CUI Marking class (Webex)

by cwallace, posted in Events & reviews, Marking & examples

CUI Marking Handbook Cover Image

 

We will be offering a CUI Marking fundamentals webex on
May 19, 2020 from 11 am – 1 pm (EDT).
Participants will receive a completion certificate for attending the webex.
In addition to providing an overview of the principles of marking in the unclassified environment, this class will provide an update on the CUI Program and its implementation among Executive Branch agencies.

The conference begins at 11:00 AM Eastern Time on May 19, 2020; you may join the conference 10 minutes prior.

Step 1: Dial into the conference.
Dial-in: 1-877-369-5243 or 1-617-668-3633
Access Code: 0205164##
Need an international dial-in number?
Step 2: Join the conference on your computer.
Entry Link: https://ems8.intellor.com/login/826851

When you access the entry link above, you will be provided a choice – to install the WebEx plug-in for your preferred browser or to join the web conference using a temporary path. Either option is acceptable.

Need assistance with your audio? Please dial 888-796-6118. Need assistance with your Webex? Please dial 888-793-6118.

Marking class presentation April

****NOTE:  You do NOT have to RSVP for this event.  When logging in to participate in the webex, log in with your full name and email address.  Your completion certificate will be filled out and emailed to you from this information. Your certificate will be emailed to you 3-4 weeks after this event***** 

 

Using CUI while teleworking during Coronavirus social distancing common issues: Cohabitants

by ecoren, posted in General updates

There is an increased potential for CUI to be overheard or observed with more people likely to be in the home.

Many people used to have the house to themselves while teleworking and now in many households’ spouses, kids, and housemates are home.

Even in homes with a room that can be used as an office, it might be a room shared by both spouses. In this situation, even if both spouses work for the government, one spouse may not have a lawful government purpose to have access to information the other spouse has access to. Special attention should be paid to dissemination controls, particularly FED ONLY, NOCON, DL ONLY, Attorney-Client, Attorney-WP, and Deliberative.

Other employees do not live in a home with even the option of an extra room to serve as an office. This might include a couple living in a studio apartment or just a very full house.

Some employees also might live with housemates that are not of their choosing because of financial constraints. Nearly all of us can think back to the days — at some point in our life — that we were in this situation.

So how do agencies and employees establish a controlled environment to effectively safeguard CUI when it is used during telework?

There are lots of deeply personal reasons an employee might have to make the judgment call they need to take extra precautions in order to achieve a controlled environment. Just to name a few examples: a kid who tells everything to their friends or random strangers they walk by, an untrustworthy roommate, a family member with mental illness, or a divorce in progress.

In most cases an employee will prefer not to go into these details with a supervisor, the same way they might be willing to say they “live in a studio apartment with a parakeet”…though some employees might not even be comfortable saying that. 

Though the personal situation can be generalized to protect employee personal privacy, there are three steps that should occur:

  1. the employee should notify their supervisor they feel a need to take extra precautions and what those precautions are,
  2. the employee acknowledges it is their responsibility to achieve a controlled environment that effectively safeguards the information and the supervisor recognizes that part of their own obligation to safeguard the information is to empower the employee with the work time and resources to do this,
  3. the agency provides supplemental training on the safeguarding needed to achieve a controlled environment is given before CUI is used.  

An employee knows their home environment best, so be a good listener when an employee says “I cannot talk about that now,” “Can I email you,” “I need to call you back about that,” etc.

Keeping the computer screen from being observed is a different set of challenges and depend greatly on the physical configuration of the work environment.

Different solutions will be right for different employees. Here a couple items supervisors might want to consider:

  • Providing flexible schedules (for example, to work at a time when others aren’t around)
  • Providing flexible range of assignments (so non-CUI work can be done if the environment changes)
  • Providing screen protectors (to limit the angles a computer screen is readable from)
  • Providing headphones (that can be used instead of speaker phones or laptop speakers; note: it remains the employee’s responsibility keep in mind people around them and be mindful of what information they are talking about)
  • Providing refresher training (particularly tailored to our new telework environment)

Employees also need to remember their obligation to report security and safeguarding incidents, even ones that happen at home. It is an essential security and safeguarding practice for agencies to foster a culture of self-reporting.

In addition, telework.gov is a great resource to check out for additional information.

What are other solutions that you have found to be a best practice as we all adjust to teleworking with a full house? What topics would you suggest be included in refresher training about creating a controlled environment while teleworking with a full house?

Save the Date: CUI Marking class (Webex)

by cwallace, posted in Events & reviews, General updates

CUI Marking Handbook Cover Image

The CUI Program Office will be hosting another

CUI Marking class

Date: May 19, 2020

Time: 11:00 am – 1:00 pm (EST)

You do not have to rsvp for this class, the information  will be posted as soon as it becomes available.

If you have any questions or concerns, please feel free to email us at CUI@nara.gov

 

NOTE: If you attended the CUI Marking class on April 23, 2020; your completion certificate will be emailed to you by the end of this week. 

 

 

NSA Article: “Working from Home? Select and Use Collaboration Services More Securely”

by devincaseycui, posted in Common questions, News

A recently published article at the National Security Agency (NSA) Central Security Service (CSS) promotes newly issued guidance entitled Selecting and Safely Using Collaboration Services for Telework.  This guidance  provides simple, actionable, considerations for individual government users and can be found here: Working from Home? Select and Use Collaboration Services More Securely.

 

 

CUI Marking Class (Webex) Reminder!

by cwallace, posted in Events & reviews, Marking & examples

CUI Marking Handbook Cover Image

 

We will be offering a CUI Marking fundamentals webex on April 23 from 11 am – 1 pm (EDT).  Participants will receive a completion certificate for attending the webex.  In addition to providing an overview of the principles of marking in the unclassified environment, this class will provide an update on the CUI Program and its implementation among Executive Branch agencies.

The conference begins at 11:00 AM Eastern Time on April 23, 2020; you may join the conference 10 minutes prior.

Step 1: Dial into the conference.
Dial-in: 1-877-369-5243 or 1-617-668-3633
Access Code: 0947408##
Need an international dial-in number?
Step 2: Join the conference on your computer.
Entry Link: https://ems8.intellor.com/login/824589

When you access the entry link above, you will be provided a choice – to install the WebEx plug-in for your preferred browser or to join the web conference using a temporary path. Either option is acceptable.

Need assistance with your audio? Please dial 888-796-6118. Need assistance with your Webex? Please dial 888-793-6118.

 

Marking class presentation April (below)

Marking class presentation April

****NOTE:  When logging in to participate in the webex, log in with your full name and email address.  Your completion certificate will be filled out and emailed to you from this information. ***** 

 

”UNCLASSIFIED”, “(U)”, and “Unclassified”

by ecoren, posted in Common questions, Marking & examples
  • “UNCLASSIFIED” in the banner marking indicates the absence of CUI and classified information.
  • “(U)” as a portion marking indicates the absence of CUI and classified information.
  • “Unclassified” when not used in a marking, indicates that the information being referred to is not classified, but does not indicate whether or not the information is controlled (CUI) or not.

Background:

Prior to the CUI Program, the term “unclassified” was used to describe information that did not meet the standards to be classified under Executive Order 13526. In classified environments, the banner marking of “UNCLASSIFIED” was placed at the top and bottom of pages to indicate the absence of classified information in documents. In portions of documents, a “(U)” indicated that a portion did not contain classified information.

In the absence of Government-wide guidance regarding the handling and marking of sensitive but unclassified information, Executive branch departments and agencies started applying additional indicators to convey the status of sensitive but unclassified information in classified documents. Markings such as “U//FOUO” and “U//LES” became commonly used in commingled documents (documents that contain both sensitive but unclassified, as well as classified information).

As agencies implement the CUI Program and modify marking standards to comply with those in 32 CFR Part 2002, the use of legacy markings, such as FOUO and LES, to describe sensitive but unclassified information will be phased out.

As part of this transition to the CUI Program, agencies should convey – through policy and training – that the term Unclassified (or Uncontrolled Unclassified Information, as described in 32 CFR Part 2002) refers to information that: is neither CUI nor classified, but is still subject to agency public release policies.

Reference: CUI Marking Handbook

Agency Considerations when allowing employees to telework with Controlled Unclassified Information (CUI) during the COVID-19 pandemic

by ecoren, posted in General updates, Uncategorized

The CUI program has a lot of flexibility built in to allow agencies to accomplish their mission, including while employees are teleworking.

Agencies must ensure CUI is safeguarded in accordance with 32 CFR 2002 (the CUI Program’s implementing directive) and the applicable laws, regulations, and government-wide policies. In doing so agencies must establish controlled environments where CUI can be effectively safeguarded. 

Telework agreements can be used to spell out whether or not CUI is permitted, as well as, which categories of CUI employees can use while teleworking. The agreement should also outline what controls (physical or electronic) need to be in place to ensure adequate protection.

Here are some common issues agencies may encounter as they allow employees to telework with CUI:

1. Increased potential for CUI to be overheard or observed with more people likely to be in the home

2. Difficulty securing devices used for telework (computers, cell phones, tablets, routers, modems)

3. Ensuring compliance with current policies and limiting use of unauthorized equipment and media

4. Enabling employees to accomplish their tasks and adjusting expectations limit use of unauthorized workarounds

Agencies, in consultation with CUI Program Officials, should develop additional guidance that addresses each of the issues described above.  Front-line supervisors should initiate discussions with their employees to assist and determine the best ways to ensure the protection of CUI while teleworking.

General guidelines for Handling Controlled Unclassified Information (CUI) as you Telework

by ecoren, posted in Uncategorized

As we all work to do our jobs in the changing work environment during the COVID-19 crisis, those who work with CUI should continue to make sure they safeguard CUI.

In many cases, CUI can be worked on, in a telework environment, as long as the proper controls are in place to achieve a controlled environment (physical and electronic) and agency policies allow it.

Make sure to follow any agency policy or guidance, especially interim guidance issued in response to COVID-19 as standard practices may have been changed to allow for greater telework participation. If needed, employees should consult their supervisor if they have any questions regarding the proper handling of sensitive information.

Here are some general guidelines to consider as you telework with CUI: 

  1. CUI should not be stored on personal systems. 
  2. Printing and hard copy storage should be kept to a minimum.  
  3. Agency sponsored/approved virtual desktops (or similar) should be used. 
  4. Personal email accounts should not be used to store or transmit CUI.

Banner Markings now on the CUI Registry!

by markriddle191017, posted in General updates, Marking & examples
In response to stakeholder requests and to enhance the usability of the CUI Registry, ISOO recently updated the CUI Registry to reflect the banner markings that can be applied to the various categories of CUI. You can find this change on individual category pages, directly below the category name. This change should assist authorized personnel in the proper application of CUI Markings.  ISOO has also developed a number of resources that should assist with the proper marking of CUI.  The CUI Marking Handbook, training videos (Introduction to Marking & Marking Commingled Information), and the CUI Coversheet are great resources as you implement and begin marking CUI.