§ 29.6 - Acknowledgment of receipt, validation, and marking.

§ 29.6 Acknowledgment of receipt, validation, and marking.

(a) Authorized officials. Only the DHS PCII Program Manager is authorized to validate , and mark information submitted for protection outside of a categorical inclusion as PCII. The PCII Program Manager or the a Program Manager's designees, Designee may mark information qualifying for protection under categorical inclusions pursuant to 6 CFR 29.6paragraph (f) of this section as PCII.

(b) Presumption of protection. All information submitted in accordance with the procedures set forth hereby in § 29.5 of this part will be presumed to be and will be treated as PCII, enjoying the protections of section 214 of the CII Act, from the time the information is received by the PCII Program Office or the a PCII Program Manager's designeeDesignee. The information shall must remain protected unless and until the PCII Program Office renders a final decision that the information is not PCII. The PCII Program Office will, with respect to information that is not properly submitted, inform the submitting person or entity within thirty calendar days of receipt, by a means of communication to be prescribed by the PCII Program Manager, that the submittal was procedurally defective. The submitter will then have an additional 30 thirty calendar days to remedy the deficiency from the date of receipt of such noticenotification by the PCII Program Office. If the submitting person or entity does not cure the deficiency within thirty calendar days of after the date of receipt of the notification provided by the PCII Program Office in this paragraph, the PCII Program Office may determine that the presumption of protection is terminated. Under such circumstances, the PCII Program Office may cure the deficiency by labeling the submission with the information required in 6 CFR § 29.5 or may notify the applicant that the submission does not qualify as PCII. No CII submission will lose its presumptive status as PCII except as provided in 6 CFR 29.6paragraph (g) of this section.

(c) Marking of information. All PCII shall must be clearly identified through markings made by the PCII Program Office. The PCII Program Office shall will mark PCII materials as follows: “This document contains PCII. In accordance with the provisions of 6 CFR part 29, this document is exempt from release under the Freedom of Information Act (5 U.S.C. 552(b)(3)) and similar laws requiring public disclosure. Unauthorized release may result in criminal and administrative penalties. This document is to be safeguarded and disseminated in accordance with the CII Act and the PCII Program requirements.” When distributing PCII, the distributing person shall must ensure that the distributed information contains this marking.

(d) Acknowledgement of receipt of information. The PCII Program Office or the a PCII Program Manager's designees shall Designee will acknowledge receipt of information submitted as CII and accompanied by an express statement, and in so doing shallwill:

(1) Contact the submitting person or entity, within thirty calendar days of receipt of the submission of CII, by the means of delivery prescribed in procedures developed by the PCII Program Manager. In the case of oral submissions, receipt will be acknowledged in writing within thirty calendar days after receipt by the PCII Program Office or the a PCII Program Manager's designee Designee of a written statement, certification, and documents that memorialize the oral submission, as referenced in 6 CFR § 29.5(a)(3)(ii);

(2) Enter the appropriate data into the PCIIMS as required in 6 CFR § 29.4(e); and

(3) Provide the submitting person or entity with a unique tracking number that will accompany the information from the time it is received by the PCII Program Office or the a PCII Program Manager's designeesDesignee.

(e) Validation of information.

(1) The PCII Program Manager shall be is responsible for reviewing all submissions that request protection under the CII Act. The PCII Program Manager shall will review the submitted information as soon as practicable. If a final determination is made that the submitted information meets the requirements for protection, the PCII Program Manager shall must ensure that the information has been marked as required in paragraph (c) of this section, notify the submitting person or entity of the determination, and disclose it only pursuant to 6 CFR § 29.8.

(2) If the PCII Program Office makes an initial determination that the information submitted does not meet the requirements for protection under the CII Act, the PCII Program Office shallwill:

(i) Notify the submitting person or entity of the initial determination that the information is not considered to be PCII. This notification also shallwill, as necessary:

(A) Request that the submitting person or entity complete the requirements of 6 CFR § 29.5(a)(4) or further explain the nature of the information and the submitting person or entity's basis for believing the information qualifies for protection under the CII Act;

(B) Advise the submitting person or entity that the PCII Program Office will review any further information provided before rendering a final determination;

(C) Advise the submitting person or entity that the submission can be withdrawn at any time before a final determination is made;

(D) Notify the submitting person or entity that until a final determination is made the submission will be treated as PCII;

(E) Notify the submitting person or entity that any response to the notification must be received by the PCII Program Office no later than thirty calendar days after the date of the notification; and

(F) Request the submitting person or entity to state whether, in the event the PCII Program Office makes a final determination that any such information is not PCII, the submitting person or entity prefers that the information be maintained without the protections of the CII Act or , returned to the submitter submitting person or entity, or destroyed. If a request for withdrawal return is made, all such information shall will be returned to the submitting person or entity.

(ii) If the information submitted has not been withdrawn by the submitting person or entity, and the PCII Program Office , after following the will return the information to the submitter in accordance with the submitting person or entity's written preference and the procedures set forth in paragraph (e)(2)(i) of this section , makes a final determination that the information is not PCII, the PCII Program Office, in accordance with the submitting person or entity's written preference, shall, within thirty calendar days of making a final determination , return that the information to the submitter. If return to the submitter is impractical, the PCII Program Office shall destroy the information within 30 days. This process is consistent with the appropriate National Archives and Records Administration-approved records disposition schedule. submitted is not eligible for protections under the CII Act. If the submitting person or entity cannot be notified or the submitting person or entity's response is not received within thirty calendar days of the date of the notification as provided in paragraph (e)(2)(i) of this section, the PCII Program Office shall will make the initial determination final and return the information to the submitter. If return to the submitter is impractical, the PCII Program Office will destroy the information within thirty calendar days. This process is consistent with the appropriate National Archives and Records Administration-approved records disposition schedule.

(f) Categorical Inclusions of Certain Types of Infrastructure CII as PCII. The PCII Program Manager has discretion to declare certain subject matter or types of information categorically protected as PCII and to set procedures for receipt and processing of such information. Information within a categorical inclusion will be considered validated upon receipt by the PCII Program Office Manager or any of the PCII Program Manager's designees Designees without further review, provided that the submitter provides the express statement required by section 214§ 29.5(a)(13). Designees shall The PCII Program Manager's designees will provide to the PCII Program Manager Office information submitted under a categorical inclusion.

(g) Changing the status of PCII to non-PCII. Once information is validated, only the PCII Program Office Manager may change the status of PCII to that of non-PCII and remove its PCII markings. Status changes may only take place when the submitting person or entity requests in writing that the information no longer be protected under the CII Act; or when the PCII Program Office determines that the information was, at the time of the submission, customarily in the public domain. Upon making an initial determination that a change in status may be warranted, but prior to a final determination, the PCII Program Office, using the procedures in paragraph (e)(2) of this section, shall will inform the submitting person or entity of the initial determination of a change in status. Notice of the final change in status of PCII shall will be provided to all recipients of that PCII received under 6 CFR § 29.8.