12 DD254 Shock Engineering Reviews.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

OPNAVINST N9210.3

7 Jun 2010

SAFEGUARDING OF NAVAL NUCLEAR

PROPULSION INFORMATION (NNPI)

UNCLASSIFIED PORTION (OMITS TABLE 2)

RECORD OF CHANGES

IDENTIFICATION

OF CORRECTION

OR CHANGE

DATE OF CHANGE DATE OF ENTRY ENTERED BY

DEPARTMENT OF THE NAVY

OFFICE OF THE CHIEF OF NAVAL OPERATIONS

2000 NAVY PENTAGON

WASHINGTON, DC 20350-2000

OPNAVINST N9210.3

N00N 7 Jun 2010

OPNAV INSTRUCTION N9210.3

From: Chief of Naval Operations

Subj: SAFEGUARDING OF NAVAL NUCLEAR PROPULSION INFORMATION

1. Purpose. This instruction defines naval nuclear propulsion information (NNPI) and establishes the safeguarding policies and requirements for such information.

2. Cancellation. NAVSEAINST 5511.32C.

3. Applicability and Scope

a. The provisions of this instruction are applicable to all equipment, components, systems, documents, drawings, information technology (IT) media, audiovisual media, and any other media or items containing classified or unclassified NNPI.

b. This instruction applies to all Navy commands and to all military and civilian personnel assigned to or employed by any element of the Navy that handles or processes classified or unclassified NNPI. This includes cleared contractor visitors working under the purview of a commanding officer (CO).

Personnel are individually responsible for compliance.

c. This instruction applies to all Navy activities, organizations, and contractors who: (1) use Navy information systems that receive, process, store, display, or transmit classified or unclassified NNPI; or (2) operate systems on behalf of the Navy or own facilities or systems that process classified or unclassified NNPI associated with Navy contracts.

4. Background. The policies and requirements previously set forth in NAVSEAINST 5511.32C have been updated and restructured into this instruction, which should be reviewed in its entirety.

5. Implementation

a. Navy activities that handle or processes NNPI shall advise Director, Naval Nuclear Propulsion Program (CNO (N00N)) within 60 days of the date of this letter of any reason preventing implementation of this instruction and the date by which all provisions of this instruction will be met.

b. Supervisors of Shipbuilding, Conversion, and Repair (SUPSHIPs) should issue a field modification request to private shipyards to incorporate this instruction into existing contracts and into the VIRGINIA-class master index of reference documents whenever possible at no increase in contract price or delay in delivery. If implementing this instruction will increase the price of or delay delivery under any contract, then this instruction should not be implemented without authorization from CNO (N00N). In such cases, the respective SUPSHIP should obtain a fully priced proposal to implement this instruction on existing contracts. CNO (N00N) should be advised within 60 days of the date of this instruction whether this instruction has been implemented, and if not, a date by which implementation will be completed.

6. Action. Navy activities shall implement the guidance contained herein and all associated references. All Navy activities handling/processing NNPI or otherwise involved in the safeguarding of NNPI shall budget for, fund, and execute the actions necessary to comply with this instruction and the publications that support it.

7. Administration and maintenance. CNO (N00N) shall ensure implementation of the provisions of this instruction, grant any exceptions needed, and address inquiries concerning the requirements contained herein. CNO (N00N) may also provide direction and guidance under its other organizational designations of “Naval Sea Systems Command” or “Naval Reactors.”

8. Records Management. Records created as a result of this instruction, regardless of media and format, shall be managed per Secretary of the Navy (SECNAV) Manual (M-)5210.1 of November 2007.

9. Forms

a. OPNAV 9210/1 IT Checklist for NNPI can be obtained from Naval Forms Online at <http://navalforms.daps.dla.mil>.

b. DD 254 DoD Contract Security Classification Specification can be obtained from the DoD Forms Web site at <http://www.dtic.mil/whs/directives/infomgt/forms/formsprogram.htm>.

K. H. DONALD

Director, Naval Nuclear Propulsion Program

Distribution: Electronic only

Department of the Navy Issuances Web site - Unclassified portion (omits table 2): <http://doni.daps.dla.mil>

Secret Internet protocol router network (SIPRNET) Department of the Navy Classified Issuances Web site - Complete instruction:

<http://hqweb.cno.navy.smil.mil/donci> http://doni.daps.dla.mil/ i

TABLE OF CONTENTS

IDENTIFICATION

TITLE

PAGE

CHAPTER 1

DEFINITION

1-1

1. Definition 1-1

2. Guidance 1-1

3. NNPI Determination 1-1

4. Classification/Handling Control

Determination 1-2

5. Information on Supporting Technologies 1-3

CHAPTER 2

MARKING

2-1

1. General 2-1

2. NNPI Control Officer (NNPICO) 2-1

3. Prospective Marking Requirement 2-1

4. Markings and Distribution Statements 2-2

5. Paragraph and Portion Markings 2-2

6. Photographs and Audiovisual Material 2-2 7.

IT Media, Equipment, and Electronic Display 2-2

CHAPTER 3

CONTROL AND STORAGE

3-1

1. General 3-1

2. Transmittal 3-1

3. Offsite Handling 3-1

4. Facility Visits 3-1 5.

CHAPTER 4

Electronic Processing 3-1

DISCLOSURE POLICY

4-1

1. General 4-1

2. Foreign Disclosure 4-1

3. Dual Citizenship 4-1

4. U.S. Executive Branch Personnel 4-1

5. Outside the U.S. Government 4-1

6. Judicial or Administrative Proceedings 4-1

7. Contractors and Subcontractors 4-2 8.

Unauthorized Release

4-2 ii

TABLE OF CONTENTS (CONT’D)

CHAPTER 5

PUBLIC RELEASE

5-1

1. General 5-1

2. Documents Containing NNPI 5-1 3.

Environmental and Occupational Safety and Health Information

CHAPTER 6

DISPOSAL

6-1

1. Documents 6-1

2. Components and Equipment 6-1

IT Media and Equipment 6-2

CHAPTER 7

CONTRACTORS AND SUBCONTRACTORS

7-1

1. General 7-1

2. Contracted Goods and Services 7-1

3. Prospective Contractor 7-1

4. Classified NNPI 7-1 5.

NN-801, NN-802, NN-817 7-1

CHAPTER 8

FACILITY VISITS

8-1

1. General 8-1

2. U.S. Citizens and U.S. Nationals 8-1

Foreign Nationals or Representatives of a Foreign Interest

CHAPTER 9

INFORMATION TECHNOLOGY (IT) POLICY

9-1

1. General 9-1

2. Requirements 9-1

3. Restrictions 9-2

4. Audit and Review 9-2

5. Deviations 9-3 6.

Contact 9-3 iii

CHAPTER 10

IT RESPONSIBILITIES

10-1

1. General 10-1

2. Information Owner 10-1

3. DAA 10-1

4. Certification Authority (CA) 10-3

5. Program Manager 10-3

6. Commanding Officer/Officer in Charge

(CO/OIC)

10-4

7. Information Assurance Manager (IAM) 10-4

8. Security Officer 10-5 9.

CHAPTER 11

Users 10-5

INFORMATION SYSTEMS

11-1

1. General 11-1

2. PIT 11-1

3. Information Systems 11-2

4. User Authorization 11-5

5. Transport 11-5 6.

Deviations 11-6

CHAPTER 12 TELECOMMUNICATION SYSTEMS 12-1

1. General 12-1

2. Telecommunication Systems 12-1

3. Transport 12-3 4.

CHAPTER 13

Deviations 12-4

OTHER ELECTRONICS 13-1

1. General 13-1

2. Other Electronics 13-1

3. Transport 13-2

Deviations 13-2 iv

APPENDIX A

REFERENCES A-1

APPENDIX B

NAVAL NUCLEAR PROPULSION INFORMATION

OVERVIEW

B-1

1. General B-1

2. Definition B-1

3. Classified NNPI B-1

U-NNPI B-2

APPENDIX C

SAMPLE SECURITY AGREEMENT FOR PROTECTION OF

U-NNPI

C-1

1. Purpose C-1 2.

Specific Requirements for Protecting U-NNPI C-1

APPENDIX D

ACRONYMS AND DEFINITIONS D-1

1. Acronyms D-1

Terms Defined D-2

TABLE 1

ACCESS REQUIREMENTS SUMMARY T1-1

TABLE 2

SYSTEMS AND COMPONENTS (PLACEHOLDER) T2-1

1. General (placeholder version) T2-1

Systems and Components T2-1

TABLE 3

IT CONTROL REQUIREMENTS FOR NNPI T3-1

1. Access Control T3-1

2. Awareness and Training T3-1

3. Audit and Accountability T3-1

4. Certification, Accreditation, and Security

Assessments T3-1

5. Configuration Management T3-2

6. Contingency Planning T3-2

7. Identification and Authentication T3-2

8. Incident Response T3-2

9. Maintenance T3-3

10. Media Protection T3-3 v

TABLE 3 (CONT’D)

IT CONTROL REQUIREMENTS FOR NNPI (CONT’D)

11. Physical and Environmental Protection T3-3

12. Planning T3-4

13. Personnel Security T3-4

14. Risk Assessment T3-4

15. System and Services Acquisition T3-4

16. System and Communications Protection T3-4

17. System and Information Integrity T3-5

18. U-NNPI Specifications (U-NNPI Systems Only) T3-5

19. Classified NNPI Specifications

(Classified NNPI Systems Only) T3-6

EXHIBITS

1. ACCESS REQUIREMENTS SUMMARY

2. COMPONENT LEVEL DETERMINATION FLOWCHART

3. MARKING REQUIREMENTS AND DISTRIBUTION

WARNING STATEMENTS

4. SAMPLE OF NOFORN MARKINGS

5. SAMPLE OF CRD MARKINGS

6. SAMPLE OF CNSI MARKINGS

7. FILE, EMAIL, APPLICATION/WEBPAGE CONTENT,

AND OTHER IT MARKING REQUIREMENTS

1-1

CHAPTER 1

DEFINITION

1. Definition. NNPI is classified or unclassified information concerning the design, arrangement, development, manufacture, testing, operation, administration, training, maintenance, and repair of the propulsion plants of naval nuclear-powered ships and prototypes, including the associated shipboard and shore-based nuclear support facilities.

2. Guidance

a. Table 1 and exhibit 1 discuss the different classification levels/handling controls for NNPI.

b. Table 2 identifies those specific systems and components associated with naval nuclear propulsion plants and the nuclear support facilities.

3. NNPI Determination

a. NNPI shall be safeguarded to prevent its disclosure to the public and others without the appropriate clearance (for classified NNPI) and a need-to-know (NTK). This section describes the process for identifying if an item is NNPI.

b. Whenever a sentence, paragraph, document, file, photograph, audiovisual or electronic/IT media, or component contains, or otherwise reveals, at least one instance of an association of the following three elements, it is NNPI:

(1) A naval nuclear propulsion plant or support facility application is directly referred to by any of the following:

(a) Ship name or hull number.

(b) Project designator.

(c) Ship system identification.

(d) Component nameplate data.

(e) Component name revealing a reactor plant function.

1-2

(2) A system or component listed in table 2.

(3) Details on technical parameters or operational conditions (e.g., design temperature or pressure).

c. Items or information specifically identified by CNO (N00N) as NNPI shall be marked and handled as such.

d. For systems listed in table 2 that have an asterisk [*] in the category column, the information on components, equipment, and subsystems installed in these systems may also be NNPI. An instance of the association of such information with both the elements in subparagraphs 3b(1) and 3b(3) above is NNPI unless one of the following applies for the component/equipment/ subsystem (Note: the exhibit 2 flow chart may assist with evaluation):

(1) It is available “commercial off-the-shelf.”

(2) It is an individual piece part (fastener, handwheel, gasket, packing, valve stem, etc.) or electrical part (resistors, capacitors, semiconductors, switches, relays, contactors, etc.). This includes piece parts whose label plates list system designations (e.g., valve or component system numbers) or manufacturers’ general component information plates.

This applies to individual piece parts even if the component assembled from them is a classified or sensitive reactor plant component.

(3) It is military-qualified and used in (or is technically equivalent to a military-qualified component used

in) Navy applications other than naval nuclear applications (ship system valves, circuit boards, circuit breakers, controllers, etc.).

(4) It meets other exemption criteria as determined by

CNO (N00N).

4. Classification/Handling Control Determination. If the subparagraphs 3b through 3d evaluation identifies information as NNPI, the classifications of Confidential Restricted Data (CRD), Confidential National Security Information (CNSI), or another classified marking or handling control is determined by requirements set forth in references (a) and (b). Reference (a)

1-3 also includes guidance for the determination of unclassified naval nuclear propulsion information (U-NNPI), unclassified controlled nuclear information (UCNI), or unrestricted unclassified information. If the subparagraphs 3b through 3d evaluation identifies information as NNPI, but classification or handling controls are not otherwise prescribed per references

(a) and (b), then the item shall be marked and handled as

U-NNPI.

5. Information on Supporting Technologies. Technology (including basic research, test data, evaluation methods, and behavior models) developed to support applications unique to the Naval Nuclear Propulsion Program (NNPP), whether the information is NNPI or not, should be considered proprietary information not releasable to the public until determined otherwise by

CNO (N00N).

2-1

CHAPTER 2

MARKING

1. General. Chapter 2 establishes marking requirements for NNPI. Special handling and disclosure restrictions for NNPI have been in effect since the NNPP’s inception. Prior to 1986, the large majority of unclassified documents were not marked with special warning notices. With the enactment of Federal statutes mandating protective measures for a range of sensitive military technology, including NNPI, marking became necessary.

Whoever possesses NNPI must comply with the disclosure restrictions set forth in this instruction, whether or not the documents, media, or equipment containing NNPI are marked with a warning notice.

2. NNPI Control Officer (NNPICO). Each activity that routinely deals with NNPI shall designate a manager familiar with NNPI protection procedures as NNPICO. Each activity will ensure that this manager is technically qualified or a technically qualified individual is available for consultation with the NNPICO as needed. It shall be this manager's responsibility to ensure that appropriate measures are established and enforced to control, and to prevent unauthorized access to or dissemination of, NNPI per this instruction. This individual will be given written authorization by the cognizant Government office/CO to determine if documents are correctly marked as NNPI (without review by CNO (N00N)).

3. Prospective Marking Requirement. All documents containing NNPI issued subsequent to the date of this instruction shall be marked following this instruction. Applicable local instructions should address requirements for marking of electronic documents, including email. Documents marked per past versions of this instruction do not require any modification. When portions of unmarked documents are revised or replaced, those portions and the cover, index, and distribution pages shall be marked following this instruction.

When an unmarked document is reissued in its entirety, all pages shall be marked per this instruction. An older, unmarked document containing U-NNPI need not be marked if it is simply being copied for internal use and not for reissuance. Before offsite release of unmarked documents, they shall be marked and handled per this instruction.

2-2

4. Markings and Distribution Statements. References (a) and

(b) contain classification and downgrading or declassification markings for classified NNPI. Exhibit 3 summarizes the marking and distribution statement requirements for NNPI. Exhibits 4, 5, and 6 provide sample NNPI documents with the appropriate markings and distribution warning statements for Not Releasable to Foreign Nationals (NOFORN), CRD, and CNSI, respectively.

5. Paragraph and Portion Markings. Paragraph or portion markings are not required for NNPI.

6. Photographs and Audiovisual Material. Photographs and audiovisual material will be marked consistent with the classification of the information therein. Photographs of naval nuclear-powered ships or nuclear support facilities shall be handled per reference (c). Audiovisual material containing NNPI shall be marked on the cover and case of each item, and at the beginning and end of each tape or reel.

7. IT Media, Equipment, and Electronic Display. IT media, equipment, and electronic display must be marked to identify the highest level of NNPI authorized. Per the Department of Defense (DoD) classification color scheme, the background color for IT media and equipment labels for classified NNPI should be red for SECRET, blue for CONFIDENTIAL, and green for U-NNPI. The foreground color for IT media and equipment labels should be white. The similar color scheme used for electronic display is discussed in subparagraph 7c.

a. IT media

(1) Classified NNPI IT media shall be marked by a pen/ marker or using a media label with the appropriate classification level and shall include the proper distribution warning statement(s) from exhibit 3, where space permits.

(2) U-NNPI IT media shall be marked “NOFORN (U-NNPI)” either with an indelible pen or with a media label and shall include the NOFORN distribution warning statement from exhibit 3, where space permits.

(3) In those cases where the size or type of media does permit the use of classification/NOFORN (U-NNPI) markings, the

2-3 media shall be placed in a container marked with the appropriate level (including the appropriate distribution warning statement(s) from exhibit 3).

b. IT equipment. User-accessible NNPI IT equipment--such as printers, multifunction devices, desktops, laptops, mobile devices, and external hard drives--shall be labeled. NNPI hard drives, regardless of whether they are internal or external, shall be labeled. Activities should consider operational security when labeling portable user IT devices to avoid drawing attention to the device as a target for theft. For monitors and other display equipment with only volatile memory--a title bar, as discussed in subparagraph 7c below, may be used in place of a label.

(1) U-NNPI IT equipment.

(a) U-NNPI IT equipment shall be labeled “NOFORN (U-NNPI)” or “Approved up to Unclassified NNPI.” The label should include the NOFORN distribution warning statement from exhibit 3, where space permits.

(b) IT equipment used to print U-NNPI (e.g.

printers, facsimile (fax) machines, copiers, multifunction devices) shall also have a label, sign, or notice, including the appropriate user notice statement from exhibit 7. The label, sign, or notice shall be positioned on or near the IT equipment so as to be clearly visible to a user of the IT equipment.

(2) Classified NNPI IT equipment.

(a) Classified NNPI IT equipment shall have a label that identifies the highest classification authorized for the equipment. For CONFIDENTIAL- and SECRET-level IT equipment, the label shall include the proper distribution warning statement(s) from exhibit 3, where space permits.

(b) Classified NNPI IT equipment used to print NNPI (e.g., printers, fax machines, copiers, multifunction devices) shall also have a label, sign, or notice including the appropriate user notice statement from exhibit 7. The label, sign, or notice shall be positioned on or near the IT equipment so as to be clearly visible to a user of the IT equipment.

2-4

c. Electronic display

(1) Required markings for the electronic display of NNPI files, emails, application/Webpage content, and other IT elements are specified in exhibit 7. Note: Printed files, emails, and application/Webpage content shall adhere to requirements for marking hard copy NNPI documents per this chapter and exhibit 3.

(2) Monitors and display equipment used for NNPI-authorized IT equipment shall have a title bar on the screen identifying authorization for NNPI.

(a) This title bar must be continuously visible during use of the monitor with an NNPI-authorized IT system or piece of equipment, must be located at the top of the screen of a monitor, and include the appropriate user notice statement for NNPI from exhibit 7.

(b) The background color of the title bar should follow the DoD color scheme and set for the highest level of information authorized: red for up to SECRET, blue for up to CONFIDENTIAL, and green for up to U-NNPI. The foreground color for the text of the title bar should be white.

(c) Mobile devices approved for NNPI shall have the appropriate title bar to the maximum extent practical.

3-1

CHAPTER 3

CONTROL AND STORAGE

1. General. Classified NNPI shall be controlled per reference (b). U-NNPI shall be controlled so that those without an NTK cannot obtain visual or physical access that would permit detailed examination. U-NNPI documents are the custody of the authorized individual using them. This individual must prevent detailed visual or physical access by those who do not have an NTK. Whenever unauthorized personnel could gain access to U-NNPI, it should be locked up (e.g., key lock).

2. Transmittal. Classified NNPI will be transmitted per reference (b). Documents containing U-NNPI shall be transmitted in a single opaque envelope or wrapping, as a minimum. The envelope or wrapping shall not be marked so as to reveal its contents to unauthorized personnel.

3. Offsite Handling. U-NNPI may be taken offsite, subject to local controls approved by the cognizant Government office, which shall ensure that the U-NNPI is protected under the disclosure requirements of this instruction and that the U-NNPI is promptly returned when no longer needed offsite.

4. Facility Visits. Requirements for visits to naval and commercial facilities performing naval nuclear propulsion work are addressed in chapter 8. Additional guidance may also be found in reference (d).

5. Electronic Processing. Protection requirements for NNPI on IT systems, which for this instruction include telecommunication systems and other electronic equipment, are addressed in chapters 9 through 13. The protection requirements for IT media containing NNPI are addressed in chapters 2, 6, 9 and table 3.

4-1

CHAPTER 4

DISCLOSURE POLICY

1. General. Access to classified NNPI shall be limited only to those individuals with an NTK and an appropriate security clearance. For classified NNPI that is also restricted data (RD), a final Government clearance is required for access.

Access to U-NNPI requires an NTK (as determined by local cognizant authority) for the performance of assigned work. CNO (N00N) must approve in writing any exception to this policy.

Any changes in access policy from past actions should be identified to CNO (N00N). Additional specific disclosure policies are discussed below.

2. Foreign Disclosure. Reference (e) prohibits release of NNPI to foreign nationals or representatives of foreign interests except as made pursuant to an approved government-to-government agreement. Furthermore, releases to be made under such an agreement require approval from the Chief of Naval Operations (CNO) in each instance.

3. Dual Citizenship. All those with dual citizenship having a need to access U-NNPI must be reported to CNO (N00N) before such access is granted.

4. U.S. Executive Branch Personnel. Disclosure of NNPI to personnel in the executive branch of the U.S. Government, except for those involved in the NNPP, requires the approval of CNO (N00N) in each instance. The fact that an individual is employed by a U.S. Government activity does not in itself justify release of NNPI to that individual.

5. Outside the U.S. Government. Disclosure of NNPI outside the U.S. Government, including U.S. industry, private individuals, or other interests, except when required in the performance of NNPP tasks, requires CNO (N00N) approval in each instance.

6. Judicial or Administrative Proceedings. When access to NNPI is solicited as part of a judicial or administrative proceeding, CNO (N00N) shall be apprised via Naval Sea System Command (NAVSEASYSCOM) Office of Counsel (00L) to ensure that proper protective mechanisms are put in place to prevent unauthorized disclosure. These mechanisms may include formal protective orders or legal filings, and may result in denial of access.

4-2

7. Contractors and Subcontractors. These requirements are addressed in chapter 7.

8. Unauthorized Release. Any release of NNPI in violation of the disclosure policy outlined in this chapter shall be reported to CNO (N00N).

CHAPTER 5

PUBLIC RELEASE

1. General. NNPI shall not be disclosed in any manner that may result in direct or indirect release to the public. No public comment should be made that would confirm or deny whether NNPI has been inadvertently released to the public. Information released to the public is considered foreign disclosure. Any proposed public release that might contain NNPI must be submitted to CNO (N00N) via NAVSEASYSCOM Corporate Communications (00D) per reference (c). CNO (N00N) will authorize release of the information once it has been determined that it contains no NNPI.

2. Documents Containing NNPI. Use of NNPI in documents that are planned for release to the public is prohibited. The NNPI content shall be issued in a separate supplemental document to maintain control of NNPI. Also, references to documents containing NNPI in journals and other publications available to foreign governments or to the public should be avoided.

3. Environmental and Occupational Safety and Health (OSH) Information. Neither environmental information nor OSH information is NNPI unless presented in such a way that it reveals information concerning the design, arrangement, development, manufacture, testing, operation, administration, training, maintenance, and repair of the propulsion plants of naval nuclear-powered ships and prototypes, including the associated shipboard and shore-based nuclear support facilities.

To the maximum extent practical, individuals should not include NNPI in documents that pertain to environmental or OSH matters since such documents are more likely to require public release.

6-1

CHAPTER 6

DISPOSAL

1. Documents

a. Disposal. NNPI documents shall be disposed as classified material.

b. Recycling of U-NNPI Documents. Recycling is authorized for U-NNPI documents provided that the documents are shredded to 1/2 inch width or less and that the shredded material is controlled in collection and transport to the recycler and controlled throughout the recycling process until such point in their processing that the U-NNPI documents are irretrievable.

c. Alternative Disposal or Recycling Methods. Alternative disposal or recycling methods (e.g. commercial or public trash collection arrangements) must be approved by CNO (N00N).

2. Components and Equipment

a. Before disposal of components or equipment that reveal NNPI, all markings (e.g., stock number, nameplate data, special material identification code (SMIC), tags, stickers, transfer documents, and meter face markings) associating the equipment or component with a nuclear propulsion plant application must be removed or obliterated. If after removal or obliteration of such markings the equipment or component would still reveal NNPI, the item shall be disposed of in the same manner as classified material.

b. In view of stringent controls for the disposal of radio-active waste, and in order to minimize radiological work, nuclear propulsion plant components or equipment to be disposed of as radioactive waste need not have markings removed or obliterated.

c. Unless specifically authorized by a ship alteration or other NAVSEASYSCOM correspondence, reactor plant components assigned 2S cognizance, SMIC X1 national stock numbers, shall not be disposed of unless first sent, per reference (f), to a designated naval shipyard for disposition by CNO (N00N). When

6-2

CNO (N00N) desires to dispose of such a component, a formal scrap directive will be provided to the naval shipyard awaiting disposition.

d. CNO (N00N Resource Management Division (H)) cognizance-, Naval Inventory Control Point (NAVICP)-managed SMIC X2, X3, X4, X5 or X6 material will be sent to NAVICP DOE Naval Reactors Material Office (Code 009) for disposal as directed by the NAVICP item manager. NAVICP (Code 009) will dispose of this material following NAVICP Naval Reactors Supply Chain Management Directorate (Code 87) instructions. However, selected CNO (N00N-H) cognizance SMIC X3 material items (e.g., resistors, capacitors, and handtools), which are not procured to nuclear-unique specifications, and other items designated by CNO (N00N) may be disposed of locally as directed by NAVICP (Code 87).

Further, NAVICP-managed, CNO (N00N-H) cognizance SMIC X2 chemicals and other SMIC X2 materials may be disposed by naval shipyards, as directed by NAVICP (Code 87).

e. Disposition of unused, but no longer required, reactor plant equipment and components provided by CNO (N00N) prime contractors as Government-furnished equipment shall be per this instruction, reference (f), and specific guidance obtained from the NAVSEASYSCOM technical representative or assistant NAVSEASYSCOM technical representative at the applicable prime contractor.

f. Disposal of shipyard facilities, support systems, and equipment used in reactor plant work shall meet the criteria for disposal in subparagraphs 2a and 2b of this chapter.

3. Disposal of IT Equipment and Media. Special handling is required for disposal of IT equipment and media that contain NNPI. All non-volatile user-addressable memory materials must be removed from computing equipment ever used to process NNPI.

This includes, but is not limited to, computer hard drive platters; removable media such as floppy disks, digital video disks (DVDs), compact disks (CDs), universal serial bus (USB) thumb-drives, and solid-state memory or hard drives; and programmable read-only memory (PROM) (including electronic storage devices embedded in multifunction equipment, such as copiers or printers). Note: this also applies to such materials involved in the unauthorized disclosures, spill, or inadvertent disclosure of NNPI.

6-3

a. U-NNPI materials shall be purged or destroyed per reference (g) before disposal or release outside of the NNPP.

Disposal of U-NNPI as classified material is also acceptable.

b. Classified NNPI materials must be disposed of under National Security Agency (NSA) requirements for classified material.

7-1

CHAPTER 7

CONTRACTORS AND SUBCONTRACTORS

1. General. Requirements to protect NNPI shall be incorporated only into those contracts having a direct association with a naval nuclear propulsion plant application. When no such association exists, the contract does not involve access to NNPI and should not include contractual stipulations for its protection.

2. Contracted Goods and Services. Activities that procure material, components, or services involving access to NNPI shall ensure that appropriate requirements to control and protect NNPI are included in any such contracts or subcontracts.

3. Prospective Contractor. When providing a specification, drawing, or other technical document containing U-NNPI to a prospective contractor for the purposes of soliciting bids, the contracting activity shall use a stipulation to obtain prospective contractor agreement to control or protect the U- NNPI until subsequent contractual controls are established.

Appendix C is a sample stipulation.

4. Classified NNPI. Contracts or subcontracts involving classified NNPI must incorporate all NNPI handling requirements into the DD-254 Department of Defense Contract Security Classification Specification of the contract or subcontract.

5. NN-801, NN-802, NN-817. Contractors or subcontractors obligated under existing contracts to adhere to the guidelines of NN-801 (Guidelines for the Control and Protection of Unclassified Naval Nuclear Propulsion Information), NN-802 (Guidelines for the Control and Protection of Classified Naval Nuclear Propulsion Information), or NN-817 (Naval Nuclear Propulsion Information Guide) shall continue to use those guidelines for protection of NNPI.

CHAPTER 8

FACILITY VISITS

1. General. Visits to naval and commercial facilities performing naval nuclear propulsion work present unique security problems due to the need to protect both unclassified and classified NNPI from unauthorized access or release. In particular, the scope and complexity of the repair, overhaul, and construction of U.S. Navy nuclear-powered ships are not always compatible with standard security and control measures.

Access to NNPI is controlled principally by identifying and isolating areas within the facility that reveal NNPI. The security program necessary to protect NNPI will depend on the type of work being performed and the personnel access control procedures in effect. In all cases, however, local activity or facility heads are responsible for establishing a security program which will ensure compliance with the disclosure policy of this instruction.

2. U.S. Citizens and U.S. Nationals. Reference (b) and the security provisions of applicable Government contracts outline the required conditions, procedures, and responsibilities for visit approval.

3. Foreign Nationals or Representatives of a Foreign Interest

a. References (b) and (e) and the security provisions of applicable Government contracts apply. In addition, visits by foreign nationals or representatives of a foreign interest, whether for classified or unclassified purposes, require the specific approval of CNO (N00N) or designated representatives.

Approval shall be obtained before the issuance of invitations or other commitments in order to protect NNPI and avoid unnecessary difficulties arising from denial of access. Requests for approval should contain activity plans for satisfying the special conditions outlined below. If all of these conditions cannot be satisfied, the visit shall either be diverted to an activity not engaged in naval nuclear propulsion work or be disapproved.

(1) The visitor(s) shall be kept under close and continuous surveillance at all times while within the physical confines of the facility.

8-2

(2) Visual, oral, and documentary disclosures of NNPI shall be prevented by isolating areas, materials, or personnel.

(3) The visit shall be accomplished without adverse impact on the facility's workload, scheduling, or other key management factors.

b. The special considerations above for visits by a foreign national or representative of a foreign interest are not required for those personnel continually performing custodial, maintenance, or administrative work that does not involve access to NNPI. In addition, in some instances, foreign nationals or representatives of foreign interests may be able to gain access to or near facilities--specifically, those that perform other diverse functions in addition to naval nuclear work--without being subject to formal access approval. In such cases, the activity is responsible for precluding unauthorized disclosure of NNPI, primarily through isolating areas or material that may reveal NNPI and carefully controlling the movement of these personnel at the activity.

c. Per the requirements of reference (e), foreign nationals or representatives of a foreign interest shall not be permitted access to the propulsion plant spaces of Navy nuclear-powered warships without the specific approval of the CNO.

9-1

CHAPTER 9

INFORMATION TECHNOLOGY (IT) POLICY

1. General. For this instruction, IT is an umbrella term that includes all technologies used for the processing of information, including telecommunication systems and other electronic equipment. Previous chapters discussed the control and protection of components, documents, photographs, or audiovisual material that contain NNPI. This chapter discusses the general policy for the control and protection of NNPI on IT systems. Additional requirements for NNPI on the three specific types of IT are discussed in subsequent chapters. For the purposes of this instruction, the three types of IT are:

a. Information Systems (discussed in chapter 11). Consist of any Navy information system that, per reference (h), is certified and accredited by the Navy designated accrediting authority (DAA) or designated as platform information technology (PIT) by the DAA.

b. Telecommunication Systems (discussed in chapter 12).

Consist of voice, fax, or video communications equipment that may be networked but are distinct from information systems.

c. Other Electronics (discussed in chapter 13). Consist of electronics such as copiers and other standalone electronics distinct from and not otherwise addressed as part of information systems or telecommunication systems.

2. Requirements. NNPI shall be safeguarded on IT systems.

a. Safeguards shall be applied such that NNPI is (1) accessed only by authorized individuals, (2) processed only on authorized IT systems, (3) processed only within authorized workspaces or environments, (4) used only for its authorized purpose(s), and (5) properly handled, marked, labeled, and disposed.

b. NNPI shall be safeguarded on IT systems by implementing a coordinated set of operational, managerial, and technical security controls. Table 3 and its associated form, OPNAV 9210/1 IT Checklist for NNPI, provide requirements for IT systems and IT media regarding control and protection for NNPI.

9-2

c. IT systems used for NNPI should be marked/labeled following chapter 2 specifications for IT equipment, IT media, and electronic display.

d. NNPP activities shall adhere to requirements and guidance of the proper IT governing organization, including references (h) through (p). Conflicts involving NNPI and other IT requirements shall be resolved by the DAA (or governing authority) and CNO (N00N).

e. Responsibilities for implementing, controlling, and protecting NNPI on IT systems are assigned in chapter 10.

3. Restrictions

a. NNPI may only be authorized for IT systems owned or operated by, for, or on behalf of an NNPP activity.

b. IT systems located outside the United States or its territories require specific approval from CNO (N00N) to process NNPI or to connect to other IT systems that process NNPI.

c. The transportation of IT systems that process NNPI or NNPI IT media to locations outside the United States or its territories requires CNO (N00N) approval. The transport section in chapters 11, 12, and 13 provides additional details for obtaining CNO (N00N) approval for the respective type of IT addressed in the chapter.

d. Personally owned IT systems (such as a computer or mobile device) and IT media are prohibited from processing NNPI.

The one exception for limited use of personally owned telecommunication systems for U-NNPI is addressed in chapter 12 of this instruction.

e. IT systems not accredited for NNPI that are involved in an authorized disclosure of NNPI are subject to response actions directed by the cognizant DAA with CNO (N00N) concurrence.

4. Audit and Review. All NNPI-authorized IT systems and all documentation associated therewith; NNPI IT media; and IT systems involved in the unauthorized disclosure of NNPI are subject to audit and review by CNO (N00N).

9-3

5. Deviations. Deviations from the requirements for control and protection of NNPI on IT systems prescribed in this instruction must be submitted in writing to CNO (N00N) for approval.

6. Contact. Questions concerning the control and protection of NNPI on IT systems or media required by this instruction should be addressed to the CNO (N00N) Director of Cybersecurity (DCS) at:

a. Director of Cybersecurity, SEA 08B Naval Nuclear Propulsion Directorate 1240 Isaac Hull Avenue SE Washington Navy Yard DC 20376-8011

b. 202-781-5931 for non-secure/commercial telephone communications;

c. <nnpi_dcs.fct@navy.mil> for unclassified email communications on Internet/non-classified Internet protocol router network (NIPRNET) (Note: this address may be listed as “NNPI_DCS” in exchange directories); or

d. <NNPI_DCS.fct@navy.smil.mil> for up to SECRET email communications on SIPRNET (Note: this address may be listed as “NNPI_DCS” in exchange directories).

mailto:nnpi_dcs.fct@navy.mil

10-1

CHAPTER 10

INFORMATION TECHNOLOGY (IT) RESPONSIBILITIES

1. General. This chapter assigns responsibilities for implementing and sustaining the control and protection of NNPI on Navy IT systems.

2. Information Owner. CNO (N00N) has statutory authority for the control and protection NNPI. Oversight of NNPI on IT has been delegated to the CNO (N00N) DCS.

a. The DCS is authorized to audit or review all IT systems that process (or are planned to process) NNPI. The DCS may designate agents to perform audits/reviews of NNPI on IT. DCS audits/reviews of NNPI on IT may include NNPP activities, Navy network operation centers, facilities, or support locations.

b. Under CNO (N00N)’s statutory authority, the DCS shall oversee cases of improper handling of NNPI and support the DAA investigations involving NNPI.

c. The DCS shall provide the DAA a determination of the suitability of an IT system to process NNPI as part of the certification and accreditation (C&A) process. DCS must concur before IT systems may be authorized to process NNPI.

3. DAA. The DAA formally assumes the responsibility for operating an IT system at an acceptable level of risk.

a. Reference (h) assigns Naval Network Warfare Command (NAVNETWARCOM) as the operational designated accrediting authority (ODAA) for any unclassified or classified IT systems owned or operated by, for, or on behalf of the Navy. Special cases in which another organization functions as the DAA are discussed below:

(1) Reference (h) authorizes the CO of a Navy vessel operating at sea to serve as a deployed DAA.

(2) Echelon 2 headquarters organizations may function as the DAA for research, development, test, and evaluation (RDT&E) networks as prescribed in reference (h).

10-2

(3) CNO (N00N) is the DAA for classified and unclassified information systems owned or operated by, for, or on behalf of CNO (N00N) and its Department of Energy (DOE) prime contractors.

(4) Defense Security Service is the DAA for classified information systems owned or operated by, for, or on behalf of the vendors supporting the Navy.

b. DAAs with overlapping responsibilities shall resolve any conflicts by formal written agreement.

c. NAVNETWARCOM and echelon 2 RDT&E DAAs shall:

(1) Accredit IT systems for NNPI per CNO (N00N) assessment:

(a) Incorporate CNO (N00N) review and concurrence into the C&A of systems that process (or are planned to process)

NNPI.

(b) Obtain CNO (N00N) concurrence for NNPI processing before issuing an authorization (e.g., authorization to operate) for an IT system to process NNPI.

(2) Address unauthorized disclosures of NNPI:

(a) Inform CNO (N00N) of any potential, alleged, or actual compromise of NNPI on IT systems

(b) Develop and maintain systems and processes to report, respond, track, and resolve unauthorized disclosures or improper handling of NNPI on IT systems.

(c) Work to minimize the unauthorized disclosures of NNPI and to mitigate their impacts.

(d) Assist in investigating the improper handling of NNPI on IT systems by providing technical experts.

(e) Coordinate the mitigation and remediation strategy for any compromise of NNPI on IT systems not authorized to process NNPI.

10-3

(3) Include CNO (N00N) in IT infrastructure strategy and planning involving NNPI systems and support audits and reviews:

(a) Provide (or coordinate) access to personnel and training material associated with NNPI at the IT system operation centers, facilities, or support locations.

(b) Submit for CNO (N00N) concurrence any changes to policy or infrastructure (hardware or software) that may affect the security of NNPI before these changes are implemented.

(4) Serve as the primary point of contact on information assurance (IA) issues with IT systems processing NNPI.

(5) Consult CNO (N00N) on requirements for NNPI, such as:

(a) Providing CNO (N00N) a copy of all inquiries regarding NNPI protections and a copy of the proposed response for concurrence before issuing the response.

(b) Consulting with CNO (N00N) on clarifications to Navy requirements for the protection of NNPI.

4. Certification Authority (CA). Reference (h) assigns Space and Naval Warfare Systems Command (SPAWARSYSCOM) the responsibility as official Navy CA, which includes the comprehensive evaluation of the security features of an IT system and determining how well it meets security requirements.

SPAWARSYSCOM shall submit completed risk assessments, including review of NNPI security controls, for systems involving NNPI to NAVNETWARCOM and CNO (N00N) during the certification process.

5. Program Manager. Reference (i) specifies that the program manager has overall business and funding responsibility for the IT system or application. In relation to NNPI, the program manager shall:

a. Adhere to requirements for safeguarding NNPI.

b. Incorporate NNPI protections into baseline requirements for IT systems that process or are planned to process NNPI.

10-4

c. Include CNO (N00N) in discussions or reviews required to clarify the proper safeguarding of NNPI on IT systems.

d. Include CNO (N00N) in discussions or reviews on IT systems and the IT services or capabilities NNPP needs.

e. Coordinate with the cognizant DAA, CNO (N00N), and CA personnel to properly test and evaluate systems and services involving NNPI.

f. Ensure that NNPI systems and services are properly included in overall lifecycle management planning for enterprise systems and services, such as sustainment, technology upgrades, and quality assurance.

g. Develop work processes to track and maintain formal communication with CNO (N00N) on IT systems containing NNPI.

6. Commanding Officer/Officer in Charge (CO/OIC). Per reference (i), the CO/OIC shall:

a. Serve as the local IA authority, including NNPI.

CO/OICs are directly responsible for identifying vulnerabilities in their operational environments and for implementing the appropriate countermeasures.

b. Ensure that personnel under their command are trained in and abide by IA policy, including NNPI control and protection requirements.

c. Ensure that all IT assets they oversee and operate are accredited and operated in keeping with the C&A documentation.

d. Designate an NNPICO (per chapter 2 of this instruction) for activities processing NNPI on IT systems.

e. Appoint agents, as necessary, to review records associated with NNPI matters at the Navy network operation centers, facilities, or support locations.

7. Information Assurance Manager (IAM). Per reference (i), the IAM is responsible for IA within a command, site, or system.

10-5

a. The IAM is responsible to the local IA command authority and DAA for ensuring the security (including NNPI) of an IT system, and that it is approved, operated, and maintained throughout its lifecycle under the IT system’s security C&A documentation. The IAM functions as the command's focal point for IA matters on behalf of, and principal advisor to, the DAA.

b. The IAM for a system shall develop C&A documents that include NNPI security controls per this instruction for IT systems that process (or are planned to process) NNPI.

c. IAMs will inform CO/OICs, NAVNETWARCOM, and CNO (N00N) of all NNPI incidents on Navy IT systems involving their command. For example:

(1) All inquiries regarding NNPI issues.

(2) Actual, potential, or alleged mishandling of NNPI.

(3) Navy IT system vulnerabilities involving risk of unauthorized access to NNPI.

8. Security Officer. Responsible for the physical protections for an activity, the security officer shall ensure the proper certification of NNPI workspaces, as well as validate U.S.

citizenship and Government security clearances required for access to systems that process NNPI.

9. Users. Reference (i) specifies that users are individuals authorized to access an IT system. Authorized users of NNPI IT systems are responsible for protecting the NNPI they handle or process.

11-1

CHAPTER 11

INFORMATION SYSTEMS

1. General

a. This chapter specifies the security requirements for NNPI for Navy information systems that are certified and accredited by the Navy DAA or are designated as PIT by the DAA.

b. The NNPI requirements for C&A promote the secure operation of information systems. They establish minimum security levels and allow a more consistent, comparable, and repeatable approach for specifying security controls for information systems that process (or are planned to process)

NNPI.

c. Reference (j) provides the Navy’s IA policy and guidance for PIT. The Navy DAA may designate a PIT DAA per reference (j).

d. C&A of Navy information systems not designated as PIT follow the DoD Information Assurance Certification and Accreditation Process (DIACAP) in reference (k), as implemented by references (l) and (m). DIACAP covers the five cradle-to-grave stages of an information system, beginning with strategy and planning for IA and ending with the decommissioning of the information system. The IA program for the Navy is implemented by reference (h). The C&A for Navy information systems are tracked in the Information Assurance Tracking System (IATS) (or its planned replacement, the Certification and Accreditation Support Tool [CAST]). Information systems that adequately fulfill IA requirements (as determined by the CA) and that the DAA concurs in are granted authority to operate (ATO). The IAM and project manager (PM) or system manager (SM) serve key IA roles throughout the lifecycle of an information system.

e. CNO (N00N) DCS oversees NNPI security controls for PIT or information systems that process (or are planned to process)

NNPI.

2. PIT. For systems designated as PIT under reference (j), the DAA or PIT DAA shall issue an ATO or interim ATO for PIT being authorized to process NNPI only with the concurrence of

CNO (N00N).

11-2

3. Information Systems. Per reference (h), information systems not designated as PIT shall be certified and accredited by the Navy DAA.

a. For information systems planned to process NNPI that are now in DIACAP phase 1 (Initiate and Plan IA C&A), or that are initiated after the date of this instruction:

(1) In DIACAP phase 1 (Initiate and Plan IA C&A), the PM/SM shall include this instruction as a requirement and specifically incorporate…