Official Use Only (OUO) information is certain unclassified information that may be exempt from public release under the Freedom of Information Act (FOIA) and has the potential to damage governmental, commercial, or private interests if given to persons who do not need to know the information to perform their jobs or other DOE authorized activites.
You do! Ask yourself: does the information have the potential to damage governmental, commercial, or private interests if given to persons who do not need the information to perform their jobs? Does it fall under at least one of the FOIA exemptions? If both answers are yes, then the information is OUO.
For assistance in making the determination, the following resources are available:
- Security Connection: (505)845-1321 or firstname.lastname@example.org
The Unclassified Controlled Information (UCI) Manual (S&S-MAN-065) is also available online for all Members of the Workforce (MOW) to use as a tool to assist MOWs on how to properly mark and protect UCI, including OUO information. The UCI Manual supplements IT012, Unclassified Controlled Information Policy and its references (including IT017, Official Use Only Information Policy).
Note: OUO designation does not automatically exempt a document from public release under FOIA; the document must be reviewed prior to release.
The FOIA requires any record of information in the federal government's possession to be publicly released upon request unless the information in the record falls under one of nine FOIA exemptions.
When information is identified as OUO, the applicable exemption number and category name must be identified. There are nine FOIA exemptions, but only exemptions 3-7 and 9 are used at SNL. Refer to IT017, Official Use Only Information Policy for descriptions of FOIA exemptions.
Never used for OUO, only used for classified information.
Do not use OUO Exemption 1. If a document is classified or potentially classified, seek Derivative Classifier (DC) or Classification Department assistance, and where applicable, follow requirements for handling classified information. (See SS002, Identifying Classified Information Policy and SS003, Classified Matter Protection and Control Policy).
As of June 6, 2011, DOE mandates that Exemption 2 is no longer applicable to OUO information. For identified topics in classification guides (formerly Exemption 2), use Exemption 7—Law Enforcement.
Do not use OUO Exemption 2. This exemption is no longer available for any purpose at SNL. Courts have limited this exemption to protection of federal government human resources records. Circumvention of Statute is no longer a valid OUO category or Freedom of Information Act (FOIA) exemption. Exemption 7—Law Enforcement, may be a suitable designation to protect information having security-related sensitivity. If further details are needed in a particular instance, consult a Derivative Classifier (DC), the SNL Classification Department, or one of the contacts associated with IT017, Official Use Only Information Policy.
Information whose disclosure is specifically protected by law and is not otherwise controlled.
Use Exemption 3 for Export Controlled Information or other material protected from disclosure by statute or other legal authority. If further details are needed in a particular instance, consult a Derivative Classifier (DC), the SNL Classification Department, an SNL Export Control subject matter expert (SME), or one of the contacts associated with IT017, Official Use Only Information Policy.
Trade secrets, commercial, or financial information that, if released, could impair the government’s ability to obtain information in the future.
Use Exemption 4 to protect proprietary or commercial information appearing in government-owned records. At SNL, this exemption usually applies to third party proprietary information.
Interagency or intra-agency memos or letters not available by law to a party unless the party is in litigation with the agency.
Use Exemption 5 to protect pre-decisional information. This is often referred to at SNL as deliberative process information.
Information that could cause an individual personal distress or embarrassment, or expose them to identity theft.
Use Exemption 6 to protect personal information. For more details about privacy requirements at SNL, refer to IT023, Personally Identifiable Information (PII) Policy.
Information that, if released, could endanger life or physical safety or disclose techniques and procedures of law enforcement investigations or prosecutions.
Use Exemption 7 for unclassified information that has sensitivity relating to security or national security programs at SNL. Be aware that an association with law enforcement investigations and prosecutions may not seem immediately evident. Nevertheless, courts have recommended Exemption 7 as a possible substitute for what was formerly protected by Exemption 2—Circumvention of Statute.
Evaluation of a financial institution’s stability.
Do not use Exemption 8 at SNL.
Geological and geophysical information and data, resource maps, and new drilling techniques.
Use of Exemption 9 at SNL is very rare . Consult one of the contacts associated with IT017,
Official Use Only Information Policy if Exemption 9 may be pertinent in a particular instance.
Any Member of the Workforce who purposefully circumvents OUO protections risks administrative penalties ranging from reprimand to loss of employment.
- Intentional release of Official Use Only (OUO) information to a person who has no need to know (NTK).
- Intentional or negligent release of an OUO-marked document to a person who has no NTK.
- Intentionally not marking a document known to contain OUO information.
- Intentionally marking a document as OUO that does not contain OUO information. Errors in identifying OUO information is not a Security Incident Management Program (SIMP)-reportable incident unless those errors result in the loss of Export Controlled Information (ECI).
OUO errors could cause findings during NNSA/DOE surveys.
OUO documents may be reproduced to the minimum extent necessary, ensuring that all copies are marked as required. Protect OUO while photocopying or reproducing documents or material.
- Reproduce only the minimum number of copies of OUO documents or material necessary to conduct official Sandia business without the permission of the originator.
- Mark and protect reproduced documents or material in the same manner as the original.
- Clear copy machine malfunctions and check all paper paths for OUO material.
- Destroy excess paper copies containing OUO according to the requirements in the “Dispose” section of IT017, Official Use Only Information Policy.
Review all documents for retention requirements before destroying. Refer to IT010, Manage Records Policy, for information related to the identification of records and the requirements related to the retention and disposition of records. For assistance on disposition of OUO materials, call the Security Connection at (505)845-1321. Use one of the following methods for disposing of Official Use Only (OUO) materials:
- Use a strip cut shredder (strips no more than one quarter of an inch wide) or,
- Use a white destruction bag.
- Protect Official Use Only (OUO) information when it is not in use or not under the control of an authorized Member of the Workforce.
- Protect OUO in a manner appropriate for the type of SNL-Controlled Premise where the information resides.
- In a Limited Area (LA):
- It is not necessary to store OUO Information ( except for Exemption 6—Personal Privacy) in a locked receptacle.
- Store OUO Exemption 6—Personal Privacy Information (such as medical, marital status, Social Security numbers, and Human Resources information) in a locked receptacle.
Recommended best practices include turning OUO information face down when left on a desk or closing the door to the receptacle when the information is unattended. Examples of a receptacle include, but are not limited to, an office, file cabinet, desk, or bookcase.
- In a Property Protection Area (PPA) or a General Access Area (GAA):
- Store OUO in a locked receptacle.
- Control access to OUO when handcarrying the information.
- Store OUO in a locked receptacle when not in use or under the control of an authorized Member of the Workforce.
- Do not pack OUO in luggage that will be checked; handcarry the information at all times.
- Use encryption that meets appropriate National Institute of Standards and Technology (NIST) standards (such as Federal Information Processing Standard [FIPS] 140-1, 2 requirements) consistent with Computing Support Services (CSS) methodologies on all OUO residing on unclassified media.
OUO Exemption 4 information may be governed by a contract with another entity and have more stringent requirements for protection in storage. Please refer to the contract and consult the Sandia General Law Center for guidance.
Review Official Use Only (OUO) documents intended for distribution outside of Sandia and ensure all markings meet current standards before release.
Dissemination of OUO via External Mail (such as U.S. Postal Service or commercial carrier):
- Use a sealed, opaque envelope, or wrapping (double wrapping is not required).
- Mark the envelope with the recipient's address and the return address.
- Write or stamp the words, To Be Opened by Addressee Only, on the envelope.
- Use an approved Unclassified Controlled Information (UCI), yellow envelope.
- Enter the recipient's name and mail stop.
- Write or stamp the words, To Be Opened by Addressee Only, on the front of the envelope.
Encrypt transmissions of OUO with Entrust or other FIPS 140-2 compliant method identified in this list of Email Encryption Options ( https://info-ng.sandia.gov/spki/email-encryption/encrypt-alt.shtml) when sending information outside of the sandia.gov domain. Existing cyber security protection measures adequately protects OUO emailed within the sandia.gov domain.
- Use encrypted fax whenever possible.
- Use unencrypted fax only when encrypted fax is not available.
- Before sending OUO via fax, contact the recipient to arrange for control of the document.
- Following the transmission, confirm with the recipient that the entire transmission has been received.
- Use encrypted voice circuits whenever possible.
- Use regular voice circuits only if encrypted capabilities are not available and transmission by other encrypted means is not a feasible alternative.
The Member of the Workforce making the OUO determination must ensure that the words " Official Use Only" (or " OUO" if space is limited) are placed on the top and bottom of the front of the document and on the top and bottom of each page or, if more convenient, on just those pages containing the OUO information.
Additionally, the front marking must be placed on the first page and must include the applicable Freedom of Information Act (FOIA) exemption number and related category name. Mark the first page as follows:
Members of the Workforce fill in the applicable FOIA exemption number and related category name, his/her name and organization, and identifies the guidance used if the determination was based on an official DOE classification guide. Use either “DOE SNL/CA” or “DOE SNL/NM” for the Org on the front marking. “DOE SNL/CA” is to be used for SNL/CA since it falls under the purview of the programmatic classification office at SNL/CA. “DOE SNL/NM” is to be used for the SNL sites that fall under the purview of the programmatic classification office at SNL/NM including SNL/NM and all SNL remote sites such as Tonopah Test Range, Kauai, WETL, etc.