Attach 1 - Cybersecurity Plan (CS) Plan.docx

Controlled Unclassified Information / FOUO

NAVAIR Patuxent River Naval Air Station Department of the Navy

RFP N00421-19-R-0099

ATTACHMENT (1)

Cyber Security (CS) Plan

Dated: 1 January 2017

Version 4.0

DISTRIBUTION STATEMENT D: Distribution authorized to DoD and U.S. DoD contractors only. Other requests shall be referred to Department of the Navy, NAVAIR, Program Information System Security Manager, Patuxent River, MD 20670-1547.

DESTRUCTION NOTICE

Destroy by any method that will prevent disclosure of contents or reconstruction of the document.

The content of this Cyber Security (CS) Plan has been established for the protection of Government data. Per Department of Defense Instruction (DoDI) 8582.01, industry partners are subject to the following requirements in order to establish a consistent and unified strategy for Government data protection. These requirements must be flowed down to any sub-contractors, suppliers and organizations that process Government data.

This CS Plan has further been established for the protection of all information being exchanged within this contract. The CS Plan also establishes the protection requirements of Government data that is processed by any “System” or “software’ that will be delivered to Government.

Per DFARS SUBPART 204.73, Covered Defense Information (CDI) is considered unclassified information. Per Presidential Directive Order 13556, November 2010 Controlled Unclassified Information (CUI) replaces categories and terms of unclassified information such as For Official Use Only (FOUO), Sensitive But Unclassified (SBU) and Law Enforcement Sensitive (LES) with the intent of utilizing a single term to improve uniformity across all Federal agencies. As CDI is a term for unclassified information it falls under the definition of CUI. CDI then must be treated as CUI. All unclassified information on this contract is considered Controlled Unclassified Information (CUI) unless specifically released and labeled as “Public” information by a Government Public Affairs Officer (PAO).

The contractor shall establish the Cyber Security (CS) Program pursuant to the requirements designated below. Furthermore the contractor shall address each of the requirements in this CS Plan within a Program Cyber Security Implementation Plan (PCSIP) utilizing Data Item Description (DID): DI-MGMT-82002 “NAVAIR Cyber security Implementation Plan” (CDRL A004, Cyber Security Implementation Plan). The Program CSIP shall serve as basis for establishing a cybersecurity baseline between this industry partner and the Naval Air Systems Command (NAVAIR) Platform Security office. Once approved by the Government the Program CSIP is intended to be utilized by other group/entities that are part of this industry partner. This is intended to not cause duplication of submitting a Program CSIP for each and every follow-up contract or delivery order. The Program CSIP will include a “roll up” of all applicable sub-contractors, suppliers, and other organizations that process Government data under this contract.

The Government will provide all necessary reference documents or electronic links to those documents not generally available to the industry partner as required. Throughout the life of the contract, if any instruction or document is replaced or superseded, the replacement or superseding instruction or document shall be applicable to the requirements defined in this CS Plan.

All CS authority within a program office rests with the civilian Program Information System Security Manager (PISSM). This authority has been designated via an appointment letter by the CS competency and the Program Manager. Questions regarding the requirements set forth in this CS Plan must be directed to the PISSM.

A.

CYBER SECURITY

Cyber Security (CS) is the discipline that protects and defends information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. These measures include providing for restoration of information systems by incorporating protection, detection, and reaction capabilities. The following paragraphs contain United States Public Law as well as Department of Defense (DoD) and Department of the Navy (DON) CS requirements. These CS requirements stem from various DoD, Secretary of the Navy (SECNAV), Office of the Chief of Naval Operations (OPNAV), and Naval Air Systems Command (NAVAIR) policies, directives, and instructions. United States Government herein described as "Government" officials have the authority to review and examine, in conjunction with contractor personnel, the CS controls on any contractor operated system containing government information for the purposes of ascertaining proper CS posture and implementation.

B.

ARCHITECTURE

The contractor’s network architecture shall maximize the use of the contractor’s existing infrastructure and that of its subcontractors, suppliers via the commercial Internet in order to maintain compatibility with the U.S. Government Wide Area Networks (WANs), such as NIPRNET, DREN, and NMCI. The contractor shall continue to utilize a network architecture which supports the mission needs of Navy/USMC Programs for the purposes of interoperability while maintaining the quality and timeliness of the technical information, data access, and delivery. The contractor shall utilize all observed network trends for the purposes of ascertaining the successful accomplishment of the preceding. The contractor shall make adjustments to its network infrastructure on an as needed basis for the purposes of meeting the mission requirements. Security measures shall be put in place in accordance with SECNAVINST 5239.3B, OPNAVINST 5239.3A, CJCSI 6211.02D, DoDI 8500.2, DoDI 8510.01, NIST 800-53 and DoDI 8520.02.

C.

CYBER SECURITY PRACTICES

The contractor shall adhere to the Department of the Navy’s (DON)’s Cyber Security Program prescribed methodologies for the protection of information to support DON missions. The contractor shall utilize existing methods and processes in order to deliver secure, interoperable and integrated information management (IM) and information technology (IT) to the DON and its contract support. The contractor shall ensure that all IT systems, software and interfaces that contain Government data meet government security certification standards and requirements appropriate to the particular classification level of operation as specified by the US Navy, Department of Defense, or other cognizant government authority for the purposes of the above mentioned DON goals in accordance with SECNAV M-5239.1. DON CS Program policies are listed in the REFERENCES section.

D.

PUBLIC KEY INFRASTRUCTURE (PKI):

Public Key Infrastructure (PKI) encryption is the chosen compliant DoD standard for protecting Controlled Unclassified Information (CUI) during transmission. CUI is defined as U.S. Government data that is NOT CLASSIFIED and that has NOT BEEN PUBLICALLY RELEASED. CUI includes but is not limited to data that is labeled or considered: For Official Use Only (FOUO), Privacy data, Contract Information, Unclassified Technical Data, Accountability information, DoD Sensitive But Unclassified (SBU). Failure to encrypt CUI during electronic transmission is considered a security weakness and must be corrected upon discovery via the contractor personnel responsible for CS. Multiple violations by individuals must be reported to the PISSM by the contractor for resolution. The contractor shall require its personnel to adhere to the required PKI policies stated herein when transmitting CUI.

The contractor shall implement DoD PKI policy per DoDI 8520.02. The contractor shall obtain and utilize PKI certificates issued by an approved External Certificate Authority (ECA) for the purposes of protecting all CUI. Approved PKI will be utilized by the contractor, its subcontractors, and suppliers when transmitting CUI via electronic means. Public Key Enablement (PKE) is the chosen DoD standard for authentication at the application level. The contractor shall utilize PKI when interacting with DoD PKI/PKE information systems and accessing DoD CUI or sensitive information.

E.

ELECTRONIC MAIL (E-MAIL):

The contractor shall utilize digital signature and encryption via DoD PKI or ECA digital certificates on all electronic mail (e-mail) messages containing CUI or e-mail messages that discuss any matter that may serve as an Operations Security (OPSEC) indicator, per DoDI 8520.02. If contractor personnel support multiple email addresses for use under this contract then a separate PKI certificate is required for each email address. Unapproved accounts, such as AOL, HOTMAIL or YAHOO, will not be used for official business under this contract unless specifically authorized to do so by the Government per CJCSI 6510.01F.

F.

DATA AT REST

The contractor shall ensure that an approved DoD product is utilized for Data at Rest (DAR) that is stored on mobile computing devices such as laptops and personal digital assistants (PDAs), or removable storage media. The cryptography shall be National Institute of Standards and Technology (NIST) Federal Information Processing Standard 140-2 (FIPS 140-2) compliant and a mechanism shall be established to ensure encrypted data can be recovered in the event the primary encryption system fails.

G.

WEB SITES, ELECTRONIC ROOMS (E-ROOMS), COLLOBORATION TOOLS, & CLOUD SERVICES

The contractor shall utilize DoD compliant PKI digital certificates to use as authenticators for accessing all DoD web sites and/or e-rooms and collaboration tools. The contractor shall utilize the official DoD remote conferencing collaboration tool, Defense Collaboration Services (DCS) (https://disa.deps.mil/disa/org/ES7/DCS/SitePages/Home.aspx) for all electronic collaborative efforts that contain DoD information.

Before hosting services such as but not limited to: web sites, e-rooms and sharepoint sites that contain DoD CUI information, the contractor shall investigate existing government tools and services to meet these requirements. In the event that existing services cannot be utilized, the contractor shall obtain government approval prior to implementing or utilizing any such services. If such services are deemed necessary by the government then, these tools shall be web based applications that enhance data delivery and distribution to include electronic collaboration and management tools. These efforts shall supplement existing legacy systems, and the Navy’s goals of web enablement of new technology and applications. Any developed systems shall utilize DoD PKI and PKE digital certificates as an authenticating mechanism and utilize existing encryption methods (i.e. Secure Sockets Layer (SSL) or Transport Layer Security (TLS) for the protection of CUI data.

The utilization of any “Cloud” services in support of this contract is unauthorized unless specifically authorized by the Government PISSM in writing.

For secure large electronic file exchange requirements, the NAVAIR External Sharepoint Site (Team Connect) will be utilized. The Government will provide and approve access to this site on a required basis. The industry partner shall ensure that the proper PKI credentials are utilized by individuals per section “D” of this CS Plan.

The U.S. Army Aviation and Missile Research Development and Engineer Center (AMRDEC) Safe Access File Exchange (SAFE) Web Application (https://safe.amrdec.army.mil/safe/) is not authorized for NAVAIR usage as this site allows usage for NON-CAC personnel. Per section “D” of this CS Plan only DOD CAC/PKI enforced authentication means are authorized. Exceptions may be granted for compelling operational requirements on a case-by-case basis by the PISSM in writing via encrypted email message.

H.

COMMON ACCESS CARDS (CAC) & SAAR-N FORMS

CAC

The government may approve and issue common access cards (CAC) to personnel supporting this contract on a case by case basis. CAC request shall be initiated using the Trusted Associate Sponsorship System Consent to Monitor (TASS) (https://www.dmdc.osd.mil/TASS/). A Trusted Agent (TA) will be identified by the Government to the Contractor for CAC issuance.

CAC applicants shall submit an initial request for a CAC or government credential to the Trusted Agent (TA) and log in to TASS to complete and submit the online application for government credentials. The sponsoring DoD Agency will provide the Applicant Request Form which is the necessary information and appropriate paperwork required for obtaining a government credential. The contractor shall then vet the Applicant using the DoD approved process. Once the Applicant, Contracting Agency, and Sponsoring Agency provide the necessary information, the Applicant shall submit the required information to the TA.

The TA will verify that the contractor has vetted the Applicant and establish the affiliation of the Applicant with the service or agency. Once the TA confirms the vetting and ensures all other requirements have been satisfied, he or she creates an application in TASS for submission.

Once the TA submits a new application for an Applicant, the TA will provide the Applicant (via secure means) the TASS weblink and his or her user ID and temporary password. The Applicant shall then log in to TASS to complete and submit the application. Once the TA submits the application, the Applicant has seven days to complete an initial log in to TASS and begin the application process, or TASS will automatically disable the Applicant's application.

Per DTM 08-003, the Next Generation CAC Implementation Guidance document, initial CAC issuance requires, at a minimum, the completion of FBI fingerprint check with favorable results and submission of a National Agency Check with Inquiries (NACI) to the Office of Personnel Management (OPM), or a DoD-determined equivalent investigation. Per DoD Manual 1000.13, Volume 1 (Enclosure 2, Section 6C) only an official government email address (e.g., .mil, .gov, .edu) may be entered into a CAC. Contractor email addresses are NOT authorized on the CAC and it is the responsibility of the contractor company to provide a valid ECA PKI certificate associated with the contractor’s official email addresses for usage and in support under this contract.

SAAR-N Forms

All personnel in support of this contract with requirements for accessing government IT systems must provide a completed System Authorization Access Request –Navy (SAAR-N) form (OPNAV 5239/14 (Rev 9/2011) or latest version thereof) and a completed Cyber Awareness Challenge ver. 2.0 or latest version thereof. This training is available at the following location: http://iase.disa.mil/eta/cyberchallenge/launchPage.htm. The contractor shall establish a CAC/SAAR-N POC to coordinate with the government in such matters. The CAC/SAAR-N POC shall deliver completed TASS Registration Request (TRR) and SAAR-N forms electronically for approval and processing by the government. SAAR-N forms shall be digitally signed by all signatories using either their DoD or ECA issued PKI certificate.

I.

CONTRACTOR OWNED UNCLASSIFIED NETWORK SECURITY

The contractor shall take means (defense-in-depth measures) necessary to protect the confidentiality, integrity, and availability of government-controlled unclassified information in the same manner as the contractor would protect its own unclassified company proprietary information. Access to government CUI from an external source shall use DoD ECA PKI certificates for authentication. The contractor shall ensure that contractor-owned or operated unclassified IT network assets (including assets used for contractor Teleworkers) used to process sensitive government information (CUI) are managed and maintained in accordance with commercial best practices, vendor-specific, or other nationally or internationally-recognized IT configuration and management standards (e.g., Contract Instruction Services (CIS), Control Objectives for Information and related Technology (COBIT®), Common Criteria (CC), National Information Assurance Program (NIAP), DoD, Defense Information Systems Agency (DISA), International Computer Security Association (ICSA), National Industrial Security Program (NIST), National Security Agency (NSA), System Administration, Networking, and Security Institute (SANS), Sarbanes-Oxley (SOX), ISO/IEC 27002:2005.

J.

INFORMATION SECURITY REQUIREMENTS FOR PROTECTION OF UNCLASSIFIED DOD INFORMATION ON NON-DOD SYSTEMS

The contractor shall safeguard unclassified DoD information stored on non-DoD information systems to prevent the loss, misuse, and unauthorized access to or modification of this information. The contractor shall:

a. Not process DoD information on public computers (e.g., those available for use by the general public in kiosks or hotel business centers) or computers that do not have access control.

b. Protect information by no less than one physical or electronic barrier (e.g., locked container or room, login and password) when not under direct individual control.

c. Sanitize media (e.g., overwrite) before external release or disposal.

d. Encrypt the information that has been identified as CUI when it is stored on mobile computing devices such as

e. Limit information transfer to subcontractors or teaming partners with a need to know and a commitment to at least the same level of protection.

f. Transmit voice and fax transmissions only when there is a reasonable assurance that access is limited to authorized recipients.

g. Not post DoD information to Web sites that are publicly available. Access control may be provided by an internal company intranet which adheres to paragraph “K” CONTRACTOR OWNED UNCLASSIFIED NETWORK SECURITY.

h. Provide protection against computer network intrusions and data exfiltration, including no less than the following:

(1) Current and regularly updated malware protection services, e.g., anti-virus, anti-spyware.

(2) Monitoring and control of inbound and outbound network traffic as appropriate (e.g., at the external boundary, sub-networks, individual hosts) including blocking unauthorized ingress, egress, and exfiltration through technologies such as firewalls and router policies, intrusion prevention or detection services, and host-based security services.

(3) Prompt application of security-relevant software patches, service packs, and hot fixes.

i. Comply with other Federal and DoD information protection and reporting requirements for specified categories of information (e.g., Critical Program Information (CPI), Personally Identifiable Information (PII), export controlled information) IAW the requirements of the contract.

K.

CLASSIFIED SYSTEMS

All classified information to be transmitted via electronic media shall use a cryptographic system authorized by the Director, National Security Agency in accordance with SECNAVINST 5510.36A Department of the Navy Information and Personnel Security Program Regulation.

The contractor must maintain accreditation with the Defense Security System (DSS) in instances where the contractor is operating a Special Test Equipment (STE) or Test Bench (TB) as required by NISPOM standards. Maintaining accreditation is defined as having and maintaining a valid Authority To Operate (ATO) from the Authorizing Official (AO) during the lifecycle of such a system. In order to maintain valid accreditation the contractor must ensure that all facets of accreditation standards are met.

One such standard is maintaining a valid and supportable operating system(s) for the STE or TB during the lifecycle of the system.

The contractor must alert and notify the government when an operating system is in danger to not being supported and/or not meeting accreditation standards one year prior to the lapse in accreditation. The contractor must provide sufficient resources to ensure a proper plan is maintained and executed to meet these requirements. In instances were a waiver in the form of a Risk Acceptance Letter (RAL) is required from the Government, the contractor must provide a request for such a RAL. A RAL from the government may be issued if the following conditions are maintained:

A. A request letter with reasons and rationale that articulate the non-compliance.

B. A detailed Plan of Action & Milestones (POA&M) document for rectifying the non-compliance.

C. A Rough Order of Magnitude (ROM) that articulates the cost of rectifying the non-compliance.

D. A detailed schedule and timeline for rectifying the non-compliance.

In the event that a RAL letter is issued, the duration of the letter will be dependent on the agreed upon established timeline and on the progress being made as stated in the POA&M.

L.

CLASSIFIED SPILLAGES & INFORMATION LEAKAGE

All classified spillages either initiated or received by the contractor containing NAVAIR data shall be reported to the Program Information System Security Manager (PISSM) and the Program Security Manager (PSM) within 24 hours of the incident.

Information leakage occurs when an adversary exploits a network or network system and begins syphoning information from those systems. In the event of an information leakage involving NAVAIR data, that incident shall be reported to the Program Information System Security Manager (PISSM) and the Program Security Manager (PSM) within 24 hours of the incident. Furthermore, an investigation shall occur in order to develop a Plan Of Action & Milestone (POA&M). The POA&M shall be submitted to the Government to ensure a similar incident does not occur. . The contractor shall conduct the investigation for any information leakage occurring at their site.

M.

PROCUREMENT OF CELLULAR TELEPHONES, PDA’S, AIR CARDS AND CALLING CARDS

Per OPNAVINST 2100.2A the contractor shall not procure cellular telephones, personal digital assistants (PDA’s), air cards and calling cards for the usage by U.S. Military and Civilian personnel.

Intentionally left blank.

REFERENCES

NIST SP 800-131A Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths

NIST SP 800-171 Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, dated June 2015. Updates as of 1-14-2016

NIST SP 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems, dated February 2010.

SECNAVINST 5510.36A DON Information Security Program, dated October 6, 2006.

Vice Chief of Naval Operations Joint Memo Ser. N09/16U100548 (8 NOV 2016)

For Information Assurance-Related Policies and Issuances:

For OPNAV / SECNAV / Navy Documents see: http://doni.daps.dla.mil/default.aspx For DoD Documents see: http://www.dtic.mil/whs/directives/index.html# For MIL Documents see: https://assist.daps.dla.mil/quicksearch/

For Classified Documents formally request from NAVAIR For links to Cyber Security-Related Policies and Issuances please go to:

http://iac.dtic.mil/csiac/ia_policychart.html

CS ACRONYMS

IA Definitions (per SECNAV M-5239.1)

Accreditation - Formal declaration by the DAA that an information system is approved to operate in a particular security mode using a prescribed set of safeguards at an acceptable level of risk.

Authentication - Authentication is assurance of the identity of a message sender or receiver. Authentication is the security measure designed to establish the validity of a transmission, message, or originator, or a means of verifying an individual's authorization to receive specific categories of information.

Authenticator - The means used to confirm the identity of a station, originator, or individual.

Availability - Availability is assurance of timely, reliable access to data and information systems by authorized users. Availability focused IA controls protect against degraded capabilities and denial of service conditions.

Certification - Comprehensive evaluation of the technical and nontechnical security features of an information system and other safeguards, made in support of the accreditation process, to establish the extent that a particular design and implementation meets a set of specified security requirements.

Class (Control) - IA controls are organized into three classes: management, operational, and technical.

Computer Network Attack - Operations to disrupt, deny, degrade, or destroy information resident in computers and computer networks or the computers and networks themselves.

Confidentiality - Confidentiality is assurance that information is not disclosed to unauthorized persons, processes, or devices. It includes both the protection of operational information and the protection of IA-related system information such as password or configuration files.

Controls - The management, operational, and technical safeguards or countermeasures prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information. Controls also provide authentication and non-repudiation of communications.

Demilitarized Zone - A “screened subnet” that exists logically between the public domain (Internet) and the DISN. This boundary condition can be physical or virtual and is intended to isolate less secure systems and networks.

Enclave - Collection of computing environments connected by one or more internal networks under the control of a single authority and security policy, including personnel and physical security.

Family (Control) - Within each IA control class, individual controls are grouped into families. A family consists of two or more controls designed to accomplish a similar purpose such as Certification and Accreditation or Contingency Planning.

Incident -Assessed occurrence having actual or potentially adverse effects on an information system.(COMSEC) Occurrence that potentially jeopardizes the security of COMSEC material or the secure electrical transmission of national security information or information governed by 10 U.S.C. Section 2315.

Cyber Security - Measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and no repudiation. These measures include providing for restoration of information systems by incorporating protection, detection, and reaction capabilities.

Information Operations - Actions taken to affect adversary information and information systems, while defending one’s own information and information systems. Information Operations require the close, continuous integration of offensive and defensive capabilities and activities, as well as effective design, integration, and interaction of command and control with intelligence support. Information Operations are conducted through the integration of many capabilities and related activities.

Information System - Set of information resources organized for the collection, storage, processing, maintenance, use, sharing, dissemination, disposition, display, or transmission of information.

Information System Security Manager – Individual responsible for the management of the Cyber Security Program.

Information System Security Officer – Individual responsible for the management of a Cyber Security system.

Integrity - Integrity is assurance that information is not modified by unauthorized parties or in an unauthorized manner. Integrity supports the assurance that information is not accidentally or maliciously manipulated, altered, or corrupted. Additionally, integrity implies the ability to detect when information has been altered.

Legacy System - An existing system that is designated for closure when the capability is absorbed by an interim or core system or if the capability is no longer required. No modifications or enhancements are made to legacy systems.

Management Controls - The management class of IA controls addresses topics that may be characterized as managerial. They are techniques and concerns that are normally directed or addressed by leadership. They focus on the management of IA and the management of risk.

Mission Assurance Category - Applicable to all DoD information systems, the mission assurance category reflects the importance of information relative to the achievement of DoD goals and objectives, particularly the warfighters' combat mission. Mission assurance categories are primarily used to determine the requirements for availability and integrity.

Mission Critical (System) - A system the loss of which would cause the stoppage of warfighter operations or direct mission support of warfighter operations.

Mission Essential (System) - A system that is basic and necessary for the accomplishment of the organizational mission.

Mission Support (System) - A system handling information that is important to the support of deployed and contingency forces. It must be absolutely accurate, but can sustain minimal delay without seriously affecting operational readiness or mission effectiveness (may be classified, but is more likely to be sensitive or unclassified).

Net-centricity - Net-centricity is the realization of a networked environment (including infrastructure, systems, processes, and people) that enables a completely different approach to warfighting and business operations. It compels a shift to a “many-to-many” exchange of data, enabling many users and applications to leverage the same data. This extends beyond the traditional focus on standardized, predefined, point-to point interfaces.

Non-repudiation - Non-repudiation is assurance that the sender of data is provided with proof of delivery and the recipient is provided with proof of the sender's identity, so neither can later deny having processed the data.

Operational Controls - The operational class of IA controls focus on activities that are implemented and executed by people as opposed to systems. These controls are put in place to improve the security of a particular system (or group of systems). They often require technical or specialized expertise and rely upon management activities as well as technical controls.

Risk - Possibility that a particular threat will adversely impact an information system by exploiting a particular vulnerability.

Technical Controls - The technical class of IA controls focus on IA controls that are set up by people but executed by systems. To be effective, these controls are dependent upon the proper functioning of the systems. Implementation of technical controls requires significant operational considerations and should be consistent with the management of IA within the organization.

Threat - Any circumstance or event with the potential to adversely impact an information system through unauthorized access, destruction, disclosure, modification of data, and/or denial of service.

image1.png