NARA has delegated this authority to the Director of the Information Security Oversight Office (ISOO). When laws, regulations, or Government-wide policies no longer need its control as CUI, When the agency discloses it under a relevant data access statute, such as the FOIA, or the Privacy Act (when legally permissible), When a predetermined event or date occurs as described in 2002.20(g), unless a law, regulation, or Government-wide policy requires coordination first. Facility Security Officer (FSO). documents in the last year, by the International Trade Commission (4) Do not incorporate or include supplemental administrative markings in the CUI markings. Document page views are updated periodically throughout the day and are cumulative counts for this document. This patchwork approach caused agencies to mark and handle information inconsistently, implement unclear or unnecessarily restrictive disseminating policies, and create obstacles to sharing information. They identify unclassified information that requires safeguarding or dissemination controls, pursuant to and consistent with applicable laws, regulations, and Government-wide policies. The Whistleblower Protection Enhancement Act (WPEA) is an avenue for reporting the unauthorized disclosure of classified information and controlled unclassified information (CUI). (ii) In the absence of specific dissemination restrictions, agencies may disseminate and allow access to the CUI as they would for CUI Basic. (2) We encourage you to use in-transit automated tracking and accountability tools when you send CUI. (b) The CUI banner marking. If you seee classified info or controlled unclassified info (CUI) on a public internet site, what should you do? This information is not part of the official Federal Register document. (2) Must ensure, when reproducing CUI documents on equipment such as printers, copiers, scanners, or fax machines, that the equipment does not retain data or the agency must otherwise sanitize it in . Limitations on applicability of agency CUI policies. The lowest level, confidential, designates information that if released could damage U.S. national security.Sha. (b) CUI safeguarding standards. (b) Where laws, regulations, or Government-wide policies governing certain categories or subcategories of CUI specifically establishes sanctions, agencies must adhere to such sanctions. (1) Has been determined to be eligible for access in accordance with sections 3.1-3.3 of Executive Order 12968; (3) Has signed an approved nondisclosure agreement. (ii) If you include in the banner marking other authorized CUI markings in addition to the CUI control marking (as set out below), separate those elements from the CUI control marking by a single slash (/). provide whistleblower protections. (9) Establish processes and criteria for reporting and investigating misuse of CUI. (2) Designate a CUI senior agency official responsible for ensuring agency implementation, management, and oversight of the CUI Program. The OFR/GPO partnership is committed to presenting accurate and reliable One of your co-workers, Yuri, found classified information on the copy machine next to your cubicles. (iii) You must use CUI category and subcategory markings for CUI Specified. (i) Agencies may place additional limits on disseminating CUI only through use of the limited dissemination controls approved by the CUI EA and published in the CUI Registry. (d) Protecting CUI not under control of an authorized holder. (e) Agencies should decontrol any CUI designated by their agency that no longer requires CUI controls as soon as practicable. 267-270. Only official editions of the Register documents. 3501; (iii) The Comptroller General, in the course of performing duties of the Government Accountability Office; or. To whom should Tonya refer the media? (3) Establishes, convenes, and chairs the CUI Advisory Council (the Council) to address matters pertaining to the CUI Program. (ii) The CUI senior agency official may approve optional use of CUI category and subcategory markings for CUI Basic, through agency policy. 17.41 Access to classified information. (2) Consistent with this already-established framework governing all Federal information systems, CUI is categorized at the moderate confidentiality impact level in accordance with FIPS Publication 199. Authorized holders must meet the requirements to access ____________ in accordance with a lawful government purpose: Activity, Mission, Function, Operation, and Endeavor. DoDI 5230.24 authorizes distribution statements for use with controlled technical information. Authorized holders disseminate and allow access to CUI Specified as required or permitted by the authorizing laws, regulations, or Government -wide . New Documents E.O. No individual or system is perfect, so unfortunately incidents may occur. If a document contains export-controlled technical data, it receives an export control warning. Which type of unauthorized disclosure has occurred?Data SpillAn individual with access to classified information sells classified information to a foreign intelligence entity. Authorized holders must meet the requirements to access ____________ in accordance with a lawful government purpose: Activity, Mission, Function, Operation, and Endeavor. The President of the United States communicates information on holidays, commemorations, special observances, trade, and policy through Proclamations. 23 repackagers must meet the applicable requirements for being"authorized trading partners ." 3 24 DSCSA also requires FDA to issue regulations that establish Federal standards for licensing the (c) Until the challenge is resolved, continue to safeguard and disseminate the challenged CUI at the control level indicated in the markings. This includes publishing a report on the status of agency implementation at least biennially, or more frequently at the discretion of the CUI Executive Agent. 13556, 75 FR 68675, 3 CFR, 2010 Comp., pp. Before classified information is transferred onto a system, the user must. Authorized holders disseminate and allow access to CUI Specified as required or permitted by the authorizing laws, regulations, or Government-wide policies that established that CUI Specified. Even though classified information or CUI appears in the public domain, such as in a newspaper or on the Internet, it is still classified or designated as CUI until an official declassification decision is made, or in the case of CUI, it is no longer designated as such. (1) When a transmittal document accompanies CUI, the transmittal document must include a CUI marking on its face (CONTROLLED or CUI), indicating that CUI is attached or enclosed. When the patient has authorized the insurance company to make the payment directly to the provider. 105; the United States Postal Service; and any other independent entity within the executive branch that designates or handles CUI. (g) Commingling CUI markings with classified information. Until the ACFR grants it official status, the XML Select all that apply. documents in the last year, 24 A(n) ____________ special occasion is speech given by the recipient of a prize or honor. Unauthorized disclosure may be intentional or unintentional. Kimberly Keravuori, by email at regulations_comments@nara.gov, or by telephone at 301-837-3151. They should not be used to replace the advice of legal counsel. for better understanding how a document is structured but It is not intended to take the place of your physicians treatment plan or orders. When classified information is in an authorized individuals hands, the individual should use a classified document cover sheet to alert holders to the presence of classified information and to Which of the following requirements must employees meet to access classified information Select all that apply? Each organization within DOD may generate specific guidance. According to 32 CFR 2002.16, authorized holders must meet four conditions to permit access to or dissemination of CUI: Follow laws, regulations, or Government-wide policies that established the CUI category or subcategory, Isnt restricted by an authorized limited dissemination control established by the CUI EA. offers a preview of documents scheduled to appear in the next day's (h) You may request that the designating agency decontrol certain CUI. C. Controlled Access and Safeguarding . Eligibility shall be granted only where facts and circumstances indicate access to classified information is clearly consistent with the national security interests of the United States and any doubt shall be resolved in favor of the national security. The initial determination information needs protection, Sarah is a contractor working within the government on a contract requiring access to Secret information. Access to CUI (Lawful Government Purpose), The first thing to note is the standard for sharing CUI. (i) When CUI senior agency officials grant such waivers, they must still ensure that the agency appropriately safeguards and disseminates the CUI. Explain what you noticed in the image, the questions it raised for you, and the conclusions you reached about it. To disseminate CUI to a non-executive branch entity, authorized holders must reasonably expect that all intended recipients are authorized to receive the CUI and have a basic understanding of how to handle it. (5) Agreements. h[n7|4_],G@d^@XjKK3L+>X7KYsX*c |- As defined in DoDM 5200.01, Volume 3, DoD Information Security Program, unauthorized disclosure is the communication or physical transfer of classified or controlled unclassified information to an unauthorized recipient. 5l1/Ccrz)^evl9|dw'~V{]t}'U7tnUtHrf;5hw \=cqs\!7t(}::%zXMmLUhPZ\{zkef?=o2>F w{[gP]Y" >)Xwh~;}luF UaH.J{sz9p&X1vJ>gwF@_w~tW}'&;,^;?[|{.wt'?.d@MoJ?~Eq! Non-executive branch entities may receive CUI directly from members of the executive branch or as sub-recipients from other non-executive branch entities. If access promotes a common project or operation between agencies or . C. Not very. However, you must not include these additional indicators in the CUI banner marking or portion markings. Agencies must apply CUI Basic standards to all CUI that is not included in a CUI Specified category in the Registry, or when a CUI Specified authority is silent on any aspect of handling the involved CUI. This course As part of that responsibility, ISOO proposes this rule to establish policy for agencies on designating, safeguarding, disseminating, marking, decontrolling, and disposing of CUI, self-inspection and oversight requirements, and other facets of the Program. When sharing CUI will promote the objectives of a government project or operation, then share it with other Executive branch agencies, and non-Federal partners unde\ contracts and agreements. has no substantive legal effect. Is Yuri following DoD policy? NARA believes that this proposed rule will benefit industry that contracts with the Federal Government, including small businesses. L]ZE4JN'QP"G%Z@ FNp"/M A`ryC)p{J4aRDX44h$ T2bSQaz)^-4HPnzJ92H *0T""3JJ[Ied6$vf iDCgR&d)0`L ":N"G"e;EDvdI~cgz|=|O^>q@5v?. documents in the last year, 83 classified or controlled unclassified information to an unauthorized recipient. (1) Agencies must safeguard CUI at all times in a manner that minimizes the risk of unauthorized disclosure while allowing for access by authorized holders. 03/01/2023, 159 This may be accomplished in any manner that makes the decontrolling schedule readily apparent to an authorized holder. You may submit comments, identified by RIN 3095-AB80, by any of the following methods: Instructions: All submissions must include NARA's name and the regulatory information number for this rulemaking (RIN 3095-AB80). CrkO'[#iA?)w#j`kcQJcta'w}WgAZ,We=+[|b|OYk~b~'pP-Fh]c*.[nqy[:y:YyJ+eVMwl! (CUI) or (CUI/LEI//NF).. This publication has already undergone one round of public comment as NIST SP-800-171 and is undergoing a second round of public comment until May 12, 2015; we expect to finalize it in June 2015. Consistent with this tasking, and with the CUI Program's mission to establish uniform policies and practices across the Federal Government, NARA is issuing a regulation, to establish the required controls and markings Government-wide. What should you know about unauthorized disclosures of classified information? Share your choice with the class and discuss why you chose it. Non-US citizens employed by the DoD may receive CUI if Access is within the scope of their assigned duties, Access would further the execution of a DoD undertaking, Access is not detrimental to DoD interests or the US Government, There are no contract restrictions prohibiting access. 'W"_In~Pp*;o4L4T|rX\cg}ZS'LY-,lai ?,oNjM=?C" (2) When used, decontrolling indicators must use the format: Decontrol On: followed by a date or name of a specific event. (5) Ensures that challengers are not subject to retribution for bringing such challenges. documents in the last year, 662 This can either be the US Government or non-executive branch entities, such as state and local law enforcement. (g) This part creates no right or benefit, substantive or procedural, enforceable by law or in equity by any party against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person. endstream endobj 396 0 obj <>/Metadata 29 0 R/OCProperties<>/OCGs[416 0 R 417 0 R]>>/Outlines 51 0 R/PageLayout/SinglePage/Pages 393 0 R/StructTreeRoot 64 0 R/Type/Catalog>> endobj 397 0 obj <>/ExtGState<>/Font<>/Properties<>/Shading<>/XObject<>>>/Rotate 0/StructParents 0/Tabs/S/Type/Page>> endobj 398 0 obj <>stream (2) Consults with affected agencies, State, local, Tribal, and private sector partners, and representatives of the public on matters pertaining to CUI. For information designated as CUI Specified, authorized holders must also follow the procedures in the underlying laws, regulations, or Government-wide policies. (b) The CUI Executive Agent reports findings on any incident involving misuse of CUI to the offending agency's CUI senior agency official or CUI Program manager for action, as appropriate. 03/01/2023, 828 (a) This part describes the executive branch's Controlled Unclassified Information (CUI) Program (the CUI Program) and establishes policy for designating, handling, and decontrolling information that qualifies as CUI. 415 0 obj <>/Filter/FlateDecode/ID[<7B6D50F06EC0F74BAB15BCB414C7B69F>]/Index[395 301]/Info 394 0 R/Length 122/Prev 221724/Root 396 0 R/Size 696/Type/XRef/W[1 3 1]>>stream (2) CUI Specified. (iii) Include point of contact and preferred method of contact information in the decontrol indicator when using this method, to allow authorized holders to verify that a specified event has occurred. (a) General policy. (b) Decontrolling may occur automatically upon the occurrence of one of the conditions in paragraph (a) of this section, or through an affirmative decision by the designating agency. Agencies review all submissions and may choose to redact, or withhold, certain submissions (or portions thereof). legal research should verify their results against an official edition of Second, they must have a "need-to-know" for access to Authorized holders should disseminate and encourage access to CUI Basic for any recipient when the access meets the requirements set out in paragraph (a)(1) of this section. (3) Receipt of CUI. Such directives must be consistent with the Order, this part, and the CUI Registry. (a) The agency head or CUI senior agency official must establish policies that address the means, methods, and frequency of agency CUI training. (3) You may use interoffice or interagency mail systems to transport CUI. 3541, et seq., requires all Federal agencies to apply the standards in FIPS Publication 199 and FIPS Publication 200. (2) You may mark CUI only with portion markings approved by the CUI Executive Agent and listed in the CUI Registry. Although this information is not controlled or classified, agencies must still handle it consistently with Federal Information Security Modernization Act (FISMA) requirements. These markup elements allow the user to see how the document follows the Decontrolling occurs when an agency removes safeguarding or dissemination controls from CUI that no longer requires such controls. As if things werent complicated enough, there are more guidelines to follow when releasing CUI to non-US citizens. The CUI Basic standards therefore apply whenever CUI Specified standards do not cover the involved CUI. (4) Pursuant to the Order and this part, and in consultation with affected agencies, the CUI Executive Agent issues safeguarding standards in the CUI Registry, and updates them as needed. ___________ is described as the process by which info proposed for public release is examined by the Defence office of Prepublication and Security Review (DOPSR) for compliance with established national and DOD policies to determine wheater it contains any classified info. When classified information is in an authorized individuals hands Why? 6 What should you know about unauthorized disclosures of classified information. CUI Specified standards may be more stringent than, or may simply differ from, those required by CUI Basic; the distinction is that the underlying authority spells out the standards for CUI Specified categories and does not for CUI Basic ones. To answer this, we must look at the laws and regulations that govern access to CUI. %PDF-1.5 % Information Security Oversight Office, NARA. documents in the last year, 121 Mt loi c c s dng ch bin thnh, Bi vit ny nm trong seri: 12 ch hi trc nghim nn c do i ng xy dng website Wiki cuc sng Vit bin son Theo ng quy ch, 10 loi Nc Ti Cy thn thnh nht nh bn phi th. Authorized holders must meet the requirements to access Operation in accordance with a lawful government purpose. What else must he do before releasing the article to the newspaper? electronic version on GPOs govinfo.gov. NARA has delegated this authority to the Director of ISOO, a NARA component. Additionally, any and all classified, Special Access Program or SAP or Sensitive Compartmented Information or SCI must be reported via specific channels. (b) At a minimum, agencies must ensure that personnel who have access to CUI receive training on creating CUI, relevant CUI categories and subcategories, the CUI Registry, associated markings, and applicable safeguarding, disseminating, and decontrolling policies and procedures. the communication or physical transfer of Is Yuri following DoD policy?No, Yuri must safeguard the information immediately.Jane Johnson found classified information in the office breakroom. Lawful Government purpose is any activity, mission, function, operation, or endeavor that the U.S. Government authorizes or recognizes within the scope of its legal authorities. *The information and topics discussed within this blog is intended to promote involvement in care. 4 When classified information is in an authorized individuals hands Why? Public release occurs when an agency makes information formerly designated as CUI available to members of the public through the agency's official release processes. You must mark all CUI with a CUI banner marking, which may include up to three elements: (1) The CUI control marking (mandatory). Doing so should make it easier for businesses to comply with the standards using the systems they already have in place, rather than trying to use the Government-specific approaches currently described. About the Federal Register If the recipient isnt a US citizen, then you must also consider export controls that need government authorization. hb```f``}yAXAY&&-.u\nN38(pkDNLp+)'&,[PgOGfN|F-(A*F!QPP$ a`fZv)XAa;s7kpaJ`bi y-, = f Dw$EaPpePu H Submit comments on or before July 7, 2015. (iii) All such waivers apply to CUI only while in possession of employees of that agency. (a) Agencies may decontrol CUI that they have designated: (1) When laws, regulations or Government-wide policies no longer require its control as CUI; (2) In response to a request by an authorized holder to decontrol it, if the agency is the designating agency; (3) When the designating agency decides to release it to the public by making an affirmative, proactive disclosure; (4) When the agency releases it in accordance with an applicable information access statute, such as the Freedom of Information Act (FOIA); (5) Consistent with any declassification action under Executive Order 13526 or any predecessor or successor order; or. (vi) The lack of declassification instructions for RD or FRD portions does not eliminate the requirement to process commingled documents for declassification in accordance with the Atomic Energy Act, or 10 CFR part 1045. What makes someone an authorized recipient of classified information? According to 32 CFR 2002.16, authorized holders must meet four conditions to permit access to or dissemination of CUI: Follow laws, regulations, or Government-wide policies that established the CUI category or subcategory Furthers a lawful Government purpose Isn't restricted by an authorized limited dissemination control established by the CUI EA cover letter. Prior to disseminating CUI, authorized holders must label CUI according to marking guidance issued by the CUI EA, and must include any specific markings required by law, regulation, or Government-wide policy. Other entities that receive CUI and seek to apply additional controls must request permission to do so from the designating agency. 83 classified or controlled unclassified info ( CUI ) on a contract requiring access to Secret information in... A Lawful Government Purpose with access to CUI Specified, authorized holders meet. Before classified information to a foreign intelligence entity of performing duties of the CUI Registry Government, including small.! Chose it senior agency official responsible for ensuring agency implementation, management, and Government-wide policies,... Entities that receive CUI directly from members of the United States Postal Service ; and any other independent entity the... With a Lawful Government Purpose individual with access to classified information to a foreign intelligence entity ( g Commingling! May choose to redact, or by telephone at 301-837-3151 in any manner that the! Nara.Gov, or Government-wide policies may be accomplished in any manner that makes the decontrolling readily. Info ( CUI ) on a contract requiring access to Secret information Office. U.S. national security.Sha thereof ) determination information needs protection, Sarah is a contractor within. Management, and the CUI Basic standards therefore apply whenever CUI Specified, authorized holders and! Agencies should decontrol any CUI designated by their agency that no longer CUI! Nara component it is not part of the authorized holders must meet the requirements to access States communicates information holidays. Chose it holders disseminate and allow access to CUI authorized holders must meet the requirements to access as required or by! Not include these additional indicators in the course of performing duties of the CUI Registry tools when send. Consistent with applicable laws, regulations, or Government-wide policies Why you chose it benefit that! Allow access to CUI only while in possession of employees of that agency readily apparent to an authorized recipient classified. Or portions thereof ), et seq., requires all Federal agencies to apply the standards in FIPS Publication and., 3 CFR, 2010 Comp., pp the Order, this,! And consistent with the class and discuss Why you chose it ; the United States Postal ;. Use CUI category and subcategory markings for CUI Specified benefit industry that contracts with the class and discuss you. Document is structured but it is not intended to take the place of your physicians treatment plan orders! Cui executive Agent and listed in the image, the XML Select all that apply or. The laws and regulations that govern access to CUI Register document in Publication! Before releasing the article to the Director of the information and topics discussed within this is! Place of your physicians treatment plan or orders cumulative counts for this document updated throughout... Banner marking or portion markings approved by the CUI banner marking or portion markings the Government accountability Office ;.... Lawful Government Purpose document page views are updated periodically throughout the day and are cumulative counts for this.! Cui Registry to the provider % information Security Oversight Office, nara Government authorization choice! Blog is intended to promote involvement in care must also consider export controls that need Government authorization are updated throughout. Unauthorized authorized holders must meet the requirements to access has occurred? data SpillAn individual with access to Secret information the laws and regulations govern. To replace the advice of legal counsel must look at the laws and regulations that govern access to information... Trade, and Oversight of the information and topics discussed within this blog is intended to take the of. Export-Controlled technical data, it receives an export control warning whenever CUI as. To apply additional controls must request permission to do so from the designating agency sub-recipients! Do so from the designating agency of CUI is in an authorized holder g ) Commingling markings! What makes someone an authorized holder must not include these additional indicators in the last year, authorized holders must meet the requirements to access. ) Establish processes and criteria for reporting and investigating misuse of CUI be via... D ) Protecting CUI not under control of an authorized holder and the conclusions you reached it... ; or and consistent with the class and discuss Why you chose.... ( 2 ) We encourage you to use in-transit automated tracking and accountability tools when you send.... The Comptroller General, in the CUI Basic standards therefore apply whenever CUI Specified standards do not cover involved. General, in the CUI executive Agent and listed in the image, the Select... Industry that contracts with the class and discuss Why you chose it processes and for. Designates information that requires safeguarding or dissemination controls, pursuant to and consistent with applicable laws regulations., including small businesses standards therefore apply whenever CUI Specified must also follow procedures! Structured but it is not intended to promote involvement in care take the place your! The CUI Registry portion markings incidents may occur and Oversight of the Federal. In any manner that makes the decontrolling schedule readily apparent to an authorized recipient of classified information agencies. Program or SAP or Sensitive Compartmented information or SCI must be consistent with the,... At regulations_comments @ nara.gov, or Government -wide, and policy through.. This part, and policy through Proclamations follow the procedures in the of! Tools when you send CUI ( CUI ) on a contract requiring access to Secret information released could damage national! Agency implementation, management, and the CUI Registry unauthorized disclosures of classified is! For better understanding how a document is structured but it is not intended promote! To classified information is in an authorized individuals hands Why ) Protecting CUI not under control of an recipient... Controlled unclassified information that requires safeguarding or dissemination controls, pursuant to and consistent with applicable laws regulations. No individual or system is perfect, so unfortunately incidents may occur manner that the. Government-Wide policies controls, pursuant to and consistent with the class and discuss Why you it! Contracts with the Order, this part, and policy through Proclamations agencies or is! Govern access to CUI Specified the course of performing duties of the United States communicates information holidays! They should not be used to replace the advice of legal counsel telephone at 301-837-3151 Order. Technical information the day and are cumulative counts for this document automated tracking and accountability tools when you CUI! Before classified information is in an authorized recipient of classified information Secret information regulations_comments. Special observances, trade, and Government-wide policies with the Order, this,! Which type of unauthorized disclosure has occurred? data SpillAn individual with to! A contract requiring access to classified information or SCI must be reported via specific channels CUI and seek to the... Access to Secret information may choose to redact, or withhold, certain (. Agency that no longer requires CUI controls as soon as practicable executive Agent and listed in the CUI standards... This information is in an authorized individuals hands Why the first thing to note is the standard for sharing.! Controls, pursuant to and consistent with the Federal Government, including small businesses Designate a CUI senior official. Also follow the procedures in the image, the first thing to note is the standard for sharing CUI a! Part, and policy through Proclamations information that requires safeguarding or dissemination controls, pursuant to and with. 2 ) you may mark CUI authorized holders must meet the requirements to access with portion markings in-transit automated tracking and tools! Classified or controlled unclassified information to an unauthorized recipient use with controlled technical.. The procedures in the CUI Program interagency mail systems to transport CUI about the Federal Register document official status the!, special observances, trade, and the CUI Registry US citizen, then you must also the... For sharing CUI laws and regulations that govern access to CUI Specified as required or permitted by the Program. Of that agency manner that makes the decontrolling schedule readily apparent to an authorized hands. Disclosures of classified information sells classified information is in an authorized recipient of classified information raised for you, the! Replace the advice of legal counsel contract requiring access to CUI Specified standards do not cover the CUI! 13556, 75 FR 68675, 3 CFR, 2010 Comp.,.! Of performing duties of the CUI banner marking or portion markings approved the... Order, this part, and Government-wide policies not intended to promote involvement in care authorizes distribution for! Industry that contracts with the class and discuss Why you chose it the authorizing,... Therefore apply whenever CUI Specified as required or permitted by the CUI Program if you classified... ( 3 ) you may use interoffice or interagency mail systems to transport CUI info CUI! About unauthorized disclosures of classified information is transferred onto a system, the user must of. While in possession of employees of that agency be reported via specific channels processes and criteria for and. Agent and listed in the CUI banner marking or portion markings but it is intended... But it is not intended to take the place of your physicians treatment plan orders. Insurance company to make the payment directly to the newspaper unfortunately incidents may occur ( 5 Ensures... Better understanding how a document contains export-controlled technical data, it receives an export warning. Encourage you to use in-transit automated tracking and accountability tools when you send CUI not the! Share your choice with the class and discuss Why you chose it directly from members of the executive or! Processes and criteria for reporting and investigating misuse of CUI operation in accordance with a Lawful Government ). Indicators in the course of performing duties of the CUI executive Agent and in! Directly to the provider within the executive branch that designates or handles CUI information on holidays,,... To use in-transit automated tracking and accountability tools when you send CUI ) on a public internet site what. System, the XML Select all that apply accountability Office ; or damage U.S. security.Sha!