Document Confidentiality and AI Use
Initial publication
Showing changes from Initial revision
to Rev 1
in Document Confidentiality and AI Use.
+---
+title: Document Confidentiality and AI Use
+category: General Requirements
+description: >
+ When to use: the administrative framework for the ownership, confidentiality, permitted use, and disposition of the Contract Documents and the project information on any construction contract, read together with every technical standard on the project. States once who owns the drawings, specifications, models, and data files and under what license the Contractor and every lower tier use them, the confidentiality classes of project information and the marking and handling of each, the need-to-know distribution and flow-down of the obligations into every subcontract and purchase order, the terms a hosted document, takeoff, review, or assistant service has to meet before the documents are processed on it, the review and responsibility rules for automated and generated content in the Contractor's deliverables, the consent required before photographs or statements about the project are published, the notice and remediation after a loss or an unauthorized disclosure, and the return or destruction of the documents at closeout, so that the technical standards carry none of it and a supplier or bidder who reads only its own section still sees the obligations.
+ Not intended for: the submittal register and review workflow and the delegated-design seal ([[sync/submittal-and-quality-procedures]]); the content of the record documents and the operation and maintenance package ([[sync/operation-and-maintenance-data]]) and the progress photograph program ([[sync/construction-progress-documentation]]); construction fencing, site access, and site security during construction ([[sync/temporary-facilities-and-controls]]); the cybersecurity of the control system and its network ([[sync/scada-and-hmi-systems]], [[sync/process-control-networks]]); warranties and bonds ([[sync/warranties-and-bonds]]); insurance, payment, and product substitution, which the Agreement and the General Conditions govern; and the Owner's own obligations to the Engineer under the Agreement between them.
+---
+
+# Scope {toc}
+
+## This standard establishes the administrative requirements for the ownership and licensed use of the Contract Documents, for the confidentiality of the project information, for the services on which the documents are processed, for automated and generated content in the Contractor's deliverables, for photographs and public statements about the Work, and for the return or destruction of the documents at closeout, on any project and under any Division of the Specifications. {note}
+
+## The confidentiality obligations on a construction contract originate in the Agreement and the General Conditions, which are contract instruments between the Owner and the Contractor, and they stop there. A subcontractor, a supplier, or a bidder usually receives only the technical sections for its trade, so the party that most often forwards the drawings to an outside tool has never read the obligation. This standard carries the obligation into the project manual, where every reader of a technical section finds it, and it states the administrative detail those instruments leave open. {note}
+
+## An engineer who issues a specification as a file has no say in which hosted tools a supplier or a contractor feeds it into, and some of those tools retain what is uploaded, use it to train a model, or make what is derived from it available to others. The standard does not name any of them. It states the terms a service has to meet, places on the Contractor the duty to verify them, and leaves the choice of tool to the Contractor. {note}
+
+## The Contractor shall comply with this standard in addition to any confidentiality, ownership, or publicity requirement stated in the Agreement, the General Conditions, or a technical standard.
+
+## Where a requirement of this standard conflicts with the Agreement or the General Conditions, the Agreement and the General Conditions shall govern.
+
+## Nothing in this standard overrides a public records law, a freedom of information law, or an open meetings law that binds a public Owner, and the Contractor's obligations under this standard shall not be reduced by any disclosure the Owner is required by such a law to make.
+
+## The following are outside the scope of this standard: {note}
+
+- The submittal register, the transmittal and review workflow, and the professional seal on delegated-design submittals, which [[sync/submittal-and-quality-procedures]] governs
+- The content, format, and delivery of the record documents and the operation and maintenance package, which [[sync/operation-and-maintenance-data]] governs
+- The progress photograph, video, and construction camera program, and the ownership of and access to that documentation, which [[sync/construction-progress-documentation]] governs and the Contract settles
+- Construction fencing, site access control, and site security during construction, which [[sync/temporary-facilities-and-controls]] governs
+- The cybersecurity of the control system, its accounts, its hardening, and its network zones and conduits, which [[sync/scada-and-hmi-systems]] and [[sync/process-control-networks]] govern
+- Warranties, the correction period, and surety bonds, which [[sync/warranties-and-bonds]] governs
+- Insurance, the price and payment procedures, and product substitution, which the Agreement and the General Conditions govern and which no SynC standard yet owns
+- The Owner's obligations to the Engineer, including the Owner's own license to the instruments of service, which the Agreement between the Owner and the Engineer governs
+
+# Confidentiality and Use Terms {toc}
+
+## The following terms are used in this standard with the meanings given here: {note}
+
+- The Contract Documents are the Agreement, the General and Supplementary Conditions, the drawings, the specifications, the addenda, and the modifications, together with the models, data files, schedules, and calculations issued under them
+- Project information is the Contract Documents and every other record about the project or the facility that the Owner, the Engineer, or the Contractor creates or receives in performing the Work, including submittals, requests for information, reports, photographs, test results, and record documents
+- An instrument of service is a drawing, specification, model, data file, calculation, or other document the Engineer or its consultants prepared for the project, in which the Engineer holds the copyright and other reserved rights
+- A public document is a document the Owner has issued without restriction, such as the bid documents a public Owner has advertised, or a document the Owner is required by law to disclose
+- A project-confidential document is any project information that is not a public document and has not been marked security-sensitive
+- A security-sensitive document is project information whose disclosure would assist an attack on the facility, its process, its control system, its chemicals, or its occupants, as identified in the datasheet or marked by the Owner
+- A lower tier is a subcontractor, a sub-subcontractor, a supplier, a fabricator, a consultant, or a testing agency engaged, at any level, under the Contractor
+- An authorized user is an individual within the Contractor's organization or a lower tier who needs the document to perform a part of the Work
+- An automated processing service is any hosted service, whether or not it is marketed as artificial intelligence, that stores, converts, searches, indexes, extracts from, estimates from, reviews, summarizes, translates, or generates content from project information, including document management, takeoff and estimating, submittal preparation, specification review, scheduling, and general-purpose assistant services
+- A conforming service is an automated processing service whose terms of service, as of the date of use, meet every condition stated in the Conforming Service Terms article of this standard
+- Generated content is text, a drawing, a schedule, a calculation, a summary, or a data file that an automated processing service produced in whole or in part, as distinct from content a person wrote
+- An archival record copy is a single complete copy of the project information that the Contractor retains after closeout for the defense of a claim, under the obligations of this standard
+
+# Referenced Standards {toc}
+
+## The ownership, confidentiality, and disposition of the Contract Documents shall comply with the latest adopted edition of each of the following unless a specific edition is cited or the Contract Documents direct otherwise.
+
+## Where referenced documents conflict, the more stringent requirement shall govern unless the Engineer of Record directs otherwise in writing.
+
+| Standard | Title |
+|----------|-------|
+| AIA A201 | General Conditions of the Contract for Construction (Section 1.5, instruments of service) |
+| AIA E203 | Building Information Modeling and Digital Data Exhibit |
+| AIA C106 | Digital Data Licensing Agreement |
+| EJCDC C-700 | Standard General Conditions of the Construction Contract (reuse of documents) |
+| ConsensusDocs 200 | Standard Agreement and General Conditions Between Owner and Constructor |
+| 17 U.S.C. 101 et seq. | Copyright Act (architectural works and technical drawings) |
+| 5 U.S.C. 552 | Freedom of Information Act |
+| 42 U.S.C. 300i-2 | Safe Drinking Water Act Section 1433, Community Water System Risk and Resilience |
+| 6 CFR Part 29 | Protected Critical Infrastructure Information |
+| 32 CFR Part 2002 | Controlled Unclassified Information |
+| NIST SP 800-171 | Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations |
+| AWWA J100 | Risk and Resilience Management of Water and Wastewater Systems |
+| ISA/IEC 62443-2-1 | Security for Industrial Automation and Control Systems, Security Program Requirements for Asset Owners |
+
+## The general conditions in common use reserve the Engineer's copyright and other rights in the instruments of service and grant the Owner and, through the Owner, the Contractor and its lower tiers a license limited to this project, and they differ in how that license is worded and in what the Owner's own rights are. The federal frameworks in the table are invoked by a federal Owner, or by a public Owner spending federal funds, and the Contract Documents say when one applies. Every state has a public records law, and those laws differ in what a public body can withhold about the security of its facilities. {note}
+
+# Submittals {toc}
+
+## Confidentiality Submittals {toc}
+
+### The Contractor shall submit the following, each at the time this standard states for it:
+
+- The acknowledgment of this standard, signed by the Contractor, before the first project information beyond the bid documents is issued to it
+- The register of automated processing services, where the datasheet requires one, with the Contractor's record of each service's verified terms
+- The distribution record for security-sensitive documents, on the Owner's request and at closeout
+- The notice of a loss, an unauthorized disclosure, or a non-conforming upload, within the time indicated in the datasheet
+- The request for consent to publish a photograph, a statement, or an award submission, before publication
+- The certificate of return or destruction, signed by the Contractor and by every lower tier that held confidential or security-sensitive documents, at closeout
+
+```datasheet
+label: Confidentiality Submittals Required
+type: checkbox
+options:
+ - Signed acknowledgment of this standard
+ - Register of automated processing services
+ - Distribution record for security-sensitive documents
+ - Notice of loss or unauthorized disclosure
+ - Request for publicity consent
+ - Certificate of return or destruction
+default:
+ - Signed acknowledgment of this standard
+ - Distribution record for security-sensitive documents
+ - Notice of loss or unauthorized disclosure
+ - Request for publicity consent
+ - Certificate of return or destruction
+constraint: all_of
+```
+
+### Confidentiality submittals shall be transmitted and tracked through the submittal procedure of [[sync/submittal-and-quality-procedures]].
+
+### The certificate of return or destruction shall be listed among the closeout submittals under [[sync/closeout-procedures]] and shall be a condition of final payment.
+
+### A signed acknowledgment at the start is what makes the obligation the Contractor's rather than a page in the project manual it did not read, and the certificate at the end, while retainage is still at stake, is the only point at which the return of the documents can be enforced without a claim. {note}
+
+# Ownership and License of the Contract Documents {toc}
+
+## Instruments of Service {toc}
+
+### The drawings, specifications, models, data files, and calculations issued under the Contract Documents are instruments of service of the Engineer and its consultants, who retain the copyright and every other reserved right in them, unless the Agreement provides otherwise.
+
+### Issuing a document to the Contractor, in print or as a file, shall not transfer ownership of it or of any right in it, and possession of a copy shall not confer a right to use it beyond the license this standard grants.
+
+### A drawing is handed over for the Work the way a key is handed over for a room: the Contractor holds it, uses it for the purpose it was issued for, and gives it back. The file formats a project now runs on make a complete copy of the whole design a single transfer, and the license is what separates the lawful copy from the one that reappears, with the title block cropped off, on a different project. {note}
+
+## Limited License and Permitted Use {toc}
+
+### The Contractor and every lower tier are granted a non-exclusive, non-transferable license to reproduce and use the Contract Documents solely for bidding, performing, closing out, and, where the Owner so directs, operating and maintaining this project.
+
+### The Contractor shall not use the Contract Documents, or any part of them, on another project, for another client, or for any purpose other than this project, without the written consent of the Owner and the Engineer.
+
+### The Contractor shall not reproduce the Contract Documents beyond the copies the Work requires, and shall not sell, license, or otherwise distribute them.
+
+### The Contractor shall not remove, obscure, or alter a title block, a professional seal, a copyright notice, a confidentiality marking, or an issue date on any document, and shall carry each of them onto every copy and every derivative the Contractor prepares from the document.
+
+### Shop drawings, coordination drawings, fabrication models, and other derivatives the Contractor prepares from the Contract Documents shall be subject to the same license and the same confidentiality obligations as the documents they were derived from.
+
+### The license granted to the Contractor shall be granted on the same terms, and with the same limits, to every lower tier, and shall not extend any further.
+
+### A derivative inherits the obligation because it inherits the content. A fabricator's shop model of the clarifier mechanism contains the clarifier, and an estimating takeoff of the building contains the building, and the license would be hollow if it stopped at the file it was issued in. {note}
+
+## Contractor's Proprietary Content {toc}
+
+### The Contractor may mark as proprietary the pricing, the unit cost breakdowns, the means and methods, and the trade secrets contained in a bid, a proposal, a submittal, or a shop drawing, provided the marking is confined to the content that is in fact proprietary.
+
+### The Owner shall protect content the Contractor has marked proprietary from disclosure to the extent the public records law of the jurisdiction allows, and the Owner's obligation is limited by that law.
+
+### A proprietary marking shall not withhold any content from the review, the inspection, the record, or the audit the Contract Documents require, and content so marked shall be furnished to the Owner, the Engineer, and their consultants for those purposes.
+
+### A marking that covers an entire submittal, or that is applied to content the Contract requires to be reviewed, is a marking the Owner cannot honor under a public records law and the Engineer cannot work around during review, and it is the marking that gets a whole package disclosed because no part of it could be separated. Marking the price breakdown and the proprietary detail, and nothing else, is what a public Owner can defend when a request arrives. {note}
+
+# Classification and Marking of Project Information {toc}
+
+## Classification Scheme {toc}
+
+### Project information shall be classified under the scheme indicated in the datasheet.
+
+```datasheet
+label: Confidentiality Classification Scheme
+type: radio
+options:
+ - Two classes, public and project-confidential
+ - Three classes, public, project-confidential, and security-sensitive
+```
+
+### Two classes suit a building whose drawings reveal nothing an intruder could not learn by walking through it, and they cost the Contractor one rule to follow, since everything that is not public is handled the same way. A third class is what a water, wastewater, power, or industrial Owner needs, because a subset of its drawings describes the control system, the chemicals, and the security features of a facility whose compromise affects the public, and that subset needs a distribution record and a tighter handling rule that would be an unreasonable burden if it applied to every door schedule. A third class without a defined list of what falls in it is the worst of both, since no one can tell which handling rule applies to the drawing in front of them. {note}
+
+### Every document that is not a public document shall be a project-confidential document unless the Owner or the Engineer has marked it security-sensitive.
+
+### Information that is or becomes public through no fault of the Contractor or a lower tier, that the Contractor can show it held before receiving it under the Contract, or that it received from a third party entitled to disclose it, is not a project-confidential document, and a security-sensitive document shall remain security-sensitive regardless of any such disclosure.
+
+### The default class is the one that applies when nobody has thought about the document, and a default of confidential means that a document nobody classified is protected rather than loose. {note}
+
+## Public Documents and the Owner's Status {toc}
+
+### The status of the Owner shall be as indicated in the datasheet.
+
+```datasheet
+label: Owner Status
+type: radio
+options:
+ - Public body subject to a public records law
+ - Private owner
+```
+
+### Bid documents a public Owner has advertised are public documents, and the Contractor's obligations under this standard with respect to them are limited to the license and the use restrictions of the Ownership and License article.
+
+### Where the Owner is a public body, the public records law of the jurisdiction governs what the Owner can withhold from a requester, and the Owner's inability to withhold a document from a requester shall not release the Contractor from its obligations with respect to that document.
+
+### A public Owner cannot make its advertised bid set confidential, and a standard that pretends otherwise is unenforceable on its face and discredits the rest of it. What the public records law decides is what the Owner must hand to a requester, which is a different question from what the Contractor can do with a document it received under a license. The two run in parallel: the Owner discloses what the law requires, and the Contractor still uses the documents only for the Work. {note}
+
+### Where a public records request seeks a document the Contractor has marked proprietary, the Owner shall notify the Contractor before disclosure where the law permits, so that the Contractor can seek the protection the law affords.
+
+## Security-Sensitive Documents {toc}
+
+### Requirements in this article apply where the three-class scheme is indicated in the datasheet.
+
+### The categories of project information classified as security-sensitive shall be as indicated in the datasheet, together with any document the Owner marks.
+
+```datasheet
+label: Security-Sensitive Document Categories
+type: checkbox
+options:
+ - Control system network architecture and addressing
+ - Cybersecurity plans, as-built hardening records, and patch baselines
+ - Account, credential, and user role inventories
+ - Security system drawings for access control, video, and intrusion detection
+ - Chemical storage quantities and locations
+ - Hydraulic, vulnerability, and consequence assessments
+ - Risk and resilience assessments and emergency response plans
+ - Documents the Owner marks as security-sensitive
+constraint: all_of
+```
+
+### The categories are the ones a water, wastewater, power, or industrial Owner protects because each describes a way into the facility or a way to hurt it. The network architecture and the account inventory that [[sync/scada-and-hmi-systems]] requires as submittals and as-builts are a map of the control system. The security system drawings under [[sync/access-control-systems]], [[sync/video-surveillance-systems]], and [[sync/intrusion-detection-systems]] show the camera blind spots and the reader locations. The chemical inventory locates the chlorine. The risk and resilience assessment a community water system prepares under Section 1433 of the Safe Drinking Water Act, and the vulnerability study behind it, list the failure modes in order of consequence. A category left unchecked is handled as project-confidential, which is a defensible choice for a facility where that category reveals nothing. {note}
+
+### The Owner may mark any document security-sensitive by a marking on the document or by a written notice to the Contractor identifying it, and the marking shall take effect on the Contractor's receipt.
+
+### Where the Owner is a federal body or is spending federal funds and so directs in the Contract Documents, security-sensitive documents shall additionally be handled as controlled unclassified information under 32 CFR Part 2002 and as the Contract Documents direct.
+
+### Where the Owner has submitted project information to the Protected Critical Infrastructure Information program under 6 CFR Part 29 and so directs in the Contract Documents, the Contractor shall handle that information as the program requires.
+
+### The federal controlled unclassified information framework sets marking, handling, and system security requirements for information the government or its agents hold, and a federally funded Owner can pass them down to the Contractor by contract. The Protected Critical Infrastructure Information program protects information an owner voluntarily submits about its facility from public disclosure and from use in civil litigation, and a Contractor who receives information so protected is bound by the program's handling rules. Neither framework applies on its own to a private project, which is why each is invoked only where the Contract Documents say so. {note}
+
+## Marking and Handling {toc}
+
+### The Engineer shall mark each security-sensitive document, on every sheet or in the file metadata and on the first page, with the words security-sensitive and the project name.
+
+### The Contractor shall carry every confidentiality marking onto every copy, every extract, and every derivative of a marked document, including a screenshot, a photograph of a screen, and a page inserted into a submittal.
+
+### The Contractor shall store security-sensitive documents, in print and in electronic form, so that only authorized users can reach them, and shall not leave them in a vehicle, at a workstation that is not attended, or on a drive or a device that is not protected by a credential.
+
+### The Contractor shall transmit security-sensitive documents only by a method that restricts receipt to the named recipient, and shall not transmit them by a public link, a shared drive open to the whole organization, or an unencrypted attachment.
+
+### A marking that lives on the cover sheet and not on the page is lost the first time a page is copied, and most leaks are a single page. Marking every sheet costs the Engineer a border stamp and is what lets a recipient three tiers down, who never saw the cover, recognize what it is holding. {note}
+
+# Distribution and Flow-Down {toc}
+
+## Need to Know {toc}
+
+### The Contractor shall distribute project-confidential and security-sensitive documents only to authorized users who need the document to perform a part of the Work, and shall limit each distribution to the sheets, sections, or files that part of the Work requires.
+
+### The Contractor shall not post project-confidential or security-sensitive documents to an open plan room, a public bid listing, a public file-sharing site, or any other location accessible to persons who are not authorized users.
+
+### The Owner's own bid distribution, and a plan room the Owner designates, are permitted distributions of the documents the Owner places there, and the restriction in this article applies to any further posting by the Contractor or a lower tier.
+
+### The Contractor shall withdraw an individual's access to project-confidential and security-sensitive documents, on every system and service, within two business days after the individual leaves the organization or the project.
+
+### Disclosure of a document that a subpoena, a court order, or a law compels is not a breach of this standard, provided the Contractor gives the Owner written notice before the disclosure where the law permits, discloses no more than is compelled, and cooperates with the Owner in seeking any protection the law affords.
+
+### Posting the whole set to a plan room is the fastest way to get subcontractor bids, and it is also how a treatment plant's control system architecture reaches every estimator in the region and every service that indexes plan rooms. A public Owner's bid distribution is public by law and is not the problem; the problem is the second posting, by a bidder, of a set that includes the sheets the Owner withheld from the public set. {note}
+
+## Flow-Down to Lower Tiers {toc}
+
+### The Contractor shall include this standard, by reference and with a copy, in each subcontract and purchase order at the depth indicated in the datasheet, and shall bind each lower tier to the obligations of this standard as if it were the Contractor.
+
+```datasheet
+label: Flow-Down Depth
+type: radio
+options:
+ - Every lower tier at every level
+ - Subcontractors and suppliers that receive project-confidential or security-sensitive documents
+default: Subcontractors and suppliers that receive project-confidential or security-sensitive documents
+```
+
+### Flowing the standard into every subcontract and purchase order, down to the supplier of the anchor bolts, puts the obligation on every party and costs the Contractor a clause in every form it issues. Limiting the flow-down to the tiers that receive confidential or security-sensitive documents keeps a commodity supplier that sees nothing but a purchase order out of it, at the cost of the Contractor deciding, for each lower tier, whether it received such a document, and being wrong when the supplier's representative was handed the drawings at a site meeting. {note}
+
+### The Contractor shall remain responsible to the Owner for the acts and omissions of every lower tier with respect to the project information, whether or not the flow-down was made.
+
+### A lower tier that received a document without the flow-down is the Contractor's breach, not the lower tier's, and the Owner pursues the Contractor. The flow-down is what lets the Contractor pursue the lower tier in turn. {note}
+
+## Distribution Record and Audit {toc}
+
+### The Contractor shall keep a distribution record of every security-sensitive document, listing for each issue the document, the revision, the recipient organization and individual, the date, the medium, and the date of return or destruction.
+
+### The Contractor shall furnish the distribution record to the Owner within seven days after the Owner's written request, and with the certificate of return or destruction at closeout.
+
+### The Owner may audit the Contractor's and any lower tier's compliance with this standard on seven days' written notice, during business hours, and the Contractor shall make its records, its storage, and its personnel available for the audit.
+
+### The record is kept for the day a document surfaces where it does not belong, when the first question is who had it. A record of the security-sensitive set alone is a few pages on most projects, which is the reason the obligation is confined to that set rather than to every drawing. {note}
+
+# Processing on Automated Services {toc}
+
+## Services Covered {toc}
+
+### The definition of an automated processing service is written around what a service does with the document and not around what the service calls itself, because the retention and training terms that matter are found on document management, takeoff, estimating, submittal preparation, scheduling, translation, and review tools as readily as on an assistant tool, and a vendor's choice to market a feature as artificial intelligence changes nothing about where the file goes. A service hosted on the Contractor's own premises and under the Contractor's own control is not an automated processing service for the purpose of this standard, because the document never leaves the Contractor. {note}
+
+### Requirements in this section apply to every automated processing service on which the Contractor or a lower tier processes project-confidential or security-sensitive documents, or any extract or derivative of them.
+
+### Processing of a public document on an automated processing service is not restricted by this section, and the license and use restrictions of the Ownership and License article continue to apply to it.
+
+## Conforming Service Terms {toc}
+
+### The Contractor shall process project-confidential and security-sensitive documents only on a conforming service.
+
+### A conforming service's terms of service, as in force on the date of use, shall grant the provider no right to use the documents, or anything derived from them, for any purpose other than operating, securing, supporting, and improving the service itself, and shall bind the provider not to disclose the documents, or the substance of them, to anyone other than the Contractor's authorized users.
+
+### A conforming service's terms of service shall not permit the provider to use the documents, or anything derived from them, to train, fine-tune, or improve a generative or general-purpose model, whether the provider's own or a third party's, or to build an index or a dataset that is made available to anyone other than the Contractor.
+
+### A conforming service's terms of service shall limit retention of the documents to the period the Contractor's own use requires and shall provide for deletion of them on the Contractor's request, except for backup copies deleted on a stated schedule and copies a processor of the provider keeps for a stated period for security or abuse monitoring, each of which the terms shall disclose.
+
+### A conforming service's terms of service shall restrict access to the documents to the Contractor's authorized users and to provider personnel who need access to operate, secure, support, or improve the service, and shall state that those personnel act under the provider's confidentiality commitment.
+
+### A consumer, free, trial, or personal tier of a service whose terms grant the provider a retention, training, or reuse right that the service's other tiers withhold is not a conforming service, regardless of any setting the user can change within it.
+
+### The Contractor shall process project documents only under an account held in the name of the Contractor's or the lower tier's organization or under that organization's administration, and not under an individual's personal account.
+
+### The Contractor shall verify a service's terms of service before the first project document is processed on it, shall keep a dated record of the terms verified and where they were found, and shall re-verify them whenever the provider changes them.
+
+### The Contractor shall furnish its record of verified terms to the Owner within seven days after the Owner's written request.
+
+### The five conditions are written around the ways a hosted service keeps what it is given, and they are written so that a service a careful engineer would accept can meet them. Every hosted service reads what it is given in order to run, to find out why a result was wrong, and to make the service better, and a condition that forbade that would be met by no service at all and would be ignored; the condition therefore allows the provider's use of the documents for the service itself and forbids every use that carries the documents, or their substance, to anyone else. A training right is the one that puts the design, in generalized form, into a product sold to the Contractor's competitors and to anyone else, and an index or dataset made available to others is the same thing by another route. A retention term is what leaves the file on the provider's servers after the project is over and after the Contractor has certified destruction; a backup that is deleted on a published schedule and a processor's abuse-monitoring copy that is kept for a stated period are the two retentions every hosted service has, and they are acceptable only because the terms say how long they last. An access term is the one that lets provider staff read the documents. A free tier is named because its terms are routinely the ones that grant every right the paid tier withholds, and because a setting a user can toggle is not a term the provider is bound by. The conditions are terms, not a technology, so a service meets them or it does not, and the Contractor can read the answer off the provider's own page. {note}
+
+## Permission and Register {toc}
+
+### The Contractor's permission to process project documents on automated processing services shall be as indicated in the datasheet.
+
+```datasheet
+label: Automated Processing Permission
+type: radio
+options:
+ - Prohibited except on services the Owner has approved in writing
+ - Permitted on conforming services, register furnished on the Owner's request
+ - Permitted on conforming services, register furnished before first use
+```
+
+### The three regimes trade the Owner's visibility against the burden on the Contractor and its lower tiers. Written approval of each service gives the Owner the final say over every tool and is the regime a security-sensitive facility or a federally funded Owner tends to require, at the cost of an approval step for every estimating, scheduling, and review tool on every subcontractor's desk, which a small subcontractor meets by not using the tool or by not asking. Permission on conforming services with a register on request puts the verification on the Contractor and asks the Owner for nothing until it wants to look, which is the lightest regime and leaves the Owner relying on the Contractor's reading of the terms. A register before first use gives the Owner notice of every service without an approval step, so that an objection can be raised before the documents are on it, at the cost of a register that has to be kept current by every lower tier as tools change. The exposure the regime protects against grows with the sensitivity of the documents and shrinks with the share of the set that is public, which is what sets the choice. {note}
+
+### Where written approval is indicated, the Contractor shall submit a description of each service and the record of its verified terms, and shall not process project documents on it until the Owner's written approval is received.
+
+### Where a register is indicated, the register of automated processing services shall list, for each service, the provider, the service name, the tier or plan, the organization and the part of the Work using it, the date the terms were verified, and the date each entry was last updated.
+
+### Where a register before first use is indicated, the Contractor shall furnish the register before the first project document is processed on any service listed in it, and shall furnish each addition before the first use of the added service.
+
+### The Owner may object in writing to a service on the register on the ground that its terms do not conform, and the Contractor shall stop processing project documents on that service within two business days after the objection and shall request deletion of the documents from it.
+
+## Owner-Issued Documents Under Terms of Use {toc}
+
+### Where the Owner or the Engineer issues the Contract Documents through a hosted service under its own terms of use, those terms of use shall apply to the Contractor's access to the documents on that service in addition to this standard.
+
+### Where the terms of use of the issuing service and this standard conflict with respect to a document on that service, the more restrictive requirement shall govern.
+
+### An issuing service's terms govern what a user does on that service: the download, the printing, the sharing of a link. They say nothing about where the downloaded file goes next, which is what this standard governs, and the two have to be read together for the document to be covered from issue to destruction. {note}
+
+# Automated and Generated Content in Deliverables {toc}
+
+## Review and Responsibility {toc}
+
+### The Contractor may use an automated processing service to prepare any part of a submittal, a request for information, a schedule, a report, a record document, or operation and maintenance data, subject to this section.
+
+### Every deliverable containing generated content shall be reviewed, before it is submitted, by a person qualified in the subject of the deliverable, and the person who signs or transmits the deliverable shall be responsible for its content as if that person had written it.
+
+### A deliverable containing generated content shall meet every requirement of the Contract Documents that applies to the deliverable, and the use of an automated processing service shall not excuse an error, an omission, or a nonconformance in it.
+
+### The standard does not care how a submittal was drafted. It cares that someone who knows the subject read it before it went out, and that the signature on it means what a signature has always meant. A product data sheet assembled by a tool and submitted unread is the same submittal, with the same defects, as one assembled by a clerk and submitted unread, and the review of it costs the Engineer the same time either way. {note}
+
+## What Generated Content Is Not {toc}
+
+### Generated content shall not constitute a certification, a test result, an inspection record, a professional opinion, a review action, or an approval, and a document that purports to be one of those shall be prepared, performed, or signed by the person or agency the Contract Documents require for it.
+
+### A delegated-design submittal shall be the sealed work of the licensed engineer responsible for it under [[sync/submittal-and-quality-procedures]], and no automated processing service, and no output of one, shall substitute for that engineer's seal or for the engineering judgment the seal represents.
+
+### A response to a submittal, a request for information, or a claim that the Contractor receives from an automated processing service shall not be treated as the Engineer's or the Owner's response, and only a response transmitted by the Engineer or the Owner under the Contract Documents shall have effect.
+
+### A test result is a measurement someone took. A certification is a statement someone stands behind. A review action is a decision the Engineer made. Each is an act, and a tool that produces text in the shape of one has produced the shape and not the act. The seal on a delegated design is the clearest case, because the law of every state reserves it to a licensed individual who exercised judgment, and no tool holds a license. {note}
+
+## Identification of Generated Content {toc}
+
+### The identification of generated content in the Contractor's deliverables shall be as indicated in the datasheet.
+
+```datasheet
+label: Identification of Generated Content in Deliverables
+type: radio
+options:
+ - Required on each deliverable containing generated content
+ - Not required
+```
+
+### Requiring identification tells the reviewer which parts of a submittal to read for the errors generated content tends to carry, such as a product that does not exist in the stated size or a code citation to a section that says something else, and it gives the Owner a record of how its record documents were produced. It costs the Contractor a statement on each deliverable and a decision about where the line sits between a tool that drafted a paragraph and a tool that checked spelling. Not requiring it treats the deliverable on its content alone, which is the position that the responsibility rule above already produces, and it leaves the reviewer to find the errors without a flag. {note}
+
+### Where identification is required, the Contractor shall state on the transmittal, or on the first page of the deliverable, that the deliverable contains generated content, the parts of it that do, and the name of the qualified person who reviewed it.
+
+# Photographs, Publicity, and Public Statements {toc}
+
+## Consent to Publish {toc}
+
+### The Contractor shall not publish, and shall not permit a lower tier to publish, a photograph, a video, drone imagery, a rendering, or a description of the Work or of the facility, in any medium including a website, a social media account, a press release, an advertisement, a proposal to another client, or an award submission, without the Owner's written consent given in the form indicated in the datasheet.
+
+```datasheet
+label: Publicity Consent
+type: radio
+options:
+ - The Owner's written consent for each item published
+ - A one-time written consent for a publicity program the Contractor describes
+```
+
+### Consent for each item gives the Owner a look at every photograph before it is posted, which a security-sensitive facility and a public body answering to its board both tend to want, at the cost of an approval cycle for every post, which a Contractor's marketing staff meets by not posting or by posting without asking. A one-time consent for a described program, such as a stated set of exterior progress photographs and a completion announcement, lets the Contractor plan its publicity and lets the Owner set the limits once, at the cost of a description precise enough that both parties know what falls outside it. {note}
+
+### The Contractor shall not name the Owner, the project, or the facility in a press release, an award submission, a client list, or a public statement without the Owner's written consent, except as the Contract Documents require for a permit, a notice, or a public filing.
+
+### Photographs, video, and imagery that show a security feature, a control room, an operator workstation, a network or server cabinet, a chemical storage or feed area, or a credential reader are security-sensitive documents and shall be handled as this standard requires for that class, whatever the purpose for which they were taken.
+
+### The progress photograph program, the format and frequency of the photographs, and the ownership of and access to them are governed by [[sync/construction-progress-documentation]] and settled in the Contract. This standard governs only whether and on what consent any of that documentation leaves the project. A photograph of a finished clearwell is a marketing asset to the Contractor and, to the Owner, a picture of a hatch, and the consent is what lets the Owner have the one without the other. {note}
+
+### A request for consent shall identify the item to be published, the medium, and the date, and the Owner's consent or refusal shall be given in writing within fourteen days after the request, failing which the Contractor may resubmit the request to the Owner's designated representative.
+
+### The Owner's consent to publish shall not transfer any right in the instruments of service, and a published photograph or rendering shall credit the Engineer where the Owner's consent so requires.
+
+# Loss and Unauthorized Disclosure {toc}
+
+## Notice {toc}
+
+### The Contractor shall give written notice to the Owner and the Engineer, within the time indicated in the datasheet after discovering it, of any loss of a project-confidential or security-sensitive document, any disclosure of one to a person who is not an authorized user, any processing of one on a service that is not a conforming service, and any publication without the consent this standard requires.
+
+```datasheet
+label: Breach Notice Period
+type: range
+unit: hours
+options:
+ min: 12
+ max: 120
+ setpoints: [12, 24, 48, 72, 120]
+constraint: max
+```
+
+### A short notice period lets the Owner change a credential, re-key a door, or withdraw a document before it is used, and it is what a security-sensitive facility needs, at the cost of a notice that is given before the Contractor knows the extent of what was lost. A longer period gives the Contractor time to find out what happened and report it once, at the cost of a lost document that is loose for that long. The period is measured from discovery and not from the event, since the Contractor cannot report what it does not know, and discovery by a lower tier is discovery by the Contractor. {note}
+
+### The notice shall identify the documents involved, the classification of each, the date and the circumstances of the loss, the disclosure, or the upload, the persons and the services that received the documents, and the steps the Contractor has taken.
+
+### Discovery by a lower tier shall be discovery by the Contractor for the purpose of the notice period, and the Contractor shall require each lower tier to report to it on discovery.
+
+## Remediation and Remedies {toc}
+
+### The Contractor shall, at its own cost, remediate a loss, an unauthorized disclosure, or a non-conforming upload, including requesting and confirming deletion from every service and recipient, cooperating with the Owner's replacement of any credential, key, or configuration the disclosure compromised, and bearing the cost of re-issuing documents the Owner or the Engineer determines are compromised.
+
+### The Contractor shall furnish the Owner, within fourteen days after the notice, a written account of the remediation taken and the confirmation of deletion received from each service and recipient.
+
+### The remedies of the Owner and the Engineer under the Agreement, the General Conditions, and the law are preserved, and compliance with the notice and remediation requirements of this standard shall not of itself release the Contractor from liability for the loss or the disclosure.
+
+### The cost a disclosure imposes on the Owner is often not the document but what has to change because of it: the credentials in a leaked account inventory, the lock cores on a leaked key schedule. The standard assigns those costs to the party whose breach caused them, and leaves the larger question of damages to the Agreement, which is where it belongs. {note}
+
+# Return or Destruction at Closeout {toc}
+
+## Disposition {toc}
+
+### At closeout, and at any earlier time the Owner requests following termination or suspension of the Contract, the Contractor and every lower tier shall dispose of the project-confidential and security-sensitive documents in their possession, including every copy on every automated processing service, as indicated in the datasheet.
+
+```datasheet
+label: Disposition of Confidential Documents at Closeout
+type: radio
+options:
+ - Return to the Owner
+ - Destroy and certify
+ - Destroy and certify, retaining one archival record copy
+```
+
+### Return suits print documents and a security-sensitive set small enough to count, and it gives the Owner the copies back rather than a promise about them, at the cost of being meaningless for an electronic file that has been copied. Destruction with a certificate is the disposition that reaches every copy, including the ones on services, at the cost of resting on the Contractor's certificate. Destruction with one archival copy recognizes that a Contractor facing a warranty claim or a lawsuit years later needs its own record of what it was told to build, and it is the disposition a Contractor's counsel asks for, at the cost of one complete set remaining outside the Owner's control for the retention period under the obligations of this standard. {note}
+
+### Where an archival record copy is permitted, the Contractor shall retain it for the period indicated in the datasheet after final completion, in a single location under the Contractor's own control and not on an automated processing service, and shall destroy it and certify the destruction at the end of that period.
+
+```datasheet
+label: Archival Record Copy Retention Period
+type: range
+unit: years
+options:
+ min: 1
+ max: 15
+ setpoints: [1, 2, 3, 5, 7, 10, 15]
+constraint: exact
+```
+
+### The retention period is set against the correction period and the special warranty terms under [[sync/warranties-and-bonds]] and against the statute of limitations and the statute of repose for construction claims in the jurisdiction, which is what the archival copy is kept to defend. A period that ends before the repose period runs leaves the Contractor without its record for a claim it can still face, and a period that runs long past it keeps a complete copy of the facility's design in a filing cabinet for no reason the Contractor can state. {note}
+
+### Destruction of an electronic document shall render it unrecoverable by ordinary means, and the Contractor shall request deletion from every automated processing service on which the document was processed and shall obtain and keep the provider's confirmation.
+
+### The Contractor shall not retain, and shall not permit a lower tier to retain, any copy of a security-sensitive document after closeout, other than the archival record copy where one is permitted.
+
+### A bidder or proposer that is not awarded the Contract, and a lower tier whose bid to the Contractor is not accepted, shall dispose of every project-confidential and security-sensitive document it received, by the disposition indicated in the datasheet and without an archival record copy, within thirty days after the award, and shall certify the disposition on the Owner's request.
+
+### The bidders who did not win are the largest group that ever held the documents and the one no contract reaches, since the only instrument between them and the Owner is the Instructions to Bidders. Stating their obligation here, where the bid set carries it, is what lets the Owner ask for the certificate. {note}
+
+## Certificate and Survival {toc}
+
+### The Contractor shall deliver with the closeout submittals a certificate of return or destruction, signed by an officer of the Contractor and by each lower tier that held project-confidential or security-sensitive documents, stating the disposition made, the date, the services from which deletion was requested and confirmed, and the archival record copy retained, if any.
+
+### The Owner may withhold final payment under [[sync/closeout-procedures]] until the certificate has been received and accepted.
+
+### The obligations of this standard shall survive final payment, final completion, and the termination of the Contract, and shall continue for as long as the Contractor or any lower tier holds any project-confidential or security-sensitive document or any copy of one.
+
+### The confidentiality obligation has to outlast the Contract because the document does. The Contract ends at final payment, the archival copy is in the cabinet for a decade after it, and the copy on a service that was never asked to delete it is there until the provider's own retention policy removes it. Survival is what keeps the obligation attached to the copies that remain. {note}
+
+# Coordination with the Agreement and Other Standards {toc}
+
+## The Contractor shall reconcile the confidentiality, ownership, and publicity requirements of the Agreement, the General Conditions, and each technical standard with this standard, and shall report in writing, before the first project information beyond the bid documents is issued to it, any conflict between them.
+
+## Where a technical standard and this standard address the same subject, the more stringent requirement shall govern unless the Contract Documents direct otherwise.
+
+## A technical standard that requires a submittal in a security-sensitive category, such as the control system architecture or the account inventory, shall be read as requiring that submittal under the handling rules of this standard.
+
+## The Contractor shall bring this standard to the attention of each bidder, proposer, and lower tier at the time it first receives project information, and shall not rely on the project manual alone to give notice of it.
+
+## The technical standards go on requiring the architecture drawings, the cybersecurity plans, and the key schedules they have always required, because the Engineer needs them to review the Work. This standard changes nothing about what is submitted and everything about who else gets to read it. {note}