ENCLOSURE 2. SAFEGUARDING
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 2
Change 3, 07/28/2020 14 ENCLOSURE 2
SAFEGUARDING
1. CONTROL MEASURES. DoD Components shall have a system of control measures that ensure access to classified information is limited to authorized persons. The control measures shall be appropriate to the environment in which access occurs and to the nature and volume of the information. The system shall include technical, physical, and personnel control measures. Administrative control measures, which may include records of internal distribution, access, generation, inventory, reproduction, and disposition, shall be required when technical, physical, and personnel control measures are insufficient to deter and detect access by unauthorized persons. Except as otherwise specified, requests for waivers to the provisions of this Volume shall be submitted in accordance with section 16 of Enclosure 3 of Volume 1.
2. PERSONAL RESPONSIBILITY FOR SAFEGUARDING. Everyone who works with classified information is personally responsible for taking proper precautions to ensure that unauthorized persons do not gain access to classified information. Everyone granted access to classified information is personally responsible for protecting the classified information they know, possess, or control and for complying with the pre-publication security review processes specified in DoDI 5230.09 (Reference (k)). Classified information shall be protected at all times either by storing it as this Volume prescribes or by having it under the personal observation and control of an authorized individual.
3. ACCESS TO CLASSIFIED INFORMATION. Except as provided in sections 5 and 6 of this enclosure and in accordance with section 11 of Enclosure 3 of Volume 1, no person may have access to classified information unless that person has a security clearance in accordance with DoD Manual 5200.02 (Reference (l)) and has signed a Standard Form (SF) 312, “Classified Information Non-Disclosure Agreement” (NDA), and access is essential to the accomplishment of a lawful and authorized Government function (i.e., has a need to know).
4. DETERMINING NEED FOR ACCESS. The individual with authorized possession, knowledge, or control of the information has the final responsibility for determining whether a prospective recipient’s official duties requires them to possess or have access to any element or item of classified information, and whether that prospective recipient has been granted the appropriate security clearance by proper authority.
5. EMERGENCY AUTHORITY. In emergencies in which there is an imminent threat to life or in defense of the homeland, the Heads of the DoD Components may authorize the disclosure of classified information, including information normally requiring the originator’s prior authorization, to an individual or individuals who are otherwise not routinely eligible for access. The disclosing authority shall:
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 2
Change 3, 07/28/2020 15
a. Limit the amount of classified information disclosed to the absolute minimum to achieve the purpose.
b. Limit the number of individuals who receive classified information .
c. Transmit the classified information through approved Federal government channels by the most secure and expeditious method consistent with this Volume, or by other means deemed necessary when time is of the essence.
d. Provide instructions about what specific information is classified and how it should be safeguarded. Information disclosed shall not be deemed declassified as of result of such disclosure or subsequent use by a recipient. Physical custody of classified information must remain with an authorized Federal government entity in all but the most extraordinary circumstances.
e. Provide appropriate briefings to the recipients on their responsibilities not to disclose the information to unauthorized individuals and obtain a signed SF 312.
f. Notify the agency or DoD Component originating of the information and the Deputy Under Secretary of Defense for Intelligence, and Security (DUSD(I&S)) within 72 hours of the disclosure of classified information, or at the earliest opportunity that the emergency permits but no later than 30 days after the release, by providing:
(1) A description of the disclosed information.
(2) Identification of individuals to whom the information was disclosed.
(3) How the information was disclosed and transmitted.
(4) Reason for the emergency release.
(5) How the information is being safeguarded.
(6) A description of the briefings provided.
(7) A copy of the signed SF(s) 312.
6. ACCESS BY INDIVIDUALS OUTSIDE THE EXECUTIVE BRANCH. Classified information may be made available to individuals or agencies outside the Executive Branch, as provided in this section, if such information is necessary for performance of a lawful and authorized function, and such release is not prohibited by the originating department or agency. The Heads of DoD Components shall designate officials to ensure the recipient’s eligibility for access, prior to the release of classified information. (See Volume 1, Enclosure 3, section 11 for requirements for access by individuals inside the Executive Branch.)
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 2
Change 3, 07/28/2020 16
a. Congress. DoDI 5400.04 (Reference (m)) provides rules for access to classified information or material by Congress, its committees, members, and staff representatives. Members of Congress, by virtue of their elected position, are not investigated or cleared by the Department of Defense.
b. Government Printing Office (GPO). Collateral documents and material of all classifications may be processed by the GPO, which protects the information according to a DoD/GPO Security Agreement (Reference (n)).
c. Representatives of the Government Accountability Office (GAO). DoDI 7650.01 (Reference (o)) sets forth rules for granting GAO representatives access to classified information that the Department of Defense originates and possesses when such information is relevant to the performance of the statutory responsibilities of that organization. Certifications of security clearances and the basis therefore, shall be accomplished under arrangements between the GAO and the relevant DoD Component. Personal recognition or presentation of official GAO credential cards are acceptable for identification purposes, but not for access to classified information.
d. Historical Researchers . Persons outside the Executive Branch who are engaged in historical research projects may be authorized access to classified information provided that the DoD Component Head or senior agency official with classification jurisdiction over the information:
(1) Determines, in writing, that such access is clearly consistent with the interests of national security in view of the intended use of the material to which access is granted by certifying that the requester has been found to be eligible for access pursuant to Reference (l) and section 3 of this enclosure.
(2) Limits access to specific categories of information over which the DoD Component has classification jurisdiction or for which the researcher has the written consent of the DoD Component or non-DoD agency with classification jurisdiction. The information contained within or revealed by the specified categories must be within the scope of the research.
(3) Maintains custody of the classified material at a DoD installation or activity or authorizes access to documents held by the National Archives and Records Administration (NARA).
(4) Obtains the requester’s agreement to safeguard the information and to submit any notes and manuscripts intended for public release for review by all DoD Components or non- DoD departments or agencies with classification jurisdiction to determine whether classified information is contained therein. The agreement shall be documented by execution of a statement substantially similar to that in Figure 1.
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 2
Change 3, 07/28/2020 17 Figure 1. Conditions Governing Access to Official Records by Historical Researchers
To Whom It May Concern:
I understand that the classified information to which I have requested access for historical research purposes is concerned with the national defense or foreign relations of the United States. Unauthorized disclosure could reasonably be expected to cause damage, serious damage, or exceptionally grave damage to the national security depending on whether the information is classified Confidential, Secret, or Top Secret, respectively. If granted access, I therefore agree to the following conditions governing access to the [insert Component or activity] files:
1. I will abide by any rules and restrictions issued in your letter of authorization, including those of other Agencies whose information is interfiled with that of the [insert Component or activity].
2. I agree to safeguard the classified information to which I gain possession or knowledge in a manner consistent with Part 4 of Executive Order 13526, “Classified National Security Information,” and the applicable provisions of the DoD regulations concerning safeguarding classified information, including Volumes 1, 2, and 3 of DoD Manual 5200.01, “DoD Information Security Program.”
3. I agree not to reveal to any person or Agency any classified information obtained because of this access except as authorized in the terms of your authorization letter or a follow-on letter. I further agree that I shall not use the information for purposes other than those set forth in my request for access.
4. I agree to submit my research notes for review to determine if classified information is contained in them before their removal from the specific area assigned to me for research. I further agree to submit my manuscript(s) for a security review before its publication or presentation. In each of these reviews, I agree to comply with any decision of the reviewing official in the interests of the security of the United States, including the retention or deletion of any classified parts of such notes and manuscript whenever the Federal Agency concerned deems such retention or deletion necessary.
5. I understand that failure to abide by the conditions in this statement shall constitute sufficient cause for canceling my access to classified information and for denying me any future access and may subject me to criminal provisions of Federal Law as referred to in Item 6.
6. I have been informed that provisions of title 18 of the United States Code impose criminal penalties, under certain circumstances, for the unauthorized disclosure, loss, copying, or destruction of defense information.
THIS STATEMENT IS MADE TO THE UNITED STATES GOVERNMENT TO ENABLE IT TO EXERCISE ITS RESPONSIBILITY FOR THE PROTECTION OF INFORMATION AFFECTING THE NATIONAL SECURITY. I UNDERSTAND THAT ANY MATERIAL FALSE STATEMENT THAT I MAKE KNOWINGLY AND WILLFULLY SHALL SUBJECT ME TO THE PENALTIES OF TITLE 18, U.S. CODE, SECTION 1001.
Signature:
Witness's Signature:
Date:
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 2
Change 3, 07/28/2020 18 (5) Authorizes access, in writing, for no more than 2 years from the date of issuance. The DoD Component may renew access for 2-year periods in accordance with DoD Component- issued regulations.
e. Presidential or Vice Presidential Appointees and Designees. Persons who previously occupied senior policy-making positions to which they were appointed or designated by the President or Vice President may not remove classified information upon departure from office, as all such material shall remain under the U.S. Government’s security control. Such persons may be authorized access to classified information they originated, reviewed, signed, received, or that was addressed to them while serving as an appointee or designee, provided that the DoD Component Head or senior agency official with classification jurisdiction for such information:
(1) Determines, in writing, that such access is clearly consistent with the interests of national security in view of the intended use of the material to which access is granted and by certifying that the requester has been found to be eligible for access pursuant to section 3 of this enclosure.
(2) Limits access to items that the person originated, reviewed, signed, or received while serving as a Presidential or Vice Presidential appointee or designee.
(3) Retains custody of the classified material at a DoD installation or activity or authorizes access to documents in the custody of the NARA.
(4) Obtains the requestor’s agreement (SF 312) to safeguard the information and to submit any notes and manuscript for pre-publication review by all DoD Components and non- DoD departments or agencies with classification jurisdiction to determine that no classified information is contained therein.
f. Use of Classified Information in Litigation. DoDD 5405.2 (Reference (p)) governs the use of classified information in litigation.
g. Special Cases. When necessary in the interests of national security, the Heads of the DoD Components or their senior agency official may authorize access to classified information by persons outside the Federal government, other than those enumerated in section 5 of this enclosure and paragraphs 6.a through 6.f of this section. Prior to authorizing access, such official must determine that the recipient is reliable, loyal, and trustworthy for the purpose of accomplishing a national security objective; meets the requirements of section 3 of this enclosure; and can and will safeguard the information from unauthorized disclosure. The national security objective shall be stated in the authorization, which shall be in writing. This authority may not be further delegated.
7. VISITS. The Heads of the DoD Components shall establish procedures to accommodate visits to their Component facilities involving access to, or disclosure of, classified information. As a minimum, these procedures shall include verifying the identity, personnel security clearance, access (if appropriate), and need to know for all visitors.
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 2
Change 3, 07/28/2020 19
a. Visit requests shall be processed and security clearance and access level verified using the Joint Personnel Adjudication System (JPAS) for DoD civilian, military, and contractor personnel whose access level and affiliation are reflected in JPAS. Fax, telephone, or other appropriate method shall be used for those personnel whose access level and affiliation are not reflected in JPAS.
b. Visits by foreign nationals to DoD Components and facilities, except for activities or events that are open to the public, shall be handled in accordance with DoDD 5230.20 (Reference (q)) and documented in the Foreign Visits System Confirmation Module.
8. PROTECTION WHEN REMOVED FROM STORAGE. An authorized person shall keep classified material removed from storage under constant surveillance. Classified document cover sheets (SF 703, “Top Secret (Cover sheet);” SF 704, “Secret (Cover sheet);” or SF 705 “Confidential (Cover sheet)”) shall be placed on classified documents not in secure storage. The cover sheets show, by color and other immediately recognizable format or legend, the applicable classification level.
9. END OF DAY SECURITY CHECKS. The heads of activities that process or store classified information shall establish a system of security checks at the close of each duty and/or business day to ensure that any area where classified information is used or stored is secure. SF 701, “Activity Security Checklist,” shall be used to record such checks. An integral part of the security check system shall be the securing of all vaults, secure rooms, and containers used for storing classified material. SF 702, “Security Container Check Sheet,” shall be used to record such actions. SFs 701 and 702 shall be retained and disposed of as required by Component records management schedules.
10. EMERGENCY PLANS. Plans shall be developed to protect, remove, or destroy classified material in case of fire, natural disaster, civil disturbance, terrorist activities, or enemy action, to minimize the risk of compromise, and for the recovery of classified information, if necessary, following such events. The level of detail and the amount of testing and rehearsal of these plans shall be determined by assessing the risk of hostile action, foreign intelligence threats, natural disaster, or terrorist activity that may place the information in jeopardy.
a. Use the requirements of Committee on National Security Systems (CNSS) Instruction 4004 (Reference (r)) when developing plans for the emergency protection (including emergency destruction under no-notice conditions) of classified communications security (COMSEC) material.
b. When preparing emergency plans, consider:
(1) Reducing the amount of classified material on hand.
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 2
Change 3, 07/28/2020 20 (2) Storing less frequently used classified material at other secure locations.
(3) Creating regular back up copies of information in electronic formats for off-site storage.
(4) Transferring as much retained classified information to removable electronic media as possible, thereby reducing its bulk.
11. USE OF SECURE COMMUNICATIONS. In accordance with the requirements of Enclosure 4, classified information shall be transmitted only over secure communications circuits approved for transmission of information at the specified level of classification. This includes communication by telephone, facsimile, e-mail and other forms of electronic communications (e.g., messages, websites). See Volume 2 of this Manual for guidance on required markings.
12. REMOVAL OF CLASSIFIED INFORMATION FOR WORK AT HOME. When it is mission critical for individuals to remove classified information and materials (e.g., IT equipment and associated storage media) for work at home, specific security measures and approvals are required. Security measures appropriate for the level of classification must be in place to provide adequate protection and security-in-depth and to prevent access by unauthorized persons. Compliance with section 13 of Enclosure 4 of this Volume is also required.
a. Top Secret. Only the Secretary of Defense, the Secretaries of the Military Departments, the Chairman of the Joint Chiefs of Staff, the Combatant Commanders, or the senior agency officials appointed pursuant to section 5.4(d) of Reference (d) may authorize the removal of Top Secret information from designated working areas for work at home. Such officials may also authorize removal of information for work at home for any lower level of classification.
b. Secret and Confidential. The Heads of the DoD Components may authorize removal of Secret and Confidential information from designated working areas for work at home. This authority shall not be delegated below the major command or equivalent level.
c. Residential Storage Equipment. A General Services Administration (GSA)-approved security container shall be furnished for residential storage of classified information. Written procedures shall be developed to provide for appropriate protection of the information, including a record of the classified information that has been authorized for removal for work at home.
d. Classified IT Systems. See section 7 of Enclosure 7 of this Volume when classified IT equipment will be used. All residential classified network connections must be certified and accredited in accordance with DoDI 8510.01 (Reference (s)) requirements.
e. Foreign Country Restriction. Work at home may be authorized in foreign countries only when the residence is in a specific location where the United States enjoys extraterritorial status (e.g., on the embassy, chancery, or consulate compound) or on a U.S. military installation.
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 2
Change 3, 07/28/2020 21
13. WORKING PAPERS. Working papers are documents (e.g., notes, drafts, prototypes) or materials (e.g., printer ribbons, photographic plates), regardless of the media, created during development and preparation of a finished product. Working papers and materials are not intended or expected to be disseminated. Working papers and materials containing classified information shall be:
a. Dated when created.
b. Marked with the highest classification of any information contained therein.
c. Safeguarded as required for the assigned classification.
d. Conspicuously marked “Working Paper” on the cover and/or first page of the document or material (or comparable location for special types of media) in letters larger than existing text.
e. Destroyed in accordance with chapter 33 of title 44, U.S.C. (Reference (t)) as implemented by DoDD 5015.2 (Reference (u)) and appropriate DoD Component implementing directives and records schedules when no longer needed.
f. Marked and controlled the same way as this Manual requires for finished products of the same classification when retained more than 180 days from date of origin (30 days for SAPs), filed permanently, e-mailed within or outside the originating activity, or released outside the originating activity, except as provided in paragraph 13.g. of this section.
g. Shared between action officers, either physically or electronically, without controlling them as permanent documents only when:
(1) The working materials are shared informally (e.g., collaborative documents or coordinating drafts) in the development process.
(2) Transfer or transmission of the material is via secure means and, if electronic, by means other than e-mail.
(3) All copies held by other than the originator are marked and controlled as required for finished products when retained more than 180 days of origin (30 days for SAPs). Consult with the originator for correct markings.
14. EQUIPMENT USED FOR PROCESSING CLASSIFIED INFORMATION. The Department of Defense has a variety of non-COMSEC-approved equipment that is used to process classified information. This includes copiers, facsimile machines, computers and other IT equipment and peripherals, display systems, and electronic typewriters. Activities shall identify those features, parts, or functions of equipment used to process classified information that may retain all or part of the information. Activity security procedures shall prescribe the appropriate safeguards to:
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 2
Change 3, 07/28/2020 22
a. Prevent unauthorized access to that information, including by repair or maintenance personnel.
b. Ensure that repair procedures do not result in unauthorized dissemination of or access to classified information. Where equipment cannot be properly sanitized or appropriately knowledgeable escort provided, cleared maintenance technicians shall be used. Electronic repair or diagnostic equipment shall be maintained as classified material by the DoD Component if there is the potential for classified data transmission from the equipment being serviced. Use of remote diagnostic or repair capabilities shall be specifically approved and authorized in writing by the activity security manager; if the equipment retains or stores any classified information appropriate physical and logical protection must be provided on the remote end and secure communications are required.
c. Replace and destroy equipment parts in the appropriate manner when classified information cannot be removed. Removable disk drives, memory chips and boards, and other electronic components of copiers, fax machines, etc. may be sanitized or destroyed in the same manner as used for comparable computer equipment. Alternatively, the equipment shall be designated as classified and be retained and protected accordingly.
d. Ensure that appropriately knowledgeable, cleared personnel inspect equipment and associated media used to process classified information before the equipment is removed from protected areas to ensure there is no retained classified information. Classification markings and labels shall be removed from sanitized equipment and media after inspection, prior to removal from protected areas.
e. Ensure computers and other equipment used to process classified information or to transmit classified information across a network are certified and accredited in accordance with Reference (s) as required by DoDI 8500.01 (Reference (v)). Measures to protect against compromising emanations shall be implemented in accordance with Reference (v).
15. REPRODUCTION OF CLASSIFIED MATERIAL. Paper copies, electronic files, and other material containing classified information shall be reproduced only when necessary for accomplishing the organization’s mission or for complying with applicable statutes or Directives. Use of technology that prevents, discourages, or detects unauthorized reproduction of classified information is encouraged.
a. Unless restricted by the originating agency, Top Secret, Secret, and Confidential information may be reproduced, including by e-mailing, scanning, and copying, to the extent operational needs require.
b. The DoD Components shall establish procedures that facilitate oversight and control of the reproduction of classified information and the use of equipment for such reproduction, including controls that ensure:
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 2
Change 3, 07/28/2020 23 (1) Reproduction is kept to a minimum consistent with mission requirements.
(2) Personnel reproducing classified information are knowledgeable of the procedures for classified reproduction and aware of the risks involved with the specific reproduction equipment being used and the appropriate countermeasures they are required to take.
(3) Reproduction limitations originators place on documents and special controls applicable to special categories of information are fully and carefully observed.
(4) Reproduced material is placed under the same accountability and control requirements as applied to the original material. Extracts of documents will be marked according to content and may be treated as working papers if appropriate.
(5) Reproduced material is conspicuously identified as classified at the applicable level and copies of classified material are reviewed after the reproduction process to ensure that the required markings exist.
(6) Waste products generated during reproduction are protected and destroyed as required.
(7) Classified material is reproduced only on approved and, when applicable, properly accredited systems. Section 14 of this enclosure provides additional guidance.
(8) Foreign government information (FGI) is reproduced and controlled pursuant to guidance and authority granted by the originating government.
16. CLASSIFIED MEETINGS AND CONFERENCES. Meetings and conferences involving classified information present special vulnerabilities to unauthorized disclosure. The Heads of the DoD Components shall establish specific requirements for protecting classified information at DoD Component-sponsored meetings and conferences, to include seminars, exhibits, symposia, conventions, training classes, workshops, or other such gatherings, during which classified information is disseminated.
a. DoD Component approval processes shall ensure that the following requirements are met:
(1) The meeting or conference serves a specified U.S. Government purpose.
(2) Use of other approved methods or channels for disseminating classified information or material are insufficient or impractical.
(3) The meeting or conference, or classified sessions thereof, takes place only at an appropriately cleared U.S. Government facility or a U.S. contractor facility that has an appropriate facility security clearance and, as required, secure storage capability, unless an exception is approved, in writing, in advance by the DoD Component Head or senior agency official. Such exception authority shall not be delegated below the senior agency official.
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 2
Change 3, 07/28/2020 24 Requests for exceptions to permit use of facilities other than appropriately cleared U.S. Government or U.S. contractor facilities shall be submitted to the DoD Component Head or senior agency official in accordance with Component procedures. The request shall include a security plan that describes how the requirements of paragraphs 16.b and 16.d of this section shall be met.
(a) If classified meetings or conferences occur at a cleared U.S. contractor location, the contractor shall comply with all applicable portions of DoD 5220.22-M (Reference (w)) and parts 120 through 130 of title 22, CFR (Reference (x)) (also known as “The International Traffic in Arms Regulations”). DoD approval for the conduct of the meeting does not constitute authorization for presentation of export-controlled information when foreign nationals attend.
(b) The conduct of classified meetings or conferences at foreign installations and contractor sites is often subject to the rules and regulations of the host country, thus presenting additional security risks. Prior to approval of the conduct of such meetings, the DoD Component shall obtain assurances, in writing, that the responsible foreign government will agree to use security measures and controls that are at least as stringent as those required by this Manual. The provisions of paragraph 16.d. also shall be satisfied. To this end, assistance can be provided by the Director, International Security Programs, Defense Technology Security Administration, Office of the Under Secretary of Defense for Policy (OUSD(P)).
(c) Routine day-to-day meetings and gatherings of DoD officials shall be conducted only at an appropriately cleared U.S. Government or contractor facility. Exceptions shall not be granted for routine meetings.
(d) The provisions of this section do not apply to operational meetings conducted in combat situations, classes conducted by DoD schools, or gatherings of personnel of a DoD Component and foreign government representatives or U.S. and/or foreign contractor representatives on a matter related to a specific U.S. Government contract, program, or project.
(4) Classified sessions are segregated from unclassified sessions.
(5) Access to the meeting or conference, or specific sessions thereof, where classified information may be discussed or disseminated is limited to persons who possess an appropriate security clearance and need to know.
(6) Any participation by foreign nationals or foreign representatives complies with requirements of Reference (q) and DoDD 5230.11 (Reference (y)) (e.g., the responsible U.S. Government foreign disclosure office(s) assures, in writing, that the information to be presented has been approved for disclosure to the represented foreign countries).
(7) Announcement of the meeting or conference is unclassified and limited to a general description of topics expected to be presented, names of speakers, logistical information, and administrative and security instructions.
(8) Procedures shall ensure that classified information, documents, recordings,
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 2
Change 3, 07/28/2020 25 audiovisual material, information systems, notes, and other materials created, distributed, or used during the meeting are controlled, safeguarded, and transported as provisions of this Manual require. Recording or taking notes, including notes on classified electronic devices, during classified sessions shall be permitted only when it is determined that such action is necessary to fulfill the U.S. Government purpose for the meeting.
(9) Information systems used during the meeting or conference to support creation or presentation of classified information shall meet all applicable requirements for processing classified information, including as appropriate considerations of technical security countermeasures (TSCM). Unclassified laptop computers, handheld information technologies (e.g., personal electronic devices (PEDs)), and other similar devices shall not be used for note taking during classified sessions. Use of classified computers and other electronic devices shall be permitted only when needed to meet the intent of the meeting or conference and appropriate protection and TSCM requirements have been met.
b. The DoD activity sponsoring a classified meeting or conference shall assign an official to serve as security manager for the meeting and be responsible for ensuring that, at a minimum, the following security provisions are met:
(1) Attendees are briefed on safeguarding procedures.
(2) Entry is controlled so that only authorized personnel gain entry to the area. Particular caution shall be taken to ensure that any individual who is not authorized to attend the classified session(s) is denied entry thereto.
(3) The perimeter is controlled to ensure unauthorized personnel cannot overhear classified discussions or introduce devices that would result in the compromise of classified information.
(4) Escorts are provided for uncleared personnel who are providing services to the meeting or conference (e.g., setting up food or cleaning) when classified presentations and/or discussions are not in session.
(5) Use of cell phones, PEDs, 2-way pagers, and other electronic devices that transmit is prohibited.
(6) Classified notes and handouts are safeguarded in accordance with Enclosure 3.
(7) Classified information is disclosed to foreign nationals only in accordance with the provisions of Reference (y).
(8) An inspection of the room(s) is conducted at the conclusion of the meeting or conference (or at the end of each day of a multi-day event) to ensure all classified materials are properly stored.
c. Appropriately cleared U.S. Government contractor personnel may provide administrative
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 2
Change 3, 07/28/2020 26 support and assist in organizing a classified meeting or conference, but the DoD Component sponsoring the gathering remains responsible for all security requirements.
d. Facilities other than appropriately cleared U.S. Government or U.S. contractor facilities proposed for use for classified meetings and conferences shall:
(1) Not be open to the public and access shall be controlled by the U.S. Government or cleared contractor through a 100 percent identification card check at the perimeter point. For a military installation or comparably protected Federal government compound, this can be at the perimeter fence of the installation or compound.
(2) Have the room(s) where the classified sessions are to be held located away from public areas so that access to the room(s), walls, and ceiling(s) can be completely controlled during the classified sessions.
(3) Provide authorized means to secure classified information in accordance with Enclosure 3.
(4) Meet the DoD antiterrorism standards specified by DoDI O-2000.16 (Reference (z)).
(5) Be subject to TSCM surveys in accordance with DoDI 5240.05 (Reference (aa)). When addressing this requirement, TSCM security classification guidance MUST be consulted to ensure proper classification of meeting details when associated with the use of TSCM.
e. Not later than 90 days following the conclusion of a classified meeting or conference for which an exception was granted, the sponsoring activity shall provide an after-action report to the DUSD(I&S) through the approving DoD Component Head or senior agency official. The after-action report shall be a brief summary of any issues or threats encountered during the event and actions taken to address the situation.
17. SAFEGUARDING FGI
a. North Atlantic Treaty Organization (NATO) Information. NATO classified information shall be controlled and safeguarded according to United States Security Authority for NATO Instruction 1-07 (Reference (ab)).
b. Other FGI. See the Glossary for the definition of FGI.
(1) To avoid inadvertent compromise, classified FGI shall be stored in a manner that will avoid commingling with other material. For small volumes of material, separate files in the same vault, container, or drawer will suffice.
(2) FGI shall be re-marked if needed to ensure the protective requirements are clear. FGI may retain its original classification if it is in English. However, when the foreign government marking is not in English, or when the foreign government marking requires a
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 2
Change 3, 07/28/2020 27 different degree of protection than the same U.S. classification designation, a U.S. marking that results in a degree of protection equivalent to that required by the foreign government shall be applied. See Appendix 1 to Enclosure 4 of Volume 2 of this Manual for comparable U.S. classification designations.
(3) U.S. documents containing FGI shall be marked as required by section 9 of Enclosure 4 of Volume 2 of this Manual. The foreign government document or authority on which derivative classification is based must be identified on the “Derived from:” line, in addition to the identification of any U.S. classification authority. A continuation sheet should be used for multiple sources, if necessary. A U.S. document containing FGI cannot be declassified or downgraded below the highest level of FGI contained in the document without the written permission of the foreign government or international organization that originated the information.
(4) Security clearances issued by the U.S. Government are valid for access to classified FGI of a comparable level.
(5) The transmission of FGI within the United States among U.S. Government agencies and U.S. contractors and between U.S. contractors with a need to know must be in accordance with this Manual and Reference (w).
(6) The international transfer of foreign government classified information must be by government officials through government-to-government channels, or channels agreed upon in writing by the originating and receiving governments (collectively “government-to-government transfer”). See Enclosure 4 and its Appendix for further guidance on transfer of classified information.
(7) The receiving DoD Components shall protect FGI to at least a degree equivalent to that required by the foreign government or international organization that provided the information. FGI shall be controlled and safeguarded in the same manner as prescribed for U.S. classified information, except as described below. The control and safeguarding requirements for FGI may be modified as permitted by a treaty or international agreement, or, for foreign governments with which there is no treaty or international agreement, through formal written agreement between the responsible national security authorities or designated security authorities of the originating and receiving governments (hereafter referred to collectively as designated security authorities (DSAs)). The Under Secretary of Defense for Policy (USD(P)) serves as the DSA.
(a) Control of Foreign Government Top Secret Information. Maintain records for 5 years of the receipt, internal distribution, destruction, annual inventory, access, reproduction, and transmittal of foreign government Top Secret information. Reproduction requires the consent of the originating government. Destruction shall be witnessed.
(b) Control of Foreign Government Secret Information. Maintain records for 3 years of the receipt, distribution, external dispatch, reproduction, and destruction of material containing foreign government Secret information. Other records may be necessary if the
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 2
Change 3, 07/28/2020 28 originator requires. Secret FGI may be reproduced to meet mission requirements.
(c) Control of Foreign Government Confidential Information. Maintain records for 2 years for the receipt and external dispatch of Confidential FGI. Do not maintain other records for foreign government Confidential information unless required by the originating government. Confidential FGI may be reproduced to meet mission requirements.
(d) Foreign Government Restricted Information and Information Provided in Confidence. In order to ensure the protection of Restricted FGI or foreign government unclassified information provided in confidence, such information shall be classified in accordance with Reference (d) which states that unauthorized disclosure of FGI is presumed to cause damage to the national security. If the foreign protection requirement is lower than the protection required for U.S. Confidential information, the information shall be marked “CONFIDENTIAL-Modified Handling” as described in Volume 2, Enclosure 4, paragraph 4.c of this Manual and the following requirements shall also be met:
1. The information shall be provided only to those individuals who have an established need to know, and where access is required by official duties.
2. Individuals given access shall be notified of applicable handling instructions. This may be accomplished by a briefing, written instructions, or by applying specific handling requirements to an approved cover sheet.
3. Documents shall be stored to prevent unauthorized access (e.g., a locked desk or cabinet or a locked room to which access is controlled).
4. DoD Components and contractors performing on DoD contracts shall handle documents bearing the marking “UK RESTRICTED” as classified in accordance with subparagraph 17.b.(7)(d). The provision in the U.S./United Kingdom (UK) Security Implementing Arrangement (Reference (ac)) that allows documents marked “UK RESTRICTED” to be handled in a manner similar to For Official Use Only (FOUO) information applies ONLY to DoD contactors operating under COMMERCIAL contracts with the UK and, pursuant to the agreement, the UK must include in the applicable contract its requirements for the marking and handling of the information. The provision does NOT apply to, nor permit, such handling of UK RESTRICTED information by DoD Components or by contractors when performing on DoD contracts.
(8) FGI shall not be disclosed to nationals of third countries, including foreign nationals who are protected individuals or permanent resident aliens, or to any other third party, or used for other than the purpose for which the foreign government provided it without the originating government’s written consent. Questions regarding releasability or disclosure should be directed to the U.S. originator, who will consult with the foreign government as required. Contractors will submit their requests through the contracting U.S. Government agency for U.S. contracts and the Defense Security Service for direct commercial contracts. Approval from the originating government does not eliminate the requirement for the contractor to obtain an export authorization as required by other regulations or policies.
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 2
Change 3, 07/28/2020 29
18. ALTERNATIVE COMPENSATORY CONTROL MEASURES (ACCM). A Head of a DoD Component with original classification authority (OCA) may employ ACCM when he or she determines that the standard security measures detailed in this Manual are insufficient to enforce need to know for classified information and SCI or SAP protections are not warranted. The use of an unclassified nickname, obtained in accordance with Chairman of the Joint Chiefs of Staff Manual (CJCSM) 3150.29C (Reference (ad)), together with a list of persons authorized access, and a specific description of information subject to the enhanced ACCM controls, are the three requisite elements of an ACCM.
a. DoD Proponents for ACCM. The DoD staff proponent for ACCM management, oversight and Congressional reporting is the OUSD(P). The proponent for ACCM security policy is the Office of the Under Secretary of Defense for Intelligence and Security (OUSD(I&S)). Given this sharing of ACCM responsibilities, staff elements in OUSD(P) and OUSD(I&S) shall implement mechanisms that ensure transparency of all ACCM actions.
b. ACCM Approval. A Head of a DoD Component may approve ACCM use for classified information over which they have cognizance. Prior to approving the establishment of an ACCM, the criticality, sensitivity, and value of the information; analysis of the threats both known and anticipated; vulnerability to exploitation; and a countermeasures cost benefits analysis shall be assessed.
c. Guidance on ACCM Use. Use of ACCM must be consistent with the following guidance:
(1) ACCM may be used to assist in enforcing need to know for classified DoD intelligence matters. The DoD Component Head establishing or terminating any such ACCM shall provide written notification within 30 days to the Director of Security, OUSD(I&S), and the Director, Special Programs, OUSD(P), who shall maintain this information as long as the ACCM is in use.
(2) ACCM may be used to assist in enforcing need to know for classified operations, sensitive support, and other non-intelligence activities. The DoD Component Head establishing or terminating any such ACCM shall provide written notification within 30 days to the Director, Special Programs, OUSD(P), for review. The Director, Special Programs, OUSD(P), shall maintain this information as long as the ACCM is in use.
(3) ACCM shall not be used for acquisition programs or activities progressing through the acquisition process.
(4) DoD Components shall obtain an unclassified nickname consistent with Reference (ad) and coordinate with OUSD(P) to preclude duplication of nicknames.
(5) A roster or listing of all persons accessed to the ACCM shall be maintained by the ACCM control officer (see subparagraph 18.f.(1)(c) of this section). The access roster will differentiate between those persons actively accessed and those whose accesses are currently inactive.
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 2
Change 3, 07/28/2020 30
(6) ACCM documents and materials shall be marked as specified in Enclosure 4 of Volume 2 of this Manual.
(7) Heads of DoD Components must establish and maintain a system that provides for recurrent inspection of the ACCM they have approved. This mechanism shall ensure compliance with the provisions of this Manual. Each ACCM shall be overseen and inspected on a recurrent basis by the ACCM sponsor or OUSD(P).
d. Prohibited Security Measures. The application of the following security measures with ACCM material is prohibited:
(1) Using personnel security investigative or adjudicative standards that are more stringent than those normally required for a comparable level of classified information to establish access eligibility to ACCM-protected information.
(2) Using code words as defined in Reference (ad).
(3) Using trigraphs, digraphs, or other abbreviations of the approved nickname.
(4) Using specialized non-disclosure agreements or any certificates of disclosure or non- disclosure for ACCM access.
(5) Using a billet structure or system to control the position or numbers of persons afforded ACCM access.
e. Prohibited Uses of ACCM. The following uses of ACCM are prohibited:
(1) Using ACCM for NATO or non-intelligence FGI. For NATO, exceptions to this limitation can be granted only by the Secretary of Defense. For non-intelligence FGI, exceptions to this limitation can be granted only by the USD(P). Request for exceptions shall be forwarded to the Director, International Security Programs, Defense Technology Security Administration, OUSD(P), for action. Such approvals must be documented and retained by the sponsor.
(2) Using ACCM to protect classified information in acquisition programs as defined in DoDD 5000.01 (Reference (ae)).
(3) Using ACCM to protect technical or operational requirements of systems in the acquisition process. Systems in operational use are not viewed as being in the acquisition process. Components of operational systems are fielded end items, not items in the acquisition process, and improvements to fielded items are eligible for ACCM status if properly justified.
(4) Using ACCM to protect Restricted Data (RD), Formerly Restricted Data (FRD), COMSEC, SCI, SAP, or Nuclear Command and Control Extremely Sensitive Information.
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 2
Change 3, 07/28/2020 31 (5) Using ACCM to protect unclassified information.
(6) Using ACCM to preclude or impede congressional, OSD, or other appropriate oversight of programs, command functions, or operations.
(7) Using ACCM to justify funding to procure or maintain a separate ACCM communication system.
f. Documentation
(1) Use of ACCM must be approved in writing by the cognizant DoD Component Head. The correspondence establishing the ACCM shall be signed by the DoD Component Head and shall include the following information:
(a) Unclassified nickname assigned in accordance with Reference (ad).
(b) Designation of the ACCM sponsor. As a minimum, the sponsor shall be a general or flag officer, or senior executive equivalent, who has OCA at the level of or higher than the information protected by the ACCM.
(c) Designation of an ACCM control officer who shall be the organization’s point of contact for all matters concerning the ACCM. Subsequent changes in designated personnel shall be provided, in writing, to the Special Programs Office, OUSD(P).
(d) Description of the essential information to be protected by the ACCM.
(e) Effective activation date and expected ACCM duration.
(f) Any planned participation by foreign partners.
(2) The ACCM sponsor shall develop and distribute a program security plan, security classification guide, and program participant briefing to all participating organizations prior to the activation of the ACCM. As a minimum, the briefing will address the specific information that is subject to ACCM security measures.
(3) The Special Programs Office, OUSD(P), shall maintain a central repository of records for all DoD ACCM.
g. Annual Reports of ACCM Use. Not later than December 15 of each year, the DoD Components shall provide a report to OUSD(P) on all ACCM usage during the previous year. The exact format for this report shall be provided annually by OUSD(P), however, the general data elements include: ACCM nickname; purpose and/or description of the ACCM program; expected duration; and ACCM sponsor and ACCM control officer(s).
h. Sharing ACCM-Protected Information. ACCM-protected information may be shared with other DoD Components and/or other Federal government departments and agencies only when
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 2
Change 3, 07/28/2020 32 the recipient organization agrees to abide by the ACCM security requirements stipulated in this enclosure.
i. Contractor Access to ACCM. DoD contractors may participate in ACCMs, or be directed to participate, only when such access and the associated security plan are identified in the DD Form 254, “Contract Security Classification Specification.” Care must be taken to ensure identification of the security plan does not disclose ACCM-protected data.
j. Program Maintenance
(1) ACCM sponsors shall maintain an updated listing of primary and alternate ACCM control officers for each organization to which they have extended their program.
(2) Each organization’s ACCM control officer shall maintain an updated ACCM access control list for their organization.
(3) Initial contact between organizations will be between each organization’s ACCM control officers. ACCM control officers may authorize action officer to action officer contact once access control lists have been exchanged between organizations.
(4) Personnel requiring access to ACCM-protected information shall receive specialized training upon initial access to the program and annually thereafter. Training, as a minimum, shall address the procedures for access, control, transmission, storage, and marking. Individuals may be required to sign an acknowledgement of training should the security plan so specify.
(5) ACCM documentation (i.e., program security plan and security classification guide) must be updated a minimum of once every 5 years.
(6) ACCM sponsors shall provide the following information, through the DoD Component Head, to OUSD(P) concurrently with the ACCM annual report:
(a) A listing of primary and alternate ACCM control officers for each organization managing an ACCM.
(b) Any updated ACCM documentation or confirmation that program documentation has been reviewed and is current.
k. Safeguarding ACCM Information. The provisions of this Manual regarding the safeguarding of classified information are modified with respect to use of ACCM as follows:
(1) Top Secret, Secret, and Confidential cover sheets (i.e., SFs 703, 704, and 705, respectively) used to cover ACCM material shall be over stamped or marked with “ACCM” and the appropriate nickname. Cover sheets specifically designated by the DoD Components for use with ACCM must be approved by the Director of Security, OUSD(I&S), prior to use.
(2) ACCM material should be handled and stored based on the security classification of
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 2
Change 3, 07/28/2020 33 the information contained therein and in a manner that separates it from non-ACCM classified information. Separate GSA approved storage containers are not required so long as everyone with access to container is also approved for access to the ACCM material stored within, but the measures used (e.g., segregated files, separate folders, drawers labeled for ACCM) shall prevent the commingling of ACCM material with other classified documents.
(3) ACCM information shall be transmitted in the same manner as other classified information at the same classification level with the following exceptions:
(a) ACCM information packaged for transmission shall have the inner envelope marked with the appropriate classification, the caveat “ACCM,” and the assigned nickname, and shall be addressed to the attention of an individual authorized access to the ACCM information.
(b) The ACCM nickname shall be used in the text of message traffic and on cover sheets accompanying secure facsimile transmissions to assist in alerting the recipient that the transmission involves ACCM-protected information. Senders shall ensure that an authorized recipient is awaiting the transmission when sending via secure facsimile. When using the Defense Message System (DMS), the material must also be marked as “SPECAT” (Special Category) in accordance with the requirements and procedures in CJCSM 5720.01B (Reference (af)). Due to limits in DMS processing, only one ACCM nickname should be used in a DMS message.
(c) Automated information systems or electronic files containing ACCM protected information shall be configured with appropriate discretionary access controls to ensure that access is restricted to individuals with authorized access.
(d) Secret Internet Protocol Router Network (SIPRNET) or other secure transmission methods authorized for processing information at the required level of classification may be used to transmit ACCM information. Each such transmission must be marked with the caveat “ACCM” and the authorized nickname in accordance with the marking guidance in Volume 2 and transmitted only to those authorized access to the ACCM information.
(e) The method of transmission selected for ACCM information, whether in hardcopy or electronic form, shall be consistent with the security classification assigned. Designation of information as requiring ACCM protection does not, in and of itself, require the transmission of the information by methods usually reserved for a higher level of classified information.
l. Security Incidents. Compromise of ACCM program information can present an immediate and real threat to national security and those personnel involved in mission execution. Anyone finding ACCM material out of proper control shall take actions to safeguard the material and shall immediately notify the local ACCM control officer, if known, or the local security manager.
(1) All reporting, inquiry, investigation, and damage assessment will be conducted per the guidelines contained in Enclosure 6 of this Volume. Any reports containing ACCM
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 2
Change 3, 07/28/2020 34 information shall be handled in accordance with the requirements of this Manual as modified by this section.
(2) Section 13 of Enclosure 6 of this Volume states the actions to take if unauthorized personnel are inadvertently afforded access to ACCM information. Inadvertent disclosure forms, commonly used with compartmented information, are not authorized for use with ACCM information.
(3) Because ACCM program information is not SCI or SAP, reasonable risk management procedures should be followed when ACCM program information is incorrectly placed on non-approved electronic processing systems or electronically transmitted to non- authorized personnel and/or systems. Deleting the file or material from all affected systems is normally a sufficient action unless the material in question is classified at a higher level of classification than that for which the system is accredited.
(4) The ACCM sponsor should be notified when the local inquiry and investigation is completed. Resolution will be in accordance with current guidance contained in Enclosure 6 of this Volume and must consider the guidance contained in the ACCM program security plan. Responsibility for the damage assessment remains with the ACCM sponsor. Any additional action will be as directed by the ACCM sponsor and the local security manager.
m. ACCM Termination. ACCM shall be terminated by the establishing DoD Component when ACCM security measures are no longer required. Notification of ACCM termination must be submitted, in writing, as required by paragraphs 18.c.(1) and 18.c.(2) of this enclosure.
n. Transitioning an ACCM to a SAP. If, at any point in time, the DoD Component Head determines that information protected by ACCM requires further protection as a SAP, authorization to establish a DoD SAP must be requested in accordance with DoD Directive 5205.07 (Reference (ag)).