Attachment 8 - CARDEROCKDIVINST 5239.6C.pdf

CARDEROCKDIVINST 5239.6C

Code 104 7 Apr 2017

CARDEROCKDIV INSTRUCTION 5239.6C

From: Commanding Officer

Subj: USE OF PORTABLE ELECTRONIC DEVICES

Ref: (a) NAVSEAINST 5239.2A

(b) SECNAVINST 5239.3C

(c) CNO WASHINGTON DC 141502Z Sep 15 (NAVADMIN 216/15)

(d) CNSS Instruction 4009, National Information Assurance Glossary of 26 April 2010

(e) OPNAV N9210.3, Safeguarding of Naval Nuclear Propulsion Information

(f) DoD CIO memo, Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and Removable Storage Media, 3 July 2007

(g) SECNAVINST 2075.1

(h) DoD Instruction 8420.01 of 3 November 2009

(i) DoD Directive 8100.02 of 14 April 2004

1. Purpose. To establish policy for the use of Portable Electronic Devices (PEDs) at the Naval Surface Warfare Center, Carderock Division (NSWCCD), West Bethesda site and Detachments, consistent with references (a), (b), and (c). Additionally, this instruction details requirements for protecting US Government information when using PEDs at other than NSWCCD facilities.

PEDs policies for acceptable use in specific Department of the Navy (DON) spaces are based on each device’s capabilities.

2. Cancellation. CARDEROCKDIVINST 5239.6B of 9 July 2010.

3. Scope

a. This instruction applies to all NSWCCD personnel, military, civilian, contractor, visitors and tenant activities at the West Bethesda site and all detachments.

b. This instruction applies to all devices broadly meeting the definition of PEDs found in reference (d). The portion providing Personal Wearable Fitness Device (PWFD) authorization is applicable to spaces located in the Continental United States, Alaska, and Hawaii.

DEPARTMENT OF THE NAVY

NAVAL SURFACE WARFARE CENTER

CARDEROCK DIVISION

9500 MACARTHUR BOULEVARD

WEST BETHESDA MD 20817-5700

IN REPLY REFER TO:

c. Exclusions. This instruction does not address wearing PWFDs in Sensitive Compartmented Information Facilities (SCIFs), or areas authorized for Special Access Programs.

In those instances, refer to the Special Security Officer (SSO) and/or SAP Control Officer (SAPCO) for guidance.

(1) This instruction does not apply to equipment specifically exempted by higher guidance, i.e., COMSEC equipment or material.

(2) Per reference (e), this instruction is not applicable to NAVSEA 08 controlled facilities.

(3) This instruction is not applicable to properly credentialed Law Enforcement (LE) or Inspector General (IG) personnel in performance of their official duties.

(4) Unless otherwise indicated, DoD and Navy Enterprise managed contracts (e.g., NMCI/NGEN) are outside the scope of this instruction.

4. Policy

a. An integral part of Cybersecurity involves the ability to limit the use of electronic devices that may interfere with designed electronic security measures or passively mitigate normal security measures, such as recording. PEDs present both of these risks and, as such, must be closely controlled. Per reference (d), PEDs are defined as any non-stationary electronic apparatus with the capability of recording, storing, and/or transmitting data, voice, video, or photo images and any device of similar capability, functionality, or design. PEDs include government procured; contractor furnished, or personally owned devices, such as:

(1) Mobile Computing Devices (laptops, notebooks, netbook computers, wireless computers, etc.);

(2) Personal Digital Assistants (PDAs) (iPhones, Smartphones, iPads, etc.);

(3) Cameras (digital or film, still or video);

(4) Sound recorders (analog and/or digital);

(5) Personal, Wearable Fitness Devices (Fitbit, Jawbone Up, Nike Fuel Band, etc.).

b. DoD-Owned PEDs

(1) DoD-owned PEDs designated for use in NSWCCD facilities and spaces will be positively identified as US Government assets. Each will be assigned an asset tag, and will be registered in the NSWCCD Information Technology (IT) asset inventory.

(2) Prior to being issued to users or being used to process any Government data (entering, manipulating, storing or transmitting data), DoD-owned PEDs will be configured with appropriate security settings. Appropriate security settings will include Information Assurance Vulnerability Alert (IAVA), Defense Information systems Agency (DISA) Security Technical Implementation Guide (STIG) compliance, updated Anti-virus, DoD required software (i.e., Host Based Security System (HBSS), encryption), and installation of a Virtual Private Network (VPN) Client for any devices that will be permitted to use remote access.

(3) PEDs without identification and authentication capabilities built-in or added to the system will be used only for administrative tasks, such as maintaining appointment calendars and non-sensitive contact lists.

c. Non-DoD PEDs

(1) Non-DoD PEDs are not authorized for use at any NSWCCD facility, and will not be connected to any NSWCCD system or network, unless specifically authorized in writing by the Information System Security Manager (ISSM). Non-DoD PED exclusion zones will be clearly defined. The use of any unauthorized PEDs will result in the device being confiscated for forensic analysis and/or possible destruction.

(2) Non-DoD PEDs are prohibited from processing Controlled Unclassified Information (CUI), except where specifically authorized in official contract documents, with final approval by the ISSM. Temporary authorization (up to 1 year) for non-DoD PEDs to handle CUI must be authorized for the temporary operation of a non-DoD PED in NSWCCD facilities and spaces for a period up to 1 year will be requested using the CARDEROCKDIV Form 5239/9, Authorization Request for Operation of Non-DoD PEDs at NSWCCD, which may be accessed at the following link: https://cuthill.crdr.navy.mil/intra/cyber_security/index.html.

(3) While at a NSWCCD facility, employees may exit Non-DoD PED exclusion zones and use their devices outside. Employees are prohibited from taking photographs or making video/voice recordings, unless specifically authorized in writing by the cognizant security manager.

d. SCIFs and Classified Materials

(1) PEDs are prohibited in SCIFs and approved classified open storage facilities, except when specifically authorized in writing by the cognizant security manager. Such authorizations will be rare, and will include the requirement to disable the infrared (IR) and radio frequency (RF) capabilities of the PED before may be carried into the SCIF.

(2) Per reference (e), PEDs will not be used for processing of Naval Nuclear Propulsion Information (NNPI) and/or Not Releasable to Foreign Nationals (NOFORN) information, except where authorized in writing by NAVSEA 08 and the cognizant security manager.

https://cuthill.crdr.navy.mil/intra/cyber_security/index.html

e. All unclassified DoD Data at Rest (DAR) that has not been approved for public release, and is stored on PEDs, must be treated as sensitive data and encrypted using commercially available encryption technology per reference (i). Only DON approved enterprise DAR products may be used.

5. Network Connected PEDs

a. PEDs may not be connected to systems or networks processing CUI and/or classified information without cognizant AO approval. This includes Navy/Marine Corps Intranet (NMCI), Research, Development, Test and Evaluation (RDT&E), or legacy/residual/standalone systems.

b. All network-connected PEDs must be scanned and remediated, per the Command’s Vulnerability Management Process.

c. PEDs that use commercial Wireless Local Area Network (WLAN) devices, services, and technologies must comply with references (h) and (i). Compliance includes the requirement that all WLAN traffic must be protected, at a minimum, by a Federal Information Processing Standards (FIPS) 140-2 certified device that authenticates and encrypts data.

d. PEDs may not have WLAN features active while physically connected to a desktop PC or otherwise connected to the network. All wireless communication systems must be included in the Assessment and Authorization process, per reference (h). Pilot projects must implement appropriate security requirements and processes during development of the system.

e. Personal Area Networks (e.g., Bluetooth) may be operated in Government network environments, provided they comply with the security requirements detailed in current DISA Wireless STIGs. Security compliance requirements include device-level authentication and data encryption.

6. Use of DoD or Other Authorized PEDs on Official Government Travel

a. Standalone PEDs that are not a part of the Command’s monthly Vulnerability Management Process will be registered using CARDEROCKDIV Form 5239/9, Authorization Request for Operation of Non-DoD PEDs at NSWCCD, scanned, and remediated prior to leaving NSWCCD facilities. The form may be accessed at the following link:

https://cuthill.crdr.navy.mil/intra/cyber_security/index.html.

b. Network connected PEDs (RDT&E/Legacy) leaving NSWCCD facilities for official government travel must be registered using CARDEROCKDIV Form 5239/9A, Registration of NSWCCD Portable Electron Devices on Official Government Travel, and certified as compliant by the cognizant ISSM. The form may be accessed at the following link:

https://cuthill.crdr.navy.mil/intra/cyber_security/index.html.

c. Foreign Travel

(1) All PEDs that will be used while on foreign travel will be examined by the cognizant ISSO prior to departure.

(2) Personnel returning from foreign travel will coordinate with the cognizant ISSO and ISSM to schedule a vulnerability and virus scanning for IT assets used while on travel. Scanning and remediation will be performed prior to reconnecting the asset to any NSWCCD system or network.

d. DoD-owned PEDs may not be joined to any network without cognizant AO approval.

e. Any remote access into NSWCCD networks will be authorized via the NSWCCD VPN/Remote Access Approval Process.

f. CUI and/or classified information can never be stored or transported on personally-owned or foreign-supplied PEDs or removable media. Any PED or removable media containing CUI removed from protected workplaces must conform to the procedures outlined in reference (b).

g. All personnel are reminded that there is no assurance of privacy in the use of any IT asset when connected to the Internet, especially overseas. When connected to the Internet and using e-mail, the connection is subject to monitoring, interception, accessing, and recording.

h. To ensure the integrity, safety, and security of Navy IT resources, including data, and DON CIO Acceptable use memo, all personnel will abide by the User Responsibilities set forth in the System Authorization Access Request (SAAR-N).

i. While overseas on personal travel, NSWCCD employees and contractors may not take DoD-owned PEDs or removable media without ISSM approval.

j. The threat to Operations Security (OPSEC) and personal security is increased when on official government travel outside the United States. Transporting DoD-owned PEDs and removable media when on official government travel should be minimized to the extent possible to reduce the risk to operational and personal security.

7. PWFD

a. Personnel may be authorized to wear PWFDs in all NSWCCD spaces where collateral classified and/or controlled unclassified information is processed, stored, or discussed as long as the device has no Wi-Fi, cellular, or audio/video recording capability.

b. NSWCCD assigned personnel wearing PWFDs will read and comply with reference (h), acknowledge in writing (or signed email) to their supervisor that they have read the reference and that the device meets the referenced requirements. This acknowledgement must be maintained by the employee’s supervisor as long as the device is worn within NSWCCD facilities.

c. Employees who are unsure whether their PWFD is in compliance with the standards will notify their supervisor, who will obtain guidance and approval through the CSM and ISSM prior to introducing it into NSWCCD facilities.

8. Wi-Fi Hotspots and Personal Hotspots

a. Government-owned Wi-Fi Hotspots

(1) Government owned Wi-Fi Hotspots will only be authorized when a clear operational requirement exists that cannot be otherwise satisfied.

(a) Government owned Wi-Fi Hotspots will not be placed within NSWCCD facilities without prior written authorization of the ISSM and the CSM.

(b) Length of Wi-Fi Hotspot Authorization will be determined at the time of approval and will not exceed the duration of the operational requirements.

(2) Government-owned Wi-Fi Hotspots are not authorized in areas where classified information is processed.

(3) Government-owned Wi-Fi Hotspots are not authorized in areas directly adjacent to a SCIF without prior SSO authorization.

(4) Government-owned Wi-Fi Hotspots will be configured per the current applicable DISA Wireless STIGs prior to being placed in service.

b. Non-Government owned Wi-Fi Hotspots are not authorized. Wi-Fi Hotspot services provided by authorized devices, such as cellular telephones, are required to be disabled while in NSWCCD facilities.

9. Responsibilities

a. Managers and Supervisors will:

(1) Support the execution of this guidance, ensuring all assigned personnel comply with the requirements identified in this instruction.

(2) Reduce the overall risk to Division IT assets by limiting the transport and use of PEDs overseas.

(3) Ensure appropriate administrative and disciplinary action for those failing to comply with this instruction.

b. Information System Security Officers (ISSOs) will:

(1) Enforce this instruction at every NSWCCD site and at all RDT&E laboratories;

enforce the authorization and permitting processes, and maintain appropriate records, as required.

(2) Where feasible, include PEDs in monthly vulnerability scanning and remediation.

(3) Consult with the ISSM on any special situations.

c. Employees and contractors will:

(1) Immediately report any loss of control, for any period of time, of a DoD-owned PED or removable media, whether by loss, theft, confiscation, temporary misplacement, or similar circumstance, to their first line supervisor, Division ISSM and the NSWCCD Security Manager.

(2) Report non-compliance to the cognizant ISSO, ISSM, and/or Command Security Office.

10. Records Management. Records created as a result of this instruction, regardless of media and format, must be managed per Secretary of the Navy (SECNAV) Manual 5210.1 of January 2012.

11. Review and Effective Date. Per OPNAVINST 5215.17A, Code 104 will review this instruction annually on the anniversary of its issuance date to ensure applicability, currency, and consistency with Federal, Department of Defense, SECNAV, and Navy policy and statutory authority using OPNAV 5215/40 Review of Instruction. This instruction is effective immediately and will expire 5 years after its issuance date unless reissued or canceled prior to the 5-year anniversary date, or an extension has been granted.

12. Forms. The following forms are available for download from the Carderock Division Cyber Security Web site at: https://cuthill.crdr.navy.mil/intra/cyber_security/index.html.

a. CARDEROCKDIV Form 5239/9, Authorization Request for Operation of Non-DoD PEDs at NSWCCD.

b. CARDEROCKDIV Form 5239/9A, Registration of NSWCCD Portable Electron Devices on Official Government Travel.

13. Point of Contact. The Information System Security Manager, Command Cybersecurity Office (Code 104) is the Point of Contact for this instruction.

Releasability and distribution:

This instruction is cleared for public release and is available electronically via the Division Intranet Directives Page, https://cuthill.crdr.navy.mil/wcm/docs.p