**[SENSITIVE UNCLASSIFIED INFORMATION]{.underline}**

**A. [GENERAL]{.underline}**.

1\. Sensitive Unclassified Information (SUI) is any information,
regardless of its physical form or characteristics, which has been
determined to have relative sensitivity and requires mandatory
protection because of statutory or regulatory restrictions or which
requires a degree of discretionary protection due to the risk to
national or DOE interests or to the magnitude of loss or harm that could
result from the inadvertent or deliberate misuse, alteration,
disclosure, or destruction of such information.

2\. SR manages and utilizes several categories of SUI. They include:

> a\. Unclassified Controlled Nuclear Information (UCNI);
>
> b\. Official Use Only (OUO);
>
> c\. Export Controlled Information (ECI); and

3\. SR may possess other Federal Departments\' SUI which includes:

> a\. The Department of State, which categorizes SUI as Sensitive But
> Unclassified (SBU). SBU was formerly called Limited Official Use.
>
> b\. The Department of Defense, which categorizes SUI as For Official
> Use Only (FOUO).
>
> Both SBU and FOUO shall be managed, protected, and utilized by SR and
> SR contractors as Official Use Only, if encountered.

4\. \"Need-to-Know\" is defined as a determination by a person having
responsibility for SUI that a proposed recipient\'s access to such
information is necessary in the performance of official or contractual
duties of employment. The \"Need-to-Know\" principle is critical to the
protection of SUI.

5.  The purpose of this chapter is to assist SRS employees in the
    identification of SUI and to provide protective measures for SUI
    from its origination until its authorized release from the SRS. The
    protective measures minimize the probability of inadvertent
    disclosure of SUI at SRS while increasing the difficulty of
    illegally obtaining SUI. SUI protective measures are not designed to
    withhold any information to which the public has a legal right of
    access.

**B. [UNCLASSIFIED CONTROLLED NUCLEAR INFORMATION ]{.underline}**

> 1\. [Definition]{.underline}. UCNI is certain unclassified Government
> information whose unauthorized dissemination is prohibited under
> section 148 of the Atomic Energy Act of 1954, as amended and
> implemented by DOE O 471.1, \"Identification and Protection of
> Unclassified Controlled Nuclear Information.\"
>
> 2\. [Types]{.underline}. The major types of UCNI are:
>
> a\. Designs of nuclear production or utilization facilities;
>
> b\. Safeguards and security information regarding nuclear facilities
> or material; and
>
> c\. Declassified nuclear weapon information that at a later date is
> considered to be sensitive.
>
> 3\. [Routine Access]{.underline}. Routine access refers to the normal
> exchange of UCNI during the conduct of official or contractual
> business. Routine access to UCNI is granted by an authorized
> individual or by a Reviewing Official (RO). To be granted routine
> access to UCNI, an individual must: **(1)** have an established
> need-to-know in the performance of official or contractual duties or
> DOE-authorized activities; and **(2)** be a U. S. citizen who is one
> of the following:
>
> a\. A Federal employee or member of the U.S. Armed Forces;
>
> b\. An employee of a Federal contractor or subcontractor;
>
> c\. A prospective Federal Government contractor or subcontractor who
> will use UCNI for Federal Government contract bidding purposes; and
>
> 4\. [Marking Requirements]{.underline}. Documents marked UCNI contain
> SUI that is not subject to disclosure under the Freedom of Information
> Act (FOIA). These documents are marked with the following information:
>
> a\. If the document has been reviewed by an RO (an Authorized
> Derivative Classifier cannot do this) and determined to contain UCNI,
> the front cover or first page of the document shall be marked with the
> statement:
>
> **\"UNCLASSIFIED CONTROLLED NUCLEAR INFORMATION\"**

## NOT FOR PUBLIC DISSEMINATION

> **\"Unauthorized dissemination subject to civil and criminal sanctions
> under Section 148 of the Atomic Energy Act of 1954, as amended (42
> U.S.C. 2168).\"**

Also it must be marked with an RO stamp, (RO\'s name, organization, date
and guidance used (list all UCNI guidance used).

The marking "Unclassified Controlled Nuclear Information" or "UCNI" must
be placed on the top and bottom of the front of the matter.

b.  Subsequent pages containing UCNI on all following pages shall be
    marked at the top and bottom of each interior page of the matter or
    on the top and bottom of only those interior pages that contain UCNI
    with one of the following:

> **\"UNCLASSIFIED CONTROLLED NUCLEAR INFORMATION\"**
>
> **or**
>
> **\"UCNI\"**
>
> c\. Removable Computer media containing UCNI must be labeled with an
> "Unclassified" label and marked **\"UNCLASSIFIED CONTROLLED NUCLEAR
> INFORMATION\" or "UCNI"**.

d.  [Caveats]{.underline}. UCNI matter may be marked with the caveat
    "DISSEMINATION CONTROLLED" when programmatic requirements place
    special dissemination or reproduction limitations on information
    controlled as UCNI. This marking indicates that reproduction,
    extraction of information, or redistribution of such matter requires
    the permission of the cognizant DOE program office. If this caveat
    is applied, the originator must ensure that the following marking is
    placed immediately above the matter's front marking:

### **DISSEMINATION CONTROLLED**

> **Distribution authorized to DOE and DOE contractors only. Other
> requests shall be approved by the cognizant DOE program office, which
> is \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_, before release.**

5.  [Transmittal Documents.]{.underline} A document that (a) transmits
    matter marked as containing UCNI and (b) does not itself contain
    classified information or UCNI must be marked on its front as
    follows:

#### **Matter transmitted contains Unclassified Controlled** 

> **Nuclear Information. When separated from**
>
> **enclosure, this transmittal document does not contain**
>
> **UCNI.**
>
> 6\. [Physical Protection Requirements]{.underline}.
>
> a\. [In Use]{.underline}. Any individual authorized access to UCNI
> shall maintain physical control so as to prevent unauthorized access
> to the information.
>
> b\. [On Computer Systems]{.underline}. UCNI information should be:
>
> \(1\) Password protected or on removable media;
>
> \(2\) Restricted distribution to individuals with established
> \"need-to-know\";
>
> \(3\) Clearly marked as appropriate;
>
> \(4\) Access to computer cables and computer equipment containing UCNI
> restricted US citizens of the company who possess a "need to know",
> and
>
> \(5\) Encrypted if passing through uncontrolled portions of the
> building or off the premises.
>
> c\. [In Storage]{.underline}.

UCNI matter or information must be secured behind a locked door or in a
locked/ container desk when unattended; or in a method which would
prevent/ preclude unauthorized disclosure.

> d\. [Transmission]{.underline}. UCNI shall be transmitted by means to
> preclude unauthorized disclosure or dissemination. Examples include:
>
> \(1\) Off premises:
>
> \(a\) Documents may be hand carried if packaged in a single sealed
> opaque envelope or wrapping as long as the individual hand carrying
> can control access to the documents and the envelope is addressed to
> an individual with an established \"need-to-know.\"
>
> \(b\) Any of the following classes of U. S. Mail: First Class,
> Express, Certified, or Registered and addressed to an individual with
> an established \"need-to-know.\"

(c) Any commercial carrier (e.g., Federal Express, Emery, etc.) using
    signature service may be used and addressed to an individual with an
    established \"need-to-know.\"

(d) An authorized individual may hand carry the matter as long as he or
    she can control access to the matter being transmitted.

> \(2\) On the premises by an authorized individual who may hand carry
> documents as long as he or she can control access to the documents.
>
> \(3\) Over Telecommunication Circuits: UCNI must be protected by
> encryption when transmitted off site by telecommunications services,
> (i.e., telephone, facsimile, narrative message, communications
> facilities, or radio communications. If UCNI is transmitted over
> public switched broadcast communications path (i.e., Internet), then
> the information must be protected by encryption. Unless US Government
> FIPS approved encryption is employed the information should not be
> transmitted over public switched broadcast communications path.
>
> e\. [Reproduction]{.underline}. Information may be reproduced to the
> minimum extent necessary, consistent with need and an established
> \"need-to-know\" as long as it is not marked as "Dissemination
> Controlled" IAW requirements in Paragraph B.6.d. above.
>
> f\. [Destruction]{.underline}.
>
> \(1\) The normal method for destroying documents containing UCNI is by
> strip shredding to a strip not exceeding 1/4 of an inch in width. This
> may be accomplished in the workplace, if strip shredders are provided.
>
> \(2\) Computer storage media containing UCNI data may be disposed of
> by one of two methods. The storage media may be sanitized by
> degaussing and disposed of as solid waste. Finally, storage media that
> cannot be degaussed, must be disposed of by pulverization, smelting,
> incineration, disintegration, or other approved methods of physical
> destruction.
>
> \(3\) Computer equipment that contains UCNI data on a hard drive must
> be sanitized/wiped. Norton Utilities will be used to wipe the hard
> drive. If the computer equipment cannot be wiped, the hard drive is
> removed and degaussed.
>
> 7\. [Loss or Unauthorized Disclosure]{.underline}. Any person who
> determines that UCNI has been or may have been lost or disclosed
> without authority shall immediately report this information to the DOE
> Savannah River Operations Office Security Incident Program Manager,
> 803-725-8936.

**C. [OFFICIAL USE ONLY]{.underline}.**

> 1\. [Definition]{.underline}. OUO consists of information which **does
> not necessarily** affect national security, but which if disclosed to
> persons who do not need it in the performance of official or
> contractual duties, may be prejudicial to the public interest, to a
> person or concern, or may assist an individual or enterprise to
> benefit improperly. OUO **may be exempt** in whole or part from the
> mandatory public disclosure requirements of the FOIA.

2.  [Categories of OUO]{.underline}. Seven of the nine categories of
    information, which are exempt from the publication and disclosure
    requirements of the FOIA, as detailed in DOE Guide 1700.1, are
    designated as OUO by SR. These seven categories of OUO information
    are described below by Exemption Number corresponding to the
    original FOIA Exemption Number. The FOIA exemptions provide the
    basis for non-disclosure and generally are discretionary rather than
    mandatory. SR will provide initial protection for sensitive
    unclassified scientific, technical, and other information with
    potential economic value as, and under, the legal doctrine of,
    Government Confidential Commercial Information (GCCI) in conjunction
    with Exemption Five as described in Paragraph C.2.c below. This
    exemption should be utilized, when deemed appropriate, by
    originators of such unclassified information for its protection as
    GCCI information from inception until its submission for formal
    review for release.

> a\. Exemption **Two:** Related solely to the internal personnel rules
> and practices of SR.
>
> b\. Exemption **Four:** Trade secrets and commercial or financial
> information of a privileged or confidential nature obtained from a
> person.
>
> c\. Exemption **Five:** Inter-agency or intra-agency memoranda or
> letters, which would not be available by law to a party other than an
> agency in litigation with the agency. S&T information which the
> originator believes may possess potential commercial/economic value
> as, and under, the legal doctrine of GCCI or may be potentially
> legally protectable intellectual property and should be provided
> preliminary discretionary protection pending formal review. (See
> Paragraph C.2 above for discussion on S&T information contained in DOE
> Order 241.1).
>
> d\. Exemption **Six:** Personnel and medical files and similar files,
> the disclosure of which would constitute a clearly unwarranted
> invasion of personal privacy.
>
> e\. Exemption **Seven:** Investigatory records compiled for law
> enforcement purposes.
>
> f\. Exemption **Eight:** Contained in or related to examination,
> operating, or condition reports prepared by, or on behalf of, or for
> the use by an agency responsible for the regulation or supervision of
> financial institutions.
>
> g\. Exemption **Nine:** Geological and geophysical information and
> data including maps concerning wells.
>
> 4\. [Marking Requirements]{.underline}.

a.  If the Originator determines a document should be protected as OUO,
    based on exemptions two or four through nine the front cover or
    first page of the document must be marked with the statement:

> **OFFICIAL USE ONLY**
>
> **\"Contains information which [may]{.underline} be exempt from public
> release under the Freedom of Information Act (5 U.S.C. 552), Exemption
> Number (s) . Approval by the Department of Energy prior to public
> release is required.\"**
>
> **Reviewed by: Date:**
>
> **(Name & Signature)**
>
> b\. The marking \"**OFFICIAL USE ONLY**\" must be placed on the bottom
> of each subsequent page or on the pages containing OUO information.
> Originators are encouraged to mark only those pages containing OUO
> information.
>
> c\. Removable Computer media containing OUO information must be marked
> \"**OFFICIAL USE ONLY**\".

5.  [Routine Access]{.underline}. Routine access to OUO may be granted
    to SR and SR contract employees with an established \"need-to-know\"
    for the OUO in the performance of official or contractual duties of
    employment. SR holders of OUO information are authorized to convey
    such information to Officials in other U.S. Government Departments
    and Agencies and contractors of those organizations, to fulfill a
    government function.

> 6\. [Physical Protection Requirements]{.underline}. See Paragraph B.6.
> above.
>
> 7\. [Unauthorized Disclosure]{.underline}. The unauthorized disclosure
> of OUO information will be reported as paragraph B.7 above.

**D. [EXPORT CONTROLLED INFORMATION]{.underline}.**

> 1\. [Export Controlled Information]{.underline}. ECI is any technical
> information determined to contain technical data, the export of which
> is restricted by:

-   10 CFR 810, DOE Assistance to Foreign Atomic Energy Activities, or

-   15 CFR 774, U.S. Department of Commerce (DOC) Export Administration
    Regulations, Commodity Control List, Supplement 1 or

-   22 CFR 121, U.S. Department of State (DOS) U.S. Munitions List; or

-   DOE export control guidance.

> If exported, ECI requires a technology export license or authorization
> under United States export regulations. Typical nuclear-related ECI
> encountered at the SRS would include nuclear fuel cycle and tritium
> production technology.
>
> 2\. [Non-Public Technical Data (NPTD)]{.underline}. NPTD is technical
> data which is not publicly available and which is not specifically
> identified in 10 CFR 810, 15 CFR 774 - Supplement 1, or 22 CFR 121.
> The U.S. DOC requires an export license review prior to transferring
> NPTD to a foreign national.
>
> 3\. [Export]{.underline}. Export means an actual shipment or
> transmission out of the United States of technology, software, or
> source code subject to US export regulations, or release of technology
> or source code subject to U.S. export regulations to a foreign
> national anywhere.
>
> 4\. [Release]{.underline}. Release occurs when NPTD or ECI leaves SRS
> control.
>
> 5\. [Release of Technology or Source Code]{.underline}. Technology or
> source code is "released" for export through:
>
> a\. Visual inspection by foreign nationals of U.S. - origin equipment
> and facilities;
>
> b\. Oral exchanges of information in the United States or abroad; or
>
> c\. The application to situations abroad of personal knowledge or
> technical experience acquired in the United States.
>
> 6\. [Technology]{.underline}. Specific information necessary for the
> development, production, or use of a product. The information takes
> the form of technical data or technical assistance.

**Note 1**: Technical assistance \-- May take forms such as instruction
skills training, working knowledge, or consulting services.

> **Note 2**: Technical assistance may involve transfer of technical
> data.
>
> 7\. [Technical Data]{.underline}. May take forms such as blueprints,
> plans, diagrams, models, formulae, tables, engineering designs and
> specifications, manuals and instructions written or recorded on other
> media or devices such as disk, tape, and read-only memories.
>
> 8\. [Access]{.underline}. ECI may be granted to SR and SR contract
> employees who are US Citizens with established need-to-know in the
> performance of official or contractual duties. Foreign nationals may
> be given routine access to NPTD if approved by the SR Export Control
> Program Manager (ECPM) or the Westinghouse Savannah River Company
> (WSRC) Export Control Officer only after a need-to-know is established
> for the foreign national and an export license or authorization has
> been obtained from the appropriate U.S. agency (i.e., DOC, DOS, or
> DOE), if required. Export licenses or authorizations are for a
> specific technology and do not authorize access to other ECI. The
> approval of the SR ECPM should be obtained prior to the release of ECI
> or NPTD to any foreign national no matter what form the technical data
> may take.
>
> 9\. [Originator]{.underline}. The originator of a document is
> responsible for the initial identification and protection of NPTD and
> ECI and must seek out an Export Control Reviewer to conduct a formal
> review if the information is being considered for release outside the
> DOE or to any foreign national.
>
> 10\. [EC Reviewer]{.underline}. An individual, who by familiarization
> and/or experience is considered a subject matter expert, authorized to
> make a determination that equipment, material, or technical
> information is or is not export controlled.
>
> 11\. [Marking Requirements]{.underline}. Products containing ECI must
> be clearly marked in accordance with the following procedures:
>
> a\. The following statement must be marked on the cover or first page
> of any information product determined to contain ECI:
>
> **\"EXPORT CONTROLLED INFORMATION\"**
>
> **Contains technical data whose export is restricted by statute.**
>
> **Violations may result in administrative, civil, or criminal
> penalties.**
>
> **Limit dissemination to U.S. citizens who are U.S. Department of**
>
> **Energy (DOE) employees or DOE contractors or employees**
>
> **of other U.S. Government agencies. The cognizant program manager**
>
> **must approve other dissemination. This notice shall not be
> separated**
>
> **from the attached document.**
>
> **Reviewer (Signature)**
>
> **Date**
>
> **Source Document**
>
> b\. The bottom of each interior page determined to include ECI must be
> marked:
>
> **\"EXPORT CONTROLLED INFORMATION\"**

c.  The marking of removable media and e-mail messages for ECI is the
    same as stated for UCNI in Paragraph B.4.c. above.

d.  Documents, faxes, e-mails, containing technical data being released
    to U.S. Government agencies and their contractors (US citizens only)
    do not require an export control review if marked:

> **CONTAINS NON-PUBLIC TECHNICAL DATA**
>
> **Requires Export Control Review Prior to Release to**
>
> **the Public or any Foreign National.**

12. [Physical Protection]{.underline}. All requirements for ECI are the
    same as stated for UCNI in Paragraph B.6. above (in use, in storage,
    information systems, reproduction, and destruction).

> Under no circumstances will ECI or NPTD be posted on the Internet,
> chat rooms, or bulletin boards.
>
> 13\. [Unauthorized Disclosure]{.underline}. Direction for unauthorized
> disclosure is the same as stated for OUO information in Paragraph C.7.
> above. Unauthorized disclosure of ECI can also result in
> administrative, civil, or criminal penalties including fines and
> imprisonment.

#