[Code of Federal Regulations]
[Title 6, Volume 1]
[Revised as of January 1, 2007]
From the U.S. Government Printing Office via GPO Access
[CITE: 6CFR29.6]

[Page 122-124]
 
                       TITLE 6--HOMELAND SECURITY
 
   CHAPTER I--DEPARTMENT OF HOMELAND SECURITY, OFFICE OF THE SECRETARY
 
PART 29_PROTECTED CRITICAL INFRASTRUCTURE INFORMATION--Table of Contents
 
Sec.  29.6  Acknowledgment of receipt, validation, and marking.

    (a) Authorized officials. Only the DHS PCII Program Manager is 
authorized to validate, and mark information as PCII. The PCII Program 
Manager or the Program Manager's designees, may mark information 
qualifying under categorical inclusions pursuant to 6 CFR 29.6(f).
    (b) Presumption of protection. All information submitted in 
accordance with the procedures set forth hereby will be presumed to be 
and will be treated as PCII, enjoying the protections of section 214 of 
the CII Act, from the time the information is received by the PCII 
Program Office or the PCII Program Manager's designee. The information 
shall remain protected unless and until the PCII Program Office renders 
a final decision that the information is not PCII. The PCII Program 
Office will, with respect to information that is not properly submitted, 
inform the submitting person or entity within thirty days of receipt, by 
a means of communication to be prescribed by the PCII Program Manager, 
that the submittal was procedurally defective. The submitter will then 
have an additional 30 days to remedy the deficiency from receipt of such 
notice. If the submitting person or entity does not cure the deficiency 
within thirty calendar days of the date of receipt of the notification 
provided in this paragraph, the PCII Program Office may determine that 
the presumption of protection is terminated. Under such circumstances, 
the PCII Program Office may cure the deficiency by labeling the 
submission with the information required in 6 CFR 29.5 or may notify the 
applicant that

[[Page 123]]

the submission does not qualify as PCII. No CII submission will lose its 
presumptive status as PCII except as provided in 6 CFR 29.6(g).
    (c) Marking of information. All PCII shall be clearly identified 
through markings made by the PCII Program Office. The PCII Program 
Office shall mark PCII materials as follows: ``This document contains 
PCII. In accordance with the provisions of 6 CFR Part 29, this document 
is exempt from release under the Freedom of Information Act (5 U.S.C. 
552(b)(3)) and similar laws requiring public disclosure. Unauthorized 
release may result in criminal and administrative penalties. This 
document is to be safeguarded and disseminated in accordance with the 
CII Act and the PCII Program requirements.'' When distributing PCII, the 
distributing person shall ensure that the distributed information 
contains this marking.
    (d) Acknowledgement of receipt of information. The PCII Program 
Office or the PCII Program Manager's designees shall acknowledge receipt 
of information submitted as CII and accompanied by an express statement, 
and in so doing shall:
    (1) Contact the submitting person or entity, within thirty calendar 
days of receipt of the submission of CII, by the means of delivery 
prescribed in procedures developed by the PCII Program Manager. In the 
case of oral submissions, receipt will be acknowledged in writing within 
thirty calendar days after receipt by the PCII Program Office or the 
PCII Program Manager's designee of a written statement, certification, 
and documents that memorialize the oral submission, as referenced in 6 
CFR 29.5(a)(3)(ii);
    (2) Enter the appropriate data into the PCIIMS as required in 6 CFR 
29.4(e); and
    (3) Provide the submitting person or entity with a unique tracking 
number that will accompany the information from the time it is received 
by the PCII Program Office or the PCII Program Manager's designees.
    (e) Validation of information. (1) The PCII Program Manager shall be 
responsible for reviewing all submissions that request protection under 
the CII Act. The PCII Program Manager shall review the submitted 
information as soon as practicable. If a final determination is made 
that the submitted information meets the requirements for protection, 
the PCII Program Manager shall ensure that the information has been 
marked as required in paragraph (c) of this section, notify the 
submitting person or entity of the determination, and disclose it only 
pursuant to 6 CFR 29.8.
    (2) If the PCII Program Office makes an initial determination that 
the information submitted does not meet the requirements for protection 
under the CII Act, the PCII Program Office shall:
    (i) Notify the submitting person or entity of the initial 
determination that the information is not considered to be PCII. This 
notification also shall, as necessary:
    (A) Request that the submitting person or entity complete the 
requirements of 6 CFR 29.5(a)(4) or further explain the nature of the 
information and the submitting person or entity's basis for believing 
the information qualifies for protection under the CII Act;
    (B) Advise the submitting person or entity that the PCII Program 
Office will review any further information provided before rendering a 
final determination;
    (C) Advise the submitting person or entity that the submission can 
be withdrawn at any time before a final determination is made;
    (D) Notify the submitting person or entity that until a final 
determination is made the submission will be treated as PCII;
    (E) Notify the submitting person or entity that any response to the 
notification must be received by the PCII Program Office no later than 
thirty calendar days after the date of the notification; and
    (F) Request the submitting person or entity to state whether, in the 
event the PCII Program Office makes a final determination that any such 
information is not PCII, the submitting person or entity prefers that 
the information be maintained without the protections of the CII Act or 
returned to the submitter or destroyed. If a request for withdrawal is 
made, all such information shall be returned to the submitting person or 
entity.

[[Page 124]]

    (ii) If the information submitted has not been withdrawn by the 
submitting person or entity, and the PCII Program Office, after 
following the procedures set forth in paragraph (e)(2)(i) of this 
section, makes a final determination that the information is not PCII, 
the PCII Program Office, in accordance with the submitting person or 
entity's written preference, shall, within thirty calendar days of 
making a final determination, return the information to the submitter. 
If return to the submitter is impractical, the PCII Program Office shall 
destroy the information within 30 days. This process is consistent with 
the appropriate National Archives and Records Administration-approved 
records disposition schedule. If the submitting person or entity cannot 
be notified or the submitting person or entity's response is not 
received within thirty calendar days of the date of the notification as 
provided in paragraph (e)(2)(i) of this section, the PCII Program Office 
shall make the initial determination final and return the information to 
the submitter.
    (f) Categorical Inclusions of Certain Types of Infrastructure as 
PCII. The PCII Program Manager has discretion to declare certain subject 
matter or types of information categorically protected as PCII and to 
set procedures for receipt and processing of such information. 
Information within a categorical inclusion will be considered validated 
upon receipt by the Program Office or any of the Program Manager's 
designees without further review, provided that the submitter provides 
the express statement required by section 214(a)(1). Designees shall 
provide to the Program Manager information submitted under a categorical 
inclusion.
    (g) Changing the status of PCII to non-PCII. Once information is 
validated, only the PCII Program Office may change the status of PCII to 
that of non-PCII and remove its PCII markings. Status changes may only 
take place when the submitting person or entity requests in writing that 
the information no longer be protected under the CII Act; or when the 
PCII Program Office determines that the information was, at the time of 
the submission, customarily in the public domain. Upon making an initial 
determination that a change in status may be warranted, but prior to a 
final determination, the PCII Program Office, using the procedures in 
paragraph (e)(2) of this section, shall inform the submitting person or 
entity of the initial determination of a change in status. Notice of the 
final change in status of PCII shall be provided to all recipients of 
that PCII under 6 CFR 29.8.