Attachment N - DoDI 8540.01.pdf

Department of Defense

INSTRUCTION

NUMBER 8540.01

May 8, 2015

Incorporating Change 1, August 28, 2017

DoD CIO

SUBJECT: Cross Domain (CD) Policy

References: See Enclosure 1

1. PURPOSE. This instruction:

a. Establishes policy, assigns responsibilities, and identifies procedures for the interconnection of information systems (ISs) of different security domains using CD solutions (CDSs) in accordance with the authority in DoD Directive (DoDD) 5144.02 (Reference (a)).

b. Aligns CD guidance for managing the information security risk and authorizing a CDS with the Risk Management Framework (RMF) in accordance with DoD Instruction (DoDI)

8510.01 (Reference (b)) and DoDI 8500.01 (Reference (c)).

c. Supersedes and cancels Assistant Secretary of Defense for Command, Control, Communications and Intelligence Memorandums (References (d) and (e)) and DoD Chief Information Officer (DoD CIO) Memorandum (Reference (f)).

2. APPLICABILITY

a. This instruction applies to:

(1) OSD, the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff (CJCS) and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the Department of Defense, the Defense Agencies, the DoD Field Activities, and all other organizational entities within the DoD (referred to collectively in this instruction as the “DoD Components”).

(2) All DoD CDSs providing CD capabilities to, from, within, or between DoD ISs to include mission partner (e.g., international, interagency, State government, or defense contractors) ISs.

DoDI 8540.01, May 8, 2015

Change 1, 08/28/2017 2

b. Nothing in this instruction alters or supersedes the existing authorities and policies of the Director of National Intelligence (DNI) regarding the protection of Sensitive Compartmented Information (SCI) as directed by Executive Order 12333 (Reference (g)), associated amendments, and other laws and regulations. DoD ISs with CDSs connected to Top Secret (TS)/SCI IS must comply with DNI policy and guidance.

c. Nothing contained in this instruction relieves, exempts, or authorizes any individual or office to take any action in violation of the section 793 of Title 18, United States Code (Reference (h)) or relieves them from possible criminal prosecution for inadvertent or deliberate transmission of government security information to unauthorized individuals or for failure to establish a bona fide “need to know.”

3. POLICY. It is DoD policy that:

a. Information flow between different security domains will be authorized to meet essential mission requirements based on the results of an assessment of the mission requirements, implementation and compliance with security requirements, and the assessment of associated risks in accordance with References (b), (c), and this instruction.

b. Operational need for each CD information flow must be balanced with the risk to all affected ISs and the DoD. The level of risk will be assessed and measured by the DoD risk executive as to whether the risk is acceptable in accordance with References (b), (c), and this instruction.

c. A DoD CD capability requirement must be met by a CDS listed on the Unified Cross Domain Services Management Office (UCDSMO)-managed CDS baseline list. When a CDS baseline list CDS cannot meet the CD capability requirements for the mission, a modified CDS baseline list CDS or new technology will be used in accordance with the selection decision based on analysis of CD alternatives in the procedures of this instruction.

d. New CD technologies proposed to meet modernization or new capability requirements will be assessed by the security control assessor (SCA) for functionality and security requirements.

e. DoD will employ existing enterprise CD service provider’s (ECDSP’s) enterprise CD service or enterprise-hosted CDS when their use satisfies the CD mission requirements of DoD Components. Leveraging another operational CDS, deployment of a CDS baseline list point to point CDS or development of a new CD technology will be considered as alternative solutions only when an enterprise solution cannot meet the CD capability requirements.

f. DoD ISs with a CDS as a component (e.g., an enclave) or a CDS as a separate IS (e.g., an enterprise CD service) must be authorized to operate by the authorizing official (AO) in accordance with Reference (c) and this instruction.

Change 1, 08/28/2017 3

g. The DoD level risk decision on use of a CDS to access or transfer information between different interconnected security domains must be made by the designated DoD risk executive as a CDS authorization (CDSA) in accordance with this instruction.

h. All CDSs will be deployed and managed on the controlling domain of the CD interconnection. A CDS will be separately authorized for operation as an IS or as a CDS component within the IS in which it is deployed.

i. A CDS on the UCDSMO-managed CDS sunset list or a legacy CDS not on the CDS baseline list must be replaced within a period of time agreed to by the AO and the DoD risk executive. A letter of exception is required to operate a CDS not on the CDS baseline list (see guidance in the procedures of this instruction).

j. A CDS found operating without approval or out of compliance with its approved security configuration requires immediate DoD chain of command notification to determine whether to disconnect or stop use of the CDS (see guidance in the procedures of this instruction).

k. Information transferred between different security domains must be correctly marked, protected, and disseminated in accordance with DoD Manual 5200.01, Volumes 1 through 4 (Reference (i)).

4. RESPONSIBILITIES. See Enclosure 2.

5. PROCEDURES. See Enclosures 3, 4, and 5.

6. RELEASABILITY. Cleared for public release. This instruction is available on the Directives Division Website at http://www.esd.whs.mil/DD/.

7. SUMMARY OF CHANGE 1. The changes made to this issuance are administrative and update releasability and references for accuracy.

8. EFFECTIVE DATE. This instruction is effective May 8, 2015.

Enclosures

1. References

2. Responsibilities

3. CD Activities

Change 1, 08/28/2017 4

4. CD Process and the DoD RMF Process

5. CD and RMF Roles

Glossary

Change 1, 08/28/2017 CONTENTS 5

TABLE OF CONTENTS

ENCLOSURE 1: REFERENCES

ENCLOSURE 2: RESPONSIBILITIES

DOD CIO

DIRECTOR, DEFENSE INFORMATION SYSTEMS AGENCY (DISA)

DIRECTOR, UCDSMO

USD(P)

USD(I)

DIRNSA/CHCSS

DIRECTOR, DEFENSE INTELLIGENCE AGENCY (DIA)

DOD COMPONENT HEADS

CJCS

CDRUSSTRATCOM

ENCLOSURE 3: CD ACTIVITIES

CD CAPABILITIES PORTFOLIO

ACQUISITION AND USE OF A CDS

ENTERPRISE SERVICES

MINIMAL IMPACT CDS AND REPEATABLE CDS INSTANTIATIONS

CDS EXCEPTIONS AND LEGACY CDS TRANSITION

USE OF REMOVABLE MEDIA FOR DATA TRANSFER

PROCESSING REQUEST FOR CD URGENT OPERATIONAL REQUIREMENT

RECIPROCITY

FOREIGN RELEASE OF CDS OR CD TECHNOLOGY

ENCLOSURE 4: CD PROCESS AND THE DOD RMF PROCESS

CD PROCESS AND DOD RMF PROCESS OVERVIEW

PRE-RMF STEP 0: ENGAGE CDSE

RMF STEP 1: CATEGORIZE IS

RMF STEP 2: SELECT SECURITY CONTROLS

RMF STEP 3: IMPLEMENT SECURITY CONTROLS

RMF STEP 4: ASSESS SECURITY CONTROLS

RMF STEP 5: AUTHORIZE IS

RMF STEP 6: MONITOR SECURITY CONTROLS

ENCLOSURE 5: CD AND RMF ROLES

DOD ISRMC

DSAWG

CDTAB

Change 1, 08/28/2017 CONTENTS 6

CDSE

CD SERVICE PROVIDER

SCA

AO

IS OWNER

INFORMATION OWNER

ISSM

ISSO

ISSE

GLOSSARY

PART I: ABBREVIATIONS AND ACRONYMS

PART II: DEFINITIONS

TABLES

1. Pre-RMF Step 0: Engage CDSE

2. CDS Alternatives and Identification of Primary RMF Leads

3. RMF Step 1: Categorize IS

4. RMF Step 2: Select Security Controls

5. RMF Step 3: Implement Security Controls

6. RMF Step 4: Assess Security Controls

7. RMF Step 5: Authorize IS

8. RMF Step 6: Monitor Security Controls

FIGURES

DoD CD and RMF Processes

Change 1, 08/28/2017 ENCLOSURE 1 7

ENCLOSURE 1

REFERENCES

(a) DoD Directive 5144.02, “DoD Chief Information Officer (DoD CIO),” November 21, 2014

(b) DoD Instruction 8510.01, “Risk Management Framework (RMF) for DoD Information

Technology (IT),” March 12, 2014, as amended

(c) DoD Instruction 8500.01, “Cybersecurity,” March 14, 2014

(d) Assistant Secretary of Defense for Command, Control, Communications, and Intelligence

Memorandum, “Secret and Below Interoperability (SABI) Reaffirmation,” May 11, 1998 (hereby cancelled)

(e) Assistant Secretary of Defense for Command, Control, Communications, and Intelligence Memorandum, “Secret and Below Interoperability (SABI),” March 20, 1997 (hereby cancelled)1

(f) DoD Chief Information Officer (CIO) Memorandum, “Cross Domain Support Element (CDSE) Responsibilities,” October 11, 2011 (hereby cancelled)

(g) Executive Order 12333, “United States Intelligence Activities,” December 4, 1981, as amended

(h) Section 793 of Title 18, United States Code

(i) DoD Manual 5200.01, “DoD Information Security Program,” Date varies by volume

(j) Joint DoD/IC Memorandum, “Establishment of the Unified Cross Domain Services

Management Office (UCDSMO) as the Cross Domain Requirements and Engineering Service Manager,” March 26, 20142

(k) DoD Chief Information Officer and Intelligence Community Chief Information Officer Charter, “Unified Cross Domain Management Office Charter,” March 21, 20072

(l) DoD Directive 8000.01, “Management of the Department of Defense Information Enterprise (DoD IE),” March 17, 2016

(m) Deputy Secretary of Defense Memorandum, “Joint Information Environment Implementation,” May 6, 2013

(n) DoD Directive 5230.11, “Disclosure of Classified Military Information to Foreign Governments and International Organizations,” June 16, 1992

(o) Title 15, Code of Federal Regulations, (also known as the “Export Administration Regulations”)

(p) Title 22, Code of Federal Regulations, (also known as the “International Traffic in Arms Regulations”)

(q) DoD Instruction 2040.02, “International Transfers of Technology, Articles, and Services,” March 27, 2014

(r) Deputy Secretary of Defense Memorandum, “Department of Defense (DoD) Chief Information Officer (CIO) Executive Board Charter,” February 12, 2012

(s) Defense Information Systems Agency Guide, “Connection Process Guide,” current version3

1https://inteldocs.intelink.gov/inteldocs/page/repository#filter=path%7CUser%20Folders/r/ra/rakosky/joseph.m.rako sky1 2UCDSMO and UCDMO memos and charter:

https://intelshare.intelink.gov/sites/ucdsmo//Documents/Forms/AllItems.aspx

Change 1, 08/28/2017 ENCLOSURE 1 8

(t) Defense Information Systems Agency, “Cross Domain Technical Advisory Board (CDTAB) Charter,” April 18, 20074

(u) National Institute of Standards and Technology Special Publication 800-30, “Guide for Conducting Risk Assessments,” September 2012

(v) National Institute of Standards and Technology Special Publication 800-39, Revision 1, “Managing Information Security Risk: Organization, Mission, and Information System View,” March 2011

(w) DoD Instruction 4000.19, “Support Agreements,” April 25, 2013

(x) DoD Instruction 5000.02, “Operation of the Defense Acquisition System,” January 7, 2015, as amended

(y) Committee on National Security Systems Instruction No. 1253, “Security Categorization and Control Selection for National Security Systems,” March 27, 20145

(z) DoD Instruction 8530.01, “Cybersecurity Activities Support to DoD Information Network Operations,” March 7, 2016

(aa) DoD 8570.01-M, “Information Assurance Workforce Improvement Program,” December 19, 2005, as amended

(ab) DoD Chief Information Officer, “DoD Architecture Framework,” current version6

(ac) Committee on National Security Systems Policy No. 26, “National Policy on Reducing

Risk of Removable Media for National Security Systems,” May, 2013

(ad) DoD 5400.11-R, “Department of Defense Privacy Program,” May 14, 2007

(ae) Department of Defense, “Unified Command Plan,” April 6, 2011, as amended

(af) DoD Instruction 5200.44, “Protection of Mission Critical Functions to Achieve Trusted

Systems and Networks (TSN),” November 5, 2012, as amended

(ag) DoD CIO and Assistant Director of National Intelligence and Intelligence Community CIO

Memorandum, “Use of Unified Cross Domain Management Office (UCDMO) Baseline Cross Domain Solutions (CDSs),” December 1, 2011

(ah) Committee on National Security Systems Policy No. 8, “Policy Governing the Release and Transfer of U.S. Government Cryptologic National Security Systems Technical Security Material, Information, and Techniques to Foreign Governments and International Organizations,” August, 2012

(ai) Chairman of the Joint Chiefs of Staff Instruction 6510.06B, “Communication Security Releases to Foreign Nations,” November 8, 2013

(aj) National Institute of Standards and Technology Special Publication 800-37, Revision 1, “Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach,” February 2010

(ak) National Institute of Standards and Technology Special Publication 800-53, Revision 4, “Security and Privacy Controls for Federal Information Systems and Organizations,” April

3 Connection Process Guide: http://www.disa.mil/Services/Network-Services/Enterprise-Connections/Connection- Process-Guide 4 CDTAB Charter: https://inteldocs.intelink.gov/inteldocs/page/document-details?nodeRef=workspace://SpacesStore/5054bc22-1ec1-46f7-9f65-4b4dc889d19e 5 CNSS publications: https://www.cnss.gov/CNSS/issuances/Instructions.cfm (Click on CNSSI No. 1253, select “save target as,” and “save” to download.) or http://www.iad.nsa.smil.mil/resources/library/cnss_section/cnss_instructions.cfm (Double click on CNSSI-1253.)

6 DoD Architecture Framework: http://dodcio.defense.gov/dodaf20.aspx

Change 1, 08/28/2017 ENCLOSURE 1 9

(al) National Institute of Standards and Technology Special Publication 800-137, “Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations,” September 2011

(am) Unified Cross Domain Management Office, “800-53 Based Cross Domain Solutions (CDS) Risk Analysis Using the 800-53 CDS Overlay,” Version 1.0a, April 24, 20147

(an) DoD Instruction 2030.08, “Implementation of Trade Security Controls (TSC) for Transfers of DoD Personal Property to Parties Outside DoD Control,” February 19, 2015

(ao) DoD Directive 5100.03, “Support of the Headquarters of Combatant and Subordinate Unified Commands,” February 9, 2011

(ap) DoD Instruction 8320.02, “Sharing Data, Information, and Technology (IT) Services in the Department of Defense,” August 5, 2013

(aq) Committee on National Security Systems Instruction No. 4009, “Committee on National Security Systems (CNSS) Glossary,” April 6, 2015

7 UCDSMO Website at: https://intelshare.intelink.sgov.gov/sites/ucdsmo/pages/cdstestreq.aspx (Double click on CDS Risk Control Guide.)

Change 1, 08/28/2017 ENCLOSURE 2 10

ENCLOSURE 2

RESPONSIBILITIES

1. DOD CIO. The DoD CIO:

a. Oversees and provides direction to UCDSMO for implementation of this instruction.

b. Serves as co-chair of the oversight panel that directs, oversees, and approves UCDSMO activities in accordance with Joint DoD and Intelligence Community (IC) UCDSMO Memorandum (Reference (j)) and the UCDSMO Charter (Reference (k)).

c. Provides strategic management, direction, and oversight to plan, program, develop, and implement enterprise CD services into the DoD Enterprise Architecture in accordance with DoDD 8000.01 (Reference (l)) and the evolving Joint Information Environment reference architectures (e.g., a Single Security and Core Data Center) in accordance with Deputy Secretary of Defense Memorandum (Reference (m)).

d. Collaborates with the Under Secretary of Defense for Intelligence (USD(I)) on strategy for DoD enterprise CD services and a CDS risk governance reciprocity.

e. Designates the DoD Information Security Risk Management Committee (ISRMC) as the DoD risk executive for authorizing the information flow between different security domains in accordance with Reference (c).

f. Establishes, via a UCDSMO-led effort, a process to ensure proper release of a CDS or CDS information to foreign mission partners in accordance with DoDD 5230.11 (Reference (n)), chapter VII, subchapter C of Title 15, Code of Federal Regulations (also known as the “Export Administration Regulations”) (Reference (o)), part 121 Category XIII of Title 22, Code of Federal Regulations (also known as the “International Traffic in Arms Regulations”) (Reference (p)), and DoDI 2040.02 (Reference (q)), in coordination with the Under Secretary of Defense for Policy (USD(P)), the Under Secretary of Defense for Acquisition, Technology, and Logistics, USD(I), the Director, National Security Agency (NSA)/Chief, Central Security Service (DIRNSA/CHCSS), and the CJCS.

g. Resolve CDS, CD enterprise services, and enterprise-hosted CDS priorities, implementation, and information resources issues based on DoD CIO Executive Board recommendations in accordance with Deputy Secretary of Defense Memorandum (Reference (r)).

2. DIRECTOR, DEFENSE INFORMATION SYSTEMS AGENCY (DISA). In addition to the responsibilities in section 8 of this enclosure, and under the authority, direction, and control of the DoD CIO, the Director, DISA:

Change 1, 08/28/2017 ENCLOSURE 2 11

a. Establishes and documents DISA’s process for providing enterprise CD services or enterprise-hosted CDSs.

(1) Provides the conditions and criteria under which a DoD Component CD capability requirement can be satisfied by a DISA enterprise CD service or enterprise-hosted CDSs.

(2) Provides the conditions, criteria, and cost model for providing DISA enterprise CD services and enterprise-hosted CDSs to DoD Components and authorized mission partners.

b. Issues and implements CDSAs approved by the DoD ISRMC or as delegated to the Defense Information Assurance (IA)/Security Accreditation Working Group (DSAWG) in coordination with the IS owner to allow a CDS to access or transfer information between different interconnected security domains.

c. Maintains the Defense Information Systems Network (DISN) Connection Process Guide (Reference (s)) outlining the business processes for connecting an IS using a DoD Component CDS in accordance with this instruction. The process guide CD appendix and associated updates will be reviewed by the DSAWG.

d. Manages the designated CD repository (i.e., the SECRET Internet Protocol Router

Network Global Information Grid Interconnection Approval Process System (SGS)), which maintains an inventory of all CDSs in operation or in the assessment and approval process.

Inventories of CDSs in use on SCI information networks will be maintained in accordance with DNI guidance.

e. Develops the security architecture to protect DISA CD enterprise services and enterprise-hosted CDS sites.

f. Provides information on the ability of interconnected DoD information networks

(DODIN) to restrict attack avenues or methods to support the CD Technical Advisory Board’s (CDTAB’s) recommendation for the CDS risk assessment and decision process.

g. Conducts and provides security reviews of CDSs and their operational environments (e.g., a DISN connected enclave) to support the DSAWG or DoD ISRMC CDSA decisions, as required.

h. Develops and provides RMF and DISN connection products and training materials on the

IA Support Environment Website at http://iase.disa.mil/Pages/index.aspx or http//iase.disa.smil.mil/index2.html to support DoD Component CDS activities.

i. Establishes and maintains the CDTAB as an advisory board to the DSAWG and provides chair and secretariat support as specified in the CDTAB Charter (Reference (t)).

3. DIRECTOR, UCDSMO. Under the authority, direction, and control of the DoD CIO as co-chair of the oversight panel in accordance with Reference (k), the Director, UCDSMO:

Change 1, 08/28/2017 ENCLOSURE 2 12

a. Provides centralized management of DoD CD activities, ensuring a common DoD

Component approach to implement this instruction.

b. Serves as principal CD advisor to the DoD CIO and provides status of DoD Components’ progress in implementing this instruction.

c. Initiates and charters working groups with DoD Component representation to address CD issues (e.g., training, assessments, or CD capability requirements), as needed.

d. Supports DoD information sharing objectives by emphasizing expedited delivery to the field of CD capabilities that meet all applicable security requirements.

e. Provides quarterly status of all plans of action and milestones (POA&Ms) for legacy

CDSs not on the CDS baseline list, CDSs operating beyond the CDS sunset list specified time, and CDS not on the CDS baseline list operating with a letter of exception. The POA&M template is available in the reference library at https://rmfks.osd.mil/rmf/General/SecAuthPackage/Pages/POAM.aspx.

f. Provides CD subject matter expertise, managerial oversight, technical support, and recommendations to DoD bodies and organizations for risk-based decisions, strategic and developmental planning, investments, and CD knowledge management.

g. Provides recommendations to the appropriate DoD entities regarding CD issues common to the DoD and IC and initiates ad hoc joint meetings as required.

h. Supports the DoD CIO in the development and alignment of DoD and IC CDS policies.

i. Establishes and provides CD criteria and standards.

(1) Establishes a CD security control overlay for use by DoD in accordance with Reference (b).

(2) Provides standardized guidance in accordance with Reference (b) on CDS implementation and assessments. This guidance must be consistent with National Institute of Standards and Technology (NIST) Special Publication 800-30 (Reference (u)) and NIST Special Publication 800-39 (Reference (v)).

(3) Provides standardized security assessment objectives and common test procedures for the CDS security control overlay.

(4) Develops and maintains a risk model in accordance with References (u) and (v) to support the DoD ISRMC and DSAWG risk decisions to authorize CDSs to access or transfer information between different security domains.

Change 1, 08/28/2017 ENCLOSURE 2 13

(5) Establishes and oversees the criteria that must be met by ECDSPs when providing advertised services and their compliance with CDS security requirements, including when operating in the deployed environment.

j. Establishes the criteria to certify DoD laboratories for verification and validation of the CD technology’s functionality and compliance with security requirements and conduct penetration testing.

k. Advocates for the standardization of CDSs to minimize redundant or duplicative development or acquisition.

l. Identifies common DoD and IC CD capability requirements and problem sets in coordination with those DoD and IC components and elements.

m. Supports CD personnel training.

(1) Consolidates CD personnel training requirements received from DoD Components.

(2) Maintains a catalog of courses available to CD personnel from the NSA, other DoD Components, and non-DoD organizations.

(3) Facilitates the use of available training courses by CD personnel and organizations.

n. Develops and maintains, with assistance from NSA and other DoD Components, a CD security control assessment process guide and security assessment report (SAR) template.

o. Manages CD capabilities portfolio.

(1) Develops and maintains a CD capabilities portfolio, to include a CDS baseline list of verified and validated CDSs, as well as a listing of end of life products on a CDS sunset list, enterprise CD services, and other CD technologies at https://intelshare.intelink.sgov.gov/sites/ucdsmo/default1.aspx.

(2) Manages a process for sponsorship of new enterprise CD services and CDSs to be placed on the CDS baseline list following a CD technology’s verification and validation of functionality and compliance with security requirements.

(3) Manages a process for identifying enterprise CD services and CDSs to be placed on the CDS sunset list.

(4) Sends notification of changes to the CDS baseline list or CDS sunset lists to CD support elements (CDSEs).

p. Develops and maintains a CD roadmap that builds on the UCDSMO CD capabilities portfolio, validated CD capability requirements, capability gaps, and emerging CD technologies to establish necessary CDSs for enterprise CD services.

Change 1, 08/28/2017 ENCLOSURE 2 14

(1) Develops and conducts an outreach strategy to encourage development of innovative commercial CD technologies and enterprise CD services that satisfy DoD and IC common capability gaps, problem sets, and projected requirements.

(2) Coordinates research and development efforts for CD technologies, to include the development and implementation of enterprise CD services and provides information on CD research and development efforts to the Assistant Secretary of Defense for Research and Engineering as requested.

(3) Releases requests for information to vendors at least semi-annually to identify potential vendor solutions for identified capability gaps and associated capability requirements.

(4) Facilitates communications between commercial entities with new CD technologies and DoD Components that have capability gaps that could be met by vendor solutions.

q. Maintains a list of DoD and IC UCDSMO certified laboratories based on NSA certification recommendation that are available to conduct fee-for-service CD technology security control assessments and penetration testing in support of DoD Component requirements, and makes the list available through the UCDSMO website.

r. Schedules and oversees security control assessments accomplished by DoD laboratories for CD technologies, including new technologies, new CDS versions, and technologies determined by the CDTAB to require a new Target of Evaluation (TOE). Security control assessments will be conducted in accordance with DoD Components priorities. Any conflicts in scheduling or resources availability between DoD Components requirements will be brought to the DoD CIO for resolution.

s. UCDSMO maintains for information purposes a control list in support of Reference (p) and a frequently asked questions file about the release and export of CDSs at UCDSMO site at https://intelshare.intelink.sgov.gov/sites/ucdsmo/default1.aspx by accessing the Cross Domain Shared Docs link and then accessing the export and release folder.

t. Appoints representatives to the CDTAB as specified in Reference (t).

4. USD(P). The USD(P):

a. Coordinates with the DoD CIO and CJCS to establish a process for release of CDSs to foreign mission partners.

b. Provides advice to the DoD CIO and other DoD Components, as required, on foreign disclosure and export of CDSs and CD technologies.

Change 1, 08/28/2017 ENCLOSURE 2 15

5. USD (I). The USD(I):

a. Collaborates with the DoD CIO and CJCS on a strategy to implement enterprise CD services.

b. Coordinates with DoD CIO to establish a process for release of CDSs to foreign mission partners.

c. Provides interpretations of Information Security Program requirements as provided in

Reference (i).

6. DIRNSA/CHCSS. In addition to the responsibilities in section 8 of this enclosure, and under the authority, direction, and control of the USD(I), the DIRNSA/CHCSS:

a. Advises the DoD CIO, DoD Component heads, and the Director, UCDSMO on the security features, practices and procedures, and architecture required for DoD CDSs to enforce security policy.

(1) Develops and maintains inspection, sanitization, and data transfer guidance documents for the file formats and protocols used by the DoD.

(2) Develops and maintains filter configuration standards.

b. Supports assessment and penetration testing of CD technologies.

(1) Assists the UCDSMO in developing standards to certify DoD laboratories to conduct security control assessments of CD technologies and penetration testing in order to verify and validate functionality and compliance with security requirements.

(2) Conducts certification assessments of DoD laboratories in accordance with

UCDSMO-provided criteria and provides certification recommendation to the UCDSMO. NSA will provide a recommendation to revoke certification if DoD standards are not being met.

(3) Provides training to DoD Component personnel based on training requirements jointly identified by the DoD Components, the IC, DoD mission partners, and the UCDSMO (e.g., the risk assessment model or CD technology assessment).

(4) Conducts penetration testing or oversees the penetration testing by other organizations of new CD technologies or new CD technology versions, as required.

c. Conducts or oversees other DoD Component Red Team operations to emulate a potential adversary’s attack or exploitation capabilities against DoD ECDSP sites or DoD Component sites hosting operational CDSs, as directed by Commander, U.S. Strategic Command

(CDRUSSTRATCOM).

Change 1, 08/28/2017 ENCLOSURE 2 16

d. Assists the UCDSMO in developing a security control assessment guide and SAR template.

e. Evaluates DoD enterprise-wide CD vulnerabilities and provides recommendations on procedures and architecture to mitigate risk to CDRUSSTRATCOM and DoD CIO, as required.

7. DIRECTOR, DEFENSE INTELLIGENCE AGENCY (DIA). In addition to the responsibilities in section 8 of this enclosure, and under the authority, direction, and control of the USD(I), the Director, DIA:

a. Provides enterprise CD services or enterprise-hosted CDS for Joint Worldwide Intelligence Communications System (JWICS) customers in coordination with collateral network service providers, as required.

b. Issues authorization for SCI enterprise CD services and enterprise-hosted CDSs deployed on JWICS in accordance with DNI guidance. If a CDS is physically deployed on a collateral DoD IS, then an assessment and approval is conducted in accordance with Enclosure 4 of this instruction for deployment.

c. Provides threat information for the transfer of information to or from foreign mission partners or foreign mission partner ISs, in support of the CD risk assessment and evaluation methodology.

8. DOD COMPONENT HEADS. The DoD Component heads:

a. Establish a CDSE to carry out CDSE responsibilities outlined in Enclosure 5 of this instruction for DoD Component current or planned CDSs.

(1) A DoD Component may execute a support agreement (e.g., a memorandum of agreement (MOA)) in accordance with DoDI 4000.19 (Reference (w)) with another DoD Component’s CDSE to conduct specified CDSE duties and responsibilities on their behalf.

(2) A DoD Component CDSE will act as an oversight and coordination office for another DoD Component’s CDSE when it is performing specified CDSE duties and responsibilities in accordance with a support agreement (e.g., an MOA).

b. Appoint representatives from the DoD Component to the CDTAB as specified in Reference (t).

c. Direct DoD Component organizations to coordinate with their servicing CDSE before contracting or obligating their organization to the acquisition of CDSs, CD technologies, or services. This includes coordinating with an external CDSE’s providing CD support (e.g., a Combatant Command coordinating with Service CDSE providing CD support).

Change 1, 08/28/2017 ENCLOSURE 2 17

(1) Appoint CDSE individuals authorized to coordinate CD activities and manage DoD Component CD requirements in the designated centralized repository. Provide list of authorized individuals to UCDSMO and DoD ECDSPs.

(2) Select CDSs and new CD technologies following a selection decision in accordance with Pre-RMF Step 0 of Table 1 in Enclosure 4 this instruction.

(3) Ensure new CDS-related concepts and initiatives are coordinated with the UCDSMO and added to the CD capabilities portfolio.

d. Use the DoD CD process specified in Enclosure 4 to identify CD capability requirements and implement CDSs in support of DoD Component missions.

e. Use ECDSP’s enterprise CD service or enterprise-hosted CDS when the solution satisfies a DoD Component’s CD capability requirements. A list of operational and future services and the ECDSPs can be found at https://intelshare.intelink.sgov.gov/sites/ucdsmo/cap-port- 2/CDServices/SitePages/Home.aspx.

f. If an enterprise CD service or enterprise-hosted CDS does not meet the CD capability requirements for the mission (e.g., exercises; research, development, test, and evaluation (RDT&E); modeling and simulation (M&S); tactical level unit operations; or sensor-to-weapon platform data transfer), then an exception for using a point to point, baseline list CDS, or new product may be required. When this case occurs, provide evaluation results during the CDS selection process establishing that the CD capability requirement cannot be satisfied by an enterprise capability.

(1) Develop a POA&M to transition a DoD Component CDS to an enterprise service or enterprise-hosted CDS as directed by the DoD ISRMC and DoD CIO Executive Board.

(2) Identify resource issues and courses of action for transition of DoD Component CDSs to enterprise service or enterprise-hosted CDS to the DoD CIO Executive Board, as

g. Document the CDS interconnection within both the IS’s RMF assessment and authorization documentation in accordance with Reference (b) and the designated DoD repository in accordance with Reference (s).

h. Ensure the use of a CDS on the CDS sunset list, or a legacy CDS not on the CDS baseline list, is documented, reviewed by the DSAWG, and authorized either by the DoD ISRMC in accordance with section 5 of Enclosure 3 of this instruction.

(1) Upload to the designated centralized repository a POA&M detailing the plan to replace a CDS not on the CDS baseline list or a CDS operating beyond the CDS sunset list specified time with a baseline list CDS and notify the DSAWG and UCDSMO.

Change 1, 08/28/2017 ENCLOSURE 2 18

(2) Manage a POA&M to migrate to a CDS baseline list CDS and provide POA&M updates to reflect changes in migration status to UCDSMO and DoD CIO.

(3) When a CDS baseline list CDS cannot be used due to unique CD capability requirements, upload the DoD Component letter of exception with information required by section 5 of Enclosure 3 to the designated centralized repository and notify the DSAWG.

i. Inspect DoD Component ISs with DoD Component CDSs via a DoD Component directed cybersecurity inspection or approved U.S. Strategic Command (USSTRATCOM) directed cybersecurity inspection at least once during the first year of operation and thereafter once every 3 years to validate IS owner security self-assessment processes.

j. Oversee and monitor the life cycle management of DoD Component CDSs and CDS security configurations.

(1) Provide for life cycle management (i.e., pre-acquisition, acquisition, and sustainment) and operation of DoD Component enterprise CD services and operational CDSs under their control in accordance with DoDI 5000.02 (Reference (x)).

(2) Implement Committee on National Security Systems Instruction (CNSSI) No. 1253 (Reference (y)) required and CDSA specified security controls to enable the defense of the CDS and its operational environment in accordance with References (b), (c), and DoDI 8530.01 (Reference (z)).

(3) Designate an office or organization to track, maintain, and provide data on CD technology RDT&E, supporting laboratories, and deployed CDSs including system development life cycle (SDLC) phase.

(4) Ensure CDSs are designated as controlled inventory items and the associated CDS components and equipment are included in the Defense Property Accountability System for the purpose of accounting for their existence, location, custody, accountability, and disposition.

(5) Oversee DoD Component execution of funding for CDSs, including existing programs and new CDS-related concepts and initiatives, in accordance with Reference (x).

(6) Review, validate, and prioritize CD capability requirements and investments.

(7) Ensure IS owners manage and maintain the operation and security throughout the CDS’s SDLC in accordance with References (b) and (c).

k. Maintain status on all CDSs, including those in operation, in the RMF process, or under research or development, in the designated centralized repository. If information is not in the designated centralized repository, the DoD Components will provide this information annually to the UCDSMO or as required by the DoD CIO.

Change 1, 08/28/2017 ENCLOSURE 2 19

l. Ensure both technical and managerial personnel involved in CDS management, administration, operation, maintenance, and assessment are trained and certified in accordance with DoD 8570.01-M (Reference (aa)).

m. Provide UCDSMO with CD personnel training requirements and associated DoD Component CD courses open to other organizations on a space available or fee-for-service basis.

n. Ensure DoD Component security control assessments and vulnerability assessments are conducted by security assessor personnel in accordance with published UCDSMO SCA guidance and baseline and CD overlay security controls for CDSs and deployed environments. Approved security control baselines and overlays are found in Reference (y).

o. Ensure DoD Component organizations with CDSs deployed within their IS authorization boundaries effectively implement required security controls for both the environment and deployed CDSs in accordance with References (b) and (y).

p. Notify Combatant Commands of any DoD Component CDS deployed and operating in a Combatant Command’s area of responsibility.

q. Defend ISs and deployed CDSs, including sensors and boundary protection measures, as required by implemented security controls, AO, USSTRATCOM, and applicable DISA security technical implementation guides.

r. Ensure organizations conduct security self-assessments periodically to validate that the approved configurations of the CDS have not changed. Self-assessments must be submitted to the respective CDSEs, approved by the organization AO or designated representative, and uploaded to the designated centralized repository in accordance with Reference (s) and this instruction.

s. Update initially and as required the designated central repository with contact information, including e-mail, address, and phones numbers, for enclave and CDS points of contact (e.g., AO, IS owner, CDSE, information systems security manager (ISSM), information systems security officer (ISSO), information systems security engineer (ISSE), technical representative, administrative representative), and the required security and architecture documentation as specified in Reference (b) and the DoD Architecture Framework (Reference (ab)).

t. Follow guidance provided by DoD CIO before release of a CDS to a foreign mission partner as specified in section 9 of Enclosure 3 of this instruction.

u. Oversee DoD Component-managed ISs use of CDSs.

(1) Require the issuance of a DoD ISMRC or DSAWG CDSA before allowing a CDS to access or transfer information between different interconnected security domains. A CDSA is required for use of a CDS.

Change 1, 08/28/2017 ENCLOSURE 2 20

(2) Provide DoD Component guidance on the CDS authorization process for DoD Component-managed ISs that is compliant with the RMF procedures specified in Enclosure 4, consistent with Reference (s), and DoD Component issuance(s), as required.

v. Direct the individuals responsible for managing a CDS to report security incidents to the local or site information security manager in accordance with Volume 3 of Reference (i) and the ISSM or ISSO in accordance with Reference (c). Inform the CDSE. In accordance with Volume 3 of Reference (i), the information security manager has the overall responsibility for resolution of the incident.

w. Establish and document DoD Component program for the use of removable media to conduct CD data transfers to include policy, acquisition, operations, and disposal. This program will be updated in accordance with Committee on National Security Systems Policy (CNSSP) No. 26 (Reference (ac)), other DoD and USSTRATCOM orders, and other issuances, as

x. Ensure a reliable human review (RHR) process and procedures are implemented for opening and reviewing digital objects (e.g., files or images) to ensure that the digital object (e.g., data) may be transferred across a CDS in those cases where RHR is required due to the limitations of the specific CDS.

(1) Provide training to information originators on the RHR process and procedures requiring that information transferred must be in accordance with References (i), (n) and (q) for the designation, marking, protection, and dissemination of controlled unclassified information and classified information.

(2) Use CDS sanitization tools as directed by DoD or the DoD Component.

(3) Enforce a visual RHR as required using procedures and standards for RHR defined in DoD Component guidance, United States Cyber Command tasking orders, and specific CDS operating guidance.

(4) Ensure adequate audit capability for attribution back to the originator.

y. Report unauthorized or non-compliant CDSs through the appropriate reporting chain as an actual or potential compromise of classified information or as an actual or potential unauthorized disclosure of controlled unclassified information, including breach of personally identifiable information (PII), in accordance with Volumes 3 and 4 of Reference (i) and DoD 5400.11-R (Reference (ad), as appropriate for the sensitivity of the information processed.

9. CJCS. In addition to the responsibilities in section 8 of this enclosure, the CJCS will facilitate and advocate Combatant Command CD capability and operational requirements at the CDTAB, DSAWG, DoD ISRMC, and other Joint Staff operational requirements forums, as required.

Change 1, 08/28/2017 ENCLOSURE 2 21

10. CDRUSSTRATCOM. In addition to the responsibilities in section 8 of this enclosure, the

CDRUSSTRATCOM:

a. Provides the DSAWG and DoD ISRMC with relevant risk data of a DoD Component’s operational environment to support CDS selection or CDSA during the RMF process. Relevant data includes evidence such as past cybersecurity inspection results, assessments, and compliance with directives and orders (e.g., vulnerability alerts or tasking orders) to determine the DoD Component’s ability to operate, manage, and defend the DoD Component’s CDS implementation.

b. Directs the disconnection or removal of CDSs or CD technologies that are determined to pose an operational risk to DoD information networks or as determined by the DoD ISRMC in coordination with operational chain of command. These CDS risks would be those determined to be impacting the ability to execute DoD missions or cause exceptionally grave or serious damage to national security through the compromise of classified information.

c. Oversees CD capabilities regarding the Unified Command Plan (Reference (ae)) assigned supporting space, missile defense, and nuclear command and control missions.

d. Validates vulnerability self-assessment processes during cybersecurity inspections.

Change 1, 08/28/2017 ENCLOSURE 3 22

ENCLOSURE 3

CD ACTIVITIES

1. CD CAPABILITIES PORTFOLIO. The UCDSMO has created the CD capabilities portfolio to meet DoD and IC problem sets and projected CD capability requirements, available through the UCDSMO website “Capabilities Portfolio” tab at:

http://intelshare.intelink.sgov.gov/sites/ucdsmo/default1.aspx, to provide a complete listing of CDSs and CD technologies.

a. Enterprise CD Services List. The CD enterprise services list identifies CD services available for delivery by the DoD and IC.

b. CDS Baseline List. The CDS baseline list is a starting point for leveraging identified and validated CDSs that support operational needs within the DoD and IC and are available for deployment. For more information on the CDS baseline list, refer to the UCDSMO Capabilities Portfolio tab at https://intelshare.intelink.sgov.gov/sites/ucdsmo/cap-port-2/default.aspx.

(1) Each solution on the CDS baseline list has successfully completed a security control assessment conducted by a SCA, who has provided a statement that comprehensive review, analysis, and testing were performed and confirms (i.e., verifies) that the requirements are correctly defined and that the CD technology correctly implements required functionality and security requirements in a non-operational environment using UCDSMO-published CDS test standards. Types of CDSs include CDSs providing access, data transfer, and multi-level solutions to meet CD requirements.

(2) The submitter confirms to the UCDSMO that the CDS has life cycle support and sustainment.

(3) The AO will direct an onsite operational security assessment (i.e., site security control assessment) of CDSs on the CDS baseline list before a DSAWG or DoD ISRMC CDSA granting authorization to transfer information between interconnected security domains is implemented.

c. CDS Sunset List. CDSs are placed on the CDS sunset list because:

(1) Components of the solution have reached end of life and are no longer supported;

(2) They were superseded by a newer version or significant security relevant configuration modification;

(3) They no longer satisfy a needed capability; or

Change 1, 08/28/2017 ENCLOSURE 3 23

(4) The solution has been deemed to have serious security problems and the DoD ISRMC or designated representative has agreed that immediate removal or replacement is necessary.

d. CD Technology Lists. The CD technology lists identify existing, emerging, and enabling CD-related technologies and supporting activities. Technologies identified may be in various stages of development and deployment, and may not have undergone security control assessment.

2. ACQUISITION AND USE OF A CDS

a. Acquisition. CDSs will be acquired in accordance with Reference (x).

b. Trusted CDSs. CDSs will be protected throughout the entire system lifecycle in accordance with DoDI 5200.44 (Reference (af)) to protect against vulnerabilities in system design, sabotage, or subversion of a system’s critical functions or components by foreign intelligence, terrorists, or other hostile elements.

c. CDS Baseline List

(1) Assists the DoD Component CDSE and DoD Component customers in selecting an appropriate CDS.

(2) Identifies vendors that can provide a CD technology or CDS for the DoD Component

CDSE.

d. New CD Technology Life Cycle Sustainment and RMF. Each item on the CDS baseline list will have a program management support structure to ensure the provision for life cycle and sustainment of CD technologies and services in accordance with Reference (b) and (x).

(1) Mission or business ownership, CD technology development and integration, and the CDS security management oversight responsibilities must comply with the policy and procedures of References (b), (c), and (x) for all CD technology acquisitions, CDSAs, and operations within the deployed environment (e.g., an enclave).

(2) New CD technologies will be added to the CDS baseline list in accordance with References (b) and (c) and this instruction.

(3) The CD capabilities portfolio is the entry point for identifying new commercial CD technologies to meet DoD and IC common problem sets and projected CD capability

(4) A DoD Component wishing to sponsor a new CD technology for placement on the CDS baseline list must contact their CDSE for assistance and guidance to ensure any new CD related technology development activities are coordinated with the UCDSMO before initiation.

Change 1, 08/28/2017 ENCLOSURE 3 24

e. Life Cycle Support and Sustainment. The DoD Component CDSE must provide the

UCDSMO a written assertion from the CDS Program Management Office that funding is available to provide life-cycle support and sustainment for a CDS to be added to the CDS baseline list. In the case of commercial off-the-shelf hardware and software, the developer must either provide a statement that required support and sustainment are included in the acquisition costs or provide a cost schedule for service or maintenance. The DoD Component CDS Program Management Office must declare that, at a minimum, the CD technologies and service life cycle supports:

(1) Availability. The CDS is available and will be supported for both DoD and IC customers in accordance with DoD CIO, Assistant DNI, and IC Chief Information Officer (CIO) Memorandum (Reference (ag)). A CDS selected and approved for use will be supported in accordance with the support agreement (e.g., a MOA) between the CDS owner and customer.

(2) Configuration Management. The CDS security relevant configuration will be documented and managed throughout the development cycle and during operational use for the life of the CD technology.

(3) Distribution Control. Distribution control will be maintained for the life of the CDS.

(4) Product Support. To the greatest extent possible, the Program Management Office or developer must provide assurance that support for the hardware platform, operating system, application, and appropriate data rights will be available for the life of the product. This assurance should include a plan for POA&M development in the case of unforeseen software or hardware obsolescence.

(5) Software Maintenance. An outline or plan for how software updates, including patching, bug fixes, upgrades, and enhancements, will be provided.

(6) User Support. An outline or plan for how help desk, user documentation, administrative documentation, and training will be supplied.

f. Additional CDS Employment Guidance. The following additional guidance is provided on employing a CDS.

(1) Chaining. The use of direct or relayed connections from a higher accredited domain to a series of lower accredited domains after passing through an isolated device that implements the enforcement of all applicable approved policy decisions for each domain transfer is permitted.

(2) Cascading. The downward flow of information through a range of security levels greater than the accreditation range of a system, network, or component without passing through an isolated device that implements the enforcement of all applicable approved policy decisions for each domain transfer is prohibited.

Change 1, 08/28/2017 ENCLOSURE 3 25

(3) Diversity. To reduce the risk when accessing or transferring information between a range of security levels, the use of different CDSs should be considered if they are available and meet the mission requirements (e.g., using one CDS between unclassified to secret domains and using a second different CDS between secret to TS SCI security domains).

3. ENTERPRISE SERVICES

a. A DoD Component must use or transition to an enterprise service if the CD requirement can be met under the existing enterprise service CDSA criteria (e.g., classification level, data types, filters,…