RE0

Sensitive Unclassified

Non-Safeguards

Information (SUNSI)

February 2, 2006

Office of the Executive Director

for Operations

Office of Information Services
Topics

* Motivation

* Task Force - Management of

Sensitive Unclassified Information

(SUI)

* Task Force - Sensitive Unclassified

Non-Safequards Information

(SUNSI) Implementation

* Challenges

2
Motivation

* Uncertainty in classification/

marking & inconsistent approach

* Task Force chartered 1212003 to

recommend improvements to the

management of SUI

* Task Force chartered 1/2005 for

SUNSI implementation

3
SUI Task Force

* Scope - All internally & externally

generated categories of SUI,

except Safeguards

* Objective - Analyze current

population of SUI & develop

ureommnnduioUns to imprUv andU

simplify management of SUI

4
Findings

* NRC handles 21 different

categories of SUI

* Existing guidance is scattered &

incomplete

5
Findings (cont.)

* Handling requirements for

externally generated SUI have

evolved thru work practices

* Evo~sfir~g po~isZ Pusigo~c

6
Findings (cont.)

* Contrary to agency requirements

- Non-supervisory staff

designating info as official use

only (OUO) or proprietary - Information not being properly marked

7
Findings (cont.)

* Procedures for handling SUI in an

electronic environment were

lacking or not easily accessible

8
Recommendations

* Separate guidance for Safeguards

from guidance for SUNSI

* Link protections (marking and

handling requirements) to "risk of

harm tfha* is reanabny oreseeable" W fW dicl foreseeable" if disclosed

9
Recommendations (cont.)

* Establish 7 categories: Allegation,

Investigation, Proprietary, Privacy

Act, Security Related, Sensitive

!".er*", anEENd ExtMM !, GEeE a0ed

(other agencies)

10
Recommendations (cont.)

* Adopt a policy that document

marking is normally sufficient

- Cover sheet should only be used

where information is particularly

sensitive & marking alone is not

sufficiant for nrnean- inn

11
Recommendations (cont.)

- Exceptions given for allegations

information & investigation

information where cover sheets

are required

12
Recommendations (cont.)

* Stop linking use of cover sheets

to FOIA exemptions

e Adopt table that presents 11

major areas of handling

requirements

* Post table & guidelines on internal

web

13
Recommendations (cont.)

* Develop agency policy on

providing SUNSI to external

government bodies & associated

handling requirements

* Develop procedures for handling

SUNSI in an electronic

environment

14
SUNSI Implementation

Task Force Charter

* Develop guidance implementing

EDO-approved recommendations

of the SUI Task Force

15
SUNSI Implementation

Task Force Charter (cont.)

* Simplify the categorization,

handling, & marking of SUNSI,

making it easier to prevent an

inadvprt*nt -- w - - --- w~ relasce - nf Wm SUNS!

16
Key Changes

* Reduced number of types/

categories of SUNSI from 23 to 7

* Eliminated cover sheets except

for Allegation & Investigation

i.fnrmatinn or if requiire for

externally generated SUNSI

17
Key Changes (cont.)

* Requires marking header and

footer of each page of SUNSI

document

* Eliminated link to FOIA exemption

* Cra..0rifie hat momst Restbrict

requirements apply if more than

one category applies

18
Key Changes (cont.)

* Need to know applies

* Clarified portion marking not

required

* Encryption required when SUNSI

transmitted f

19
Challenges

* No government-wide policy on

encryption of SUNSI

* Some firewalls block email with

attachments encrypted using current tool

* Compliance with guidance on

disposal of hard copies perceived

as an additional burden or cost

20