23R0003_RFP Att 15 CARDEROCKDIVNOTE 5239.pdf

Canc frp: Aug 2022

CARDEROCKDIVNOTE 5239

Code 1043 25 Aug 2021

CARDEROCKDIV NOTICE 5239

From: Commanding Officer, Naval Surface Warfare Center, Carderock Division

Subj: PORTABLE ELECTRONIC DEVICES AND PERIPHERALS

Ref: (a) CARDEROCKDIVINST 5239.6C

(b) CNO Washington DC 271858Z May 20 (NAVADMIN 148/20)

(c) DoD Memorandum For Senior Pentagon Leadership, Commanders of the Combatant Commands, Defense Agency and DoD Field Activity Directors, subject “Collaboration Peripherals in Secure Spaces” dated June 4, 2021

(d) DoD Instruction 5200.48 of 6 March 2020

(e) SECNAVINST 5510.36B

(f) DoD Directive 8100.02 of 14 April 2004

(g) CARDEROCKDIVINST 12713.12A

Encl: (1) Extract; NAVADMIN 148/20

1. Purpose. To update policy and provide specific guidance for the use of Portable Electronic Devices (PEDs) and peripherals on Navy Marine Corps Intranet (NMCI) and Research, Development, Test and Evaluation (RDT&E) networks, per references (a) through (g).

2. Scope: This notice applies to the following:

a. All military, civilian, and contractor personnel, assigned or detailed to the Naval Surface Warfare Center, Carderock Division (NSWCCD), West Bethesda, Maryland campus and all Detachments/Sites. The provisions of this notice apply to both on-site and telework situations.

b. All visitors to NSWCCD spaces, regardless of location.

3. Background

a. With the onset of the COVID-19 Pandemic, the Department of Defense (DoD) responded by rapidly expanding and placing collaborative platforms in service to support a maximum

DEPARTMENT OF THE NAVY

NAVAL SURFACE WARFARE CENTER

CARDEROCK DIVISION

9500 MACARTHUR BOULEVARD

WEST BETHESDA MD 20817-5700

IN REPLY REFER TO:

telework posture. This resulted in the requirement to update reference (a) by allowing for the use of camera and microphone capabilities for use with various PEDs as identified in reference (b).

b. Reference (b) is the primary, authoritative directive for use of embedded computer capabilities and peripherals, including desktops, laptops, tablets, and smartphones in spaces not addressed by reference (c). An extract of reference (b) is provided in enclosure (1) for ease of reference.

c. Any provisions of reference (a), (b), or (c) not specifically addressed in this notice remain in effect.

4. Policy

a. Embedded Capabilities

(1) The use of embedded cameras and microphones on Government-furnished computers is prohibited in classified spaces.

(2) NMCI provided, embedded capabilities on Department of the Navy (DON)-issued computer systems are authorized for use in unclassified Government workspaces and/or telework environments.

(a) Unclassified workspaces include meeting rooms, which are authorized to convert from unclassified to classified environments. The Standard Operating Procedure (SOP), Procedures for Classified Meetings, must be followed before upgrading or downgrading the classification of the space. Users must refer to the SOP and/or address questions to Department 10, Code 105 prior to converting an unclassified workspace to a classified environment.

Additional situations or concerns not addressed in the SOP will be referred to Department 10, Code 105. The Classified Meeting SOP can be accessed at:

https://cuthill.aw3s.navy.mil/intra/code10/security/documents/SOP_for_classified_meetings_011 619.pdf.

(b) Workspaces located within classified environments (such as conference rooms or interior offices with a door), may be authorized to conduct conferencing at the unclassified level.

In these instances, protect information outside the immediate area where the conferencing is taking place by ensuring no classified conversation can be heard and no classified material is viewable. Users must refer to the Procedures for Classified Meetings SOP and/or address questions to the space custodian prior to use. Additional questions may be addressed to Department 10, Code 105.

(3) Use of an embedded Wi-Fi capability is permitted in Government spaces where Wi-Fi is installed and authorized by the assigned custodian of that space. Government assets are authorized for Wi-Fi usage in a telework situation. All personnel must consult with the https://cuthill.aw3s.navy.mil/intra/code10/security/documents/SOP_for_classified_meetings_011619.pdf https://cuthill.aw3s.navy.mil/intra/code10/security/documents/SOP_for_classified_meetings_011619.pdf respective space custodian or their Departmental Information Officer (DIO) regarding questions about authorized Wi-Fi spaces.

b. DON-issued Peripherals

(1) To ensure peripherals are authorized for use on NMCI or RDT&E systems, all equipment procurement must comply with the Approved Product List (APL). Only products on the APL may be used on Government Furnished Equipment (GFE). Effective immediately, NSWCCD personnel will only procure peripherals contained on APLs established by the following network providers.

(a) NMCI APL can be accessed at:

https://www.homeport.navy.mil/services/downloads/nmcicertifieddevicelist.xls

(b) ONEnet APL can be accessed at:

https://navyonenet.com/navy-one-net-products/

(2) Government-procured headsets, with or without microphones, must be wired using either a 3.5 millimeter (mm) audio jack, or Universal Serial Bus (USB) port, and cannot have noise cancelling functionality. These headsets must be unplugged when not in use.

(3) Government-procured, Bluetooth (BT) headsets, that do not require a USB dongle or any other physical connection to enable wireless connectivity, may be used with Government-issued PEDs in a telework environment or in unclassified office spaces, provided there are no discussions taking place involving classified information or Controlled Unclassified Information (CUI). Currently, NMCI computers do not have embedded BT capability.

(4) Government-procured external cameras, without memory capability, may only be used on systems at the classification level of the space. See reference (c) for information pertaining to classified spaces.

(a) Per reference (b), waivers regarding use of external web cameras on workstations at a lower classification level than the workspace may be approved on a case-by-case basis by the Navy System Information Security Officer (SISO) for select situations (e.g., offices with doors).

(b) A camera pass is not required for these devices in the aforementioned usage situations.

(c) External cameras are considered unclassified when unplugged from classified computers.

https://www.homeport.navy.mil/services/downloads/nmcicertifieddevicelist.xls https://navyonenet.com/navy-one-net-products/

(5) Government provided printers and/or scanners

(a) Are not authorized for use in a telework environment.

(b) Any exception to this policy must be fully justified and approved in writing, in advance, by the Commanding Officer (CO), NSWCCD. Per references (a) and (b), if the CO approves an exception to policy, users must ensure that any printed material containing CUI and/or unclassified information that is not approved for public release, is safeguarded by locking it in a drawer, cabinet, or room. All printed material containing CUI (or higher classification) as defined by references (d) and (e) must be returned to the Government worksite for proper disposition.

(6) See reference (b) for additional information pertaining to the use of Government-issued peripherals on personal devices.

c. Personally-owned PEDs and/or Peripherals. The use of any personally-owned PED or peripheral is prohibited in restricted areas approved for the open storage of classified material, and/or in spaces where classified information is being discussed. Personally-owned PEDs and/or peripherals involved in an electronic spill of classified information may be subject to seizure and forensic examination, per applicable law and policy.

(1) The following personally-owned peripherals may be connected to unclassified Government equipment while in a telework environment or in unclassified Government spaces:

(a) Headphones or headsets, with microphones using a 3.5 mm audio jack or USB ports;

(b) USB Keyboard;

(c) USB Mouse;

(d) BT devices that do not require a USB dongle to be connected to an asset; and.

(e) External monitors, without memory storage capabilities, may be connected using Video Graphics Array, Digital Visual Interface, High-Definition Multimedia Interface, or a Display Port Connection.

(2) The following personally-owned peripherals are prohibited from connecting to Government computers:

(a) External storage devices, including, but not limited to cellular telephones, USB memory sticks, hard drives, digital cameras, etc.;

(b) External monitors using a USB connection; and

(c) Any personally-owned printing device.

d. Procurement of Peripherals

(1) To ensure peripherals are authorized for use on NMCI or RDT&E systems, all equipment procurement must comply with the APL. The APL is continuously updated to ensure the product list is current. Reference (c) provides guidance on peripherals that will be used in classified spaces.

(2) All peripheral procurements must be coordinated with the cognizant DIO prior to submission. If there is a need for a specific peripheral device, or there are questions about using the peripheral in a restricted area, contact the cognizant DIO, or the custodian of the restricted area, prior to procurement.

(3) For additional information regarding a specific peripheral device, contact the cognizant DIO, or the applicable service desk, prior to procurement:

(a) NMCI Service Desk: ServiceDesk_Navy@nmci-isf.com.

(b) RDT&E Service Desk (Code 1042):

M_CRDR_WB_HelpDesk_NSWC_Carderock@navy.mil.

e. Prohibited Peripherals

(1) Peripherals manufactured by any source designated as prohibited by DON or the Defense Information Systems Agency (DISA) may not be procured. Per reference (b), the list of companies prohibited by law include, but are not limited to, Huawei, Zhong Xing Telecommunication Equipment, Hikvision, Hytera, and Dahua. If there are any uncertainties as to whether a source is authorized or prohibited, contact the appropriate Service Desk for clarification.

(2) Connecting a prohibited peripheral device will generate notifications to Information Technology (IT) monitoring systems, resulting in the disconnection of the Government IT asset from the network, and disabling of the user account. The user account will not be re-enabled until after the security inquiry and interview by one of the Information System Security Managers (ISSMs) are completed.

f. Medical Portable Electronic Devices (MPEDs)

(1) Requirements for MPED access to Government spaces are provided in Table 1 below.

mailto:ServiceDesk_Navy@nmci-isf.com mailto:M_CRDR_WB_HelpDesk_NSWC_Carderock@navy.mil

Table 1 – Medical Portable Electronic Devices (MPEDs)

MPED Type

Unclassified Government

Space / Telework Environment

Classified / Restricted

Government Spaces (Collateral)

Sensitive Compartmented

Information Facility

(SCIF)

Special Access Program (SAP) Facility (SAPF)

SAPF within

SCIF

Implanted MPED, non-transmitting, per reference (f)

No restrictions No restrictions Coordinate with Special Security Officer (SSO) in advance

Coordinate with SAP Government SSO (GSSO) in advance

Coordinate with SAP GSSO and SSO in advance

Implanted MPED, transmitting to receiver

No restrictions Requires approval by Command ISSM and Activity Security Manager (ASM)

Coordinate with SSO in advance

Coordinate with SAP GSSO in advance

Coordinate with SAP GSSO and SSO in advance

Non-implanted MPED, non-transmitting

No restrictions No restrictions Coordinate with SSO in advance

Coordinate with SAP GSSO in advance

Coordinate with SAP GSSO and SSO in advance

Non-implanted MPED, transmitting

No restrictions Requires approval by Command ISSM and

ASM

Coordinate with SSO in advance

Coordinate with SAP GSSO in advance

Coordinate with SAP GSSO and SSO in advance

(2) Denial of Access. If access while using an MPED is denied, the requester/user will notify his or her respective chain of command within 5 working days to facilitate resolution. If the situation cannot be resolved, the requester/user may seek Reasonable Accommodation (RA), per reference (g).

g. Personally-owned/Government-issued Cellular Telephones and Tablets

(1) The use of personally-owned or Government-issued cellular telephones and tablets (with or without cameras) is prohibited in restricted areas approved for the open storage of classified material, and/or in spaces where classified information is being discussed.

(2) Personally-owned or Government-issued cellular telephones and tablets (with or without cameras) may be used while in a telework environment or in unclassified Government spaces. When a camera or microphone capability is used, it is the user’s responsibility to ensure that no unauthorized information is photographed, viewable, or recorded (audio or visual) in the background (including Common Access Cards).

5. Records Management

a. Records created as a result of this instruction, regardless of format or media, must be maintained and dispositioned according to the records disposition schedules found on the Directives and Records Management Division (DRMD) portal page:

https://portal.secnav.navy.mil/orgs/DUSNM/DONAA/DRM/SitePages/Home.aspx.

b. For questions concerning the management of records related to this notice or the records disposition schedules, please contact the NSWCCD Command Records Manager.

https://portal.secnav.navy.mil/orgs/DUSNM/DONAA/DRM/SitePages/Home.aspx

6. Cancellation Contingency. This notice remains in effect for 1 year or until cancelled or superseded.

TODD. E. HUTCHISON

Releasability and distribution:

This notice is cleared for public release and is available electronically via the Division Intranet Directives Page, https://cuthill.aw3s.navy.mil/wcm/docs.php?doctype_id=1 https://cuthill.aw3s.navy.mil/wcm/docs.php?doctype_id=1

EXTRACT: NAVADMIN 148/20

Enclosure (1)

Highlights from CNO Washington DC 271858Z May 20 (NAVADMIN 148/20) follow. This table reflects the most commonly used equipment in various spaces and is not all encompassing. Refer to NAVADMIN 148/20 as the authoritative source if questions arise.

Telework

Sites with no NNPI or Classified

Information Exposed or Discussed

General Office Space with no

NNPI or Classified

Information Exposed or Discussed

General Office Space with NNPI or

Classified Information Exposed or Discussed

Open Storage Areas up to and including

TOP SECRET

(Collateral)

SCIF or

SAPF

Exceptions and Mitigation Notes

Government-owned external cameras connected to Navy Computers

Y

Y

N

Y

1. Can only be used on unclassified systems.

2. Can only be used on systems equal to the classification of the space, i.e., in an Open Storage TOP SECRET, no web cameras can be connected to a Secret system.

Government-owned cameras connected to Personal Computers

Y

1. Web cameras may only be used on authorized unclassified collaboration platforms.

Government-owned wired headsets with microphones connected to Navy Computers

Y

2. Must be wired using either a 3.5mm jack or

USB port.

3. Cannot contain active noise cancellation functionality.

4. Must be unplugged when not in use.

Government-owned wired headphones without microphones connected to Navy Computers

Y Y

2. Must be wired using either a 3.5mm jack or

USB port.

3. Cannot contain active noise cancellation functionality.

4. Must be unplugged when not in use.

Government-owned Bluetooth wireless earbuds used on Government iPhones or Tablets

Y Y N N N

Personally-owned peripherals, wired or Bluetooth-enabled used on Navy-issued computers

Y

Y

N N N

*Naval Nuclear Propulsion Information **Use in Navy-accredited SCIFs. May be authorized by the Navy SSO or Navy Regional SSO (RSSO) on a case-by-case basis, contact the SSO.

***Use In Navy-accredited SAPFs. May be authorized by the Director, DON SAPCO on a case-by-case basis, contact your GSSO.