1. Purpose.
This Order describes the Public Buildings Service (PBS) policy to protect information related to Federal buildings, grounds, and property under the jurisdiction, custody, or control of the U.S. General Services Administration (GSA), including those properties delegated to other Federal agencies by the Administrator of General Services. For the purposes of this Order, all such buildings, grounds, and property are collectively referred to as “GSA-controlled space.” Within the Controlled Unclassified Information (CUI) Program, this information is categorized as Physical Security information. Physical Security information is a category of CUI. This policy authorizes safeguarding and dissemination controls, established by the CUI Program, to be applied to Physical Security information. Not all building information for these buildings is automatically considered CUI. Only specific applicable information that qualifies and is marked as CUI needs to be controlled and protected in accordance with 32 C.F.R. part 2002. GSA will use CUI terminology and markings on all applicable building information in all formats, as described in greater detail in Appendix B. Building information marked as Sensitive But Unclassified (SBU) in accordance with previous versions of this policy (PBS 3490.2 series) must be protected and handled as CUI in accordance with 32 C.F.R. part 2002. Information that was marked as SBU does not need to be re-marked with CUI markings while it remains in the possession of an authorized holder within GSA; however, upon transfer or reuse (in derivative form) outside of GSA, the information must be marked or identified as CUI in accordance with 32 C.F.R. part 2002. All holders of this information must align protective measures to the standards of this Order and the CUI Program in 32 C.F.R. part 2002. Building occupancy data does not meet the definition of sensitive building information and is not covered by this Order.
2. Background.
a. GSA has been marking and managing SBU building information and has issued several updates to the policy relating to such information since the bombing of the Alfred Murrah Federal Building in 1995.
b. Executive Order 13556, signed on November 4, 2010, established a program for managing CUI, with the National Archives and Records Administration (NARA) serving as the executive agent. This executive order emphasizes the importance of “the openness and uniformity of Government-wide practice.” GSA has been working with NARA to develop CUI standards and best practices. NARA published its CUI implementing regulation at 32 C.F.R. part 2002 on September 14, 2016. Accordingly, GSA is replacing the GSA SBU designation with the executive branch-wide CUI designation and this Order implements the new CUI requirements for PBS building information in accordance with GSA Order CIO 2103.1, Controlled Unclassified Information (CUI) Policy, issued May 16, 2017.
U.S. General Services Administration