DD254_CUI_ADDENDUM_AAWGDev.pdf

CONTRACT# solicitation: Academic and Analytical Wargame Development

ADDENDUM

SAFEGUARDING CONTROLLED UNCLASSIFIED INFORMATION (CUI)

Provided by the USAWC G2 Security Office

Item 10j, 11j, and 11l: The following procedures will be used to protect Controlled Unclassified Information (CUI), which includes legacy For Official Use Only (FOUO) information.

References:

a. Army Regulation (AR) 380-5 (Army Information Security Program), 25 MAR 22.

b. Department of Defense Instruction (DoDI) 5200.48 (Controlled Unclassified Information), 6 MAR 20.

c. Memorandum, Deputy Chief of Staff, G-2 (DAMI-CD), 27 AUG 20, subject: Implementing Guidance for Department of Defense Instruction 5200.48, Controlled Unclassified Information.

1. The CUI marking is assigned to information at the time of its creation in a DoD User Agency.

CUI encompasses OPSEC, critical technology, intelligence, and personally identifiable information that, if not properly identified, marked, and controlled, could impair the Army's ability to conduct its mission. It is not authorized as a substitute for a security classification marking.

CUI information requires extra precautions to ensure it is not released to the public.

2. Other non-security markings such as “Limited Official Use,” “Official Use Only,” and “Sensitive But Unclassified” are used by non-DoD User Agencies for the same type of information and should be safeguarded and handled in accordance with instructions received from such agencies. The marking "For Official Use Only" is legacy and is being phased out of use.

3. Use of the above markings does not mean that the information cannot be released to the public. Similarly, the absence of such markings does not mean the information is cleared or approved for public release. All unclassified information must be reviewed by the Government prior to its release, to determine whether a significant and legitimate Government purpose is served by withholding the information or portions of it. Contractors shall monitor CUI for aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information. Contractors shall report the potential classification of aggregated or compiled CUI to the Army requiring activity.

4. Identification markings:

a. An unclassified document containing CUI or legacy FOUO information shall be marked “CUI” in bold letters at least 3/16 of an inch high at the bottom of the front cover (if any), on each page containing CUI information, and on the outside of the back cover (if any).

b. Within a classified document, an individual page that contains both CUI and classified information will be marked at the top and bottom with the highest security classification appearing on the page. If an individual portion contains CUI information but no classified information, the portion will be marked “CUI.”

CONTRACT# solicitation: Academic and Analytical Wargame Development

c. Decontrol or removal of the CUI or legacy “FOR OFFICIAL USE ONLY” marking can only be accomplished by the originator or other competent government authority. When CUI or FOUO status is terminated, all known holders will be notified to the extent possible.

5. Dissemination: CUI information may be released only to DoD components, officials of DoD components, and other DoD contractors when needed to conduct official DoD business.

Authorization must be received through the Foreign Disclosure channels prior to releasing to foreign nationals. The USAWC Foreign Disclosure Officer is the point of contact.

6. Storage: During normal working hours CUI information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information.

During non-working hours, personnel must keep CUI under control at all times or protect it with at least one physical barrier and reasonably ensure that the information is protected from unauthorized access and observation. This can be accomplished by placing the information in locked buildings, rooms, file cabinet, or desk drawer. Expenditure of funds for security containers or closed areas solely for the protection of CUI is prohibited.

7. Transmission: CUI information may be sent via first-class mail or parcel post; do not place CUI markings on outer packaging. Discussion of CUI material on the phone is authorized if necessary for performance of the contract. CUI transmission via facsimile machine is permitted;

however, the sender is responsible for determining whether appropriate protection will be available at the receiving location before transmission. Digital transmission of CUI information must be digitally signed and encrypted, or via approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure or transport layer security (e.g., https). Do not use unofficial or personal email accounts or messaging systems for

CUI.

8. Destruction: Destruction will be accomplished in a manner that makes it unreadable, indecipherable, and irrecoverable. Destroy paper using cross cut shredders which produce particles that are 1 mm x 5 mm (0.04 in. x 0.2 in.) in size (or smaller), or pulverize/disintegrate paper materials using disintegrator devices equipped with a 3/32 in. (2.4 mm) security screen.

9. Unauthorized Disclosure: Unauthorized disclosure of CUI information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure.

The unauthorized disclosure of CUI information protected by the Privacy Act may result in criminal sanctions. Unauthorized disclosure of CUI does not constitute decontrol. Incidents involving the UD of CUI will be reported through command channels to DCS, G–2, (DAMI–CD).

Reports will outline the facts, particularly when the fact of the incident may become public or attract media attention.

10. Contractors shall complete required OPSEC and CUI training and comply with USAG CBKS and USAWC OPSEC Plans.

11. Point of contact is USAWC G2, Security Manager.