B08 Attachment 0013 ARMY REG 25_1 Army Information Technology 062513.pdf

Army Regulation 25–1

Information Management

Army Information Technology

Headquarters Department of the Army Washington, DC 25 June 2013

UNCLASSIFIED

SUMMARY of CHANGE

AR 25–1

Army Information Technology

This major revision, dated 25 June 2013--o Changes the title of the publication from "Army Knowledge Management and Information Technology" to "Army Information Technology" (cover).

o Realigns chapters by five principles: Army information technology management; Web site management; information and security management;

enterprise architecture standards and certifications; and installation information technology services and support (para 1-5).

o Incorporates the newly formed Army Cyber Command/Second U.S. Army as the principal organization responsible for Army cyber operations and delineates multiple changes to roles and responsibilities as a result of Cyber Command’s stand-up (chap 2).

o Updates the responsibilities of higher officials as necessary (chap 2).

o Adds requirements for Army organizations to use the Computer Hardware, Enterprise Software and Solutions procurement system (paras 2-16h, 3-4a, and 3-4l).

o Incorporates information management organizations below Headquarters, Department of the Army as a new paragraph (para 2-31).

o Removes knowledge management roles and responsibilities in response to functional roles and missions being realigned in the Army (throughout).

o Deletes Records management, Printing and publishing, Information Assurance, and Visual information chapters and incorporates relevant policy through and into the appropriate chapters (throughout).

o Restructures content in this publication; removes procedural, historical, and background information; and updates paragraphs with authoritative documents and Web sites in order to create a more lean, relevant, and user-friendly document (throughout).

o Removes telecommunications policy for inclusion in a new Army Regulation (throughout).

o Cancels DA Form 3938, Local Service Request (throughout).

o Cancels DA Form 5697, Visual Information (VI) Activity Authorization Responsibility Record (throughout).

o Makes administrative changes (throughout).

Headquarters Department of the Army Washington, DC 25 June 2013

Information Management

Army Information Technology

*Army Regulation 25–1

Effective 25 July 2013

H i s t o r y . T h i s p u b l i c a t i o n i s a m a j o r revision.

S u m m a r y . T h i s r e g u l a t i o n e s t a b l i s h e s policies and assigns responsibilities for in-f o r m a t i o n m a n a g e m e n t a n d i n f o r m a t i o n technology. It applies to information tech-nology contained in both business systems and national security systems (except as noted) developed for or purchased by the D e p a r t m e n t o f A r m y . I t a d d r e s s e s t h e management of information as an Army resource, the technology supporting infor-m a t i o n r e q u i r e m e n t s , a n d t h e r e s o u r c e s s u p p o r t i n g i n f o r m a t i o n t e c h n o l o g y . T h i s r e g u l a t i o n i m p l e m e n t s 4 0 U n i t e d S t a t e s Code, Subtitle III; 44 United States Code, C h a p t e r s 3 5 a n d 3 6 ; 1 0 U n i t e d S t a t e s C o d e , S e c t i o n s 2 2 2 3 a n d 3 0 1 4 ; a n d DODD 8000.01. It establishes the Army’s Chief Information Officer. The full scope of the Chief Information Officer’s respon-sibilities and management processes are d e l i n e a t e d t h r o u g h o u t t h i s r e g u l a t i o n .

These management processes involve stra-tegic planning, capital planning, business process analysis and improvement, assess-ment of proposed systems, information re-s o u r c e m a n a g e m e n t ( t o i n c l u d e investment strategy), performance meas-urements, acquisition, and training.

Applicability. This regulation applies to t h e A c t i v e A r m y , t h e A r m y N a t i o n a l Guard/Army National Guard of the United States, and the U.S. Army Reserve, unless otherwise stated. Portions of this regula-t i o n p r e s c r i b e s p e c i f i c p r o h i b i t i o n s t h a t are punitive, and violations of these provi-sions may subject offenders to non-judi-cial or judicial action under the Uniform Code of Military Justice. During mobili-zation, procedures in this publication can be modified to support policy changes as necessary.

Proponent and exception authority.

The proponent of this regulation is Chief Information Officer/G–6. The proponent has the authority to approve exceptions or waivers to this regulation that are consis-tent with controlling law and regulations.

The proponent may delegate this approval authority, in writing, to a division chief within the proponent agency or its direct reporting unit or field operating agency, in the grade of colonel or the civilian equiv-alent. Activities may request a waiver to this regulation by providing justification that includes a full analysis of the ex-pected benefits and must include formal review by the activity’s senior legal offi-cer. All waiver requests will be endorsed by the commander or senior leader of the requesting activity and forwarded through t h e i r h i g h e r h e a d q u a r t e r s t o t h e p o l i c y proponent. Refer to AR 25–30 for specific guidance.

Army internal control process. This regulation contains internal control provi-s i o n s a n d p r o v i d e s a n I n t e r n a l C o n t r o l Evaluation for use in evaluating key inter-nal controls (see appendix C).

S u p p l e m e n t a t i o n . S u p p l e m e n t a t i o n o f this regulation and establishment of com-mand and local forms are prohibited with-o u t p r i o r a p p r o v a l f r o m t h e C h i e f I n f o r m a t i o n O f f i c e r / G – 6 ( S A I S – P R G ) , 1 0 7 A r m y P e n t a g o n , W a s h i n g t o n , D C 20310–0107.

Suggested improvements. Users are invited to send comments and suggested improvements on DA Form 2028 (Recom-m e n d e d C h a n g e s t o P u b l i c a t i o n s a n d Blank Forms) directly to Office of the C h i e f I n f o r m a t i o n O f f i c e r / G – 6 (SAIS–PRG), 107 Army Pentagon, Wash-ington, DC 20310–0107 (cio-g6.policy.in-box@mail.mil).

Committee management. AR 15–1 re-quires the proponent to justify establishing o r c o n t i n u i n g c o m m i t t e e ( s ) , c o o r d i n a t e draft publications, and coordinate changes in committee status with the U.S. Army Resources and Programs Agency, Depart-ment of the Army Committee Manage-ment Office (AARP–ZA), 9301 Chapek Road, Building 1458, Fort Belvoir, VA 22060-5527. Further, if it is determined t h a t a n e s t a b l i s h e d “ g r o u p ” i d e n t i f i e d within this regulation, later takes on the characteristics of a committee, as found in the AR 15–1, then the proponent will fol-l o w a l l A R 1 5 - 1 r e q u i r e m e n t s f o r e s -tablishing and continuing the group as a committee.

Distribution. This publication is availa-ble in electronic media only and is in-tended for command levels B, C, D, and E for the Active Army, the Army Na-tional Guard/Army National Guard of the U n i t e d S t a t e s , a n d t h e U . S . A r m y Reserve.

*This regulation supersedes AR 25–1, dated 4 December 2008.

AR 25–1 • 25 June 2013 i

UNCLASSIFIED

Contents (Listed by paragraph and page number)

Chapter 1 Introduction, page 1 Purpose • 1–1, page 1 References • 1–2, page 1 Explanation of abbreviations and terms • 1–3, page 1 Responsibilities • 1–4, page 1 Overview • 1–5, page 1 Information accountability and transparency • 1–6, page 2 Force generation through information sharing • 1–7, page 2

Chapter 2 Responsibilities, page 3 The Army Chief Information Officer/Deputy Chief of Staff, G–6 • 2–1, page 3 Army Cyber Command/Second U.S. Army • 2–2, page 6 The U.S. Army Network Enterprise Technology Command • 2–3, page 7 Principal officials, Headquarters, Department of the Army • 2–4, page 8 Under Secretary of the Army • 2–5, page 8 Assistant Secretary of the Army (Financial Management and Comptroller) • 2–6, page 8 Assistant Secretary of the Army (Acquisition, Logistics, and Technology) • 2–7, page 8 Office of General Counsel • 2–8, page 9 Administrative Assistant to the Secretary of the Army • 2–9, page 9 Chief of Public Affairs • 2–10, page 10 Director of the Army Staff • 2–11, page 10 Deputy Chief of Staff, G–2 • 2–12, page 10 Deputy Chief of Staff, G–3/5/7 • 2–13, page 11 Assistant Chief of Staff for Installation Management • 2–14, page 12 The Judge Advocate General • 2–15, page 12 Commanders of Army components, Army commands, Army service component commands, and direct reporting units

(as authorized by their respective Headquarters, Department of the Army elements) • 2–16, page 12 Army service component command commanders • 2–17, page 13 Commanding General, U.S. Army Training and Doctrine Command • 2–18, page 13 Commanding General, U.S. Army Materiel Command • 2–19, page 14 Commanding General, U.S. Army Forces Command • 2–20, page 14 Commanding General, U.S. Army Special Operations Command • 2–21, page 14 The Surgeon General/Commanding General, U.S. Army Medical Command • 2–22, page 14 Commanding General, U.S. Army Corps of Engineers • 2–23, page 15 Chief, Army Reserve • 2–24, page 15 Chief, National Guard Bureau • 2–25, page 15 Commanding General, U.S. Army Test and Evaluation Command • 2–26, page 15 Commanders or directors of major subordinate commands; field-operating agencies; and separately authorized activities, tenant, and satellite organizations • 2–27, page 16 Joint Force Headquarters-State, U.S. Army Reserve Command, or comparable-level community commanders • 2–28, Program executive officers and direct-reporting product managers • 2–29, page 16 Program, project, and product managers and information technology materiel developers • 2–30, page 17 Information management organizations below Headquarters, Department of the Army level • 2–31, page 18

Chapter 3 Army Information Technology Management, page 19 General • 3–1, page 19 Planning phase • 3–2, page 20 Investment phase • 3–3, page 20 ii AR 25–1 • 25 June 2013

Contents—Continued

Execution phase • 3–4, page 20

Chapter 4 Web Site Management, page 25 Army enterprise portals, Web sites and email • 4–1, page 25 Social media sites • 4–2, page 28

Chapter 5 Information and Security Management, page 28

Section I Data management, page 28 Army Data Board • 5–1, page 29 Army Data Management Program • 5–2, page 29

Section II Information Management, page 33 Visual information management • 5–3, page 33 Records management • 5–4, page 35 Publishing and printing • 5–5, page 37

Section III Information and Data Security, page 37 Information assurance • 5–6, page 37 Privacy impact assessments • 5–7, page 37 Quality of publicly disseminated information • 5–8, page 38

Chapter 6 Enterprise Architecture Standards and Certifications, page 39

Section I Enterprise Architecture, page 39 General • 6–1, page 39 Army enterprise architecture governance • 6–2, page 39 Complying with Defense Information Systems Registry standards • 6–3, page 39 Army enterprise architecture composition • 6–4, page 40 Internet protocol management • 6–5, page 40

Section II Certifications for Network Operations, page 41 Army interoperability certification • 6–6, page 41 Certification of information support plans and tailored information support plans • 6–7, page 42 Networthiness certification program • 6–8, page 42 Department of Defense information assurance certification and accreditation process • 6–9, page 42

Chapter 7 Installation Information Technology Services and Support, page 42 Information technology support principles • 7–1, page 42 Information technology support services for Army organizations on Army installations • 7–2, page 43 Service and support agreements with Department of Defense activities • 7–3, page 43 Morale, Welfare, and Recreation activities and non-appropriated fund instrumentalities • 7–4, page 43 Electronic and information technology access for Army employees and members of the public • 7–5, page 43 Installation-level technical support and service • 7–6, page 44 Tactical use of the secure network on Army installations • 7–7, page 44 Hardware and software services • 7–8, page 44 Telework • 7–9, page 44 iiiAR 25–1 • 25 June 2013

Contents—Continued

Energy conservation guidelines for information technology equipment • 7–10, page 45 Information technology support for military construction • 7–11, page 45

Appendixes

A. References, page 46

B. Army Portfolio Management Solution Registration Business Rules, page 57

C. Internal Control Evaluation, page 60

Table List

Table 5–1: Required visual information forms, page 35

Glossary iv AR 25–1 • 25 June 2013

Chapter 1 Introduction

1–1. Purpose This regulation establishes policies and assigns responsibilities for information management and information technol-ogy (IT). This regulation applies to IT contained in mission command systems; intelligence systems (except as noted);

weapon systems (except as noted); business systems; and, when identified, national security systems (NSSs) developed or purchased by the Department of Army (DA). This regulation does not apply directly to information systems (ISs) acquired under the National Intelligence Program (NIP), the Military Intelligence Program (MIP), or to the operational support of intelligence and electronic warfare systems operating in a stand-alone configuration where inclusion of integrated support would not be efficient or effective.

1–2. References Required and related publications and prescribed and referenced forms are listed in appendix A.

1–3. Explanation of abbreviations and terms Abbreviations and special terms used in this regulation are explained in the glossary.

1–4. Responsibilities See chapter 2 for responsibilities.

1–5. Overview

a. This regulation is structured according to five disciplines. Army information technology management; Web site management; information and security management; enterprise architecture (EA) standards and certifications; and installation information technology services and support. Organizing IT policy under these five disciplines will assist end users in finding information within the regulation.

b. Regulation structure.

(1) Responsibilities, chapter 2. This chapter outlines the roles and responsibilities for Army organizations to manage and implement IT in the Army.

(2) Army information technology management, chapter 3. The information technology management (ITM) chapter outlines the life cycle of an IT investment. This chapter addresses Army IT governance and requirements for reporting, accountability, and compliance through the life cycle. Compliance with Army policies is supported through the Army’s governance boards, reporting structures, and oversight procedures. The Strategic Management System tracks essential priorities and strategic initiatives in support of Army IT policy and strategic direction.

(3) Web site management, chapter 4. The Web site management chapter provides information on the appropriate and authorized use of Army Web sites, including Army Knowledge Online (AKO), SharePoint, and social media sites.

(4) Information and security management, chapter 5. This chapter includes information on data management (DM), visual information (VI) management, records management, publishing and printing, and information security. Informa-tion management (IM) includes the collection and management of information from one or more sources and the distribution of that information to one or more audiences. All ISs and IT described within this publication are subject to Army and Department of Defense (DOD) information assurance (IA) and security requirements. The IA and security policies are specifically addressed in AR 25–2 and the AR 380 series (for example, AR 380–5 and AR 380–53).

(5) Enterprise architecture standards and certifications, chapter 6. This chapter provides policy and guidance governing the composition and use of architecture documentation in the Army. It includes discussion on architecture governance, compliance with DOD and Army policies, and Internet protocol (IP) management.

(6) Installation information technology services and support, chapter 7. This chapter covers services and support on Army installations. Additional information about installation IT services and support can be found on the Installation Management Command’s portal at http://www.acsim.army.mil/index.htm.

c. Global enterprise network. Land Warrior Network (LandWarNet) is the Army’s contribution to the global information grid (GIG), which consists of the globally interconnected, end-to-end set of Army information capabilities;

associated processes; and personnel for collecting, processing, storing, disseminating, and managing information on demand to support Warfighters, policy makers, and support personnel. LandWarNet includes all Army-owned, leased, and leveraged DOD, Joint communications and computing systems and services; software (including applications);

data-security services; and other associated services.

(1) The Army’s network, LandWarNet, is one of the Army’s top modernization efforts. It is an essential enabler to a 21st-century expeditionary Army. Every facet of the expeditionary Army, from garrison to the tactical edge, leverages the network. Network functionality, agility, reliability, and security enable operationally effective business and war-fighting operations. LandWarNet is continually changing and modernizing and requires Army users to update opera-tional business processes to keep Soldiers, commanders, civilians, and mission partners connected, informed, and empowered.

1AR 25–1 • 25 June 2013

(2) As LandWarNet is a global enterprise network, it is critical that regulations regarding the network and its proper use are understood and enforced. A vulnerability created by a single individual or organization not following Army regulations regarding the network’s proper use will be a vulnerability shared by all users and organizations across this enterprise network.

1–6. Information accountability and transparency

a. Record-keeping requirements. Records created under the purview of this regulation, regardless of content or format, will be kept, at a minimum, in accordance with the retention schedules found at https://www.arims.army.mil.

The Army Records Information Management System (ARIMS) is a role-based system managed and operated by the U.S. Army Records Management and Declassification Agency (RMDA). The primary purpose of ARIMS is to provide authorized personnel with Web-based tools and technology to manage both hardcopy and electronic Army records.

Additional requirements at the State level, including statutory, legal, financial, or administrative by the authority of the State’s governor and adjutant general, will be governed by Title 32 of the United States Code and managed in accordance with State policy. Note that information used in decision-making and business processes is Army record material (whether stored electronically or as a hard copy), and is scheduled, maintained, and preserved in accordance with AR 25–400–2.

b. Information as a resource.

(1) Except where restricted for reasons of national security, privacy, sensitivity, or proprietary rights, personnel will manage information as a shared resource and make it available to all authorized to access the information to accomplish their mission and functions. The cost to the Army of collecting, processing, distributing, and storing information makes it impossible to view information as a free commodity. Army personnel must carefully plan requirements for information and supporting IT. The management of information resources and IT is applicable to all Army organizations.

(2) The IT and related investments will be evaluated in terms of direct support and compatibility with Army enterprise (AE) solutions, mandates, and processes and their corresponding information requirements.

(3) The IT embedded in or integral to weapon systems, machines, medical instrumentation, servomechanisms, training devices, or test and evaluation (TE) systems, except for those systems with no external interface, are included in the provisions of this regulation. This regulation supports the precept that information is a strategic defense asset during peacetime and wartime, and the peacetime information infrastructure must support wartime requirements by providing information services for rapid deployment and sustainment of U.S. Armed Forces around the world.

(4) The Army information architecture (AIA) was developed based on DOD’s information enterprise architecture (IEA) in order to enable better understanding and interoperability of shared information by providing guidance and compliance requirements to Army stakeholders. The AIA enables the design, development, deployment, and use of information systems that are consistent, comprehensive, compatible, and integrated across the Army enterprise. This multiplies the impact of agile, adaptive IT by leading to more efficient and effective computing environments; which as part of the common operating environment are less costly to develop, design, field, and support. In addition, the AIA aligns to the Army and DOD data strategy to make data visible, accessible, understandable, trusted (to include protection, assurance, and security), and interoperable throughout their life cycle to any authorized Army consumer or mission partner possessing the appropriate security clearance and need to know. The end state of the LandWarNet, enabled by integrating the AIA into overall Army Enterprise Architecture (AEA) activities, will consist of data-enriched applications with an increased ability to access, interact with, and use diverse data stores. This is done via a layer of standard data services, informed as needed by information exchange standards specifications (IESS) within or among communities of interest (COIs).

1–7. Force generation through information sharing When IT capabilities are focused to meet the information needs of the Warfighter, information can be employed as a force multiplier.

a. Force-multiplier benefits of information. Information becomes a force multiplier when it provides a capability that, when added to and employed by a combat force, significantly increases the combat potential of that force and enhances the probability of successful mission accomplishment. Information technology and DM provide tools that enable the Army to achieve force multiplication through information sharing and network-centric operations. Command and control has been a recognized force multiplier, and improvements in information technologies offer opportunities to improve existing information sharing and explore new approaches.

b. Customer-focused information technology management. The IT community professionals will maintain customer focus in their support of system users and the Warfighter.

(1) The Army IT community provides information capabilities and services for the benefit of Army, DOD, non- Defense Federal agencies, coalition partners, and the general public. The IT capabilities and services are not ends in themselves. Ultimately, they have value only when they support the Warfighter and the Army’s mission. Because of the strategic and tactical roles of IT in support of the Army’s missions, the IT community must maintain focus on the needs of its customers.

(2) This customer focus should include awareness of current user requirements, the quantity and quality of the

2 AR 25–1 • 25 June 2013 support provided, future customer requirements, and emerging IT capabilities. The Army’s use of IT requires a strong relationship between the IT community and its customer, where both the customer and the service provider take responsibility for communicating with one another. Each organization’s ITM process must have that same communica-tion strength. Although primary responsibility must be assigned to the various aspects of this process, both IT providers and their customers must remain actively engaged for the process to succeed.

c. Customer participation in information technology management.

(1) Army customers must be sensitive to the IT community’s need for customer involvement in seemingly unrelated management issues because of the potential IT impacts to Army organizations. Customers must also be willing to participate actively in the support process, especially in defining their requirements. Customers must identify their IT requirements and communicate these clearly to IT personnel (that is, information management officers (IMOs), S–6, G–6, or network enterprise centers (NECs)) throughout the procurement process to ensure the customers’ needs are fulfilled.

(2) The IT community must embrace accountability to the customer. Ensuring that customer requirements are identified and met are essential elements of the ITM process. The IT community’s acceptance of an agreed-upon customer support level must be fully backed with adequate IT staff and resources in order to meet the commitment at the supported installation site. Service and accountability to the customer will be incorporated into the analysis to outsource or consolidate, and included in agreements and contracts for IT support capabilities.

Chapter 2 Responsibilities

2–1. The Army Chief Information Officer/Deputy Chief of Staff, G–6

a. The Army has consolidated the Army Chief Information Officer (CIO) and the DCS, G–6 positions as the Army

CIO/G–6. This allows the Army to better synchronize the Army’s global network activities; to achieve secure, seamless interdependent global network processes and services; and, to better synchronize Warfighter requirements with global network capabilities and services. The Office of the Army CIO/G–6 serves as the principal focal point in Headquarters, DA (HQDA) for IM matters with Congress; the Government Accountability Office; the Office of Management and Budget (OMB); other Federal agencies; DOD; Joint Staff (JS); Army organizations and commands; and, other military departments, academia, and industry. The Army CIO/G–6 provides policy and guidance on IT systems and networks in accordance with General Order 2012–01. This includes reviewing and evaluating existing Army IM and IT policies to determine their adequacy and overseeing the implementation of DOD IT or IM-related policies or guidance. The CIO/ G–6 provides oversight and coordination for the implementation of policies in—

(1) 44 USC 29, 44 USC 31, and 44 USC 33 (Public Law 94575, Federal Records Management); and 44 USC 35 (Federal Information Security Management Act (FISMA)), and 44 USC 36 (E-Gov Act).

(2) 5 USC 552 (Freedom of Information Act).

(3) 5 USC 552a (Privacy Act of 1974).

(4) 10 USC 3014 and 10 USC 2223(b).

(5) 40 USC Subtitle III (Clinger-Cohen Act).

(6) DODD 8000.01.

b. The CIO/G–6, as the Army CIO, is the principal staff assistant and advisor to the Secretary of the Army on Army

IM, pursuant to 10 USC 3014(c)(1)(D), including but not limited to information enterprise (IE) networks and network-centric policies and concepts; command, control, communications, and computers (C4); non-intelligence space matters;

and enterprise-wide integration of Army information matters. The CIO sets the strategic direction for and supervises the execution of Army IM policies and programs, including the global network, network architecture, and information-sharing policy. The CIO directs information resources management, including the allocation and obligation of IT capital assets in accordance with 40 USC Subtitle III; 44 USC 35; and, 44 USC 36. The CIO is the principal official within HQDA with oversight responsibilities for all IT resources under the provisions of the Clinger-Cohen Act. The CIO/G–6 coordinates with the Under Secretary of the Army, in his role as Chief Management Officer, to develop Army enterprise-wide business system architecture that supports Army business operations management.

c. The Army CIO/G–6, as the Army CIO, will—

(1) Serve as the Army’s lead agent for LandWarNet to enhance the ability to reconcile current to future force

LandWarNet capabilities, improve business agility, and achieve Warfighter decision superiority. The CIO is the single authority responsible and accountable to—

(a) Deliver structured, controlled, repeatable, and measurable processes that drive accountability and compliance for the management of the Army’s information technology enterprise.

(b) Ensure secure LandWarNet capabilities and services to Army leadership and Warfighters.

(c) Enable agile responses to rapidly changing operational requirements for Army and Joint missions.

(2) Direct IM function within the DA, including to—

3AR 25–1 • 25 June 2013

(a) Develop the DA’s IM strategy, policies, and guidance that are in compliance with laws, regulations, and standards.

(b) Oversee IM and IT resources planning, programming, budgeting, and execution;

(c) Develop and implement the IM and IT capital planning and investment-control strategy, including the design and operation of all major information resources management processes.

(d) Develop, coordinate, and implement an assessment process for Army IM programs; including compliance with

IM policies, guidance, standards, and monitoring.

(3) Support the Assistant Secretary of the Army for Acquisition, Logistics, and Technology (ASA (ALT)) through the development of policy on the acquisition of IM, IT, and information resources. Ensure that acquisitions are managed in a manner that implements CIO/G–6 policies and procedures to maximize value while assessing and managing the risks for acquiring IT.

(4) Serve as the appeal authority to receive and resolve appeal requests for ensuring the quality, objectivity, and integrity of Army information disseminated to the public in accordance with FOIA and Privacy Act programs.

(5) Establish, maintain, facilitate, and guide the implementation of the Armywide EA.

(6) Prescribe Army strategy, policy, and portfolio management for Army bandwidth capabilities and activities.

(7) Serve as member of the Federal CIO Council and the DOD CIO Executive Board (EB).

(8) Chair the Army CIO EB.

(9) Develop, promulgate, and direct compliance with information security and IA policy (see AR 25–2).

(10) Review, coordinate, and co-certify the IT Budget in conjunction with the Assistant Secretary of the Army

(Financial Management and Comptroller) (ASA (FM&C)).

(11) Represent the Army on the Committee on National Security Systems.

(12) Oversee the Armywide implementation and modernization of LandWarNet.

(13) Prescribe Army IE strategy, policy, portfolio management, architecture, and strategic communications that result in effective IT investments Armywide.

(14) Participate as a core member of the Business Systems Information Technology–Executive Steering Group

(BSIT–ESG) in the role of standards provider.

(15) Serve as the Army designated approval authority (DAA) for the certification and accreditation (C&A) of collateral top secret and below Army information systems (see AR 25–2).

(16) Monitor the operations and structure of the military and civilian personnel management systems to ensure that the Army’s requirements for qualified IT and communications personnel are addressed and that IT career development plans, programs, and objectives are established. Duties include serving as the functional chief for the ITM career program 34 (CP–34) and as the principal coordination point for designated military specialties. The CIO is responsible for the policy, oversight, and management of the Army civilian ITM CP–34. (See also DA Pam 25–1–1, AR 690–950, and AR 350–1.)

(17) Prescribe IT portfolio management (PfM) policy and oversee implementation of mission area (MA) IT portfo-lios to ensure they are aligned with Army enterprise solutions.

(18) Serve as the Army’s lead for the Enterprise Information Environment Mission Area (EIEMA) to support the DOD EIEMA lead and ensure enterprise information environment efforts are traceable to, and fully enable, the required capabilities for the Warfighting and business MAs.

(19) In coordination with Army Cyber Command, direct research of new IT technologies and training venues that deliver value across the enterprise.

(20) Reduce the introduction of vulnerabilities and system interoperability performance problems by controlling and approving changes to the Army’s authorized software baseline that constitutes its operational network. For additional information, see the Configuration Management Plan at https://ctsf.army.mil/cmweb/librarian.htm and scroll down to click on the “SOPs” tab.

(21) Serve as functional proponent for the Army enterprise portals (that is, AKO, enterprise collaboration services, and so forth).

(22) Serve as the functional proponent of AEA, to include establishing, implementing, leading, and managing the

AEA.

(23) Establish and oversee the Army Data Management Program (ADMP) to include the appointment of the Army Chief Data Officer (see also chapter 5 of this publication).

(24) Provide oversight and direction for network-centric concepts and management, including the Army Networthi-ness Program.

(25) Serve as the functional proponent and primary interface with the Defense Information Systems Agency (DISA) on existing and emerging DOD enterprise services such as email, data center consolidation, collaboration, and unified communications.

d. The Army CIO/G–6, as the Army Staff G–6, is the principal advisor to the Chief of Staff of the Army, the Army Staff, Army service component commands (ASCCs), Army Cyber Command/Second U.S. Army, and combatant commands of unified and specified commands for IM, IT, and their impact on current and future Warfighting

4 AR 25–1 • 25 June 2013 capabilities. This includes advice on all matters concerning enterprise information activities required to ensure the standardization, compatibility, security, interoperability, and fiscal discipline of enterprise information services support-ing the Warfighter.

e. The CIO/G6, as the Army Staff G–6, is responsible for information management and signal operations, network and communications security, force structure, equipping, and employing signal forces. The CIO/G–6, as the Army Staff G–6, will—

(1) Develop and execute the Army’s IM and IT strategy, policy, plans and programs; and oversee the execution of IM and IT policies and plans by other Army organizations.

(2) Monitor and advise on information and signal operations, network and communications security, force structure, and the equipping and employment of signal forces. Assess the impacts to the Warfighter of IM-related strategy, policies, plans, services, and programs. Advocate for and monitor the implementation of IM requirements on behalf of the Warfighter.

(3) Oversee the implementation and enforcement of Army global network requirements and operations to achieve standardization, compatibility, security, interoperability, and fiscal discipline of IM and IT services supporting the Warfighter.

(4) Provide policy, guidance, and resourcing for the Army’s communication needs for all network layers, including top secret and higher levels of security, as well as access to coalition networks.

( 5 ) S e r v e a s s e n i o r a u t h o r i t y f o r t e l e c o m m u n i c a t i o n s p r o g r a m s a n d c o m m i t t e e s . S e e A R 2 5 – 1 3 f o r m o r e information.

(6) Serve as senior authority for Army VI and multimedia products as defined in chapter 5 of this regulation and in DA Pam 25–91. The Army CIO/G–6 Visual Information Management office is responsible for managing the Army’s VI activities.

(7) Serve as the proponent for the information systems supporting C4 and IT programs, including, but not limited to—

(a) Serve as the Army focal point for IT system issues (to include NSS). Receive, coordinate, and integrate these issues, ensuring the integration of systems-development efforts with cross functional or technical lines.

(b) Participate in and provide representation for the planning, programming, budgeting, and execution (PPBE) process decision group; and exercise centralized oversight of IT expenditures for all appropriations, including formulat-ing and defending the resources necessary to provide C4/IT to the Warfighter.

(c) Develop, coordinate, and manage the IT capital planning and investment management program.

(d) Recommend and coordinate new standards and ensure IT system conformance to the approved DOD IT

Standards Registry (DISR); coordinate and support the priorities within IT for information system development-related activities; and secure adequate resource support.

(e) Coordinate resource requirements for IT support activities.

(f) Coordinate IT requirements relevant to Army continuity of operations (COOP) plans and systems that support survival, recovery, and reconstitution; and ensure essential information services in support of DA COOP are available to alternate sites of HQDA agencies, Army commands (ACOMs), and installations.

(g) Prescribe, in conjunction with the Office of the Administrative Assistant to the Secretary of the Army, records management requirements in the life cycle of ISs, beginning at the initial milestone.

(h) Collaborate with the Deputy Chief of Staff, G–8 in the development of command, control, communications, c o m p u t e r s , i n t e l l i g e n c e , s u r v e i l l a n c e , a n d r e c o n n a i s s a n c e ( C 4 I S R ) p o s i t i o n s p r e s e n t e d a t F u n c t i o n a l C a p a b i l i t i e s Boards, the Joint Capability Board, and the Joint Requirements Oversight Council.

(8) Lead and manage the Army Net-Centric Data Management Program and serve as the Army component data administrator under the DOD Data Administration Program (see chap 5).

(9) Manage, plan, and program for the Army Spectrum Management Program (AR 5–12).

(10) Ensure Army interoperability processes are structured to allow seamless transition for obtaining Joint Inter-operability Certification and synchronize the Army Portfolio Management Solution (APMS) with the DOD IT Portfolio Repository (DITPR). This includes, but is not limited to—

(a) Represent Army interests in Joint, DOD, and Army technical interoperability forums.

(b) Expand interoperability certification process to cover all capability areas. Incrementally establish memorandums of agreement (MOAs) with functional proponents laying out portfolio Army Interoperability Certification (AIC) requirements and strategies.

(c) Ensure appropriate Joint certification documentation has been developed to allow for continued fielding of Army systems while also satisfying Joint Interoperability Certification requirements.

(d) Establish Federated Net-centric Sites (FaNS) criteria for accreditation by the Office of the Army CIO/G6.

(e) Coordinate with the U.S. Army Training and Doctrine Command (TRADOC) and ASA (ALT) in the develop-ment and review of all mission threads.

(f) Prescribe guidance for the Army’s use of the Defense Research and Engineering Network (DREN). (See https:// www.us.army.mil/suite/files/13410760 for additional DREN guidance.)

5AR 25–1 • 25 June 2013

(g) Prescribe Army IP address policy, and direct plans for IP address management and usage.

(h) Validate IT and NSS requirements through the review of data on the capabilities and Army Requirements

Oversight Council Management System.

(i) Ensure that IT infrastructure requirements to sustain interoperability requirements are identified in the Army’s budget submissions.

(j) Ensure the compatibility and interoperability of IT and NSS with Joint, unified, combined, Federal Government, and other Army systems as required.

(11) Establish annually, in coordination with Army Cyber Command and U.S. Army Network Enterprise Technol-ogy Command (NETCOM), the vision, direction, and architecture of Installation-Information Infrastructure Moderniza-tion Program (I3MP) for use by NECs in their requirements development efforts.

2–2. Army Cyber Command/Second U.S. Army Army Cyber Command/Second U.S. Army will conduct cyber operations, including to—

a. Exercise a single command and control authority for all collateral top secret and below Army network operations in accordance with Army, Joint, and DOD regulations.

b. Serve as the single authority for the operation, management, and defense of the LandWarNet global enterprise network, including as follows—

(1) Prescribe all common-user IT services and capabilities.

(2) With exception to Joint Worldwide Intelligence Communications System (JWICS), serve as the single authority to implement Army IP policy, conduct Army IP registration, and manage Army IP address space.

(3) Prescribe “army.mil” and “army.smil.mil” Internet domains and the assignment of sub-domains requested by other Army organizations.

(4) Manage Army IT network and system capabilities to achieve survival, recovery, and reconstitution for COOP support requirements in accordance with AR 525–27.

(5) Execute Army Computer Network Defense-Service Provider (CND-SP) responsibilities to include incident, event, and problem management, in accordance with DODD 0–8530.1. Serve as the Army’s primary general service CND-SP, which includes responsibility for executing, monitoring, and managing CND services for Army-controlled networks. In addition, also be responsible for coordinating Army CND-SP support for networks supported by Army Forces but not under direct Army control.

c. Oversee and report threats to the Army global enterprise network and, as required, other DOD agencies and their enabling technologies.

d. Prescribe the operational activities, policies, processes, procedures, and protocols for reportable intelligence and information; in addition to incident management, event management, problem management, and database and Internet/ Web management.

e. Prepare and rehearse a network operations COOP plan, to include resolving actual or potential interruptions in service or reductions in quality of service in mutually agreed upon response times; identifying and prioritizing infrastructure, service, and security events; establishing appropriate responses to those events; defining and eliminating problems that have detrimental impact on quality and cost of services; mitigating probability of problem occurrence;

and ensuring optimal performance, security and functionality of enterprise databases and hosted applications.

f. In coordination with CIO/G–6, support information security and information assurance compliance for collateral top secret and below networks and systems—

(1) Prescribe the operational aspects of information protection and data security, including processes that enforce Armywide compliance with the Federal Information Security Management Act of 2002 and OMB Circular A–130.

Identify and analyze threats to the Army global enterprise network and its enabling technologies.

(2) Measure Army compliance with IA requirements and prescribe IA program operational execution activities, processes, and practices (see AR 25–2).

g. Enable external engagement—

(1) Formulate Army military telecommunications exchange agreements between the United States and regional defense organizations or friendly foreign nations, and coordinate each agreement’s procedural details with the com-mander of the relevant theater of operations.

(2) In support of Joint staff information requirements—

(a) Develop and maintain plans.

(b) Provide reports on JS-controlled communications assets, as required.

(3) Fund (as appropriate), operate, maintain, and defend equipment, facilities, systems, and required services supporting the United States, the North Atlantic Treaty Organization (NATO), and NATO-member communications objectives, as assigned; and provide subject-matter expertise in negotiations for communications agreements.

h. Oversee operational review and coordination of information infrastructure or architectures. Advise the CIO/G–6 on AEA, in support of implementation, management, and security of the global enterprise network.

6 AR 25–1 • 25 June 2013

i. Operate Army communications facilities and circuitry as part of the Defense Information Systems Network (DISN), including to—

(1) Approve and validate telecommunication requests for service, to include special-access requirements.

(2) Operate, maintain, and defend the Defense Red Switch Network, as well as the Army’s portion of military satellite communications for Defense satellite communications systems; Defense Information Infrastructure (microwave and fiber optic cable systems); and routers on the non-secure Internet protocol router network (NIPRNET), secret Internet protocol router network (SIPRNET), and defense switched network (DSN).

j. Develop, validate, and execute approved Army telecommunications requirements to DISA and overseeing imple-mentation of Army telecommunication requirements.

2–3. The U.S. Army Network Enterprise Technology Command NETCOM will provide enterprise management and services, including to—

a. Serve as the DAA for the Army enterprise, as directed by the CIO/G6.

b. Serve as the Army IT integrator to achieve a single, virtual, Enterprise Network by advising the end-to-end management of the Army’s enterprise service area (service delivery, service operations, and infrastructure management) using the AEA and IEA. Provide Army network enterprise services and capabilities, including the mandated core enterprise services of the DOD Information Enterprise Architecture, installation IT services, and network connectivity.

Prescribe the Army’s IT Service Management Program—

(1) Prescribe all service delivery activities, policies, processes, procedures, and protocols for configuration manage-ment, availability management, capacity management, change management, and release management for the Army’s networks, systems, and functional processing centers. This includes technical and operational authority for any system architecture design or device that impacts the Army global-enterprise network and enabling technologies.

(2) Prescribe all service operations activities, policies, processes, procedures, and protocols for incident manage-ment, event management, problem management, spectrum management, and database and Internet Web management for the Army’s networks, systems, and functional processing centers. This includes technical and operational authority over capabilities that impact the Army global-enterprise network and enabling technologies.

(3) Prescribe all infrastructure management activities, policies, processes, procedures, and protocols for network and telecommunications management, facilities management, data storage management, IT services continuity management, and mid- and mainframe management for the Army’s networks, systems, and functional processing centers. This includes technical and operational authority over capabilities that impact the global-enterprise network and enabling technologies.

c. Prescribe security of assigned fixed-station communications facilities and Army contractor telecommunications.

d. Prescribe requirements for mobile or transportable communications assets to support assigned missions and functions.

e. Organize and chair the LandWarNet technical configuration control board, and direct the Army enterprise configuration control and release management.

f. Advocate for transformation, and engineer the enterprise network to efficiently and effectively serve the needs of the Army.

g. Oversee Army leases of telecommunications services, and ensure that such services conform to DOD and

National Communications Systems guidance.

h. Oversee the Army Military Affiliate Radio System program, including amateur radio operators licensed to operate as a Military Affiliate Radio System member (see AR 25–6).

i. Support CIO/G6 to prescribe resources (people, projects, technology, and infrastructure) for service delivery, service operations, infrastructure management, IA, and network defense.

j. Prescribe communication services in support of the news media during field exercises, contingencies, and combat operations when commercial capabilities are not available.

k. Prescribe the Army’s Networthiness Program; and the operational assessment of systems, applications, or devices to determine security, interoperability, supportability, sustainability, usability (SISSU), and compliance with Federal, DOD, combatant commanders, Services, and agency regulations, policies, and guidelines.

l. Require mission application owners and maintainers to provide evidence of a rigorous source code validation and remediation program for Government-developed or -maintained software and applications components submitted for certificates of networthiness. This ensures adherence to secure coding practices and provides evidence of due diligence with respect to software assurance considerations in the selection of commercial off-the-shelf (COTS) products integrated into systems or submitted for certificates of networthiness.

m. Prescribe the Army’s IT Service Management Program.

n. Provide combat camera (COMCAM) documentation support for theater Army, Joint military operations, and operations other than war, including to develop and maintain appropriate plans.

o. Oversee the formulation, operation, maintenance, and defense of the Defense Telecommunication Service-

Washington, in accordance with DODI 4640.07.

7AR 25–1 • 25 June 2013

p. Provide an IT-operational engineering force with worldwide deployment capability to provide quick-reaction support to plan, integrate, install, operate, and maintain IT systems from the power projection platform to the tactical theater of operations.

q. Prescribe server and application consolidation, collaboration tools, best-business practices, and Web services supporting the global-network enterprise. Also, prescribe the configuration of Web applications across the Army.

r. Provide technical guidance for connectivity between Army DREN users and Army installations for Army enterprise services.

2–4. Principal officials, Headquarters, Department of the Army Within their respective areas of functional and process proponency, principal officials, HQDA will—

a. Serve as the HQDA proponent for information requirements and associated…