Attachment I - DOD-CUI Non-Disclosure Agreement

CUI NOTICE 2020-03a: This guidance document is binding on agency and Federal contractor actions as authorized under applicable statute, executive order, regulation, or similar authority. This guidance document does not have the force and effect of law on, and is not meant to bind, the public, except as authorized by law or regulation or as incorporated into a contract.

[AGENCY NAME]

NON-DISCLOSURE AGREEMENT

intending to be legally bound, consent to the terms in this agreement in consideration of being granted access to Controlled Unclassified Information, specified below.
Signer acknowledges the category or categories of information that they may have access to, and the signer’s willingness to comply with the standards for protection, by placing their initials in front of the applicable category or categories below: Initials:

Controlled Unclassified Information (CUI) Categories:
[List all applicable CUI Categories by Category Name]

As used in this agreement and as defined in 32 CFR Part 2002, Controlled Unclassified Information (CUI) is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy (LRGWP) requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information [Information that Executive Order 13526, Classified National Security Information, December 29, 2009 (3 CFR, 2010 Comp., p. 298), any predecessor or successor order, or the Atomic Energy Act of 1954, as amended, requires agencies to mark with classified markings and protect against unauthorized disclosure] or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency. The LRGWP may require or permit safeguarding or dissemination controls in three ways: (1) Requiring or permitting agencies to control or protect the information but providing no specific controls, which makes the information CUI Basic; (2) Requiring or permitting agencies to control or protect the information and providing specific controls for doing so, which makes the information CUI Specified; or (3) Requiring or permitting agencies to control the information and specifying only some of those controls, which makes the information CUI Specified, but with CUI Basic controls where the authority does not specify.