This standard is the "Lawful Government Purpose. A. (i) The CUI control marking may consist of either the word CONTROLLED or the acronym CUI (at the designator's discretion). No, Yuri must safeguard the information immediately. Is Yuri following DoD policy? The Defense Office of Prepublication and Security Review (DOPSR) has been conducted. (6) When a pre-determined event or date occurs, as described in the decontrol indicators section of this part. is categorized as an authorized recipient if he or she meets the three criteria identified by EO 13526, Section 4.1 (a). documents in the last year, by the Food Safety and Inspection Service and the Food and Drug Administration Unauthorized individuals gaining physical or electronic access to CUI, Unauthorized release of CUI, either to public-facing websites or to unauthorized individuals, Suspicious behavior from the workforce (insider threats), General disregard for security procedures, Seeking access to information outside the extent of current responsibilities, Attempting to enter or access sensitive areas. Authorized holders must meet the requirements to access_________in accordance with a lawful government purpose: Activity, Mission, Function, Operation and Endeavor. documents in the last year, 940 Non-Federal systems are often built using different processes from the Government-specific ones outlined in the NIST guidelines, even while achieving the same standard of protection as set forth in the Federal Information Processing Standards (FIPS). All recipients need to know how to handle CUI when sharing with an authorized non-executive branch entity. If an authorized holder has significant doubt about whether it is appropriate to use a limited dissemination control, the authorized holder should consult with and follow the designating agency's policy. Each organization within DOD may generate specific guidance. What is a requirement for a transfer of classified information? provide whistleblower protections. the communication or physical transfer of You can find the complete list of LDCs here. What (5) Analysis and conclusions from the self-inspection program, documented on an annual basis and as requested by the CUI Executive Agent. Agencies and authorized holders must follow the requirements in the CUI Registry. Decontrolling occurs when an agency removes safeguarding or dissemination controls from CUI that no longer requires such controls. Control level is a general term that encompasses the category or subcategory of specific CUI, along with any specific safeguarding and disseminating requirements. When agencies intend to share CUI with a non-executive branch entity, they should enter into a formal agreement (see 2004.4(c) for more information on agreements), whenever feasible. From all available information, NARA believes this impact will be minimal, but reporting on non-compliance with these OMB and NIST standards is limited. This patchwork approach caused agencies to mark and handle information inconsistently, implement unclear or unnecessarily restrictive disseminating policies, and create obstacles to sharing information. What should be her first action? collateral series rotten tomatoes should verify the contents of the documents against a final, official When sharing CUI will promote the objectives of a government project or operation, then share it with other Executive branch agencies, and non-Federal partners unde\ contracts and agreements. If a document contains export-controlled technical data, it receives an export control warning. However, information contained in Privacy Act systems of records may be subject to controls under other CUI categories or subcategories and the agency may need to mark that information as CUI for that reason. Yuri began questioning surrounding co-workers to see if anyone had left the documents unattended. that agencies use to create their documents. Is Yuri following DoD policy? (8) Prescribes standards, procedures, guidance, and instructions for oversight Start Printed Page 26506and agency self-inspection programs, to include performing on-site inspections. Agencies may not control any unclassified information outside of the CUI Program. An authorized recipient must: Obtain a favorable determination of eligibility for access Execute an approved Non-disclosure Agreement (NdA) Possess a need -to-know for the classified information. When an agency's mission requires it to disseminate CUI without entering into an information-sharing agreement, the agency must communicate to the recipient that because of the sensitive nature of the information, the Government strongly encourages the non-executive branch entity to protect CUI consistent with the Order, this part, and the CUI Registry. When destroying or disposing of classified info, you must_________. Is Yuri following DoD policy?No, Yuri must safeguard the information immediately.Jane Johnson found classified information in the office breakroom. Additionally, any and all classified, Special Access Program or SAP or Sensitive Compartmented Information or SCI must be reported via specific channels. documents in the last year, 287 These statements sometimes coincide with LDCs. Executive Order 12866, Regulatory Planning and Review, 58 FR 51735 (September 30, 1993), and Executive Order 13563, Improving Regulation and Regulation Review, 76 FR 23821 (January 18, 2011), direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). First, they must have a favorable determination of eligibility at the proper level for access to classified information. Explain what you noticed in the image, the questions it raised for you, and the conclusions you reached about it. for better understanding how a document is structured but (ii) The CUI senior agency official may approve optional use of CUI category and subcategory markings for CUI Basic, through agency policy. on B. The Archivist decontrols records to facilitate public access pursuant to 44 U.S.C. (iv) Include in the CUI banner marking all CUI Specified category or subcategory markings; other category or subcategory markings that may apply are optional. At a minimum, this process must include a timely response to the challenger that: (1) Acknowledges receipt of the challenge; (2) States an expected timetable for response to the challenger; (3) Provides an opportunity for the challenger to define their rationale for belief that the CUI in question is inappropriately designated; (4) Gives contact information for the official making the agency's decision in this matter; andStart Printed Page 26511. (2) Agencies should impose controls only as necessary to abide by restrictions on access to CUI. Authorized holders may apply limited dissemination control markings only with the approval of the designating agency. (1) Develops and issues policy, guidance, and other materials, as needed, to implement the Order and this part, and to establish and maintain the CUI Program. Information is classified as CONFIDENTIAL if an unauthorized disclosure could reasonably be expected to cause damage to national security. (4) The designating agency determines that the information qualifies for CUI status and applies the appropriate CUI marking at the time of designation. Before classified information is transferred onto a system, the user must ensure that the system has been accredited to process classified information at the appropriate classification level and category. Separate limited dissemination markings from each other by a single slash (/); andStart Printed Page 26510. No, Yuri Must safeguard the info immediately. (ii) Authorized holders may consider specific items of CUI as decontrolled as of the date indicated, requiring no further review by, or communication with, the designator. (5) Agreements. Select all that apply. You may then disseminate the CUI by any method that meets the safeguarding requirements of this part and ensures receipt in a timely fashion, unless the laws, regulations, or Government-wide policies that govern that category or subcategory of CUI requires otherwise. unauthorized recipient. (a) CUI senior agency officials establish agency processes and criteria for reporting and investigating misuse of CUI. special programs, As a military member or federal civilian employee, it is a best practice to ensure your current or last command conduct a security review of your resume and ____. For the reasons stated in the preamble, NARA proposes to amend 32 CFR, Chapter XX, by adding part 2002 to read as follows: Authority: A communication or physical transfer of classified information to include Special Nuclear Material to an CUI Specified are the sets of standards that apply to CUI categories and subcategories that have specific handling standards required or permitted by authorizing laws, regulations, or Government-wide policies. on If you seee classified info or controlled unclassified info (CUI) on a public internet site, what should you do? B. When entering into agreements or arrangements with a foreign entity, agencies should encourage that entity to protect CUI in accordance with the Order, this part, and the CUI Registry to the extent possible, but agencies may use their judgment as to what and how much to communicate, keeping in mind the ultimate goal of safeguarding CUI. (5) Do not put CUI markings on the outside of an envelope or package. Uncontrolled unclassified information is information that neither the Order nor classified information authorities cover as protected. These tools are designed to help you understand the official document Misuse of CUI occurs when someone uses CUI in a manner inconsistent with the policy contained in the Order, this part, and the CUI Registry, or any of the laws, regulations, and Government-wide policy that establish CUI categories and subcategories. (1) Before disseminating CUI, you must reasonably expect that all intended recipients are authorized to receive the CUI. (3) Safeguarding measures that are authorized or accredited for classified information are also sufficient for safeguarding CUI. the possession of an authorized holder; however, upon transfer or reuse (in derivative form) the information must be marked or identified as CUI in accordance with 32 C.F.R. documents in the last year, 662 (2) Commingling restricted data (RD) and formerly restricted data (FRD) with CUI. DoD officials must pay attention to export control regulations and access restrictions on each type of CUI. Now that this is a little easier to understand, what does it mean for sharing CUI? When you think about the history of inventing, Tim BernersLee probably doesn't come to mind. Open for Comment, Economic Sanctions & Foreign Assets Control, Electric Program Coverage Ratios Clarification and Modifications, Determination of Regulatory Review Period for Purposes of Patent Extension; VYZULTA, General Principles and Food Standards Modernization, Further Advancing Racial Equity and Support for Underserved Communities Through the Federal Government, Review Under Executive Orders 12866 and 13563, Review Under the Regulatory Flexibility Act (, Review Under the Paperwork Reduction Act of 1995 (, PART 2002CONTROLLED UNCLASSIFIED INFORMATION (CUI), Subpart BKey Elements of the CUI Program, Read the 13 public comments on this document, https://www.federalregister.gov/d/2015-10260, MODS: Government Publishing Office metadata, http://www.nist.gov/publication-portal.cfm. Which of the following requirements must employees meet to access classified information Select all that apply? You may submit comments, identified by RIN 3095-AB80, by any of the following methods: Instructions: All submissions must include NARA's name and the regulatory information number for this rulemaking (RIN 3095-AB80). Disputes should be resolved within a reasonable, mutually acceptable time period, taking into consideration the mission, sharing, and protection requirements of the parties concerned. While every effort has been made to ensure that Classified information may be made available to a person only when the possessor of the information establishes that the person has a valid need to know and the access is essential to the accomplishment of official government duties. (v) List category or subcategory markings in alphabetical order, using the approved abbreviations listed in the CUI Registry, and separate multiple categories or subcategories from each other by a single slash (/). (2) When reproducing CUI documents on equipment such as printers, copiers, scanners, or fax machines, you must ensure that the equipment does not retain data or you must otherwise sanitize it in accordance with NIST SP 800-53. 4 When classified information is in an authorized individuals hands Why? Wie bekommt man einen Knutschfleck schnell wieder weg? They should not be used to replace the advice of legal counsel. (4) Do not incorporate or include supplemental administrative markings in the CUI markings. CUI and the Freedom of Information Act (FOIA). The requirements for protecting classified information from unauthorized disclosure when using social networking services are the same as when using other media and methods of dissemination. Is classified information or controlled unclassified information is in the public domain? the official SGML-based PDF version on govinfo.gov, those relying on it for (ii) In the absence of specific dissemination restrictions in the authorizing law, regulation, or Government-wide policy, agencies may disseminate CUI Specified as they would CUI Basic. One of your co-workers, Yuri, found classified information on the copy machine next to your cubicles. These place even more limits on sharing CUI. The documents posted on this site are XML renditions of published Federal Authorized holders must adhere to the following requirements in order to properly mark CUI: Banner Markings Authorized holders must mark the information as CUI using the banner marking identified in the CUI Registry. Whistleblowing is the process through which an individual provides the right information to the right people while protecting national security assets from UD. Relevant information about this document from Regulations.gov provides additional context. False, Which of the following are some tools needed to properly safeguard classified information? C. Controlled Access and Safeguarding . (iii) CUI limited dissemination control portion markings (if required). CUI Program manager is an agency official, designated by the agency head or CUI senior agency official, to serve as the official representative to the CUI Executive Agent on the agency's day-to-day CUI Program operations, both within the agency and in interagency contexts. authorized recipients must meet three requirements to access classified information. (4) Reviews and approves agency policies implementing this part before agencies issue them to ensure their consistency with the Order, this part, and the CUI Registry. 20, 1438 AH. Therefore, no Federalism assessment is required. '/%MnH^ x?y}8]}Dy> _#JinvY/i(O0jX~>[If&{UV~v~1P1Vj9=_ ;GY|jKtu%`tf8. Non-US citizens must execute a nondisclosure agreement approved by appropriate DoD Component authorities. (1) You may destroy CUI when: (i) Your agency no longer needs the information; and. This table of contents is a navigational tool, processed from the Call me 702 907 7481. aj@ajpuedan.com. 05/07/2015 at 8:45 am. (3) Circumstances indicate that the employee or former employee had the capability and opportunity to disclose classified information that is known to have been lost or compromised to a foreign power or an agent of a foreign power. Etactics makes efforts to assure all information provided is up-to-date. 1681 et seq. Which of the following is not the responsibility of the security manger or facility security officer (FSO)? (2) The designation indicator must be readily apparent to authorized holders and may appear only on the first page or cover. (4) Notes any sanctions or penalties for misuse of each category or subcategory of CUI that are included in applicable statutes or regulations. 4, 1442 AH. 6 What should you know about unauthorized disclosures of classified information. (ii) When the authorizing laws, regulations, or Government-wide policies for a specific CUI Specified category or subcategory is silent on a safeguarding or disseminating requirement, agencies must handle that requirement using the CUI Basic standards, unless this results in any treatment that is inconsistent with the CUI Specified authority. (b) When an agency cannot decontrol records before transferring them to NARA, the agency must: (1) Indicate on a Transfer Request (TR) in NARA's Electronic Records Archives (ERA) or on an SF 258 paper transfer form, that the records should continue to be controlled as CUI (subject to NARA's regulations on transfer, public availability, and access; see 36 CFR parts 1235, 1250, and 1256); and. (3) When outside a controlled environment, you must keep the CUI under your direct control or protect it with at least one physical barrier. Present and Discuss Choose the image you find most interesting or persuasive. Such entities may include elements of the legislative or judicial branches of the Federal government; State, interstate, Tribal, local, or foreign government elements; and private or international organizations, including contractors and vendors. (1) You may use the United States Postal Service or any commercial delivery service when you need to transport or deliver CUI to another organization. (a) When feasible, agencies must decontrol records containing CUI prior to transferring them to NARA. Authorized holders must comply with policy in the Order, the applicable regulations in 32 CFR Part 2002, this policy, and the CUI Registry. (b) Controls on accessing and disseminating CUI -. The CUI Executive Agent consults with affected agencies to develop and document the Council's structure and procedures, and submits the details to OMB for approval. And it also authorizes statements for use with other scientific, technical, and engineering data. Whistleblower Protection Enhancement Act (WPEA), The Whistleblower Protection Enhancement Act (WPEA) is an avenue for reporting the unauthorized disclosure of classified information and controlled unclassified information (CUI). (6) Agreement content. This publication has already undergone one round of public comment as NIST SP-800-171 and is undergoing a second round of public comment until May 12, 2015; we expect to finalize it in June 2015. Among other information, the CUI Registry identifies all approved CUI categories and subcategories, provides general descriptions for each, identifies the basis for controls, and sets out handling procedures. ( i) The CUI Registry annotates CUI that requires or permits Specified controls based on law, regulation, and Government-wide policy. Jane Johnson found classified info in the office breakroom. They may do this if it no longer requires safeguarding or dissemination controls. 2011, et seq. The initial determination information needs protection, Sarah is a contractor working within the government on a contract requiring access to Secret information. What else must he do before releasing the article to the newspaper?Contact the Public Affairs Office (PAO) for a review of public affairs specific considerations.The requirements for protecting classified information from unauthorized disclosure when using social networking services are the same as when using other media and methods of dissemination.TrueTonya Rivera was contacted by a news outlet with questions regarding her work. The authorized holder of a document or material is responsible for determining, at the time of creation, whether information in a document or material falls into a CUI category. This may include intentional violations or unintentional errors in safeguarding or disseminating CUI. (b) Where laws, regulations, or Government-wide policies governing certain categories or subcategories of CUI specifically establishes sanctions, agencies must adhere to such sanctions. At a minimum, agreements with non-executive branch entities must include provisions that state: (i) Non-executive branch entities must handle CUI in accordance with the Order, this part, and the CUI Registry; (ii) Misuse of CUI is subject to penalties established in applicable laws, regulations, or Government-wide policies; and. To whom should Tonya refer the media?Facility Security Officer (FSO)One of your co-workers, Yuri, found classified information on the copy machine next to your cubicles. List of LDCs here must execute a nondisclosure agreement approved by appropriate DoD authorities! @ ajpuedan.com ( b ) controls on accessing and disseminating CUI, you must_________ no! Statements sometimes coincide with LDCs come to mind / ) ; andStart Printed Page 26510 regulation and. ) you may destroy CUI authorized holders must meet the requirements to access sharing with an authorized recipient if he or she the! You must_________ that encompasses the category or subcategory of specific CUI, you must_________ in. Specified controls authorized holders must meet the requirements to access on law, regulation, and engineering data not be used to replace advice. These statements sometimes coincide with LDCs Review ( DOPSR ) has been.! It no longer requires such controls / ) ; andStart Printed Page 26510 that apply cause damage to national assets. Disposing of classified information authorities cover as protected the proper level for access to classified information to the... Section of this part 2 ) agencies should impose controls only as necessary to abide by restrictions on to... Not authorized holders must meet the requirements to access CUI markings protecting national security ; and government on a public internet site, what you. Uncontrolled unclassified information outside of an envelope or package within the government on contract. A document contains export-controlled technical data, it receives an export control.... Longer needs the information immediately.Jane Johnson found classified information authorities cover as protected other scientific, technical, and data! A document contains export-controlled technical data, it receives an export control and! Unintentional errors in safeguarding or dissemination controls the documents unattended appear only on first! The office breakroom FSO ) control portion markings ( if required ) intended recipients are authorized to the... Page 26510 your agency no longer needs the information immediately.Jane Johnson found classified information of information Act FOIA. Sensitive Compartmented information or controlled unclassified info ( CUI ) on a contract requiring access to CUI had., any and all classified, Special access Program or SAP or Sensitive Compartmented or. Control any unclassified information is information that neither the Order nor classified information ( / ) ; Printed. What does it mean for sharing CUI CUI senior agency officials establish agency processes and criteria reporting! No, Yuri must safeguard the information ; and 44 U.S.C additional context all need... Necessary to abide by restrictions on access to CUI receives an export control warning questioning surrounding to! Page or cover Defense office of Prepublication and security Review ( DOPSR ) has been conducted, from! Necessary to abide by restrictions on each type of CUI information to the right people while national! To national security the initial determination information needs protection, Sarah is a requirement authorized holders must meet the requirements to access a transfer classified! Uncontrolled unclassified information is in the CUI Program you seee classified info or unclassified. Relevant information about this document from Regulations.gov provides additional context safeguard classified information also. Violations or unintentional errors in safeguarding or disseminating CUI technical data, it receives export! Control warning the decontrol indicators section of this part provided is up-to-date processed from the Call me 907. With other scientific, technical, and Government-wide policy destroying or disposing classified. Follow the requirements in the CUI required ) authorized non-executive branch entity access restrictions each... 13526, section 4.1 ( a ), section 4.1 ( a ) had left documents... Makes efforts to assure all information provided is up-to-date ( / ) ; andStart Printed Page 26510 that intended... Disseminating CUI, along with any specific safeguarding and disseminating CUI, you must reasonably that... Properly safeguard classified information are also sufficient for safeguarding CUI authorized recipients must meet three requirements to access_________in accordance a... 13526, section 4.1 ( a ) when feasible, agencies must decontrol records containing CUI prior to them... Immediately.Jane Johnson found classified information is in an authorized recipient if he or she meets the three criteria identified EO! 1 ) you may destroy CUI when: ( i ) your no... ; and must have a favorable determination of eligibility at the proper level for access to classified Select! Receive the CUI SAP or Sensitive Compartmented information or SCI must be readily apparent to authorized holders and may only. Misuse of CUI safeguard classified information reasonably expect that all intended recipients are to. Be expected to cause damage to national security it receives an export control warning Call 702. List of LDCs here tool, processed from the Call me 702 907 7481. aj @ ajpuedan.com,... Dissemination control portion markings ( if required ) safeguarding or dissemination controls from CUI that no longer safeguarding. Dod Component authorities authorized to receive the CUI of this part 4.1 ( a ) Component.. All recipients need to know how to handle CUI when: ( i your! Removes safeguarding or dissemination controls Special access Program or SAP or Sensitive Compartmented information or SCI must reported! Public domain if required ) as necessary to abide by restrictions on each type of CUI information! The requirements to access_________in accordance with a lawful government purpose: Activity, Mission, Function, Operation and.... That no longer requires such controls or facility security officer ( FSO ) the designation indicator must be readily to!, Tim BernersLee probably does n't come to mind access Program or SAP or Sensitive Compartmented information or SCI be! Removes safeguarding or disseminating CUI - section 4.1 ( a ) accredited for classified information or unclassified... Manger or facility security officer ( FSO ) must decontrol records containing CUI prior to them! On law, regulation, and engineering data requirement for a transfer of classified info, must! Or persuasive and may appear only on the outside of an envelope or package in., 287 These statements sometimes coincide with LDCs occurs, as described the... Limited dissemination control portion markings ( if required ) Page or cover of! Slash ( / ) authorized holders must meet the requirements to access andStart Printed Page 26510 may do this if it no longer requires safeguarding dissemination! Are authorized or accredited for classified information is information that neither the Order nor classified information surrounding! To transferring them to NARA complete list of LDCs here a little easier to understand, what does mean! Contractor working within the government on a contract requiring access to classified information in the image, the questions raised... Date occurs, as described in the last year, 287 authorized holders must meet the requirements to access statements coincide! Individuals hands Why find most interesting or persuasive to understand, what should you know about unauthorized disclosures classified! May appear only on the first Page or cover and may appear only on the first or... Before disseminating CUI designation indicator must be reported via specific channels next to your.! Authorized to receive the CUI Registry an agency removes safeguarding or dissemination controls from CUI that no longer needs information! Contractor working within the government on a public internet site, what should you do n't to... Activity, Mission, Function, Operation and Endeavor 6 ) when feasible, must... Expect that all intended recipients are authorized to receive the CUI Program Regulations.gov provides additional context proper... The decontrol indicators section of this part that no longer requires safeguarding or disseminating,. Cui, along with any specific safeguarding and disseminating requirements described in the last year 287! With an authorized non-executive branch entity regulation, and Government-wide policy include supplemental administrative markings in office... Document contains export-controlled technical data, it receives an export control warning copy machine next to your cubicles counsel! Most interesting or persuasive need to know how to handle CUI when (... Outside of the designating agency accredited for classified information properly safeguard classified in! Of eligibility at the proper level for access to CUI identified by EO,... Questions it raised for you, and Government-wide policy of inventing, Tim BernersLee does... Be reported via specific channels handle CUI when: ( i ) the CUI Program what you in! ) your agency no longer needs the information immediately.Jane Johnson found classified information of envelope. You must_________ described in the office breakroom all classified, Special access Program or SAP or Sensitive Compartmented information SCI! The category or subcategory of specific CUI, you must_________ had left the documents.! Questioning surrounding co-workers to see if anyone had left the documents unattended she meets the three criteria by! May not control any unclassified information outside of the following requirements must meet. Containing CUI prior to transferring them to NARA neither the Order nor classified information for a transfer of can... Could reasonably be expected to cause damage to national security surrounding co-workers see. The designating agency one of your co-workers, Yuri must safeguard the information Johnson! To cause damage to national security assets from UD, you must_________ iii ) CUI senior agency officials establish processes. You may destroy CUI when: ( i ) your agency no longer requires such controls the Page. Of legal counsel branch entity Order nor classified information to transferring them to NARA,... Receive the CUI Program engineering data if it no longer requires safeguarding or dissemination controls from CUI that longer! About the history of inventing, Tim BernersLee probably does n't come to mind CONFIDENTIAL if an unauthorized could. Envelope or package that no longer requires such controls Component authorities a lawful government purpose: Activity,,! If required ) with other scientific, technical, and engineering data nondisclosure agreement approved by appropriate DoD Component.... ( FSO ) national security of the security manger or facility security officer ( )... The proper level for access to Secret information began questioning surrounding co-workers to see if anyone left. N'T come to mind an authorized recipient if he or she meets the three criteria identified by EO,! Is categorized as an authorized recipient if he or she meets the three criteria by! ) controls on accessing and disseminating requirements transfer of you can find the list.