17rFOUO_Attachments_AandB.pdf

Section 00 22 16 – Attachment A – Page 1

Attachment A

Controlled Unclassified Information Non-Disclosure Agreement

I, _______________________________________, an individual official, employee, consultant, or subcontractor of or to _________________________________________________ (the Authorized Entity), intending to be legally bound, hereby consent to the terms in this Agreement in consideration of my being granted conditional access to certain information, specified below, that is owned by, produced by, or in the possession of the United States Government.

As used in this Agreement, Controlled Unclassified Information (CUI) is an over-arching term that covers any information which the loss of, misuse of, or unauthorized access to or modification of could adversely affect the national interest or the conduct of Federal programs, or the privacy to which individuals are entitled under Section 552a of Title 5, as amended, but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense or foreign policy. This includes information categorized by government agencies as: For Official Use Only (FOUO) and any other identifier used by other government agencies to categorize information as CUI. Applicable regulations governing the handling and dissemination of FOUO are DoD Manual 5200.01-V4 and Army Regulation 380-5.

I understand and agree to the following terms and conditions of my access to the information indicated above:

1. I hereby attest that I am United States citizen.

2. I hereby acknowledge that I have received a security indoctrination concerning the nature and protection of information to which I have been provided conditional access, including the procedures to be followed in ascertaining whether other persons to whom I contemplate disclosing this information have been approved for access to it, and that I understand these procedures.

3. By being granted conditional access to the information indicated above, the United States Government has placed special confidence and trust in me and I am obligated to protect this information from unauthorized disclosure, in accordance with the terms of this Agreement and the laws, regulations, and directives applicable to the specific categories of information to which I am granted access.

4. I attest that I understand my responsibilities and that I am familiar with and will comply with the standards for protecting such information that I may have access to in accordance with the terms of this Agreement and the laws, regulations, and/or directives applicable to the specific categories of information to which I am granted access. I understand that the United States Government may conduct inspections, at any time or place, for the purpose of ensuring compliance with the conditions for access, dissemination, handling and safeguarding information under this Agreement.

5. If I am represent the prime contractor, I will have my subcontractor(s) and my suppliers complete and sign Attachment A, Controlled Unclassified Information Non-Disclosure Agreement and Attachment B, Instructions for Handling and Dissemination of for Official Use Only (FOUO) Information PRIOR to releasing any copies or reproduction of any part of the solicitation documents (W9128A-17-R-0001). As the prime contractor I will keep

Section 00 22 16 – Attachment A – Page 2 a list of subcontractor(s) and suppliers who were provided the solicitation documents. I hereby agree that the Government reserves the right to ask the list of subcontractor(s) and suppliers who were provided a copy of the solicitation documents.

6. I will not disclose or release any information provided to me pursuant to this Agreement without proper authority or authorization. Should situations arise that warrant the disclosure or release of such information I will do so only under approved circumstances and in accordance with the laws, regulations, or directives applicable to the specific categories of information. I will honor and comply with any and all dissemination restrictions cited or verbally relayed to me by the proper authority.

7. I hereby agree that material which I have in my possession and containing information covered by this Agreement, will be handled and safeguarded in a manner that affords sufficient protection to prevent the unauthorized disclosure of or inadvertent access to such information, consistent with the laws, regulations, or directives applicable to the specific categories of information. I agree that I shall return all information to which I have had access or which is in my possession 1) upon demand by an authorized individual; and/or 2) upon the conclusion of my duties, association, or support to the United States Government; and/or 3) upon the determination that my official duties do not require further access to such information.

8. I hereby agree that I will not alter or remove markings, which indicate a category of information or require specific handling instructions, from any material I may come in contact with unless such alteration or removal is consistent with the requirements set forth in the laws, regulations, or directives applicable to the specific category of information. I agree that if I use information from a sensitive document or other medium, I will carry forward any markings or other required restrictions to derivative products, and will protect them in the same matter as the original.

9. I hereby agree that I shall promptly report to the appropriate official, in accordance with the guidance issued for the applicable category of information, any loss, theft, misuse, misplacement, unauthorized disclosure, or other security violation, I have knowledge of and whether or not I am personally involved. I also understand that my anonymity will be kept to the extent possible when reporting security violations.

10. If I violate the terms and conditions of this Agreement, such violation may result in the cancellation of my conditional access to the information covered by this Agreement. This may serve as a basis for denying me conditional access to other types of information, to include classified national security information.

11. I hereby assign to the United States Government all royalties, remunerations, and emoluments that have resulted, will result, or may result from any disclosure, publication, or revelation of the information not consistent with the terms of this Agreement.

12. This Agreement is made and intended for the benefit of the United States Government and may be enforced by the United States Government or the Authorized Entity. By granting me conditional access to information in this context, the United States Government may seek any remedy available to it to enforce this Agreement including, but not limited to, application for a court order prohibiting disclosure of information in breach of this Agreement. I understand that if I violate the terms and conditions of this Agreement, I could be subjected to administrative, disciplinary, civil, or criminal action, as appropriate, under the laws, regulations, or directives applicable to the category of information involved and neither the United States Government nor the Authorized

Section 00 22 16 – Attachment A – Page 3

Entity have waived any statutory or common law evidentiary privileges or protections that they may assert in any administrative or court proceeding to protect any CUI to which I have been given conditional access under the terms of this Agreement.

13. I understand that all conditions and obligations imposed upon me by this Agreement apply during the time that I am granted conditional access, and at all times thereafter.

14. Each provision of this Agreement is severable. If a court should find any provision of this Agreement to be unenforceable, all other provisions shall remain in full force and effect.

15. My execution of this Agreement shall not nullify or affect in any manner any other secrecy or non-disclosure Agreement which I have executed or may execute with the United States Government or any of its departments or agencies.

16. These restrictions are consistent with and do not supersede, conflict with, or otherwise alter the employee obligations, rights, or liabilities created by Executive Order No. 12958, as amended; Section 7211 of Title 5, United States Code (governing disclosures to Congress); Section 1034 of Title 10, United States Code, as amended by the Military Whistleblower Protection Act (governing disclosure to Congress by members of the military); Section 2302(b)(8) of Title 5, United States Code, as amended by the Whistleblower Protection Act (governing disclosures of illegality, waste, fraud, abuse or public health or safety threats); the Intelligence Identities Protection Act of 1982 (50 USC 421 et seq.) (governing disclosures that could expose confidential Government agents); and the statutes which protect against disclosure that may compromise the national security, including Sections 641, 793, 794, 798, and 952 of Title 18, United States Code, and Section 4(b) of the Subversive Activities Act of 1950 (50 USC 783(b)). The definitions, requirements, obligations, rights, sanctions, and liabilities created by said Executive Order and listed statutes are incorporated into this agreement and are controlling.

17. I have read this Agreement carefully and my questions, if any, have been answered. I acknowledge that the briefing officer has made available to me any laws, regulations, or directives referenced in this document so that I may read them at this time, if I so choose.

Signature Date

Organization (Provide Name, Address, and Phone Number)

Section 00 22 16 – Attachment B – Page 1

Attachment B

Instructions for Handling and Dissemination of FOUO Information

Access to FOUO Information

FOUO information may be disseminated within the DoD components and between officials of the DoD components and DoD contractors, consultants, and grantees as necessary in the conduct of official business.

FOUO information may also be released to officials in other departments and agencies of the executive and judicial branches in performance of a valid government function.

Marking FOUO Information

Unclassified documents and material containing FOUO information shall be marked as follows:

Documents will be marked FOR OFFICIAL USE ONLY at the bottom of the front cover (if there is one), the title page (if there is one), the first page, and the outside of the back cover (if there is one).

Pages of the document that contain FOUO information shall be marked FOR OFFICIAL USE ONLY at the bottom.-

Each paragraph containing FOUO information shall be marked with the abbreviation FOUO in parentheses at the beginning of the FOUO portion.

Material other than paper documents (for example, slides, computer media, films, etc.) shall bear markings which alert the holder or viewer that the material contains FOUO information.

FOUO documents and material transmitted outside the Department of Defense must bear an expanded marking on the face of the document so that non-DoD holders understand the status of the information. A statement similar to this one should be used:

This document contains information exempt from mandatory disclosure under the FOIA.

Exemption(s) _ apply.

When FOUO information is contained within a classified document, the same rules apply except that full pages that contain FOUO information but no classified information shall be marked FOR OFFICIAL USE ONLY at both the top and bottom of the page.

Safeguarding FOUO Information

FOUO information should be handled in a manner that provides reasonable assurance that unauthorized persons do not gain access.

During working hours, reasonable steps should be taken to minimize risk of access by unauthorized personnel.

After working hours, FOUO may be stored as a minimum in unlocked containers, desks or cabinets if government or government-contract building security is provided. If government or government-contract building security is not provided, it must be stored at a minimum in a locked desk, file cabinet, bookcase, locked room, or similar place.

FOUO documents and material may be transmitted via first class mail, parcel post, or -- for bulk shipments --fourth class mail.

Section 00 22 16 – Attachment B – Page 2

Fax or e-mail transmission of FOUO information (voice, data or facsimile) must be by encrypted communications systems. FOUO information may not be made publicly available (i.e. placed on the internet) and if maintained on a network, data must be encrypted at rest.

FOUO documents must be destroyed by using a cross-cut shredder when no longer needed.

The Contractor is prohibited from further disclosure, dissemination, removal, or reproduction of this information without the expressed written authorization of the Contracting Officer or their representative.

The Contractor will maintain sufficient records to detail accountability for all copies of provided documents.

The Contractor requires written permission from the Contracting Officer or their designated representative to share FOUO information with Foreign Nationals.

Enforcement

Administrative penalties may be imposed for misuse of FOUO information. Criminal penalties may be imposed depending on the actual content of the information (privacy, export control, etc.).

Legal & Regulatory Authorities

5 USC 301 - Departmental Regulations DoD Manual 5200.01-V4 - The Information Security Program: Controlled Unclassified Information DoD Directive 5400.7 - The Freedom of Information Act (FOIA) Program DoD Regulation 5400.7-R – The DoD Freedom of Information Act Program DoD Regulation 5400.11-R – Department of Defense Privacy Program

Signature

Printed Name Date

Organization (Provide Name, Address, and Phone Number)

I acknowledge and understand my responsibilities for the handling and protection of FOUO information

Section 00 22 16 – Attachment 1 – Page 1

Attachment 1

Operations Security (OPSEC) Addendum

(U) Operations Security (OPSEC). Contractor must develop and implement processes and procedures to protect unclassified and sensitive aspects of the project from disclosure to unauthorized personnel (i.e., anyone operating outside the scope of the project). Information that must be protected falls into three categories: administration / organization, operations, and facility design. The contractor must protect organizational data that includes unit mission, organizational structure, administrative & operational support relationships with higher headquarters and host nation organizations. The contractor must protect operations data that includes installation activities & operations, construction activities & operations, and installation & construction security procedures and protocols.

The contractor must also protect facility design information reflecting sensitive capabilities and vulnerabilities.

The critical information list highlights other unclassified and sensitive information that may require protection from disclosure to unauthorized personnel.

(U/FOUO) Prime areas for consideration include: "For Official Use Only" (FOUO) document control & storage, transmission, and destruction; worker / visitor access control & escort procedures; and material acquisition & delivery. Contractors will PKI-encrypt all FOUO project data transmitted via unclassified internet communications. FOUO project data may not be made publicly available (i.e., placed on the internet) and if maintained on a publicly available network [server], data must also be encrypted at rest.

Unless FOUO material is approved for public release by the U.S. Government Contracting Officer or his designated representative, Contractor must protect the material (e.g., facility designs, drawings, and specifications) from public release. U.S. Government Contracting Officer or his designated representative must approve the release of any FOUO material to foreign nationals, e.g., local national subcontractors.

All project designs, drawings, and specifications shall be returned to the U.S. Government Contracting Officer or his designated representative upon contract termination or earlier if no longer required.

Contractor must implement acquisition and shipping procedures to protect the integrity of materials intended for installation within a secure facility.

(U) Contractors may be required to sign the non-disclosure agreements indicating that they will not reveal or discuss project or installation details with unauthorized personnel. Unless authorized by installation security officer, cameras and communications devices (e.g., cell phones, laptops, thumb drives) are prohibited on installation.

Section 00 22 16 – Attachment 2 – Page 1

Attachment 2

Critical Information List (U)

1. (U) Administration / Organization Information

• Installation tenant unit names or designators, unit missions or functions, organizational structure, administrative & operational support relationships with higher headquarters and host nation organizations

• Numbers, specialties, names, and contact information of personnel assigned / working on site

• Numbers and types of vehicles located on site

2. (U) Operations Information

• Installation activities & operations

• Construction activities & operations, such as equipment & material acquisition, delivery, & installation procedures & schedules

• Installation & construction security procedures and protocols, including strengths & weaknesses, layout, entry control procedures

• Personnel issues (e.g., disciplinary actions, alcoholism, and indebtedness)

• Security violations, on-going investigations, or investigation results

• Site visitors, especially distinguished visitors (e.g., agendas, visit purpose)

• Utility outages (scope / impact & schedule)

3. (U) Facilities Information

• Installation site plans (e.g., facilities layout, utilities & communications infrastructure)

• Building designs & specifications; specific types (make & model) of equipment and materials being installed in the facility

• Computer & communications systems designs & specifications

• Security system plans, capabilities, and vulnerabilities

Section 00 22 16 – Attachment 3 – Page 1

Attachment 3

Additional Information for Prime Contractors

1. The Prime Contractor may make additional copies or reproductions of any part of the solicitation documents

(W9128A-17-R-0001) for its subcontractors and its suppliers. The Prime Contractor shall follow Instructions for Handling and Dissemination of FOUO Information (see Attachment B), Operations Security (OPSEC) Addendum (Attachment 1), and Critical Information List (U) (Attachment 2).

2. The Prime Contractor shall have its subcontractors and its suppliers sign and complete the following forms:

a. Controlled Unclassified Information Non-Disclosure Agreement (Attachment A)

b. Instructions for Handling and Dissemination of FOUO Information (Attachment B)

3. The Prime Contractor shall design document control procedures, and identify personnel with the Prime

Contractor and all subcontractors and all suppliers, who will be responsible for maintaining document control records. These personnel shall be identified. (See Attachment 4, Sample Spreadsheet for Vetting).

4. All subcontractors must also comply with all document control policies, and is prohibited from further disclosure, dissemination, removal, or reproduction of this information without notifying the Prime Contractor.

5. The Prime contractor-designated document control personnel shall maintain sufficient records to detail accountability for all copies of provided documents. At a minimum the records must contain the names of all persons issued documents along with a detailed description of the documents provided.

6. The Prime contractor document control personnel shall verify all documents are returned to their control when no longer needed by personnel within their organization or by its subcontractors.

7. The Contractor shall limit dissemination of all information based on a “need-to-know” basis. The Prime

Contractor is responsible for controlling all forms of information, including documents, drawings, sketches, photographs/exposed negatives, written descriptions of work requirements, electronic media, and similar information. Upon request, return such information, including copies, promptly to the Contracting Officer / Contracting Officer’s Representative (COR), or Site Security Manager (SSM).

8. At any time, the Government may request for the Spreadsheet for Vetting from the Prime Contractor, as well as the completed and signed Instruction for Handling and Dissemination of FOUO Information and the completed and signed Unclassified Information Non-Disclosure Agreement.

Section 00 22 16 – Attachment 4 – Page 1

Attachment 4

Sample Spreadsheet for Vetting

Request No.

Full Name Job Title Date of Birth

Place of Birth

Citizenship Home Address