Protection of OUO

Digital Padlock

Any Member of the Workforce who purposefully circumvents OUO protections risks administrative penalties ranging from reprimand to loss of employment.

Circumventions include:

  • Intentional release of Official Use Only (OUO) information to a person who has no need to know (NTK).
  • Intentional or negligent release of an OUO-marked document to a person who has no NTK.
  • Intentionally not marking a document known to contain OUO information.
  • Intentionally marking a document as OUO that does not contain OUO information. Errors in identifying OUO information is not a Security Incident Management Program (SIMP)-reportable incident unless those errors result in the loss of Export Controlled Information (ECI).

OUO errors could cause findings during NNSA/DOE surveys.

Who can determine what information is OUO?

You do! Ask yourself: does the information have the potential to damage governmental, commercial, or private interests if given to persons who do not need the information to perform their jobs? Does it fall under at least one of the FOIA exemptions? If both answers are yes, then the information is OUO.

For assistance in making the determination, the following resources are available:

The Unclassified Controlled Information (UCI) Manual (S&S-MAN-065) is also available online for all Members of the Workforce (MOW) to use as a tool to assist MOWs on how to properly mark and protect UCI, including OUO information. The UCI Manual supplements IT012, Unclassified Controlled Information Policy and its references (including IT017, Official Use Only Information Policy).

How do I mark a document that contains OUO?

The Member of the Workforce making the OUO determination must ensure that the words " Official Use Only" (or " OUO" if space is limited) are placed on the top and bottom of the front of the document and on the top and bottom of each page or, if more convenient, on just those pages containing the OUO information.

Additionally, the front marking must be placed on the first page and must include the applicable Freedom of Information Act (FOIA) exemption number and related category name. Mark the first page as follows:

Protection of OUO
  • Protect Official Use Only (OUO) information when it is not in use or not under the control of an authorized Member of the Workforce.
  • Protect OUO in a manner appropriate for the type of SNL-Controlled Premise where the information resides.
  • In a Limited Area (LA):
    • It is not necessary to store OUO Information ( except for Exemption 6—Personal Privacy) in a locked receptacle.
    • Store OUO Exemption 6—Personal Privacy Information (such as medical, marital status, Social Security numbers, and Human Resources information) in a locked receptacle.

Recommended best practices include turning OUO information face down when left on a desk or closing the door to the receptacle when the information is unattended. Examples of a receptacle include, but are not limited to, an office, file cabinet, desk, or bookcase.

  • In a Property Protection Area (PPA) or a General Access Area (GAA):
    • Store OUO in a locked receptacle.
    • Control access to OUO when handcarrying the information.
    • Store OUO in a locked receptacle when not in use or under the control of an authorized Member of the Workforce.
    • Do not pack OUO in luggage that will be checked; handcarry the information at all times.
    • Use encryption that meets appropriate National Institute of Standards and Technology (NIST) standards (such as Federal Information Processing Standard [FIPS] 140-1, 2 requirements) consistent with Computing Support Services (CSS) methodologies on all OUO residing on unclassified media.

OUO Exemption 4 information may be governed by a contract with another entity and have more stringent requirements for protection in storage. Please refer to the contract and consult the Sandia General Law Center for guidance.

Reproduction of OUO

OUO documents may be reproduced to the minimum extent necessary, ensuring that all copies are marked as required. Protect OUO while photocopying or reproducing documents or material.

  • Reproduce only the minimum number of copies of OUO documents or material necessary to conduct official Sandia business without the permission of the originator.
  • Mark and protect reproduced documents or material in the same manner as the original.
  • Clear copy machine malfunctions and check all paper paths for OUO material.
  • Destroy excess paper copies containing OUO according to the requirements in the “Dispose” section of IT017, Official Use Only Information Policy.

Destruction of OUO

Review all documents for retention requirements before destroying. Refer to IT010, Manage Records Policy, for information related to the identification of records and the requirements related to the retention and disposition of records. For assistance on disposition of OUO materials, call the Security Connection at (505)845-1321. Use one of the following methods for disposing of Official Use Only (OUO) materials:

  • Use a strip cut shredder (strips no more than one quarter of an inch wide) or,
  • Use a white destruction bag.