized as a substitute for a security classification marking but is used on official government information that may be withheld from the public as listed above. An unclassified document containing U//FOUO information shall be marked UNCLASSIFIED//FOR OFFICIAL USE ONLY or U//FOUO in bold letters at the bottom on the outside of the front cover (if any), on each page containing U//FOUO information, and on the outside of the back cover IAW DoDM 45200.01-V4.

4. Dissemination and Transmission of U//FOUO Information: No person may have access to information designated as U//FOUO unless that person has been determined to have a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose. Until U//FOUO status is terminated, the U//FOUO information may be disseminated within DoD Components and between officials of DoD Components and DoD contractors to conduct official business for the Department of Defense, provided that dissemination is consistent with any further controls imposed by a distribution statement. Recipients shall be made aware of the status of such information, and transmission shall be by means that preclude unauthorized public disclosure. Transmittal documents shall call attention to the presence of U//FOUO attachments. Removal of the U//FOUO marking can only be accomplished by the originator or other competent authority IAW DoDM 5200.01-V4.

5. Transporting U//FOUO Information: Records containing U//FOUO information shall be transported in a manner that precludes disclosure of the contents. When not commingled with classified information, U//FOUO information may be sent via first-class mail or parcel post.

Bulky shipments, such as distributions of U//FOUO directives or testing materials, that otherwise qualify under postal regulations may be sent by fourth-class mail. When material marked U//FOUO is removed from storage, attach DA Label 87 (For Official Use Only Cover Sheet).

6. Electronically Transmitted Messages: The contractor shall not transmit any U//FOUO information electronically over the Internet unless it is encrypted by Federal Information Processing Standard (FIPS) 140-2 standard. All messages will be transmitted in accordance with (IAW) Army Regulation (AR) 25-1. Documents containing U//FOUO shall not be posted on websites available to the public.

7. Telephone Usage: U//FOUO information may be discussed over the telephone lines with DoD Components and between officials of DoD Components and DoD contractors to conduct official business for the Department of Defense.

8. Storage of U//FOUO Information During Duty Hours: Records/data determined to be U//FOUO shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for access to this information.

9. Storage of U//FOUO Information During Nonduty Hours: At the close of business, U//FOUO records shall be stored so as to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks, etc., is adequate when normal U.S.

Government or government-contractor internal building security is provided during non-duty hours. When such internal security control is not exercised, locked buildings or rooms provide adequate after-hours protection. If such protection is not considered adequate, U//FOUO material shall be stored in locked receptacles such as file cabinets, desks, or bookcases.

10. Termination: The originator or other competent authority, e.g., initial denial and appellate authorities, shall terminate U//FOUO markings or status when circumstances indicate that the information no longer requires protection from public disclosure.

11. Disposal: Documents containing U//FOUO shall be destroyed by shredding. When a mechanical automatic shredder is not available, non-record copies of U//FOUO materials may be destroyed by tearing each copy into pieces to preclude reconstructing, and placing them in regular trash containers. CD-ROM/DVD copies of U//FOUO documents will be destroyed by breaking the CD media into pieces or placing into a mechanical shredder.

12. Unauthorized Disclosure: The contractor shall take appropriate action to ensure there is no unauthorized disclosures of U//FOUO information. If an unauthorized disclosure does occur, the respective DoD Component that originated the U//FOUO information shall be informed of its unauthorized disclosure. The unauthorized disclosure of U//FOUO information protected by the Privacy Act may result in criminal sanctions.