Attachment 3 - DD254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

BY ORDER OF THE SECRETARY

OF THE AIR FORCE

AIR FORCE INSTRUCTION 16-1404

29 MAY 2015

AIR COMBAT COMMAND

Supplement

18 MAY 2017

Certified Current, 23 NOVEMBER 2020

Operations Support

AIR FORCE INFORMATION

SECURITY PROGRAM

COMPLIANCE WITH THIS PUBLICATION IS MANDATORY

ACCESSIBILITY: Publications and forms are available for downloading or ordering on the e-Publishing website at www.e-Publishing.af.mil/

RELEASABILITY: There are no releasability restrictions on this publication

OPR: SAF/AAZ

Supersedes: AFI 31-401, 1 November 2005;

AFI 31-406, 29 July 2004

Certified by: SAF/AA

(Ms. Zarodkiewicz)

Pages: 116

(ACC)

OPR: ACC/IP

Supersedes: AFI 31-401_ACCSUP, 7 April 2006

Certified by: HQ ACC/IP

(Mr. G. Timothy Patterson)

Pages: 30

This publication implements Air Force Policy Directive (AFPD) 16-14, Security Enterprise

Governance; Department of Defense (DoD) Directive 5210.50, Management of Serious Security

Incidents Involving Classified Information, DoD Instruction (DoDI) 5210.02, Access and

Dissemination of RD and FRD, DoDI 5210.83, DoD Unclassified Controlled Nuclear

Information (UCNI), DoD Manual (DoDM) 5200.01, DoD Information Security Program, Volume 1, Volume 2, Volume 3, and Volume 4; and DoDM 5200.45, Instructions for Developing

Security Classification Guides. It applies to individuals at all levels who create, handle, or store classified information and CUI, including Air Force Reserve, Air National Guard (ANG), and contractors when stated in the contract or DD Form 254, Department of Defense Contract

Security Classification Specification, except where noted otherwise. This AFI may be supplemented at any level, but all supplements will be routed to the Office of Primary

Responsibility (OPR) prior to certification and approval. Refer recommended changes and http://www.e-publishing.af.mil/

2 AFI16-1404_ACCSUP 18 MAY 2017

questions about this publication to the OPR listed above using the AF Form 847, Recommendation for Change of Publication; route AF Form 847 from the field through the appropriate chain of command. The authorities to waive wing/unit level requirements in this publication are identified with a Tier (“T-0, T-1, T-2, and T-3”) number following the compliance statement. See AFI 33-360, Publications and Forms Management, Table 1.1 for a description of the authorities associated with the tier numbers. Submit requests for waivers through the chain of command to the appropriate tier waiver approval authority, or alternately, to the publication OPR for non-tiered compliance items. Ensure that all records created as a result of processes prescribed in this publication are maintained in accordance with Air Force Manual

(AFMAN) 33-363, Management of Records, and disposed of in accordance with the Air Force

Records Information Management System (AFRIMS) Records Disposition Schedule (RDS). The use of the name or mark of any specific manufacturer, commercial product, commodity, or service in this publication does not imply endorsement by the Air Force.

(ACC) This supplement implements and extends the guidance of Air Force Instruction (AFI)

16-1404 Information Security Program Management. This supplement applies to Air Force

Reserve Command (AFRC) units that are tenants on Air Combat Command (ACC) installations and to the Air National Guard (ANG) only upon mobilization and when published to Air Force e-Publishing http://www.e-publishing.af.mil/index.asp under Air Combat Command. This publication may be supplemented at any level. Refer recommended changes and questions about this publication to the OPR listed above using the AF Form 847, Recommendation for Change of

Publication; route AF Form 847 from the field through the appropriate chain of command. The authorities to waive wing/unit level requirements in this publication are identified with a Tier

(“T-0, T-1, T-2, and T-3”) number following the compliance statement. See AFI 33-360, Publications and Forms Management, Table 1.1 for a description of the authorities associated with the tier numbers. Submit requests for waivers through the chain of command to the appropriate tier waiver approval authority, or alternately, to the publication OPR for non-tiered compliance items. Ensure that all records created as a result of processes prescribed in this publication are maintained IAW Air Force Manual (AFMAN) 33-363, Management of Records, and disposed of IAW Air Force Records Information Management System (AFRIMS) Records

Disposition Schedule (RDS). The use of the name or mark of any specific manufacturer, commercial product, commodity, or service in this publication does not imply endorsement by the Air Force.

SUMMARY OF CHANGES

The publication has been substantially revised and must be completely reviewed.

Chapter 1— PROGRAM OVERVIEW AND ADDITIONAL ROLES AND

RESPONSIBILITIES 7

1.1. Air Force Security Enterprise

1.2. Information Protection

1.3. Information Protection Oversight

http://www.e-publishing.af.mil/index.asp

AFI16-1404_ACCSUP 18 MAY 2017 3

1.4. Information Protection Managers

1.5. Information Protection Implementation

1.6. Air Force Information Security

1.7. Other Roles and Responsibilities

Chapter 2— AIR FORCE INFORMATION SECURITY IMPLEMENTATION 10

2.1. Security Program Executives (SPE)

2.2. MAJCOM/DRU Director, Information Protection

2.3. MAJCOM/DRU Information Security Specialist

2.4. Wing Commanders

2.5. Wing Chief, Information Protection

2.6. Wing Information Security Specialist

2.7. Commanders and Directors

2.8. Security Managers

Chapter 3— CLASSIFICATION, DECLASSIFICATION, AND MANDATORY

DECLASSIFICATION REVIEW (MDR) PROGRAM 23

3.1. Classification

3.2. Original Classification

3.3. Tentative Classification

3.4. Derivative Classification

3.5. Declassification and Changes in Classification

3.6. Mandatory Declassification Review (MDR) Program

Chapter 4— MARKING CLASSIFIED INFORMATION AND CONTROLLED

UNCLASSIFIED INFORMATION (CUI) 31

4.1. Classified Information

4.2. Controlled Unclassified Information (CUI)

Chapter 5— SAFEGUARDING, STORAGE AND DESTRUCTION, TRANSMISSION

AND TRANSPORTATION OF CLASSIFIED AND CONTROLLED

UNCLASSIFIED INFORMATION (CUI) 34

5.1. Safeguarding

5.2. Storage and Destruction

4 AFI16-1404_ACCSUP 18 MAY 2017

5.3. Transmission and Transportation

Chapter 6— SECURITY EDUCATION AND TRAINING AWARENESS 44

6.1. General Requirement

6.2. Initial Orientation Training

6.3. Special Training Requirements

6.4. Annual Refresher Training

6.5. OCA and Derivative Classifier Training Waivers

6.6. Declassification Authority Training and Certification Program

6.7. Management and Oversight Training

Chapter 7— SECURITY INCIDENTS INVOLVING CLASSIFIED INFORMATION 48

7.1. Introduction

7.2. Reporting and Notifications

7.3. Security Inquires

7.4. Security Investigations

7.5. Security Incident Reporting and Oversight

Chapter 8— NUCLEAR CLASSIFIED INFORMATION SECURITY (RESTRICTED

DATA (RD), FORMERLY RESTRICTED (FRD), CRITICAL NUCLEAR

WEAPONS DESIGN INFORMATION (CNWDI), AND DOE SIGMA)

AND NUCLEAR CUI 53

8.1. General

8.2. Restricted Data (RD) Management Official

8.3. The Director

8.4. The Deputy Chief of Staff, Logistics, Installations and Mission Support

(AF/A4)

8.5. The Assistant Chief of Staff, Strategic Deterrence & Nuclear Integration

(AF/A10)

8.6. Access to FRD

8.7. Access to RD

8.8. Access to CNWDI

8.9. Access to DOE Sigma Information

AFI16-1404_ACCSUP 18 MAY 2017 5

8.10. Derivative Classification and Marking of Nuclear Information

8.11. Reciprocity

8.12. Dissemination

8.13. Dissemination Prohibitions

8.14. Protection and Destruction of Nuclear Information

8.15. Declassification of RD and FRD Documents

8.16. Terminating RD/CNWDI Access for Cause

CHAPTER 9— NORTH ATLANTIC TREATY ORGANIZATION (NATO)

INFORMATION 59

9.1. General NATO Information

9.2. NATO Indoctrination Process

9.3. Granting U.S. Personnel Access to NATO Unclassified

9.4. Terminating U.S. Personnel Access to NATO Information

9.5. Access to NATO Information for Citizens of NATO Nations

9.6. Access to NATO Information for non-U.S. and non-NATO Nation citizens

9.7. NATO Security Clearance Certificates

9.8. Use of Coversheets

9.9. Storage and U.S. Information Systems (IS) Handling NATO Classified

Information

9.10. Marking, Downgrade/Declassification, Reproduction, Transmission, Destruction of NATO Information

Chapter 10— AIR FORCE INFORMATION SECURITY PROGRAM SELF-

INSPECTION AND OVERSIGHT 62

10.1. General

10.2. Frequency

10.3. Execution

10.4. Documentation

10.5. Self-Assessments

6 AFI16-1404_ACCSUP 18 MAY 2017

Chapter 11— STANDARD FORM (SF) 311, AGENCY SECURITY CLASSIFICATION

MANAGEMENT PROGRAM DATA 66

11.1. General

11.2. Part A and B

11.3. PART C

11.4. Part D

11.5. Parts E, F, and G

11.6. Part H

11.7. Part I

Attachment 1— GLOSSARY OF REFERENCES AND SUPPORTING INFORMATION 69

Attachment 2— AIR FORCE SECURITY CLASSIFICATION GUIDE TEMPLATE 77

Attachment 3— INSTRUCTIONS FOR COMPLETING DD FORM 2024 93

Attachment 4— CLASSIFIED MEETING/BRIEFING/CONFERENCE CHECKLIST 95

Attachment 5— INSTRUCTIONS FOR COMPLETING DOE FORM 5631.20 98

Attachment 6— OPERATIONAL VISUAL INSPECTION CHECKLIST 99

Attachment 7—(Added-ACC) RESIDENTIAL STORAGE REQUEST MEMORANDUM 101

Attachment 8—(Added-ACC) RISK ASSESSMENT TEMPLATE 103

Attachment 9—(Added-ACC) INQUIRY OF SECURITY INCIDENT REPORT 105

Attachment 10—(Added-ACC) PERSONAL WEARABLE FITNESS DEVICES (PWFDS) 107

Attachment 11—(Added-ACC) CONSTRUCTION GUIDELINES FOR SECURE

CONFERENCE FACILITIES 109

AFI16-1404_ACCSUP 18 MAY 2017 7

Chapter 1

PROGRAM OVERVIEW AND ADDITIONAL ROLES AND RESPONSIBILITIES

1.1. Air Force Security Enterprise. AFPD 16-14 defines the Air Force Security Enterprise as the organizations, infrastructure, and measures (to include policies, processes, procedures, and products) in place to safeguard AF personnel, information, operations, resources, technologies, facilities, and assets against harm, loss, or hostile acts and influences.

1.2. Information Protection. Information Protection is a subset of the Air Force Security

Enterprise. Information Protection consists of a set of three core security disciplines (Personnel, Industrial, and Information Security) used to:

1.2.1. Determine military, civilian, and contractor personnel’s eligibility to access classified information or occupy a sensitive position (Personnel Security).

1.2.2. Ensure the protection of classified information and controlled unclassified information

(CUI) released or disclosed to industry in connection with classified contracts (Industrial

Security).

1.2.3. Protect classified information and CUI that, if subject to unauthorized disclosure, could reasonably be expected to cause damage to national security (Information Security).

1.3. Information Protection Oversight. These key positions direct, administer, and oversee management, functioning and effectiveness of Information Protection.

1.3.1. The Senior Agency Official (SAF/AA) is the Secretary of the Air Force appointed authority responsible for the oversight of Information Protection for the Air Force.

1.3.2. The Security Program Executive (SPE) is appointed by the MAJCOM/DRU

Commander in accordance with AFPD 16-14 and is responsible for oversight of Information

Protection for their MAJCOM/DRU.

1.3.2.1. (Added-ACC) The Director, Information Protection implements the

Information Protection Program on behalf of the MAJCOM Commander. (T-2)

1.3.3. Wing Commanders provide oversight of Information Protection by ensuring security controls, safeguards, and countermeasures are established through application of risk management principles, as appropriate, for their wings. This may be delegated to the

Wing/CV.

1.4. Information Protection Managers. These key positions develop guidance, as necessary, and serve as principal advisors to the personnel identified in paragraph 1.3.

1.4.1. Director of Security, Special Program Oversight and Information Protection

(SAF/AAZ) is responsible to the Senior Agency Official and addresses the equities within the functional portfolio related to Information Protection.

1.4.2. MAJCOM/DRU Director, Information Protection is responsible to the SPE and for integrating Information Protection into MAJCOM/DRU operations and provides oversight and direction to the security specialists assigned to the MAJCOM/DRU Information

Protection Directorate/organizational structure.

8 AFI16-1404_ACCSUP 18 MAY 2017

1.4.3. Chief, Information Protection. Executes Information Protection on behalf of the Wing

Commander and provides oversight and direction to group and squadron commanders, directors, and security managers, and the security specialists assigned to the Wing

Information Protection Office.

1.4.3.1. (Added-ACC) The Chief, Information Protection implements the

Information Protection Program for the Wing Commander and works directly for the

Wing/CV. (T-1)

1.4.4. Commanders and Directors ensure military and civilian personnel are properly cleared for access to classified information and CUI, integrate contractors into their existing security programs, and protect classified information and CUI under their authority to support

Information Protection.

1.5. Information Protection Implementation. The key security professionals below are responsible for implementing Information Protection core security disciplines (information, industrial, and personnel security).

1.5.1. Security Specialists are Office of Personnel Management (OPM) occupational series

0080, Security Administration, and are responsible for implementing Information Protection core security disciplines (Information, Personnel, and Industrial Security). Security Specialist responsible for these core security disciplines:

1.5.1.1. At a MAJCOM/DRU are assigned to the Information Protection Directorate and report to the MAJCOM/DRU Director, Information Protection.

1.5.1.2. At Wings are assigned to the Wing Information Protection Office and report to the Wing Chief, Information Protection.

1.5.2. Security managers are principle advisors to group/squadron/detachment commanders, and directors. They implement the core security disciplines under the guidance and direction of the Wing’s Chief, Information Protection.

1.6. Air Force Information Security. Is a core security discipline within Information

Protection that is designed to identify and protect classified national security information and

CUI in accordance with DoD policy issuances. DoDM 5200.01, Volumes 1-4, DoDI 5210.02, DoDD 5210.50, DoDI 5210.83, and DoDM 5200.45 provide the foundational guidance and this

AFI clarifies responsibilities within these DoD governances where needed.

1.6.1. The Air Force standard guidance for marking collateral classified information is

DoDM 5200.01, Volume 2, Marking of Classified Information. Personnel assigned to Special

Access Program (SAP) and Sensitive Compartment Information (SCI) will follow additional guidance as mandated by their security officials. The standard for marking CUI (e.g., For

Official Use Only (FOUO)) is DoDM 5200.01, Volume 4, Controlled Unclassified

Information (CUI).

1.6.2. Submit requests for clarification through information protection channels to SAF/AAZ when conflicts between this publication and DoD guidance occur. (T-1)

1.6.3. Headquarters AFOTEC Information Protection maintains Information Protection oversight of all assigned AFOTEC headquarters agencies and geographically separated units.

(T-1)

AFI16-1404_ACCSUP 18 MAY 2017 9

1.7. Other Roles and Responsibilities. Several Air Force organizations have responsibilities in implementing the Air Force Information Security Program.

1.7.1. The Deputy Under Secretary of the Air Force, International Affairs (SAF/IA) serves as the senior official responsible for directing, administering, and overseeing the Air Force

Information Security Program pertaining to Foreign Government Information (FGI), the disclosure of classified information and CUI to foreign governments and international organizations, and security arrangements for international programs.

1.7.2. The Deputy Chief of Staff, Manpower, Personnel and Services (AF/A1) ensures civilian and military performance rating/appraisal systems includes the designation and management of classified information as a critical element or item to be evaluated in accordance with DoDM 5200.01, Volume 1.

1.7.3. The Deputy Chief of Staff, Intelligence, Surveillance and Reconnaissance (AF/A2) serves as the Air Force Head of the Intelligence Community Element (HICE) and is the authority for all actions regarding the security, use, and dissemination of SCI.

1.7.4. The Deputy Chief of Staff, Logistics, Installations and Mission Support (AF/A4) serves as the Air Force unclassified controlled nuclear information (UCNI) reviewing official.

1.7.5. The Assistant Chief of Staff, Strategic Deterrence & Nuclear Integration (AF/A10) provides subject matter expertise for information security issues related to Nuclear Weapons

Data (NWD).

1.7.6. SAF/CIO A6 ensures Information Systems Security Officials execute duties in accordance with DoDM 5200.01, Volume 1, Enclosure 2.

1.7.7. The Director, Information Management (SAF/AAI) serves as the focal point for the management of declassification programs to include Automatic, Systematic, Scheduled, and

Mandatory Declassification Review (MDR).

1.7.7.1. Establishes the Air Force declassification program IAW DoDM 5200.01, Volume 1, Enclosure 5 and develops declassification training. See Chapters 3 and 6 for details.

1.7.7.2. Establishes the Mandatory Declassification Review (MDR) Program for the Air

Force. See Chapter 3 for additional details.

1.7.7.3. Provides data for completion of the Agency Security Classification Management

Program Data, Agency Annual Self-Inspection Program Data, and Office of the Assistant to the Secretary of Defense reports.

1.7.7.4. Establishes Air Force criteria to evaluate declassification programs and assists with completing the Agency Self-Inspection Report.

1.7.8. The Commander, Headquarters United States Air Forces in Europe (USAFE) serves as the Air Force Executive Agent (EA) for the North Atlantic Treaty Organization (NATO)

Safeguarding Program. The USAFE Director, Information Protection represents the Air

Force at NATO meetings and interagency forums, and forwards requests to establish and disestablish AF sub-registries to the Central United States Registry (CUSR).

10 AFI16-1404_ACCSUP 18 MAY 2017

Chapter 2

AIR FORCE INFORMATION SECURITY IMPLEMENTATION

2.1. Security Program Executives (SPE). Uses the core security disciplines within

Information Protection and any other program’s processes (e.g., COMSEC, OPSEC, FDO, FOIA, PA, etc.) to identify, promote information sharing, facilitate judicious use of resources, and simplify management of, employ, maintain and enforce standards for safeguarding, storing, destroying, transmitting, and transporting; and mitigate the adverse effects of unauthorized access or disclosure, compromise or loss by investigating and acting upon reports of security violation involving classified information and CUI for the command.

2.1.1. Designate a Restricted Data Management Official if the command creates, stores, or handles Restricted Data (RD), Formerly Restricted Data (FRD), Critical Nuclear Weapons

Design Information (CNWDI), or Department of Energy (DOE) Sigma information.

2.1.1. (ACC) ACC/A10 is designated as the RD, CNWDI data management official. (T-

2)

2.1.2. Designate a NATO subregistry officer in accordance with United States Authority, North Atlantic Treaty Organization (NATO) (USSAN) 1-07 and DoDM 5200.01, Volume 1, Enclosure 2, if the MAJCOM/DRU creates, store or process NATO information.

2.1.3. Validate Original Classification Authority (OCA) designations annually, upon request.

2.1.3.1. OCAs that manage a security classification or declassification guide will maintain their authority until the security classification/declassification guide is terminated.

2.1.3.2. OCAs that do not manage or provide oversight of a security classification guide are validated by using the general rule standard in DoDM 5200.01, Volume 1, Enclosure

4.

2.1.4. Serve as the approval authority to allow command personnel to remove Secret and

Confidential information from designated working areas for work at home in accordance with DoDM 5200.01, Volume 3, Enclosure 2.

2.1.4. (ACC) ACC/IP will approve residential storage. (T-2)

2.1.5. Establish or leverage an existing forum to address issues related to the

MAJCOM/DRU security enterprise and mission.

2.1.6. Ensure appropriate security measures to protect classified information stored on military assets such as aircraft, military platforms or classified munitions items not specifically addressed in Chapter 5 of this AFI are adequately protected.

2.1.6.1. Coordinate with other MAJCOMs when in transit or deployed to support

MAJCOM operational missions.

2.1.6.2. Address specific measures for aircraft in foreign countries where non-U.S.

security support is provided.

AFI16-1404_ACCSUP 18 MAY 2017 11

2.1.7. Fully implement the MAJCOM/DRU MDR program by appointing primary and alternate MDR monitors in writing and submit the appointment to usaf.pentagon.saf-aa.mbx.mdr-workflow@mail.mil or mail to SAF/AAII, 1000 Air Force Pentagon, Washington DC, 20330-1000. Include the individual’s Rank/Grade, Name, Unit/Office

Symbol, Phone, E-mail, and Organizational Address.

2.1.7. (ACC) ACC/IP is designated as the MDR monitor. (T-2)

2.1.8. Submit Senior Agency Self-Inspection and Agency Security Classification

Management Program Data reports annually to SAF/AA in accordance with Chapters 10 and 11 of this AFI.

2.2. MAJCOM/DRU Director, Information Protection . Coordinates the execution of

Information Protection and collaborates with other security program managers (e.g., COMSEC, OPSEC, FDO, FOIA, PA, etc.) to identify, promote information sharing, facilitate judicious use of resources, and simplify management of, employ maintain and enforce standards for safeguarding, storing, destroying, transmitting, and transporting; and mitigate the adverse effects of unauthorized access or disclosure, compromise or loss by investigating and acting upon reports of security violation involving classified information and CUI on behalf of the SPE.

2.2.1. Provide the SPE risk-based countermeasure strategies to assure mission protection and success.

2.2.2. Chair/participate in SPE designated forum to address Information Protection concerns.

2.2.3. Ensure supplements and self-assessment checklists are coordinated with SAF/AAZ prior to publishing and loading into the Management Internal Control Tool (MICT) database.

2.2.4. Ensure Information, Industrial, and Personnel Security Specialists assigned to the

Information Protection Directorate are trained in accordance with Chapter 6 of this AFI.

This applies to any military personnel assigned to the directorate and managing the

Information, Industrial, or Personnel Security Program.

2.2.5. Serve as a focal point for Security, Education, Training and Awareness (SETA) by appointing an individual in the Information Protection Office to interact with SAF/AAZ

SETA Program Manager.

2.2.6. Develop and maintain security violations and infraction metrics and report them to

SAF/AAZ when requested.

2.2.7. Provide guidance to Wing Chief, Information Protection.

2.2.8. Provide direction to staff Directors and Special Staff.

2.2.9. Prepares Senior Agency Self-Inspection and Agency Security Classification

Management Program Data reports in accordance with Chapters 10 and 11 of this AFI for the SPE.

2.2.10. Develop staff packages for approval of classified residential storage.

2.2.10. (ACC) Submit residential storage requests through WG/IP to ACC/IP for approval. (T-2) Requests will contain full justification for residential storage. (T-2)

Requests will include the residence address, operating instruction/contingency plans for the protection of classified information, and Wing Cybersecurity Office (WCO) mailto:usaf.pentagon.saf-aa.mbx.mdr-workflow@mail.mil

12 AFI16-1404_ACCSUP 18 MAY 2017

certification stating communications system equipment meet TEMPEST requirements.

(T-2) See Attachment 7.

2.2.11. Coordinate with wings and perform staff assistance visits as required.

2.3. MAJCOM/DRU Information Security Specialist.

2.3.1. Analyze security violations and infractions to determine security impact on protecting classified information and CUI.

2.3.2. Determine training requirements for Top Secret Control Officers (TSCO), if mandated.

2.3.3. Coordinate security requirements with other commands to assure protection of classified information aboard aircraft and other military platforms.

2.3.4. Collect and maintain metrics for security violations and infractions.

2.3.5. Participate in development of risk-based countermeasure strategies to assure mission protection and success, as requested.

2.3.6. Provide oversight of the security incident inquiry/investigation process.

2.3.7. Identify security education and training requirements and communicates these requirements to the SAF/AAZ Information Protection Program SETA representative.

2.3.8. Provide documentation of OCA initial and refresher training, when requested.

2.3.9. Coordinate on security classification guides, instructions, and other program related guidance resources.

2.4. Wing Commanders. Uses the core security disciplines within Information Protection and coordinates with other program managers (e.g., COMSEC, OPSEC, etc.) to identify, promote information sharing, facilitate judicious use of resources, and simplify management of, employ maintain and enforce standards for safeguarding, storing, destroying, transmitting, and transporting; and mitigate the adverse effects of unauthorized access or disclosure, compromise or loss by investigating and acting upon reports of security violations involving classified information and CUI for the wing.

2.4.1. Designate a Restricted Data Management Official if the wing creates, stores, or handles RD, FRD, CNWDI, or DOE Sigma information. (T-1)

2.4.1. (ACC) Personnel assigned to the Wing Information Protection office cannot be appointed to serve in this role. (T-1)

2.4.2. Appoint a NATO Control Point Officer if the wing processes or stores NATO information. Request the establishment of a control point through your servicing NATO

Subregistry. (T-1) Multiple NATO control points could be established depending on the volume of NATO information the wing processes.

2.4.2. (ACC) Personnel assigned to the Wing Information Protection office cannot be appointed to serve in this role. (T-1)

2.4.2.1. (Added-ACC) The Wing IP office conducts annual inspection of NATO

Control Point (User Office), to ensure compliance with the current USSAN and

Central U.S. Registry inspection criteria. (T-2) Inspections will include an inventory

AFI16-1404_ACCSUP 18 MAY 2017 13

of physical (printed) material as well as electronic media. Inspection results will be submitted to the ACC Subregistry. (T-2)

2.4.3. When needed, make security-in-depth and supplemental control determinations, in accordance with Chapter 5 of this AFI. (T-1)

2.4.4. Establish 1 day each year with specific attention and effort focused on disposing of unneeded classified material (clean-out day). (T-0)

2.4.5. Reviews Wing’s annual self-inspection report and security classification management program data reports and submits results to the SPE. (T-1)

2.4.6. Ensure Chief, Information Protection is assigned as a member of the Wing’s

Integrated Defense Council. (T-1)

2.4.7. Approve and recertify open storage rooms/areas, as required. (T-1)

2.4.7. (ACC) CIPs are the approval official for open storage/secure rooms. (T-2) The open storage area will be approved or recertified, in writing, and the memorandum sent to the unit for posting on the inside of the open storage area entrance door. (T-2) Wing IP office and security manager maintains a copy of the package. (T-1) This also includes approval and recertification of secure conference rooms and risk assessments IAW DoD

5200.01, Volume 3, Enclosure 3. (T-1)

2.5. Wing Chief, Information Protection. Coordinates the execution of Information Protection and any other program’s processes (e.g., COMSEC, OPSEC, etc.) to identify, promote information sharing, facilitate judicious use of resources, and simplify management of, employ maintain and enforce standards for safeguarding, storing, destroying, transmitting, and transporting; and mitigate the adverse effects of unauthorized access or disclosure, compromise or loss by investigating and acting upon reports of security violation involving classified information and CUI on behalf of the Wing/CV.

2.5. (ACC) Wing Chief, Information Protection. Implements the Information, Personnel and Industrial Security Programs on behalf of the wing commander. (T-1) 25th AF/A2S will act as the Information Protection Office for Headquarters, 25th Air Force providing information protection services to the headquarters and its collocated subordinate organizations IAW AFI 16-1404 and this supplement. (T-1)

2.5.1. Ensures the Information, Industrial, and Personnel Security Specialists are trained

IAW DoDM 5200.01, Volume 3, Enclosure 5. (T-0) Chapter 6 of this AFI provides options for meeting this requirement.

2.5.2. Conducts staff assistance visits, when requested. (T-1)

2.5.3. Provides guidance, direction, coordination, and oversight to commanders, directors, security managers, TSCOs, and others in security management roles as necessary. (T-1)

Ensure they are kept abreast of changes in policies and procedures. (T-0)

2.5.4. Conducts annual self-inspection on major areas identified in DoDM 5200.01, Volume

1, Enclosure 2 and Chapter 10 of this AFI. (T-1)

2.5.4. (ACC) Provide results of the annual inspection to ACC/IP. (T-2)

14 AFI16-1404_ACCSUP 18 MAY 2017

2.5.5. Writes a wing instruction or leverage another directive that applies to all wing personnel, (T-1) which includes:

2.5.5.1. Provisions for safeguarding classified information during emergency situations and military operations, if appropriate. (T-0)

2.5.5.2. Security measures and procedures regarding visitors who require access to classified information or facilities that contain classified information. (T-0)

2.5.5.3. Identification of a classified storage location for personnel arriving unexpectedly or while in transit and in possession of classified information. (T-1)

2.5.5.3. (ACC) Wing Command Posts will provide an overnight repository for classified couriers making an emergency stop/lay over. (T-2) Classified couriers making routine or planned visits to ACC bases will coordinate classified storage requirements with the host unit being visited prior to their arrival. (T-1)

2.5.6. Assists commanders and directors with solving information security related issues.

2.5.7. Provides countermeasure strategies to assure mission protection.

2.5.8. Develops approval/recertification packages for open storage areas/secure rooms. (T-1)

Ensure the package includes a statement the room meets construction standards. (T-1)

2.5.8. (ACC) Reviews open storage/secure room certification during annual self-inspections to ensure no modifications or changes have occurred to the facility/operating instructions. (T-1) Conduct risk assessments on all open storage/secure rooms utilizing attached risk assessment template. (T-1) In addition, develop approval/recertification packages for secure conference rooms. See Attachment 8. (T-1)

2.5.8.1. Recommend coordinating with the local civil engineers and request an assessment of the construction standards.

2.5.8.2. Consider contacting the Wing Information Assurance Office.

2.5.8.3. Consult with parent unit when a new facility design may contain open storage rooms.

2.5.9. Prepares Senior Agency Self-Inspection and Agency Security Classification

Management Program Data reports for Wing/CC in accordance with Chapters 10 and 11 of this AFI and processes them through Information Protection channels to MAJCOM/DRU

Director, Information Protection. (T-1)

2.5.9. (ACC) Wing IP offices submits report to ACC/IP to meet required deadlines. (T-

2.5.10. Participates as a member of the Wing’s Integrated Defense Council. (T-1) This may be delegated to a member of the Information Protection Office.

2.5.11. (Added-ACC) Security manager (SM) meetings will be held no less than semiannually. (T-2) Based on risk and SM turnover, meetings may need to be held more frequently. Provide meeting minutes to all SMs and attendees. (T-2) Focus of these meetings should be concentrated on problems/trend areas and training deficiencies as required. (T-2) Exception: Due to expeditionary rotations, semi-annual meetings are not required for forward deployed locations (i.e. AFCENT, AFSOUTH, etc.). (T-2)

AFI16-1404_ACCSUP 18 MAY 2017 15

2.5.12. (Added-ACC) Establish and maintain files (electronic files are authorized) for each wing, tenant or geographically separated units that participates in the host installation information security program with the following official records, as appropriate, in accordance with (IAW) the RDS: (T-2)

2.5.12.1. (Added-ACC) Appointment memorandums for SMs, ASMs, and top-secret control officers/assistant (TSCO/TSCA). (T-2)

2.5.12.2. (Added-ACC) Copy of the last annual Wing unit self-inspection or

Information Protection Management Evaluation (IPME) report or assessment annotated in the Industrial, Information or Personnel Security MICT. (T-2) The USM is required to provide a memorandum every 30 days to the wing IP until all discrepancies noted on an annual program review or MICT assessment are corrected.

(T-2)

2.5.12.3. (Added-ACC) Copy of all secure room, vault and secure conference room approval/ recertification memorandums. (T-2)

2.5.12.4. (Added-ACC) Proof of required security manager training IAW DoD

5200.01. (T-2)

2.5.12.5. (Added-ACC) Security Incident Reports or a reference page to the file location. (T-2)

2.5.12.6. (Added-ACC) Other items as determined by the Wing CIP.

2.6. Wing Information Security Specialist.

2.6.1. Maintains records of OCA initial and annual training, if OCAs are assigned. Submit the documentation when requested. (T-1)

2.6.1. (ACC) Original Classification Authority (OCA). OCA training records must reflect position title, name of the OCA, and the date training was accomplished as a minimum. Provide ACC/IP a copy of training/recertification. (T-1)

2.6.2. Provides guidance and direction to commanders and directors or designated security manager when requested on all aspects of the Air Force Information Security Program. (T-1)

2.6.3. Provides oversight of the security incident inquiry/investigation process to include establishing a central tracking system. (T-1)

2.6.4. Analyzes security violations and infractions to determine security impact. (T-1)

2.6.5. Provides technical guidance and advice to commanders/directors for conducting information security risk assessments in accordance with DoDM 5200.01, Volume 3, Enclosure 3. (T-1)

2.6.6. Trains security managers on their duties and responsibilities in accordance with

Chapter 6 of this AFI. (T-1)

2.6.6. (ACC) Train all newly appointed Security Managers (SM) within 90 duty days of assignment. (T-1)

2.6.7. Coordinate on security classification and declassification guides, Air Force instructions, and other program related guidance resources as needed. (T-1)

16 AFI16-1404_ACCSUP 18 MAY 2017

2.6.8. Advises commanders on types of emergency plans to develop based on local threats of hostile actions, foreign intelligence, natural disasters, or terrorist activity. (T-1)

2.6.9. Provides OCAs and derivative classifiers guidance, direction, and oversight for marking classified information and CUI. (T-1)

2.6.10. Validates construction standards, with assistance from the Wing Civil Engineer if needed, for open storage area (secure room) and vaults, and recommends supplemental safeguarding standards, based on a risk assessment, to commanders and directors prior to approval. (T-1)

2.6.11. Provides commanders and directors assistance in developing exception to policy staff packages to deviate from protection standards identified in DoDM 5200.01. (T-1)

2.6.12. Integrate on-base contractor operations into the installation’s Information Security

Program. (T-1)

2.6.12.1. (Added-ACC) Contractors located on ACC installations will be designated as integrated visitor groups or intermittent visitors unless circumstances exist to identify the contractor operations as a cleared facility. (T-1)

2.6.12.2. (Added-ACC) On-base contractor cleared facilities are not recommended for ACC activities. ACC/IP must be notified prior to wing commanders authorizing a contractor to operate on the installation as a cleared facility. (T-1)

2.6.13. Coordinate with Wing Information Assurance Office to ensure full integration of information technology requirements to include: access, security, and response action to security incidents involving classified information and CUI on IT systems. (T-1)

2.6.14. Assist Chief, Information Protection with annual self-inspection.

2.7. Commanders and Directors.

2.7. (ACC) Commanders and Directors. Non-ACC units on ACC bases or geographically separated units supported by an ACC Base will need to enter into a host-tenant support agreement or memorandum of understanding to participate in the host base

Wing Information Security Program, unless they are included in their parent Wing’s program. (T-2) ACC units on non-ACC bases will enter into a host-tenant support agreement to participate in the host base Wing Information Security Program. (T-2) All program requirements established by ACC, the host base Wing and the parent MAJCOM/Wing, if required, must be adhered to by all units, regardless of whether they participate in the host base Wing’s program or not. (T-2) Non-ACC units on ACC bases that do not participate in the host base Wing’s program will provide copies of their parent Wing’s or HHQ’s self-inspection reports to ensure the host base Wing commander can properly assess risk. (T-1)

2.7.1. Appoint a Security Manager in accordance with DoDM 5200.01, Volume 1, Enclosure

2, and ensure they are trained IAW DoDM 5200.01, Volume 3, Enclosure 5 within 6 months of appointment. (T-0) Contractors and personnel assigned to the Information Protection

Directorate/Office cannot be appointed to serve in this role. Forward the appointment to the

Wing Information Protection Office. (T-1)

AFI16-1404_ACCSUP 18 MAY 2017 17

2.7.1. (ACC) Appoint at least one assistant SM. (T-2) SMs and assistant SM must be trained within 90 days of appointment. Alternate SM and assistant SM are synonymous.

2.7.1.1. Security managers may be appointed to serve combined populations of smaller units, groups, and staff agencies rather than multiple units appointing a security manager.

For example, a group may appoint a security manager to oversee all the assigned squadrons within the group and the squadrons appoint security assistants to perform administrative functions.

2.7.1.1. (ACC) The CIP will provide guidance for documenting these configurations. (T-2)

2.7.1.2. If assistant security managers are appointed, train to the same standard as the security managers. (T-0)

2.7.1.3. Security Assistants may be appointed to assist the security manager with performing administrative tasks such as processing forms for access or security clearances, documenting security education and training and validating security clearances. Appointments must be in writing and in accordance with DoDM 5200.01, Volume 1, Enclosure 3, and they must be trained within 6 months of assuming duties. (T-

0)

2.7.1.4. (Added-ACC) Each security container, open storage (secure room or vault) and/or live Secret Internet Protocol Router Network (SIPRNET) lockbox will have a responsible primary and alternate custodian. (T-2) Multiple containers and lockboxes can be administered by the same custodians. Use the SF 700 to identify the primary and alternate custodians and to record all combinations/combination changes as outlined IAW DODM 5200.01Volume 3, Enclosure 3. (T-2) Annotate and maintain documentation of training. (T-2)

2.7.1.5. (Added-ACC) Ensure security managers and alternate security managers, if available, attend SM meetings held by the Wing Information Protection Office. (T-2)

2.7.1.6. (Added-ACC) Top Secret Control Accounts. Establish an account and appoint, in writing, Top Secret Control Officer (TSCO) and Top Secret Control

Assistant (TSCA), if Top Secret material is routinely stored, received or dispatched.

2.7.2. Grant personnel access to classified information and continually evaluate their trustworthiness in accordance with DoDM 5200.01, Volume 1, Enclosure 2, and AFI 31-501

(CHANGING TO AFI 16-1405)), Personnel Security Program Management, and Chapters

5, 8, and 9 of this AFI. (T-0) This may not be delegated. (T-0) Ensure all collateral access is reflected in the security access requirement (SAR) level shown on the unit manning document. Consider suspension of an individual’s access whenever their trustworthiness, loyalty, or honesty becomes questionable in accordance with AFI 31-501 (CHANGING TO

AFI 16-1405). (T-1)

2.7.3. Implement an ongoing security education and training program which includes all elements detailed in Chapter 6 for initial and annual refresher training. (T-1)

18 AFI16-1404_ACCSUP 18 MAY 2017

2.7.4. Identify personnel whose duties require derivative classification and ensure they are trained IAW DoDM 5200.01, Volume 3, Enclosure 5. (T-0) Chapter 6 of this AFI identifies options to meet this requirement. As a minimum, persons with access to classified information systems will be identified. (T-1) Ensure training records are maintained by the individual or develop a system for maintaining the records. (T-1)

2.7.4. (ACC) The Unit Security Manager will maintain a copy of the derivative training documentation. (T-2) All required derivative classifier training will be completed prior to deployment. (T-2) Training certificates that have been obtained within two years may suffice for this requirement. (T-2)

2.7.4.1. Instruct derivative classifiers to document derivative classification decisions to support the annual security classification management program data collection effort when requested. (T-1)

2.7.5. Evaluate security incidents to determine appropriate measures to be taken to prevent further occurrences and if sanctions should be administered. (T-1)

2.7.6. Identify areas within the unit where classified information is discussed or processed.

(T-1) If the area contains information systems, communications systems, or cryptographic equipment contact the wing Information Assurance (IA) office to conduct an Emission

Security assessment of the areas prior to processing classified information. (T-1) If this assessment has not been completed prior to the publication of this AFI the wing IA office must be contacted within 6 months of the date of this AFI to schedule assessments. (T-1)

2.7.6.1. Areas such as open storage rooms, offices with secure telephone equipment

(STE), conference rooms, and etc. are examples. Do not restrict the list to just these areas or types of equipment.

2.7.7. Develop a unit security plan/instruction to: (T-1)

2.7.7.1. Protect, remove, or destroy classified material in case of fire, natural disaster, civil disturbance, terrorist activities, or enemy action based on the threats/risks of these incidents occurring. (T-0) Refer to DoDM 5200.01, Volume 3, Enclosure 2, and Wing

Information Protection Office for guidance on developing the plan.

2.7.7.2. Prohibit the use of government or personal cellular/PCS and or radio frequency

(RF), infrared (IR) wireless devices, and other devices such as cell phones and tablets, and devices that have photographic or audio recording capabilities in areas identified in paragraph 2.7.6 of this AFI in accordance with DoDD 8100.02, Use of Commercial

Wireless Devices, Services, and Technologies in the Department of Defense (DoD)

Global Information Grid (GIG) unless written approval has been received by the

Authorization Official, formerly called Designated Approving Authority. (T-0) Items listed in paragraph 2.5 of DoD 8100.02 are exempt.

2.7.7.3. Address security incidents when Government and personal cellular/PCS, RF wireless, and similar devices are discovered in Air Force-controlled classified areas. (T-

1) Refer to Chapter 5 of this AFI for additional information on processing these types of security incidents.

AFI16-1404_ACCSUP 18 MAY 2017 19

2.7.8. Establish a system to conduct end of day security checks using SF 701, Activity

Security Checklist, at the close of each duty and/or business day to ensure classified information is secure within unit work centers. (T-1) This is not required for 24/7 work centers.

2.7.8. (ACC) End of Day inspections will also be completed at shift change by those centers having 24/7 operations. (T-2)

2.7.9. Identify features, parts or functions of equipment used to process classified information that may retain all or part of the information. (T-0) Once identified develop security procedures to address safeguarding measures. (T-0) Refer to DoDM 5200.01, Volume 3, Enclosure 2, for guidance on what to address.

2.7.9. (ACC) Reproduction devices such as a Multi-Function Device (MFD) that have permanent memory may be authorized for classified use. (T-2) MFDs are considered IA enabled devices and as such must comply with AF Information Technology Commodity

Council (ITCC) standards, available through AFWay, and be configured IAW DISA

Security Technical Implementation Guide (STIG). (T-2) Use of an MFD must be documented in the enclave Authorization and Accreditation (A&A) package and approved by the AF Authorizing Official (AO). Work with your local WCO to meet

A&A requirements. (T-1). All systems utilized for classified reproduction, will have the following configuration:

2.7.9.1. (Added-ACC) Copiers used for classified reproduction will not be connected to the unclassified network. (T-2)

2.7.9.2. (Added-ACC) The FAX and email capability physically disabled. (T-2)

2.7.9.3. (Added-ACC) Immediate overwrite function enabled. (T-2)

2.7.9.4. (Added-ACC) No user data box or other storage is authorized, regardless of encryption options. (T-2)

2.7.9.5. (Added-ACC) Password enabled Hard Disk Drive (HDD) lock. (T-2)

2.7.9.6. (Added-ACC) Overwrite HDD/temporary data enabled for all jobs. (T-2)

2.7.9.7. (Added-ACC) Overwrite all HDD sanitization for end of life. (T-2)

2.7.9.8. (Added-ACC) Use ACCVA 16-1 Authorized to Process Classified Label &

ACCVA 16-3, MFD Authorized to Process Classified Poster. (T-2)

2.7.10. Will approve and address procedures for equipment used for reproducing Top Secret, Secret and Confidential information and if applicable, ensure the system is accredited. (T-1)

The approval must facilitate oversight and control of the reproduction of classified information and the use of the equipment for such reproduction. (T-1) Prior to approval review DoDM 5200.01, Volume 3, Enclosure 2, for addition guidance. Coordinate with

Wing Information Assurance to ensure accreditation requirements are identified and addressed or verified as not necessary, if device will be networked to a government IS. (T-1)

2.7.11. Establish a process to ensure the names of the people having knowledge of combinations to security containers, open storage rooms, and vaults are maintained on a list and combinations are changed in accordance with DoDM 5200.01, Volume 3, Enclosure 3.

(T-0)

20 AFI16-1404_ACCSUP 18 MAY 2017

2.7.11. (ACC) List personnel with knowledge of the security container combination on the SF700 or a separate list/memorandum if more than the SF700 will accommodate. (T-

2) The list/memorandum should be readily available upon request. (T-2)

2.7.12. Contact the Wing Information Protection Office to establish a secure room or a vault, and assist with risk assessment, if needed. (T-1) This includes new facility designs that may require secure rooms. (T-1) Do not use rooms until they are approved. (T-1)

2.7.12. (ACC) Notify the Wing Information Protection Office, in writing, when a secure room or vault is no longer used for classified storage. (T-2) Move any classified to another open storage area or security container prior to disestablishing the open storage area. (T-2)

2.7.12.1. (Added-ACC) The Commander or Director of the proposed area must submit a request for unattended open storage survey, in writing, to the Wing IPO. (T-

2) The request must include complete justification, e.g., size, amount, reason security containers cannot be used, etc., and type and level, of material or equipment to be openly stored. (T-2) Note: If the facility has 24/7 operations in place as a result of mission requirements, then no approval for unattended open storage is required. (T-1)

2.7.13. Approve classified meetings and conferences. Ensure:

2.7.13.1. An official has been designated as a security manager for the meeting if the organization’s security manager does not perform these duties. (T-0) This individual implements the security provisions established in DoDM 5200.01, Volume 3, Enclosure

2. See Attachment 4, Classified Meeting/Briefing/Conference Checklist, for quick reference.

2.7.13.2. Meetings or conferences, or classified sessions thereof, do not take place outside a U.S. Government facility or a cleared U.S. contractor facility with an appropriate facility security clearance unless an exception is approved in advanced by

SAF/AA. (T-0)

2.7.13.2. (ACC) The location where the classified meeting, conference or session is held must be located away from public areas and the perimeter controlled as specified in DoDM 5200.01, Volume 3, Enclosure 2. (T-0)

2.7.13.2.1. Submit exception requests to SAF/AAZ and include a security plan in accordance with DoDM 5200.01, Volume 3,…