Attachment B - Handling CUI Information Final 30 August 24.pdf

Attachment B

Conversion of Secure Working Area, Okinawa, Japan

Instructions for Handling and Dissemination of CUI Information

Access to CUI Information

CUI information may be disseminated within the DoD components and between US citizen officials of the DoD components and US citizen DoD contractors, consultants, and grantees as necessary in the conduct of official business. CUI information may also be released to US citizen officials in other departments and agencies of the executive and judicial branches in performance of a valid government function.

Marking CUI Information

Unclassified documents and material containing CUI information shall be marked as follows:

Documents will be marked CONTROLLED UNCLASSIFIED INFORMATION at the bottom of the front cover (if there is one), the title page (if there is one), the first page, and the outside of the back cover (if there is one).

Pages of the document that contain CUI information shall be marked CONTROLLED UNCLASSIFIED INFORMATION at the bottom. -

Each paragraph containing CUI information shall be marked with the abbreviation CUI in parentheses at the beginning of the CUI portion.

Material other than paper documents (for example, slides, computer media, films, etc.) shall bear markings which alert the holder or viewer that the material contains CUI information.

CUI documents and material transmitted outside the Department of Defense must bear an expanded marking on the face of the document so that non-DoD holders understand the status of the information. A statement similar to this one should be used:

This document contains information exempt from mandatory disclosure under the FOIA.

Exemption(s) _ apply.

When CUI information is contained within a classified document, the same rules apply except that full pages that contain CUI information, but no classified information shall be marked CONTROLLED UNCLASSIFIED INFORMATION at both the top and bottom of the page.

Safeguarding CUI Information

CUI information should be handled in a manner that provides reasonable assurance that unauthorized persons do not gain access.

During working hours, reasonable steps should be taken to minimize risk of access by unauthorized personnel.

After working hours, CUI may be stored as a minimum in unlocked containers, desks or cabinets if government or government-contract building security is provided. If government or government-contract building security is not provided, it must be stored at a minimum in a locked desk, file cabinet, bookcase, locked room, or similar place.

CUI documents and material may be transmitted via first class mail, parcel post, or -- for bulk shipments --fourth class mail.

Fax or e-mail transmission of CUI information (voice, data or facsimile) must be by encrypted communications systems. CUI information may not be made publicly available (i.e., placed on the internet) and if maintained on a network, data must be encrypted at rest.

CUI documents must be destroyed by using a cross-cut shredder when no longer needed.

The Contractor is prohibited from further disclosure, dissemination, removal, or reproduction of this information without the expressed written authorization of the Contracting Officer or their representative.

The Contractor will maintain sufficient records to detail accountability for all copies of provided documents.

The Contractor requires written permission from the Contracting Officer or their designated representative to share CUI information with Foreign Nationals.

Enforcement

Administrative penalties may be imposed for misuse of CUI information. Criminal penalties may be imposed depending on the actual content of the information (privacy, export control, etc.).

Legal & Regulatory Authorities

5 USC 30l - Departmental Regulations DoD Manual 5200.0l-V4 - The Information Security Program: Controlled Unclassified Information DoD Directive 5400.7 - The Freedom of Information Act (FOIA) Program DoD Regulation 5400.7-R - The DoD Freedom of Information Act Program DoD Regulation 5400.ll-R - Department of Defense Privacy Program

Signature Printed Name Date

Organization (Provide Name, Address, and Phone Number)

I acknowledge and understand my responsibilities for the handling and protection of CUI information

Attachment l

Attachment 1

Operations Security (OPSEC) Addendum

(U) Operations Security (OPSEC). Contractor must develop and implement processes and procedures to protect unclassified and sensitive aspects of the project from disclosure to unauthorized personnel (i.e., anyone operating outside the scope of the project). Information that must be protected falls into three categories: administration / organization, operations, and facility design. The contractor must protect organizational data that includes unit mission, organizational structure, administrative & operational support relationships with higher headquarters and host nation organizations. The contractor must protect operations data that includes installation activities & operations, construction activities & operations, and installation & construction security procedures and protocols.

The contractor must also protect facility design information reflecting sensitive capabilities and vulnerabilities.

The critical information list highlights other unclassified and sensitive information that may require protection from disclosure to unauthorized personnel.

(U/CUI) Prime areas for consideration include: "Controlled Unclassified Information" (CUI) document control & storage, transmission, and destruction; worker / visitor access control & escort procedures; and material acquisition & delivery. Contractors will PKI-encrypt all CUI project data transmitted via unclassified internet communications. CUI project data may not be made publicly available (i.e., placed on the internet) and if maintained on a publicly available network [server], data must also be encrypted at rest.

Unless CUI material is approved for public release by the U.S. Government Contracting Officer or his designated representative, Contractor must protect the material (e.g., facility designs, drawings, and specifications) from public release. U.S. Government Contracting Officer or his designated representative must approve the release of any CUI material to foreign nationals, e.g., local national subcontractors.

All project designs, drawings, and specifications shall be returned to the U.S. Government Contracting Officer or his designated representative upon contract termination or earlier if no longer required.

Contractor must implement acquisition and shipping procedures to protect the integrity of materials intended for installation within a secure facility.

(U) Contractors may be required to sign the non-disclosure agreements indicating that they will not reveal or discuss project or installation details with unauthorized personnel. Unless authorized by installation security officer, cameras and communications devices (e.g., cell phones, laptops, thumb drives) are prohibited on installation.

Attachment 2 Critical Information List (U)

l. (U) Administration / Organization Information

• Installation tenant unit names or designators, unit missions or functions, organizational structure, administrative & operational support relationships with higher headquarters and host nation organizations

• Numbers, specialties, names, and contact information of personnel assigned / working on site

• Numbers and types of vehicles located on site

2. (U) Operations Information

• Installation activities & operations

• Construction activities & operations, such as equipment & material acquisition, delivery, & installation procedures & schedules

• Installation & construction security procedures and protocols, including strengths & weaknesses, layout, entry control procedures

• Personnel issues (e.g., disciplinary actions, alcoholism, and indebtedness)

• Security violations, on-going investigations, or investigation results

• Site visitors, especially distinguished visitors (e.g., agendas, visit purpose)

• Utility outages (scope / impact & schedule)

3. (U) Facilities Information

• Installation site plans (e.g., facilities layout, utilities & communications infrastructure)

• Building designs & specifications; specific types (make & model) of equipment and materials being installed in the facility

• Computer & communications systems designs & specifications

• Security system plans, capabilities, and vulnerabilities

Attachment 2

Attachment 3

Additional Information for Prime Contractors

l. The Prime Contractor may make additional copies or reproductions of any part of the solicitation documents for its subcontractors and its suppliers. The Prime Contractor shall follow Instructions for Handling and Dissemination of CUI Information (see Attachment B), Operations Security (OPSEC) Addendum (Attachment l), and Critical Information List (U) (Attachment 2).

2. The Prime Contractor shall have its subcontractors and its suppliers sign and complete the following forms:

a. Controlled Unclassified Information Non-Disclosure Agreement (Attachment A)

b. Instructions for Handling and Dissemination of CUI Information (Attachment B)

3. The Prime Contractor shall design document control procedures and identify personnel with the Prime

Contractor and all subcontractors and all suppliers, who will be responsible for maintaining document control records. These personnel shall be identified.

4. All subcontractors must also comply with all document control policies, and is prohibited from further disclosure, dissemination, removal, or reproduction of this information without notifying the Prime Contractor.

5. The Prime contractor-designated document control personnel shall maintain sufficient records to detail accountability for all copies of provided documents. At a minimum the records must contain the names of all persons issued documents along with a detailed description of the documents provided.

6. The Prime contractor document control personnel shall verify all documents are returned to their control when no longer needed by personnel within their organization or by its subcontractors.

7. The Contractor shall limit dissemination of all information based on a "need-to-know" basis and to US citizens only. The Prime Contractor is responsible for controlling all forms of information, including documents, drawings, sketches, photographs/exposed negatives, written descriptions of work requirements, electronic media, and similar information. Upon request, return such information, including copies, promptly to the Contracting Officer / Contracting Officer's Representative (COR), or Site Security Manager

(SSM).

8. At any time, the Government may request for the Spreadsheet for Vetting from the Prime Contractor, as well as the completed and signed Instruction for Handling and Dissemination of CUI Information and the completed and signed Unclassified Information Non-Disclosure Agreement.

Attachment 3