DRAFT
RCRA
Confidential Business Information
Security Manual
August 1992
-------
1
1
4
6
6
6
7
7
8
8
9
10
10
10
12
13
14
15
16
17
18
19
20
20
21
22
25
28
TABLE OF CONTENTS
INTRODUCTION
A. Important Terminology
B. Forms
AUTHORIZING FEDERAL EMPLOYEES FOR ACCESS TO RCRA CBI
A. Initiating Request of Access to RCRA CBI
B. Processing Employees Request for CBI Access
C. Preparing for CBI Access
D. Acquiring CBI Access Authority
E. RCRA CBI Access List
F. Relinquishing Access Authority
G. Maintaining Access
PROCEDURES FOR USING AND SAFEGUARDING RCRA CBI
A. Procedures for Obtaining CBI
B. Storage of RCRA CBI Materials
C. Procedures for Transferring Custody of CBI
D. Creating New CBI Documents and Personal Working
Papers
E. Creating Non-CBI Documents
F. Declassifying CBI Materials
G. Reproduction of RCRA CBI Materials
H. Destruction of RCRA CBI Materials
I. Meetings at Which RCRA CBI is Discussed
J. Traveling with CBI
K. Telephone Calls that do not include Submitter
L. Telephone Calls with Submitter
M. Computer Security
N. Violation of Procedures, Lost Documents, and
Unauthorized Disclosures
OTHER AGENCIES ACCESS TO RCRA CBI
CONTRACTOR ACCESS
i
-------
VI.
CONGRESSIONAL ACCESS
31
VII. DOCUMENT CONTROL OFFICER RESPONSIBILITIES 32
A. Assignment of a DCO 32
B. Relinquishing DCO Responsibilities 32
C. General Responsibilities 33
D. EPA Headquarters vs. Regional Responsibilities 34
VIII. WORK ASSIGNMENTS AND CONTRACTS 35
APPENDIX A (CBI Forms)
APPENDIX B (Sample Inventory)
-------
I. INTRODUCTION
This manual sets forth procedures for Environmental. Protection Agency
(EPA) employees (both Regional and Headquarters) and other Federal
employees to follow in handling information claimed as Confidential
Business Information (CBI) under the Resource Conservation and
Recovery Act (42 USC S. 6901 et seq.).
EPA is required to protect from public disclosure Confidential Business
Information (CBI) obtained under RCRA. EPA employees are prohibited
from knowingly or willfully causing or allowing an unauthorized release or
disclosure of such information. EPA is permitted to authorize a Federal
employee for access to RCRA CBI when such access is necessary to
perform woi;k in connection with the employee's official duties. EPA has
issued regulations (40 CFR Part 2) which outline confidentiality
provisions. The procedures in this manual supplement those set forth in
40 CFR Part 2, and describe specific procedures for handling CBI within
the RCRA program.
All EPA contractors and subcontractors who have access to CBI must
abide by the restrictions and guidelines found in this manual.
Additionally, the "Contractor Requirements for the Control and Security of
RCRA Confidential Business Information" (or Contractor Security
Manual), describes specific procedures to be followed by EPA
Contractors and subcontractors and their employees.
Most RCRA CBI access occurs at the EPA Headquarters storage facility,
referred to as the RCRA Confidential Business Information Office (RCRA
CBI Office). If a need is established, EPA may also authorize CBI access
at other facilities, including EPA Regional Offices, other Federal agency
offices, and contractor facilities. Procedures for handling, using, and
storing RCRA CBI at all facilities are outlined in this manual. However,
some differences in security procedures are required at facilities outside
of EPA Headquarters.
A. Important Terminology
The following terms are used frequently throughout this manual:
RCRA CBI, or CBI, is information claimed to be business
confidential under EPA's confidentiality regulations as set forth in
40 CFR Part 2.
1
-------
"'Business confidentiality' claim means a claim or
¦ allegation that business information is entitled to
confidential treatment for reasons of business
confidentiality, or a request for a determination that
such information is entitled to such treatment." (40
CFR Part 2.201(h))
"'Reasons of business confidentiality'" include the
concept of trade secrecy and other related legal
concepts which give (or may give) a business the
right to preserve the confidentiality of business
information and to limit its use or disclosure by ¦
others in order that the business may obtain or retain
business advantages it derives from its rights in the
information." (40 CFR Part 2.201(e))
i
RCRA CBI materials are documents, files, or any other
information media that contain RCRA CBI. Some of the CBI
materials received consist only partially of confidential information.
RCRA CBI Access List is a listing of all individuals who have been
authorized for access to RCRA CBI.
Secure Storage Containers are containers that are secured from
access by persons not authorized for access to RCRA CBI.
Secure storage areas are used to maintain CBI materials. The area is
secure from access by non-authorized personnel and therefore CBI
materials may be used.
CBI Cover Sheets. Every RCRA CBI document must have attached to
the front a RCRA CBI cover sheet (Form 8710-13). The cover sheet
must have inscribed, the DCO's name, date of receipt and Document
Control Number (DCN). Each time an employee gains access to the
document, he or she must write the date and his or her name, employee
identification number, and signature on the cover sheet.
CBI Stamp. The first page that indicates the document is CBI and the
back of the last page of the document must be labeled with a stamp thai
identifies that the document contains CBI. If the document is a copy or
is received from outside the Agency, the document should be stamped
by the DCO.
2
-------
Document Tracking System is a system for accounting for the
location or disposition of RCRA CBI materials. Materials in a
document tracking system are tracked through manual or
automated logs. Each document is assigned a unique document control
number (DCN) and that number, as well as the date of receipt,
description of the document, the number of copies that are on file, and
the location of each copy are logged into the system. This system
enables a DCO to track a document's movement from the time that it is
written or received at EPA until the time that it is destroyed or archived.
The automated document tracking system in use at Headquarters is
called the Automated Log Index System (ALIS). It utilizes a machine-
readable barcode affixed to each CBI document controlled by the
document tracking system to facilitate efficient processing and tracking of
documents. Each document submitted as CBI is assigned a unique
document control number; each copy of that document is assigned a
unique barcoded number. In this fashion, the CBI office is able to track
not only the access to a particular document, but also the location of
each copy of that document.
Federal Employees are any individuals directly employed by the
federal government.
EPA Employees are individuals directly employed by EPA.
EPA Contractors refers generally to companies, and specifically to
employees of those companies, employed by EPA through the use of
contract vehicles.
Director, Office of Solid Waste has overall supervisory authority •
for RCRA activities, including RCRA Confidential Business
Information.
Director, Communications Analysis and Budget Division
(CABD), OSW is responsible for day-to-day implementation of
RCRA CBI, including developing policies for the use and handling
of CBI, operating the EPA Headquarters RCRA CBI Office, and .
supervising the RCRA CBI staff.
Authorizing Official is an EPA Division Director (or a supervisor of
equivalent authority) who nominates an EPA employee for RCRA
CBI access. Authorizing officials' responsibilities, also include
3
-------
ensuring that their employees renew their CBI access authority
annually.
HEADQUARTERS RCRA CBI staff is responsible for all CBI-related
activities, including reviewing security plans, performing security
inspections, and processing forms and records pertaining to requests for
RCRA CBI access authority for organizations and individuals.
Document Control Officer (DCO) manages the CBI office at the
facility at which he or she is employed and has overall
responsibility for the receipt, storage, and use of RCRA CBI at his
or her facility. There is one DCO at EPA Headquarters, one at
each EPA Region and one at selected and approved contractor or
other "off-site" facilities.
Document Control Assistant (DCA) assists the DCO in
performing CBI functions at the facility at which he/she is
employed.
B. Forms
The following forms are referred to in this manual:
Inventory Log (RCRA CBI)
Request for Approval of Contractor Access to RCRA
Confidential Business Information
Destruction Log (RCRA CBI)
RCRA Contractor Employee Confidentiality
Agreement
Confidentiality Agreement for U.S. Employees Upon
Termination/Transfer
Authorization for Access to RCRA CBI
Request for Approval of Temporary
Employee for Access to RCRA CBI
RCRA Confidential Business Information (Cover
Sheet)
8710-1
8710-5
8710-7
8710-9
8710-10
8710-11
B710-12
8710-13
4
-------
8710-14 Confidentiality Agreement for Contractor Employees
Upon Termination/Transfer
All forms are found in Appendix A of this manual. Additional forms
can be copied from the Appendix or obtained from the RCRA CBI
Office. Note: The RCRA CBI Cover Sheet must always be blue.
-------
II. AUTHORIZING FEDERAL EMPLOYEES FOR ACCESS TO RCRA CBI
The RCRA CBI Document Control Officer (DCO) is permitted to authorize any
Federal employee for access to RCRA CBI materials if that employee has a
need for such information for the performance of his or her official duties.
There are three steps to receiving CBI access authority. To receive
authorization, an individual must:
1. Submit a signed Authorization for Access to
Confidential Business Information form (#8710-11),
to the RCRA CBI Office.
2. Read the RCRA CBI Security Manual. (Available
through the RCRA CBI office.)
3. Take and pass a test on basic CBI security
procedures.
After an individual has successfully passed the CBHest, his/her name will be
added to the official CBI Access List and they may immediately access CBI
materials.
A. Initiating Request for Access to RCRA CBI
EPA employees and other Federal employees who either perform
work for EPA or for other Federal agencies must request
authorization for RCRA CBI access by completing the Request for
Access to RCRA Confidential Business Information form (8710-11).
This form must be completed by the employee and signed by
his/her authorizing official (Division Director or equivalent). When
the form is signed it must be forwarded to the RCRA CBI Office.
B. Processing Employees Request for CBI Access
Upon receipt of a signed Authorization for Access form, the CBI Office
will initiate procedures for authorization. These procedures include:
1. Ensuring that a completed Background Investigation form (SF-83)
is in the requesting individual's Personnel file. If the form does not
exist, the employee must complete one and have it filed in his/her
personnel folder. (This form should have been completed by the
employee when they arrived at EPA.)
6
-------
2. Sending a copy of the RCRA CBI manual to the individual, with a
memo indicating when the CBI Test can be taken.
Preparing for CBI Access
The employee requesting access must completely read the RCRA CBI
manual. When the manual is read, he or she should contact the RCRA
DCO (Headquarters or Regional, as appropriate) to confirm a date and
time to take the CBI Test.
The test is composed of nineteen questions derived from the manual and
relating to basic security procedures and precautions as they relate to
CBI materials. To successfully pass the CBI test, seventeen questions
must be answered correctly. If an individual does not pass the test on
the first try, he/she must wait one week before taking the test again. If
he/she again fails to pass the test, he/she will be allowed to try one
more time, at least a week after the second attempt.
If the employee fails to pass the test on the third attempt, CBI access will
be denied and a memo will be forwarded to the authorizing official
explaining the reasons for the refusal. If the employee still requires
access to CBI materials, he/she must re-read the manual, and eventually
pass the test.
D. Acquiring CBI Access Authority
When the employee passes the test, he or she will be granted access to
RCRA CBI and the individual's name will be added to the RCRA CBI
Access List which is updated, and distributed, monthly.
When an employee is granted access to CBI, he/she accepts the
following responsibilities:
Gaining access to only that CBI material that is required to
perform his/her official duties.
Ensuring that no unauthorized personnel access the CBI materials.
Abiding by the guidelines for accessing, maintaining, storing, and
disposing of CBf materials
Maintaining a record of all meetings that contain or discuss CBI.
Renewing CBI access authority annually.
7
-------
Informing the RCRA CBI office when access is no longer needed.
Failure to abide by all of the above may result in the suspension of
access to CBI.
E. RCRA CBI Access List
The Access List is used as a reference to determine whether an
individual has RCRA CBI access authority. Questions regarding whether
a particular employee has RCRA CBI access authorization should be
directed to the RCRA CBI staff.
DCOs at each facility are responsible for reviewing the RCRA CBI Access
List on a monthly basis to determine whether any names of employees
within their jurisdiction should be added to or deleted from the list.
Changes to the Access List must be forwarded to the DCO by the 20th
day of each month. A facility specific RCRA CBI Access list will be
maintained by the facility DCO and made available monthly to all CBI
cleared personnel at that facility. The Regional DCOs are required to
also publish and distribute to the Headquarters DCO a list of all CBI
cleared personnel for their Region including the Regional contractors.
The EPA Headquarters DCO will produce and distribute monthly the
Access List for all EPA Headquarters personnel and contractors. A new
list, regardless of whether changes were made, will be printed and
distributed by the seventh day of each month. The consolidated RCRA
CBI Access List will be maintained at EPA Headquarters.
Supervisors are responsible for reviewing the CBI Access List quarterly to
determine that employees under their supervision need to be added,
deleted or remain on the Access List. Any changes that need to be
made should be reported to their CBI office before the 20th of the month
to ensure that changes are instituted for the next month's list.
F. Relinquishing Access Authority
Employees must relinquish their access authority and be removed from
the RCRA CBI'Access List under the following circumstances:
termination of their employment;
termination of duties requiring access to RCRA CBI;
8
-------
failure to abide by CBI requirements; or,
failure to renew access authority.
In addition, if an employee transfers to another branch or division within
the Office of Solid Waste and the employee will continue to require CBI
access, the employee is required to inform the CBI office of the transfer.
If the employee still requires access to CBI after the transfer, the
employee must have his/her division director send a memo to the CBI
office informing them that he/she requires continued access to CBI. The
test need not be taken again until the annual renewal.
When access is relinquished or revoked an employee must complete the
Confidentiality Agreement for U.S. Employees Upon Termination/Transfer
form (8710-10). Upon receipt of the form, the CBI staff will review the
document tracking system to ensure that all CBI documents entrusted to
that empioyee have been returned. When all documents have been
returned, the CBI staff will remove the employee's name from the RCRA
CBI Access List.
G. Maintaining Access
Employees who are approved for RCRA CBI access must maintain their
access authority by annually passing a RCRA CBI test. If an employee
fails to renew his/her access authorization, the CBI staff will notify the
employee's supervisor that the employee will be removed from the
access list if they do not renew their access authorization. If renewal is
not made within 30 days of the notification, the employee will be removed
from the access list.
9
-------
III. PROCEDURES FOR USING AND SAFEGUARDING RCRA CBI
Any information submitted to EPA required by the. RCRA program may be
claimed by the submitting facility as RCRA CBI. The submitter must clearly
indicate what materials are claimed as CBI. RCRA CBI sent by mail should
always be sent to a DCO. If, however, employees receive mail containing
materials labeled as CBI those materials must be taken immediately to the
facility's DCO for proper entry into the document tracking system. Once
entered, the documents can be logged out by the DCO like any other CBI
documents.
A. Procedures for Obtaining CBI
Employees who are authorized for access to RCRA CBI and who wish to
obtain CBI materials must do so through a DCO. The DCO will retrieve
the requested documents from the storage facility and will log them out
to the requestor through the facility's document tracking system, after
verifying that the employee is authorized for access to CBI.
Whenever employees gain access to a CBI document they must enter
the date of receipt, their employee identification number, and their
signature on the document's RCRA CBI blue cover sheet. The purpose
of the cover sheet is to record who has had access to. the document and
to record the chain of custody of the document. Employees are
responsible for safeguarding all CBI materials in their possession until the
materials are logged back into the storage facility. Employees must
return the CBI materials to the storage facility at the end of each day, or
store the materials in approved storage containers.
RCRA CBI materials may be logged out for no longer than 90 days. In
special circumstances, the DCO in charge of the storage facility may
grant an extension at the end of the 90 day period. DCOs in charge of
storage facilities will periodically review document check-out activity to
spot documents not returned within the 90 day period. DCOs will
contact the appropriate personnel concerning materials that are overdue.
Employees, and their authorizing officials, are responsible for returning
overdue materials to their DCO. Documents not returned within 30 days
after they first appear on the overdue notice will be considered to have
been lost (see Section lll-N).
B. Storage of RCRA CBI Materials
RCRA CBI materials must never be left unattended where persons not
authorized for CBI access might gain access to them. Employees using
10
-------
RCRA CBI are responsible for ensuring that no unauthorized disclosures
. of that information occurs. This means that employees must either
maintain constant control over the RCRA CBI. documents in their
possession, return the CBI materials to the DCO for proper storage, or
store the materials in a RCRA CBI approved storage container. The
following types of containers are approved for RCRA CBI:
metal fiie cabinets with key locks or combination locks;
desks with key locks; or
safes.
If necessary, a storage container may be used by more than one
individual to store RCRA CBI materials, but each individual must be
authorized for access to the CBI stored there. Each person using the
cabinet or safe should be assigned a separate storage space within the
cabinet or safe and is responsible for any RCRA CBI he or she stores
there.
Secure storage areas
The DCO may, as an exception to the procedures above, authorize the
use of secure storage areas when such a designation is justified by a
large volume and high frequency of daily use of RCRA CBI. Secure
storage areas must be able to be secured from unauthorized access by
door locks and/or an intrusion alarm and/or an electronic card entry
system. Secure storage areas can be used as a RCRA CBI work area
and as a storage area for RCRA CBI. The requirement that CBI be
stored while not in use, is recommended but not required in a secure
storage area.
The RCRA CBI Office at EPA Headquarters is a secure storage area.
Authorized personnel may use and access documents while in the office
without concern of unauthorized access. Most EPA Regions maintain a
CBI secure storage area. EPA employees, or their contractors, may
request approval of the establishment and use of a secure storage area.
The request must be submitted in writing to the RCRA CBI office.
Approval of the request will be based on the need/necessity for long
term access to requested CBI materials, volume of materials to be
stored/used, and level of security of the area.
11
-------
All EPA CONTRACTORS wanting CBI access must:
submit a security plan to the EPA CBI office;
appoint a DCO to monitor all CBI activity at the facility; and
be inspected and approved by the appropriate EPA DCO.
(Headquarter's contractors must be approved and inspected by
the Headquarter's EPA DCO; the Regional contractors by the
Regional EPA DCO.)
have all personnel approved in accordance with this manual;
The EPA Headquarters DCO may provide interim certification for secure
storage facilities until they are inspected and approved by the RCRA CBI
Staff. Each contractor's facility must have an approved DCO responsible
for ensuring that all CBI procedures are followed, and all documents are
properly maintained. The contractor DCO is responsible for requesting,
in writing, approval of a secure storage area and for arranging an
inspection by the RCRA CBI staff. The RCRA CBI staff will maintain a
record of the locations and date of inspection of all RCRA CBI secure
storage areas.
Entry to CBI secure facilities
If an individual needs to enter the secure area, the DCO in charge of the
area must first determine whether(the individual is authorized for access
to RCRA CBI by referring to the Access List. If the person is authorized
for access, the DCO will require the person to sign a Visitors Log prior to
entry. Persons not authorized for access to RCRA CBI may gain entry to
a secure area only if they sign the Visitors Log and are escorted at all
times by a person with RCRA CBI access authorization. A current copy
of the RCRA CBI Authorized Access List should be stored near the door
of every secure storage area by the DCO in charge of the area.
Procedures for Transferring Custody of CBI
Transfer within a Facility
Custody of CBI may be transferred from one employee authorized for
CBI access to another only through a DCO. The transferor must return
the document to the DCO, who will log it into the document tracking
12
-------
system as returned. The intended recipient may then request access to
that document and have the document logged out to them. There must
be a record indicating any transfer of CBI materials.
Transfer of CBI to individuals at other facilities.
Any transfer of CBI materials must be sent through the DCO. CBI may
also be transferred using a courier service or an express postal service.
These services may only be used when time is of the essence, because,
unlike registered mail, they do not require each person who handles the
package to sign for it as it changes hands.
RCRA CBI materials destined for CBI-authorized persons who are
located outside of the facility in which the materials are stored (including
the submitter that, claimed them as confidential) may be transferred
through:
hand carrying by an employee who is authorized for CBI access;
registered mail, return receipt requested; or
a courier or express postal service.
Regardless of'which transfer method is used, the materials being
transferred must be double wrapped. The inner wrapping must be
labeled with the transferee's name and the statement "RCRA Confidential
Business Information -- to be opened by audressee only" The outer
wrapping must be labeled only with the name and address of the
recipient and the return address of the transferor; nothing on the outer
wrapping should indicate that the package contains RCRA CBI.
Regardless of which method is used to send CBI, all CBI materials must
be sent through the transferor's DCO. The transferor's DCO must
enclose two copies of a custody receipt with the package. The receiving
DCO must sign, date, and send back to the transferor DCO one copy of
the custody receipt in order to verify receipt. The other copy of the
custody receipt is maintained by the receiving DCO.
D. Creating New CBI Documents and Personal Working Papers
Documents and other materials produced by Federal employees using
RCRA CBI documents frequently contain CBI themselves (i.e., reports,
facility inspections, waste analysis). If a newly created document
contains CBI, the document's author must take it to the DCO to be
13
-------
logged into the document tracking system at the employee's facility
(exception to the logging requirements are described below). The DCO
will assign the CBI document a document control number and either log
it out to the employee or retain it for storage.
Personal Working Papers
Personal Working Papers are materials, such as meeting notes and draft
versions of reports, that are utilized solely by the creators
and not distributed or used by other individuals. If a document created
by an employee using CBI can be considered "personal working papers"
it does not need to be logged into the CBI document tracking system.
Personal working papers must be stored and handled as if it were CBI,
even though it is not logged or tracked through the document tracking
system.
The author of a personal working paper may give it to a typist who is
authorized for access to CBI, without logging it into the document
tracking system. The typist must return to the author the typed
document and the document being typed from when typing is
completed. However, the personal working papers and copies must be
. logged into the document tracking system if they are to be transferred to
anyone other than the author.
E. Creating Non-CBI Documents
. Some materials produced using RCRA CBI are not confidential. Non-
confidential documents are produced if:
(1) the CBI is deleted from an existing document;
(2) the CBI used is masked or;
(3) the CBI is aggregated; such that no one not authorized for
access can discern the CBI, even when consulting publicly
available materials,
(4) a submitter drops its claim of confidentiality for the
information in the document; or,
(5) the submitter cannot substantiate a claim.
14
-------
Creating Non-CBI Documents by Eliminating CBI from Existing
Documents
New documents may be created from existing CBI documents by'
eliminating all confidential business information from the documents
thereby making the documents non-CBI. In all instances the author of
the document is responsible for ensuring that it contains no CBI.
Creating Non-CBI Documents by Masking or Aggregating
' The Headquarters DCO must be consulted in advance by any authors
who wish to produce a non-confidential document by masking or
aggregating CBI. The program office must review all applications of
masking and aggregating techniques to ensure that appropriate
techniques are being used. The non-CBI documents must be reviewed
and approved by the EPA program office or project officer
for final determination of CBI status.
F. Declassifying CBI Materials
To declassify CBI materials, an employee must take the materials to
his/her DCO and present the DCO with evidence indicating that the
materials either are no longer confidential or contain no CBI. For
example, if CBI claims for the materials have been withdrawn by the
submitter, the employee should present the DCO with the submitter's
written relinquishment of the claim.
After being presented with evidence that a document contains no CBI
and receiving approval from the EPA program office or project officer, the
DCO must cross out all CBI markings on the document and remove the
document's cover sheet. The DCO must then inscribe the document
and cover sheet with the statement "Contains no RCRA CBI, " and sign
and date the cover sheet. The DCO must also log the document out of
the document tracking system. After all of the above steps have been
taken the document is then declassified.
CBI Claim Dropped
A submitter may at any time drop its claim of confidentiality.
The submitter must notify either the Program Office or the RCRA CBI
Office in writing before the information can be released to the public.
15
-------
The DCO will then declassify the document (see F below) The document
may then be removed from RCRA CBI facility and sent to
the appropriate EPA program office for disposition.
Substantiation of a CBI Claim
The EPA Program Office may request substantiation of a claim of
confidentiality. To do so, either the Program Office or the RCRA CBI
Office must inform the submitter by certified mail-return receipt
requested of the request for substantiation of the claim. The submitter
has 15 working days after receipt of the request to send comments as to
why their material should remain confidential. If comments are not
received within the 15-day period, and EPA has verified that the
comments were not lost in transmission, this will be construed as a
waiver of the confidentiality claim and EPA will be free to release the
information without further notice. If a submitter feels that some or all of
their information should remain CBI, the CBI materials, and written
substantiation are provided to the EPA's Office of General Counsel or
Regional Counsel, where appropriate. The EPA Counsel will render a
final determination pursuant to 40 CFR, Section 2.205.
If the EPA Counsel determines that the claim should be denied, the
submitter is informed of the decision by certified mail-return receipt
requested. The information may be released after the 10th working day
following the business* receipt of the written notification. During this 10-
day period the submitter may challenge EPA's decision in Federal District
Court. Upon such filing, the CBI cannot be released until the court
upholds EPA's determination.
G. Reproduction of RCRA CBI Materials
Copying of RCRA CBI materials should be limited to the maximum extent
possible. RCRA CBI materials may be reproduced only at copying
machines located in:
secure storage facilities; or
non-secure locations approved for CBI duplication by RCRA
CBI staff.
CBI materials may be reproduced only by a DCO or DCA. Employees
should present the materials they need reproduced to the DCO or to a
16
-------
DCA to reproduce.
If all machines in approved locations for duplicating CBI materials are
inoperable, the facility's DCO may authorize the use of other machines
for duplicating CBI materials. However, a machine must be dedicated
solely to CBI document reproduction while CBI documents are being
copied and the DCO or DCA must directly supervise the machine while
the CBI materials are being duplicated.
If the machine in a non-secure location malfunctions while RCRA CBI
materials are being copied, the facilities DCO must ensure that either the
machine is directly supervised by a person authorized for RCRA CBI
access until it is repaired or that a person authorized for access to CBI
inspects the machine's paper path and image surfaces to retrieve any
materials containing RCRA CBI that are caught in the machine.
All copies of RCRA CBI documents must be stamped by the DCO as
RCRA CBI and covered with a new RCRA CBI cover sheet. The cover
sheet on the original must not be copied for use with the copy. Copies ¦
must be logged into the document tracking system and must be
assigned the same document control numbers. (At Headquarters, each
document is assigned a unique barcode number to facilitate tracking of
each copy.) All copies should also be marked with a clear indication of
copy number (i.e. Copy #5). When copies of documents are to be given
to other employees, the copies should be logged out individually through
the DCO directly to the recipients. Excess or unusable copies must be
destroyed by the DCO.
H. Destruction of RCRA CBI Materials
RCRA CBI materials may be destroyed only under the supervision of a
DCO. The procedures in this section for destruction of CBI materials
apply to all materials containing RCRA CBI, including handwritten notes,
personal working papers, draft documents, telephone records, computer
printouts and diskettes, microfiche and any other CBI materials, whether
or not logged into the document tracking system. Individuals wishing to
have CBI materials destroyed must take them to the DCO responsible for
tracking those materials.
CBI maintained at an outside secure facility (EPA contractors) may be
destroyed only with prior approval by the originating DCO.
Documentation of destruction, and the original blue RCRA Cover Sheet,
must be returned to the originating DCO. Upon receipt of such
17
-------
documentation, the DCO will make the proper notation of destruction in
the document tracking system and in the destruction log.
CBI materials such as papers, documents, or printouts must be
shredded. The destruction of RCRA CBI materials logged into the
document tracking system must be documented by DCOs in a CBI
Destruction Log (#8710-7). This log is essential to the DCO for
performing document inventories.
RCRA CBI Cover Sheets taken from materials being destroyed must be
inscribed by the DCO with the destruction date and the DCO's name.
The cover sheet must then be placed in the appropriate file for
permanent storage. RCRA CBI Cover Sheets from destroyed documents
must not be destroyed themselves; they must be retained for audit
purposes.
I. Meetings At Which RCRA CBI Is Discussed
CBI meetings are scheduled gatherings of two or more people at which
CBI is discussed. This does not include informal discussions during
which CBI is mentioned, such as between a supervisor and an employee
working on matters concerning CBI. However, if CBI is to be discussed,
use of these procedures is encouraged no matter how informal the
discussion.
The meeting chairperson is usually the person who schedules and
organizes meetings. If a chairperson has not previously been identified,
one must be selected at the beginning of the meeting. The chairperson
is responsible for ensuring (by referring to the CBI Access List) that only
persons authorized for access to RCRA CBI are in attendance when the
discussion involving CBI commences.
The meeting chairperson must provide a sign-in sheet to record the
meeting date, time, place, chairperson and subject. All persons
attending the meeting must sign this sheet. After the meeting, the
chairperson must give the sign in sheet to the DCO who will file it in the
appropriate CBI document file.
The chairperson must also ensure that the meeting room is secured after
the meeting. This includes cleaning all chalkboards, taking any
unheeded CBI materials to the DCO for destruction, and ensuring that
nothing is left in the room that could lead to the unauthorized disclosure
of RCRA CBI.
18
-------
The meeting chairperson must remind those in attendance of their duty
to treat as confidential any notes or recordings taken at the meeting until
the CBI status of the materials can be determined pursuant to the
procedures noted above.
Pursuant to the personal working papers policy described above, notes
taken during the meeting that contain RCRA CBI must be protected as
CBI but need not be logged into the document tracking system if they
are retained by the note-taker. However, if the note-taker wishes to
transfer possession of the notes to someone else, the notes must first be
assigned a document control number and be logged into the document
tracking system by the DCO.
Meetings may be tape recorded only with the permission of the
chairperson. Such recordings may contain CBI and must be treated like
any other CBI material.
The author of a CBI document may circulate copies of the document at a
meeting without logging the document into the. document tracking
system if the author:
attends the meeting and is present when the document is
discussed;
collects all copies of the document at the end of the
meeting; and
submits all copies of the document for destruction
after the meeting.
The document's author must number the copies (i.e., 1 of 6, 2 of 6, etc.)
before handing them out at the meeting and check to make sure that all
copies are returned at the end of the meeting.
J. Traveling with CBI
Federal employees who are authorized for CBI access may travel with
CBI materials in their possession. In addition, with permission of their
immediate supervisor, employees travelling with RCRA CBI may take CBI
materials home with them prior to or after a trip only if it would be
impractical to return to work to pick up the materials before departure or
to drop them off after return.
19
-------
If a traveller intends to transfer possession of the RCRA CBI materials
which he or she is carrying, before the trip the CBI materials must be
double wrapped and logged out from the document tracking system.
The materials should not be unwrapped until the traveler's destination is
reached at which time the material must immediately be taken to the
DCO and logged into the document tracking system.
If the employee does not intend to transfer possession of the CBI
materials, for example, if they are being brought for use in a meeting,
they need not be double wrapped. However, the traveller must maintain
the materials within his or her constant possession or control at all times.
[Even if the traveler does not intend to transfer possession of the CBI.
materials, he or she may temporarily store the materials with the DCO at
the location he or she is visiting.]
While traveling by plane of other public conveyance, employees must
keep the RCRA CBI materials in their possession, and may not "check"
the materials with their luggage. When employees travel with CBI
materials and are unable to deliver or ship the CBI materials to a facility
authorized for RCRA CBI access, they may store the materials for short
periods, but never overnight, inside a locked trunk of a motor vehicle.
RCRA CBI materials may be stored overnight in hotel safes, if receipt is
obtained from the hotel management, or otherwise must be kept in the
possession of the traveler.
K. Telephone Calls That do no include Submitter
Federal employees and EPA contractors with RCRA CBI access authority
may discuss CBI on the telephone with other individuals who are
authorized for access to RCRA CBI. All parties to a telephone call are
responsible for verifying, by using the RCRA CBI Authorized Access List,
that the other is authorized for access to CBI. The individual who
initiates a discussion that includes RCRA CBI must indicate that the
conversation involves CBI.
L. Telephone Calls With Submitter
With the permission of the submitter, employees who are authorized for
CBI access may discuss CBI on the telephone with the submitter. The
Federal employee must:
verify the identity of the submitter employee to whom
he/she is speaking;
20
-------
inform the submitter that the telephone lines are not
secured;
assure the submitter that discussion of CBI with a Federal
employee on the telephone does not constitute a waiver of
any claim of confidentiality; and
inform the submitter that any further information provided in
the telephone conversation can be claimed as confidential.
Care must be taken to discuss CBI from a submission only with an
individual named in the submission or others identified by the
submission's signatory.
Authorized individuals who initiate telephone calls must keep a record of
all telephone calls with individuals located outside their facilities during
which RCRA CBI is discussed.
The record should include at least the date, time, subject and the names
of all parties involved.
Computer Security
Mainframe Computers
Mainframe computers used for processing RCRA CBI must be dedicated
solely to RCRA CBI data. Passwords or other security devices may not
be relied on to segregate the system into confidential and non-
confidential portions. Requests for approval must be made in writing to
the Information Management Branch Chief, CABD.
Individuals needing on line access to a dedicated CBI mainframe
computer require authorization for such access from the CBI staff. On
line access is access that gives the individual the ability to read, change,
manipulate, or obtain data from the CBI database or program a
computer that houses RCRA CBI.
Personal Computers (PC)
CBI Authorized individuals may use CBI on a personal computer (PC)
without special authorization. While using RCRA CBI on a PC in an
unsecured area, the PC operator must retain exclusive control over the
operation of the computer and printer and must ensure that only
individual authorized for access can view the PC's screen. If the PC
21
-------
operator must leave the PC for any reason, the computer session must
be completely terminated.
CBI data used on a PC can be stored on either floppy disks or
detachable hard disks. Disks containing CBI must be removed from the
PC after each session, unless the PC is located in a secure storage area,
and stored like any other CBI materials. Disks which are no longer
needed or which are damaged must be transferred to the DCO for
destruction.
The use of a fixed hard disk in a PC for processing of CBI data is not
recommended unless the PC is located in a secure storage area.
However, if one must be used in an unsecured area, it must be erased at
the end of each session. The erasure must be verified by the PC
operator.
Proper termination of a PC session involving CBI consists of the following
steps
transferring and verifying the transfer of the CBI data to the
storage medium (floppy or detachable hard drive);
removing the storage medium from the PC; and
turning off the PC.
Computer printouts
Because not all data on a CBI computer is CBI, an employee who
obtains a printout from a CBI computer (PC or mainframe) must first
determine whether the printout contains CBI. Printouts must be
assumed to be CBI unless they are determined not to be.
If a printout contains CBI, it must immediately be logged by the DCO into
the document tracking system, stamped as RCRA CBI, assigned a
document control number, covered with a RCRA CBI cover sheet, and
be treated like any other CBI document.
N. Violations of Procedures, Lost Documents, and Unauthorized
Disclosures
The procedures described in this manual are designed to secure CBI
from unauthorized public disclosure. Therefore it is imperative that the
CABD Director be notified any time these procedures may have been
breached.
22
-------
Unauthorized Disclosure of CBI Material
After investigating a written report to determine whether an unauthorized
disclosure has taken place the CABD Director will either:
conclude that it is unlikely that any disclosure took place and give
the affected business no notice; or
determine that unauthorized disclosure may have taken place,
upon which determination the CABD Director must provide the
affected business written notice within two working days of making
that determination, but no later than four days after receiving the
written report.
Written notice to the affected business must contain a description of the
RCRA CBI that may have been disclosed and the date of the disclosure.
Violations of Procedures
The CBI Staff will investigate any alleged violation of this manual's
procedures, even if there is no evidence in a written report of a lost
document or unauthorized disclosure. The CABD Director will direct the
RCRA CBI staff to investigate the reported violation, determine what
corrective action is appropriate and notify the supervisors of affected
employees. Supervisors are responsible for imposing disciplinary action,
if necessary. The CABD Diriector will also confer with supervisors to
identify document handling or CBI use or storage procedures that can be
implemented to prevent recurrence of violations.
Any corrective action recommended by the CABD Director should fit the
individual characteristic of each violation. This includes action ranging
from training and revision of work procedures to removal of the
individual's name from the RCRA CBI authorized access list.
24
-------
OTHER AGENCIES ACCESS TO RCRA CBI
EPA's regulations (40 CFR Part 2) allow disclosure of RCRA CBI to other
Federal Agencies in either of two circumstances.
when the official purpose for which the information is needed by
the agency is in connection with its duties under any law for
protection of health or the environment or for specific law
enforcement purposes; or
when disclosure is necessary to enable the other agency to
perform a function on behalf of EPA.
In either circumstance, the procedures described below must be followed
before RCRA CBI may be disclosed to the other agency.
Request for Access
EPA may disclose RCRA CBI to another Federal agency upon the written
. request of that agency when such disclosure is necessary to enable the other
agency to carry out a function on behalf of EPA. The request may be directed
to either the EPA program Office or the RCRA DCO at least two weeks prior to
the time access is needed. The request must be signed by an official of the
other agency who is at least equivalent in authority to the Division Director. It
should specifically state the information to which access is needed, the official
purpose for which RCRA CBI is needed, and how long the CBI is needed. As
part of its written request, the other agency must agree in writing not to disclose
any information designated as confidential as outlined below in 40 CFR
2.209(c)(5).
"(i) The other agency has statutory authority both to compel
production of the information and to make the proposed
disclosure, and the other agency has, prior to disclosure of the
information to anyone other than its officers and employees,
furnished to each affected business at least the same notice to
which the affected business would be entitled under this subpart;
(ii) The other agency has obtained the consent of each affected
business to the proposed disclosure; or (iii) the other agency has
obtained a written statement from the EPA General Counsel or an -
EPA Regional Counsel that disclosure of the informatiuon would
be proper under this subpart."
When access is requested by another agency, EPA must give affected
businesses at least ten calendar days notice before access by the other agency
25
-------
may take place. Notice may be given by Federal Register notice or certified
mail, return receipt requested. The notice will be prepared by the DCO and
must include:
the identity of the agency to which RCRA CBI is to be disclosed;
the official purpose for the access;
whether access is authorized only on EPA premises or also at the
other agency's facilities;
the type of information to be disclosed; and
the period of time for which access to RCRA CBI is authorized.
Before RCRA CBI may be disclosed, the DCO must ensure that the other
agenc/ understands the responsibilities of handling RCRA CBI:
All security precautions outlined in this manual must be adhered to
by the agency.
All individuals needing access to CBI must gain authorization for
access as outlined in this manual.
All documents must be returned promptly to the RCRA. CBI
Office.
However, no notice is required to affected businesses when EPA furnishes
RCRA CBI to another agency to perform a function on behalf of EPA, including
but not limited Department of Justice for purposes of investigation or
prosecution of civil or criminal violations of EPA activities, or to any Federal
agency for purposes of performing an EPA statutory function under an
interagency agreement.
Access Outside of EPA
EPA will encourage other agencies to restrict their access of RCRA CBI to EPA
premises. However, if this is not practical, the agency may request that EPA
grant access privileges at their facility. In order to be granted such privileges,
the agency must have security procedures and standards in place which equal
or surpass those set forth in this manual; each facility must be inspected and
approved by the CBI DCO; and a DCO for that facility must be appointed.
26
-------
Employees of other agencies must be authorized for access to CBI. If an
employee's agency's facility has not been approved for CBI, the employee may
not remove any documents, notes, or correspondence containing RCRA CBI
from EPA premises.
27
-------
V. CONTRACTOR ACCESS
If an EPA contractor needs to access RCRA CBI to perform a task for EPA, the
following steps must be taken:
Contractor must submit a Request for Access to the EPA RCRA
CBI DCO; and.
EPA RCRA CBI DCO must notify affected businesses.
If a contractor requires access to RCRA CBI at their facility, a request for CBI
approval of a secure storage area must be submitted by the EPA project officer.
(Refer to Section III for details on applying for and receiving approval.)
Request for Access
EPA may allow EPA contractors to access RCRA CBI upon the written request.
The Request for Approval of Contractor Access to RCRA CBI form (#8710-5)
must be submitted by the EPA Project Officer, reviewed, by the DCO and
approved by the OSW Division Director and OSW Office Director. The request
should be submitted at least three weeks prior to the need for access. The
request should state the specific information to which access is needed, the
specific purpose for which RCRA CBI is needed, and for how long the CBI is
needed. ¦
[Note: Requests for access by Regional Contractors should be submitted
by the appropriate Project Officer to the Regional RCRA CBI DCO. The
form should be approved by the appropriate Regional Division Director
prior to being submitted to the OSW Division Director.]
Notice to Affected Businesses
When disclosure is needed by an EPA Contractor, EPA must give affected
businesses at least ten calendar days notice before access by the contractor'
may take place. Notice may be given by Federal Register notice or certified
mail (return receipt requested). The notice will be prepared by the DCO and
must include:
the identity of the contractor to which RCRA CBI is to be
disclosed;
the official purpose for the access;
28
-------
whether access is authorized only on EPA premises or also at the
contractor's facilities;
the type of information to be disclosed; and
the period of time for which access to RCRA CBI is authorized.
[Note: Since the Regional Technical Enforcement Support (TES)
contractors will access CBI documents on a piecemeal basis, notification
is generally performed individually through letters, rather than through a
Federal Register notice.]
The recipient must understand the responsibilities of handling RCRA.CBI,
specifically:
All security precautions outlined in this manual must be adhered to
by the recipient.
All individuals needing access to CBI must gain authorization for
access as outlined in this manual.
All documents must be returned promptly to the RCRA CBI Office.
EPA will encourage other contractors to restrict their access of RCRA CBI to
EPA premises. However, if this is not practical, the contractor may request that
EPA grant access privileges at their facility. In order to be granted such
privileges, the contractor must have security procedures and standards in place
which equal or surpass those set forth in this manual; each facility must be
inspected and approved by the RCRA CBI DCO; and a DCO for that facility
must be appointed.
For each contract for which off-site access to CBI has been requested, the
contractor must prepare a CBI Security Plan and Access List and submit both
for approval to the EPA RCRA CBI DCO. Upon approval of the Security Plan,
the CBI staff will perform an inspection of the facility to ensure that appropriate
security precautions have been taken. If an inspection is not immediately •
possible, interim certification can be granted.. The CBI Office must perform the
inspection within the first two months of a contractor request. Yearly
reinspection of contractor facilities will take place.
All contractor employees that need access to CBI must receive authorization for
access to CBI. Authorization procedures can be found in Section III. If an
29
-------
employee's facility has not been approved for CBI, the employee may not
remove any documents, notes, or correspondence containing RCRA CBI from
EPA premises.
30
-------
CONGRESSIONAL ACCESS
The CABD Director must be immediately notified if a request is received for
documents or information that would require access to RCRA CBI by Congress
or the Comptroller General. Pursuant to 40 CFR 2.209, access may be allowed
only if the request is made by the Speaker of the House, the President of the
Senate, a chairman of a committee or subcommittee, or the Comptroller
General and no statute forbids disclosure.
When disclosure is requested by the Congress or the Comptroller General, EPA
must give affected businesses at least ten calendar days notice before access
by the requesting body may take place. However, if the requesting body asks
in writing that no notice be given, EPA will give no notice. When notice to the
affected businesses is appropriate, notice may be given by Federal Register
Notice or certified mail (return receipt requested). The notice will be prepared
by the DCO and must include:
the identity of the body to which RCRA CBI is to be disclosed;
the official purpose for the access;
whether access is authorized only on EPA premises or also at the
requesting body's facility;
the type of information to be disclosed; and
. the period of time for which access to RCRA CBI is authorized.
Before RCRA CBI may be disclosed, the DCO must ensure that the recipient
understands the responsibilities of handling RCRA CBI, specifically:
All security precautions outlined in this manual must be adhered to
by the recipient.
All individuals needing access to CBI must gain authorization for
access as outlined in this manual.
All documents must be returned promptly to the RCRA CBI Office.
31
-------
VII. DOCUMENT CONTROL OFFICER RESPONSIBILITIES
Document Control Officers (DCOs) are responsible for managing and
overseeing all CBI activities at their facility. This includes, but is not limited to:
oversight of the document control process including receipt,
storage, tracking and destruction of CBI documents;
ensuring that all security precautions are maintained;
providing notification of access to businesses prior to allowing
access by non-EPA personnel;
authorizing individuals for access to RCRA CBI;
authorizing and approving secure storage areas;
performing an annual audit of the CBI materials entrusted to their
care; and,
Investigating all violations of CBI procedures and making
recommendations for action.
All facilities that are authorized to receive RCRA CBI are required to have an
authorized Document Control Officer (DCO). A Document Control Assistant
(DCA) may be appointed to assist the DCO in the daily operations of the CBI
facility.
A. Assignment of a DCO
All facilities that are authorized to receive and store RCRA CBI must have
an approved and trained DCO before RCRA CBI can be transferred to
that facility. The Headquarters CBI DCO is responsible for providing
training materials and guidance on appropriate document handling
procedures to both EPA and Contractor RCRA CBI DCOs. The
Document Control Officer must be appointed, in writing, by their
supervisor, or individual in charge if the facility to which RCRA CBI is to
be transferred.
B. Relinquishing DCO Responsibilities
Whenever a DCO terminates their employment or relinquishes their DCO
responsibilities for any reason, the Headquarters RCRA CBI DCO must
be notified in writing with a Confidentiality Agreement for U.S. Employees
32
-------
Upon Termination/Transfer form (#8710-10). A new DCO should be
appointed within two weeks of the previous DCO's departure.
General Responsibilities
As the responsible person assigned to oversee the RCRA CBI functions,
the DCO must ensure that:
all manual and automated logs are properly maintained and stored
securely;
document control numbers are assigned to those documents
requiring them;
the proper procedures for the use of CBI materials are closely
followed;
only CBI authorized personnel have access to CBI materials; and,
an annual audit of all CBI document is performed.
Annual Audit and Inventory
An annual audit of all RCRA CBI documents must be performed annually.
At the conclusion of the audit, an inventory of all RCRA CBI documents
indicating the confirmed location of each document (the originals and
copies). The DCO at each facility is responsible for performing this
annual audit.
In the case of contractors, the audit should result in a formal inventory
document of every CBI document in their possession which is delivered
to their EPA DCO for review and approval. In the case of Regional DCO,
the audit should result in the production of an inventory of all documents
either maintained at the Regional Office or one of the Regional
Contractors.
Inventories should follow the format outlined in Appendix B and must
contain at least the EPA-designated document control number, copy
number brief description of document, and status and/or location of
each document. Status of document may be indicated as "Destroyed",
"Logged Out". If the document has been destroyed, the date of
destruction is required. If a document is logged out, the date the
document was logged out and identity of individual it was logged out to
is required. This should be personally confirmed by the DCO.
33
-------
Upon completion of the annual audit and inventory of all documents, the
Headquarters DCO must provide a written report of the status of CBI to
the Director, Communications Analysis and Budget Division and the
Chief, Information Management Branch. The report should include any
discrepancies found during the inventory/audit and indicate steps
recommended for resolving these discrepancies.
[Note: The Annual Inventory document is not considered to be CBI and
therefore does not require security precautions for the transport, transfer
or storage of the document.]
D. EPA Headquarters vs. Regional Responsibilities
The HQ and Regional-DCO have an inter-related and yet separate set of
responsibilities. The Regional DCO is responsible for oversight of all
RCRA CBI documents submitted to the EPA Region, of all Regional
contractors, and of all their Regional personnel (as they relate to RCRA
CBI). The Headquarters DCO is responsible, similarly, for the
Headquarter CBI office, for maintaining the HQ RCRA CBI documents,
for overseeing the HQ contractors, and for oversight of the Regional
RCRA CBI operations.
34
-------
VIII. WORK ASSIGNMENTS AND CONTRACTS
All work assignment managers, project officers and contract officers need to be
aware of the requirements required due to allowing contractor maintenance of
RCRA CBI. These requirements should be clearly delineated in all work
assignments and contracts that handle CBI.
Specifically, at the conclusion of all contracts in which CBI has been used, the
contractor is required to return all CBI documents to-the EPA CBI DCO.
Funding should be set aside for this purpose.
Additionally, while the work is in progress, the Contractor is required to abide
by all requirements as they are enumerated in this manual and in the
Contractor's Security Manual. The Contractor must employ a CBI Document
Control Officer, perform an annual audit, and return all documents to the EPA
CBI DCO upon request.
Language for Work Assignments
The following language is recommended for inclusion in all work assignments
that handle RCRA CBI:
"Confidential Business Information
If this work assignment requires use of RCRA Confidential
Business Information (CBI), the contractor shall abide by all RCRA CBI
requirements and stipulations found in the RCRA CBI Security Manual
and in the contract (Section ). The contractor shall identify in the
work plan budget all estimated costs for dealing with CBI requirements
per the contract."
35
-------
APPENDIX A
Confidential Business Information
Forms
-------
RCRA CBI U 8 AGENCY OOEB NOT CONTAIN NATIONAL
WHEN FILLEO IN INVENTORY LOG SECURITY INFORMATION IE.O. 123501
""" ¦" RCRA CONFIDENTIAL BUSINESS INFORMATION
DATE
RECEIVEO
OOCUMENT
CONTROL NO.
NO
PAQES
RECEIVED FROM
(Entw company, «lly. and hiiiI
DESCRIPTION
DISPOSITION
\
LOCATION OF STORAGE FACILITY
INCLUDING DIVISION AND ROOM NO.
EPA Form 6T10-1 (10421
-------
REQUEST FOR APPROVAL OF CONTRACTOR ACCESS
TO RCRA CONFIDENTIAL BUSINESS INFORMATION
Requesting Official*
Signature
Date
Title and Office
Telephone No.
Contractor and contract numbtr (if modification)
I. Brief description of contract, including purpose, scope, length, and other important details (Continue on the
back of this form if ntctsury.l
II. What RCRA C8I will be required, and why? (Continue on back if necessary.)
>
III. Will computer access to RCRA CBI be required by the contract? If so, explain why and to what extent on
the back of this form.
If you approve this request, this office will initiate procedures to ensure compliance with 40 CFR 2.301(h) and the RCRA
Confidential-Business Information Security Manual.
'Must be Di«'Sion Director (or equivalent) or' above.
Office Director for
Solid Waste
Approved
EPA Form 8710-S (10-82)
Date
-------
rcra cat -
WHEN FILLED IN
U.S. ENVIRONMENTAL PROTECTION AGENCY
DESTRUCTION LOG
RCRA CONFIDENTIAL BUSINESS INFORMATION
DOES NOT CONTAIN
NATIONAL SECURITY
INFORMATION
(E.O. 123S6I
OCO OR OCA NAME
LOCATION
DATE
DE-
STROYED
DOCUMENT
CONTROL
NUMBER
DESCRIPTION
DCOORDCA
SIGNATURE
-
EPA For* 8710-7 (10-621
-------
RCRA CONTRACTOR'S EMPLOYEE CONFIDENTIALITY AGREEMENT
! understand that as an employee of a contractor performing work for the
United States Environmental Protection Agency, I will have access to certain Confidential Business Information submitted under
the Resource Conservation and Recovery Act (RCRA) (42 U.S.C. 6901 et seq.). This access has been granted to me in order to per-
form my work under the contract.
I understand riiat RCRA Confidential Business Information may not be disclosed by me except as authorized by RCRA, the con-
tr»ct, and the security procedures used by my employer under the contract. I understand that under section 3007(b)(2)-of RCRA
(42 U.S.C. 6927 (b)(2)), I am liable for a possible fine of up to $5,000 and/or imprisonment for up to 1 year if I willfully disclose
RCRA Confidential Business Information to any person not authorized to receive it. In addition, I'understand that I may be sub-
ject to disciplinary action for violation of this agreement up to and including dismissal.
t agree that I will treat any RCRA Confidential Business Information furnished to me as confidential and that I will follow the
security procedures used by my employer under the contract. I have been informed of and understand the procedures.
NAME
SIGNATURE
DATE
EPA Form 8710-9 (10-82)
-------
CONFIDENTIALITY AGREEMENT FOR
UNITED STATES EMPLOYEES UPON TERMINATION OR TRANSFER
In accord*not with my official dutias at an employee of the United States, I hava had access to Confidential Busineu Information
under the Resource Conservation and Recovery An (RCRA) (42 U.S.C. 6901 etseq.). I understand that RCRA Confidential
Busineu Information may not be disclosed except as authorized by RCRA or Agency regulations.
I certify that I have returned all copies of any RCRA Confidential Business Information in my possession to the Document Control
Officer as specified in the procedures sat forth in RCRA Confidential Busineu Information Security Manual.
I agree that I will not remove any copies of RCRA Confidential Busineu Information from the premises of the Agency upon my
termination or transfer. I further agree that I will not disclose any RCRA Confidential Business Information to any person after
my termination or transfer.
I understand that as an employee of the United States who has had acceu to RCRA Confidential Business Information, under
18 U.S.C. 1905, I am liable for a pouible fine of up to SI.000 and/or imprisonment for up to 1 year if I willfully disclose RCRA
Confidential Business Information to any person.
ff I am still employed by the United States, I also understand that I may be subject to disciplinary action for violation of this agree-
ment.
1 am aware that 1 may be subject to criminal penalties under 18 U.S.C. 1001 if 1 have made any statement of material facts knowing
that such stitament is false or if 1 willfully conceal any material fact.
I
NAME .
1
1
t
10 NUMBER (
signature
DATS
EPA Form 1710-10 11042)
-------
1. AUTHORIZATION FOR ACCESS TO RCRA CONFIDENTIAL BUSINESS INFORMATION (CBI)
FULL NAME
EPA 10 NUMBER
POSITION
OFFICE (Inciud* Division)
It is the responsibility of each Authorizing Official* to ensure that employees under his/her supervision who require access to RCRA CE
1. Complete the required investigative forms prior to access to RCRA CBI
2. Sign the Confidentiality Agreement for EPA Employees.
3. Are fully informed regarding their security responsibilities for RCRA CBI.
4 Obtain access only to that RCRA CBI required to perform their official duties.
SIGNATURE OF AUTHORIZING OFFICIAL
TELEPHONE NO.
DATE
TITLE
LOCATION
II.
APPOINTMENT OF DCO AND OCAS
If employee is being appointed DCO or OCA, authorizing official (Division Director or above) must sign this section.
SIGNATURE ANO TITLE
DATE
III.
CONFIDENTIALITY AGREEMENT FOR EPA EMPLOYEES
I understand that I will have access to certain Confidential Business Information submitted under the Resource Conservation and
Recovery Act(RCRA), (42 U.S.C. 6901 et seq.). This access has been granted in accordance with my official duties as an employee
of the Environmental Protection Agency.
I understand that RCRA CBI may not be disclosed except as authorized by RCRA and Agency regulations. I understand that under
18 U.S.C. 1905 I am liable for a possible fine of up to $1,000 and/or imprisonment for up to 1 year if I willfully disclose RCRA
CBI to any person not authorized to receive it. In addition, I understand that I may be subject to disciplinary action for violation
of this agreement with penalties ranging up to and including dismissal.
I agree that I will treat any RCRA CBI furnished to me as confidential and that I will follow the procedures set forth in the RCRA
Confidential Business-Information Security Manual.
I have read and understand the procedures.
SIGNATURE
TELEPHONE NO.
DATE
• V. | certify that all necessary investigative formst have been completed and forwarded to the Headquarters Security Branch.
SIONATURE LOCAL OCO/DCA
TELEPHONE NO.
DATE
'Must be Division Director (or equivalent) or above.
tFor employees described in section I.G under "exceptions" and those who require administrative full-field investigations.
EPA Form 1710-11 (1042)
-------
REQUEST FOR APPROVAL OF TEMPORARY EMPLOYEE
FOR ACCESS TO RCRA C8I
DATE OF REQUEST
OIVISlON DIRECTOR
PROGRAM OFFICE
TELEPHONE NUMBER
MAIL CODE
nami or EMPLOYEE
POSITION OCCUPIED
The abom named employee require* access to RCRA Confidential Business Information to perform his or her assigned duties. The
individual falls into a category which requires approval of the appropriate Division Director prior to access being granted, and is
aho required to submit to the Security Branch the forms required to initiate a NACI Investigation: SF-17t, Personal Qualifications
Statement: SF-65, Data for Noneensitive or Noncritical-Sensitive Position; and SF-67, United States Office of Personnel Manage-
ment Fingerprint Chart
1 authorize the above-named employee to have access to RCRA CBI, contingent upon his or her submitting the appropriate forms
to the Security Branch and subsequently submitting the usual RCRA Access Authorization Form through the normal channels.
SIGNATURE DIVISION DIRECTOR
DATE
1 certify that the above-named employee has submitted the necessary investigative forms to the Security Branch and has been finger-
primed.
' 1
DATE
RETURN TO
Return this completed form to the Program Office Division Director, with a copy to the Document Control Officer.
SPA Form 1710-12 (1042)
-------
The attached document contains Confidential Business Information obtained under the Resource Conser-
vation and Recovery"Act (RCRA) (42 U.S.C. 6901 et seq.). RCRA Confidential Business Information may
not be disclosed lurther or copied by you except as authorized in the procedures set forth in the RCRA
CONFIDENTIAL BUSINESS INFORMATION SECURITY MANUAL.
If you willfully disclose RCRA Confidential Business Information to any person not authorized to receive
it, you may be liable under 18 U.S.C. 1905 for a possible fine up to SI,000 and/or imprisonment for up
to 1 year. In addition, disclosure of RCRA Confidential Business Information or violation of the proce-
dures cited above may subject you to disciplinary action with penalties ranging up to and including dis-
missal.
Each person who is given access to this document must fill in the information below.
^ last name | signature
EPA ID NO
DATE OUT
DATE IN
OCO initial
-
EPA Form 8710-13 (10-82)
DO NOT DETACH
-------
CONFIDENTIALITY AGREEMENT FOR CONTRACTOR'S EMPLOYEES
UPON TERMINATION OR TRANSFER
As an employee of . a contractor performing work for the United StateJ
Environmental Protection Agency. I have had access to certain Confidential Business Information submitted under the Resource
Conservation and Recovery Act (RCRA) (42 U.S.C. 6901 et seq.). This access was granted to me in order to perform my work under
a contract.
I certify that t have returned all copies of any RCRA Confidential Business Information in my possession to the area designated
for Confidential Business Information at my company.
I agree that I will not remove any copies of RCRA Confidential Business Information from the premises of the company upon my
termination or transfer. I further apee that I will not disclose any RCRA Confidential Business Information to any person after my
tirmination or transfer.
I understand that as a contractor employee who has had access to RCRA Confidential Business Information, under section 3007(b)(2)
of RCRA (42 U.S.C. 6927(b)(2)), I am liable for a possible fine of up to $5,000 and/or imprisonment for up to 1 year if I willfully
disclose RCRA Confidential Business Information to any person.
If I am (till employed by the contractor, I also understand that I may be subject to disciplinary action for violation of this agreement.
I am aware that I may be subject to criminal penalties under 18 U.S.C. 1001 if I have made any statement of material facts
knowing that such statement is false or if I willfully conceal any material fact.
IPA Form >710-14 (10-B2)
-------
APPENDIX B
Confidential Business Information
Sample Inventory
-------
^ n RCftA C«l f'ONAOfNCY OOC« NOT CONTAIN NATIONAL {
tQQn WHCN FILL8D IN INVEWTOflV LOG SECURITY INFORMATION {C.O.123MI
IMO' WW«N riLLND M HCWACONFIDENTIAL SUUNtlS INFORMATION
DATE
MCIIVIO
OOCUMfNT
CONTROL NO.
IMmur eew^ewy, thy. mt mt»i
OCKRIFTION
OIWOIITION
Ol/
J&1W&&V-OZ
<£
5#7 /%*« -SC-PO {m&u, If,
CX^.W
tU^liutoA*
7>r
jejndviu*riR
"f S&rc-fx (ShtU ClUtH
, 1 £,tt> O5 -
/
ZtrWGtoi -03
r&so&i
(DtHtUHar- fUtCn
¥
IIAJIfW"
61/
feo
J&H3¥c,&3r(X.
V-
^ (crfji - {/Uolo ^L
ii* ec*. /*~ KLp^-t-f-kbH; i Z It)
CXvnAivmc - forru
•
°%o
JEliWtgCg-d'y
------- |