B08 Attachment 0014 Army Reg 25_2 Army Cybersecurity 040419.pdf

UNCLASSIFIED

Army Regulation 25 – 2

Information Management: Army Cybersecurity

Army Cybersecurity

Headquarters Department of the Army Washington, DC 4 April 2019

SUMMARY of CHANGE

AR 25 – 2

Army Cybersecurity

This major revision, dated 4 April 2019— o Changes the title of the regulation from Information Assurance to Army Cybersecurity (cover).

o Prescribes the use of DA Form 7789 (Privileged Access Agreement and Acknowledgement of Responsibilities) (paras 2–1c(3) and 2–38a(3)).

o Assigns responsibilities and prescribes policies for the Army Cybersecurity Program in accordance with DODI 8500.01, DODI 8510.01, and related issuances listed in appendix A (throughout).

o Implements functional elements of AR 525 – 2 as they relate to cyber risk management (throughout).

o Supersedes Army Directive 2013 – 22, Implementation and Enforcement of the Army Information Assurance Program (hereby superseded) (throughout).

o Fully integrates cybersecurity into system life cycles and makes cybersecurity a visible element of information technology portfolios (throughout).

o Implements a standard, integrated, change management process for Army information technology across all mission and business areas to ensure efficient and secure handling of all changes to the Army’s information technology infrastructure, applications, systems, architecture, software, and hardware (throughout).

o Ensures that information technology and resources (personnel, equipment, and training) support operational and enterprise objectives, and are consistent with applicable laws, regulations, and standards (throughout).

o Ensures that mission-essential tasks for cybersecurity readiness are set, and assessment data are collected, processed (in an automated fashion, where possible), analyzed, reported, and continually monitored to ensure that corrective actions are taken to address readiness issues (throughout).

*This regulation supersedes AR 25-2, dated 24 October 2007 and AD 2013-22, dated 28 October 2013.

AR 25–2 • 4 April 2019

UNCLASSIFIED

i

Headquarters Department of the Army Washington, DC

*Army Regulation 25 – 2

4 April 2019 Effective 4 May 2019 Information Management : Army Cybersecurity

Army Cybersecurity

History. This publication is a major revi-sion.

Summary. This regulation establishes the Army Cybersecurity Program and sets forth the mission, responsibilities, and poli-cies to ensure uniform implementation of public law and Office of Management and Budget, Committee on National Security Systems, and Department of Defense issu-ances for protecting and safeguarding Army information technology, to include the Army-managed portion of the Department of Defense Information Network, (hereafter referred to as information technology) and information in electronic format (hereafter referred to as information). Information technology includes infrastructure, ser-vices, and applications used directly by the Army or for the Army by legal agreements or other binding contracts.

Applicability. This regulation applies to the Regular Army, the Army National Guard/Army National Guard of the United States, and the U.S. Army Reserve, to in-clude all Headquarters, Department of the Army staff, Army commands, Army Ser-vice component commands, direct report-ing units, all other Army agencies, and all personnel, authorized users and privileged users, unless otherwise stated. It applies to all Army information technology and infor-mation in electronic format at all classifica-tion levels; and Special Access Program and Sensitive Activity information systems except when handling sensitive compart-mented information. Nothing in this regula-tion alters or supersedes the existing author-ities and policies of the Department of De-fense or the Director of National Intelli-gence regarding the protection of sensitive compartmented information as directed by Executive Order 12333. The Director of National Intelligence has delegated author-ity for all Army Sensitive Compartmented Information systems to the Deputy Chief of Staff, G – 2.

Proponent and exception authority.

The proponent of this regulation is the Army Chief Information Officer/G – 6. The proponent has the authority to approve ex-ceptions or waivers to this regulation that are consistent with controlling law and reg-ulations. The proponent may delegate this approval authority, in writing, to a division chief within the proponent agency or its di-rect reporting unit or field operating agency, at the rank of O – 6 or GS – 15. Ac-tivities may request a waiver to this regula-tion by providing justification that includes a full analysis of the expected benefits and risk. All waiver requests will be endorsed by the commander or senior leader of the requesting activity and forwarded through its higher headquarters to the policy propo-nent. The request must include formal re-view by the activity’s senior legal officer and endorsement by the authorizing offi-cial. Refer to AR 25 – 30 for specific guid-ance.

Army internal control process. This regulation contains internal control provi-sions, in accordance with AR 11 – 2, and identifies key internal controls that must be evaluated (see appendix B).

Supplementation. Supplementation of this regulation and establishment of com-mand and local forms are prohibited with-out prior approval from the Army Chief In-formation Officer/G – 6 (SAIS – CB), 107 Army Pentagon, Washington, DC 20310 – 0107 (army.ciog6.policy-inbox@mail.mil).

Suggested improvements. Users are invited to send comments and suggested improvements on DA Form 2028 (Recom-mended Changes to the Publications and Blank Forms) directly to Army Chief Infor-mation Officer/G – 6 (SAIS – CB), 107 Army Pentagon, Washington, DC 20310 – 0107 (army.ciog6.policy-inbox@mail.mil).

Committee management. AR 15 – 39 requires the proponent to justify establish-ing or continuing committee(s), to coordi-nate draft publications, and to coordinate changes in committee status with the Office of the Administrative Assistant to the Sec-retary of the Army, Department of the Army Committee Management Office (AARP – ZA), 9301 Chapek Road, Building 1458, Fort Belvoir, VA 22060 – 5527. Fur-ther, if it is determined that an established “group” identified within this regulation later takes on the characteristics of a com-mittee, as found in AR 15 – 39, then the pro-ponent will follow all AR 15 – 39 require-ments for establishing and continuing the group as a committee.

Distribution. This publication is availa-ble in electronic media only and is intended for the Regular Army, the Army National Guard/Army National Guard of the United States, and the U.S. Army Reserve.

Contents (Listed by paragraph and page number)

Chapter 1 Introduction, page 1 mailto:army.ciog6.policy-inbox@mail.mil mailto:army.ciog6.policy-inbox@mail.mil mailto:army.ciog6.policy-inbox@mail.mil

Contents—Continued ii AR 25–2 • 4 April 2019

Purpose • 1 – 1, page 1 References • 1 – 2, page 1 Explanation of abbreviations and terms • 1 – 3, page 1 Responsibilities • 1 – 4, page 1 Records management requirements • 1 – 5, page 1 Overview • 1 – 6, page 1 Statutory authority • 1 – 7, page 1 Precedence • 1 – 8, page 1

Chapter 2 Responsibilities, page 2 Principal Officials, Headquarters, Department of the Army; Commanders of Army commands, Army service component commands, and direct reporting units; and senior leaders of agencies and activities • 2 – 1, page 2 Assistant Secretary of the Army (Acquisition, Logistics, and Technology) • 2 – 2, page 4 Assistant Secretary of the Army (Financial Management and Comptroller) • 2 – 3, page 5 Assistant Secretary of the Army (Installations, Energy and Environment) • 2 – 4, page 5 Assistant Secretary of the Army (Manpower and Reserve Affairs) • 2 – 5, page 5 Administrative Assistant to the Secretary of the Army • 2 – 6, page 5 Army Chief Information Officer/G – 6 • 2 – 7, page 5 The Inspector General • 2 – 8, page 7 Army Auditor General • 2 – 9, page 8 Deputy Chief of Staff, G – 1 • 2 – 10, page 8 Deputy Chief of Staff, G – 2 • 2 – 11, page 8 Deputy Chief of Staff, G – 3/5/7 • 2 – 12, page 9 Deputy Chief of Staff, G – 4 • 2 – 13, page 9 Deputy Chief of Staff, G – 8 • 2 – 14, page 10 Assistant Chief of Staff for Installation Management • 2 – 15, page 10 Provost Marshal General • 2 – 16, page 10 Commanders of Army commands, Army service component commands, and direct reporting units, and senior leaders of agencies and activities • 2 – 17, page 10 Commanding General, U.S. Army Training and Doctrine Command • 2 – 18, page 10 Commanding General, U.S. Army Materiel Command • 2 – 19, page 11 Commanding General, U.S. Army Cyber Command • 2 – 20, page 11 Commanding General, U.S. Army Intelligence and Security Command • 2 – 21, page 12 Commanding General, U.S. Army Test and Evaluation Command • 2 – 22, page 13 Commanding General, U.S. Army Criminal Investigation Command • 2 – 23, page 13 Army senior information security officer • 2 – 24, page 13 Authorizing official • 2 – 25, page 14 Authorizing official designated representative • 2 – 26, page 14 Security control assessor • 2 – 27, page 14 Information system owner • 2 – 28, page 15 Program and system managers • 2 – 29, page 15 Information system security officer • 2 – 30, page 15 Information system security manager • 2 – 31, page 15 Information system security engineer • 2 – 32, page 15 User representative • 2 – 33, page 16 All personnel • 2 – 34, page 16 Army-appointed authorizing officials • 2 – 35, page 16 Army code signing attribute authority • 2 – 36, page 16 Authorized users • 2 – 37, page 16 Privileged users and accounts • 2 – 38, page 17

Chapter 3 The Army Cybersecurity Program, page 17 Cybersecurity Program functions • 3 – 1, page 17 Cybersecurity governance activities • 3 – 2, page 18

Contents—Continued

AR 25–2 • 4 April 2019 iii

Governance structure • 3 – 3, page 19 Army Cybersecurity governance • 3 – 4, page 20

Chapter 4 Cybersecurity Risk Management Program, page 21 Army Risk Management Program • 4 – 1, page 21 Cyber risk management • 4 – 2, page 21 Risk Management Framework • 4 – 3, page 21 Continuity of operations • 4 – 4, page 22 Physical security • 4 – 5, page 22 Information security • 4 – 6, page 23 Communications security • 4 – 7, page 23 Telecommunications Electronics Materiel Protected from Emanating Spurious Transmissions • 4 – 8, page 23 Operations security • 4 – 9, page 23 Protection of information technology and information • 4 – 10, page 23 Access control • 4 – 11, page 24 System and services acquisition • 4 – 12, page 25 Software assurance • 4 – 13, page 26 Cross-domain solutions • 4 – 14, page 26 Identity, credential, and access management • 4 – 15, page 26 Mobility • 4 – 16, page 26 Monitoring • 4 – 17, page 27 Configuration management • 4 – 18, page 27 Incident response and reporting • 4 – 19, page 27 Media security • 4 – 20, page 27 Internet and commercial cloud service providers • 4 – 21, page 28 Wireless services • 4 – 22, page 28 Peripheral devices • 4 – 23, page 28 Teleworking security • 4 – 24, page 28 Privately owned information technology • 4 – 25, page 29 Workforce management, training, education, and certification • 4 – 26, page 29

Chapter 5 Acceptable Use, page 29 User agreement • 5 – 1, page 29 User responsibilities and rules of behavior • 5 – 2, page 30 Notice of privacy rights and authorized monitoring and searches • 5 – 3, page 30

Chapter 6 Compliance, page 30 Oversight and inspections • 6 – 1, page 30 Compliance reporting requirements • 6 – 2, page 31

Appendixes

A. References, page 32

B. Internal Control Evaluation, page 41

Figure List

Figure 3 – 1: Tiered risk management approach (NIST SP 800 – 39), page 19 Figure 3 – 2: Army cybersecurity governance, page 20

Glossary

AR 25–2 • 4 April 2019 1

Chapter 1 Introduction

1 – 1. Purpose This regulation establishes policies and assigns responsibilities for the Army Cybersecurity Program to ensure adherence to Department of Defense (DOD) cybersecurity policies, processes, and standards. It integrates and coordinates with the functional elements of AR 525 – 2 to safeguard Army assets. The cybersecurity program sets the conditions necessary for the Army to protect and safeguard information technology (IT) capabilities; support mission readiness and resilience; and ensure the confidentiality, integrity, and availability of information in electronic format (hereafter referred to as infor-mation). It fully integrates risk management into every aspect of the Army.

1 – 2. References See appendix A.

1 – 3. Explanation of abbreviations and terms See the glossary.

1 – 4. Responsibilities See chapter 2 for responsibilities.

1 – 5. Records management requirements The records management requirement for all record numbers, associated forms, and reports required by this regulation are addressed in the Records Retention Schedule-Army (RRS – A). Detailed information for all related record numbers, forms, and reports are located in Army Records Information Management System (ARIMS)/RRS – A at https://www.arims.army.mil. If any record numbers, forms, and reports are not current, addressed, and/or published cor-rectly in ARIMS/RRS – A, see DA Pam 25 – 403 for guidance.

1 – 6. Overview Cybersecurity is a holistic program to manage IT-related security risk. To be effective, it must be integrated fully into every aspect of the Army. It requires the implementation and enforcement of proper management and operational proce-dures by the entire organization, from commanders and senior leaders of agencies and activities providing the strategic vision and goals for the organization, to strategic planners and project and program managers (PMs), down to each indi-vidual who helps develop, implement, and operate the IT that supports the Army’s mission and business processes. Fur-thermore, each individual, at every level, is responsible for procedural compliance with the proper practices and procedures for safeguarding information and IT. The responsibility for ensuring that personnel abide by these practices and procedures is inherent to commanders and senior leaders of agencies and activities.

1 – 7. Statutory authority Statutory authority is derived from Section 2223, Title 10, United States Code (10 USC 2223); 40 USC 11315; 44 USC, Chapter 35; and applicable Office of Management and Budget (OMB) memoranda, to include reporting requirements established via the Federal Information Security Modernization Act (FISMA) of 2014, Defense authorization and appro-priations acts, and DOD issuances.

1 – 8. Precedence This regulation is the proponent policy document for the Army Cybersecurity Program, which implements the DOD Cy-bersecurity Program. The Army will follow Director of National Intelligence (DNI), DOD, and Chairman of the Joint Chiefs of Staff (CJCS) issuances, to include directives, instructions, security technical implementation guides (STIGs), security requirements guides (SRGs), orders, and alerts. Supporting Department of the Army (DA) pamphlets will be published to provide uniform procedures for implementing and enforcing the policies in this regulation. Compliance with this regulation and the supporting DA pamphlets is mandatory. When needed, the Army Chief Information Officer/G – 6 (CIO/G – 6) will issue policy memoranda to amplify guidance for the policies in this document. This document does not alter or supersede existing DOD or DNI authorities and policies regarding the protection of sensitive compartmented in-formation (SCI) and Special Access Programs (SAP) for intelligence, as directed by EO 12333, and national security https://www.arims.army.mil/

2 AR 25–2 • 4 April 2019 information systems, as directed by EO 13231, nor other applicable laws and regulations. The DNI has delegated authority for all Army SCI systems to the Deputy Chief of Staff (DCS), G – 2. If at any time there is a conflict in this regulation with any related DNI, DOD, or Joint issuances, the higher-level policy will take precedence. Report identified conflicts or the need for amplifying guidance on DA Form 2028 (Recommended Changes to Publications and Blank Forms).

Chapter 2 Responsibilities Commanders and senior leaders of agencies and activities at all levels and those they appoint, to include PMs, information system owners (ISOs), application owners, IT service owners, information owners, portfolio managers, resource managers, and acquisition senior and functional services managers, are accountable for the implementation and enforcement of this regulation and will ensure individual and organization accountability within organizations and activities under their pur-view.

2 – 1. Principal Officials, Headquarters, Department of the Army; Commanders of Army commands, Army service component commands, and direct reporting units; and senior leaders of agencies and activities HQDA Principal Officials; Commanders of ACOMs, ASCCs, and DRUs; and senior leaders of agencies and activities will—

a. Implement the Army Cybersecurity Program to ensure that the personnel, processes, and IT for which they have development, procurement, integration, modification, operation and maintenance, and/or final disposition responsibility comply with this regulation and the amplifying policy guidance developed by the Army CIO/G – 6. This includes, but is not limited to—

(1) Develop, maintain, and modify IT as required to ensure uniform application of cybersecurity policies, procedures, and standards, and risk management security controls, in accordance with OMB, National Institute of Standards and Tech-nology (NIST), Committee on National Security Systems (CNSS), DOD, Joint, and Army issuances.

(2) Develop, implement, and maintain the security plan for assigned IT, as described in DODI 8510.01.

(3) Ensure that IT has been granted authorization to operate (ATO) by the assigned authorizing official (AO). Comply with all authorization decisions, including denial of authorization to operate. Enforce authorization termination dates.

(4) Transition from legacy or end-of-life cross-domain solutions (CDS) to those on the CDS baseline list managed by the Unified Cross-Domain Management Office (UCDMO).

(5) When a cross-domain service is required, leverage those provided by the Defense Information Systems Agency

(DISA) to the fullest extent possible.

(6) Provide appropriate notice of privacy rights and explain monitoring policies to all users.

(7) Require user authentication to DOD information systems and networks in accordance with DODI 8520.03.

(8) Ensure an effective vulnerability management process is in place, which includes—

(a) Ensuring that baseline configurations contain all required patches and follow applicable STIGs and SRGs at the time the baseline is established, and are updated upon the release of new or revised information assurance vulnerability alerts, STIGs, and SRGs.

(b) Ensure that security patches are made available for new vulnerabilities and are applied in accordance with the sus-pense dates or sooner if possible, per operational directives.

(c) Employ an automated patching process, when practical, in order to minimize manpower requirements and system downtime.

(d) Provide authorized personnel the access necessary to conduct required technical compliance assessments, to include vulnerability scans.

(9) Provide for vulnerability mitigation and incident response and reporting capabilities in order to—

(a) Comply in a timely and efficient manner with DOD and Army cybersecurity directives, guidance, and alerts for implementing mitigations and taking corrective action in defense of the DOD information network (DODIN).

(b) Limit damage and restore effective service following an incident.

(c) Collect and retain audit data to support technical analysis relating to misuse, penetration, or other incidents involving

IT under their purview, and provide these data to appropriate law enforcement or other investigating agencies.

(10) Implement security-informed configuration management (CM) and change management processes in accordance with NIST guidance and as described in DODI 8440.01.

(11) Implement insider threat policy, guidance, and monitoring activities as part of a comprehensive cybersecurity pro-gram directed by national, DOD, and office of the DNI leadership.

AR 25–2 • 4 April 2019 3

b. Assign the appropriate responsibility and authority to individuals within the organization as necessary to implement, manage, and enforce this regulation, and for all applicable roles in accordance with DODI 8510.01, DODD 8140.01, and related DOD, CNSS, and Army issuances.

(1) Appoint and oversee privileged users as required to carry out appointed functions. Ensure that privileged users meet the requirements for authorized and privileged users in accordance with this regulation. Monitor privileged users to ensure that they continue to meet the requirements.

(2) Ensure that all cybersecurity personnel under their purview are appointed in writing. Manage their training and certification through the Army Training and Certification Tracking System (ATCTS) at https://atc.us.army.mil.

c. Ensure that all personnel—

(1) Are appropriately cleared, trained, qualified, and authorized in accordance with applicable CNSS, DOD, and Army information security, communications security (COMSEC) and cybersecurity issuances before accessing IT, and continue as such while authorized access.

(2) Sign a user agreement of acknowledgement (paper or electronic) prior to account activation and annually thereafter that states they—

(a) Have read, understood, and agreed to abide by, notably the rules that describe user responsibilities and expected behavior for IT usage in accordance with this regulation.

(b) Have read, understood and agreed to the notice of privacy rights, and consented to monitoring and searches in accordance with this regulation.

(3) Create and maintain a profile in the ATCTS. Ensure that users’ profiles are current and correct with all applicable documentation, to include completed DD Form 2875 (System Authorization Access Request (SAAR)), annually signed user agreement, applicable training certificates, and, as applicable , DA Form 7789 (Privileged Access Agreement and Acknowledgement of Responsibilities), appointment memoranda, and records of professional certifications.

d. Military and civilian personnel may be subject to appropriate action if they knowingly, willfully, or negligently compromise, damage, or place Army information systems at risk by not ensuring implementation of DOD and Army policies and procedures. Violations are identified in the Army IT user agreement.

(1) These provisions may be punished as violations as follows:

(a) Sanctions for civilian personnel may include, but are not limited to, some or all of the following administrative actions: oral or written warning or reprimand; adverse performance evaluation; suspension with or without pay; loss or suspension of access to IS or networks, and classified material and programs; any other administrative sanctions authorized by contract or agreement; and/or dismissal from employment. Sanctions for civilians may also include prosecution in U.S.

District Court or other courts and any sentences awarded pursuant to such prosecution. Sanctions may be awarded only by civilian managers or military officials who have authority to impose the specific sanction(s) proposed.

(b) Sanctions for military personnel may include, but are not limited to, some of the following administrative actions:

oral or written warning or reprimand; adverse performance evaluation; and loss or suspension of access to IS or networks and classified material and programs. Sanctions for military personnel may also include any administrative measures au-thorized by service directives and any administrative measures or non-judicial or judicial punishments authorized by the Uniform Code of Military Justice (UCMJ).

(c) Defense contractors are responsible for ensuring employees perform under the terms of the contract and applicable directives, laws, and regulations and must maintain employee discipline. The contracting officer, or de-signee, is the liaison with the defense contractor for directing or controlling contractor performance. Outside the assertion of criminal jurisdic-tion for misconduct, the contractor is responsible for disciplining contractor personnel. Only the Department of Justice may prosecute misconduct under applicable Federal laws, absent a formal declaration of war by Congress (which would subject civilians accompanying the force to UCMJ jurisdiction). For additional information on contractor personnel au-thorized to accompany U.S. Armed Forces, see DODI 3020.41.

e. Build capabilities to support cybersecurity objectives that are shared with mission partners, and ensure that they are consistent with guidance contained in DOD 8000.01 and governed through the integrated decision structures and processes described in DODI 8500.01.

f. Identify the resources required to implement DODI 8510.01 for inclusion in the Defense planning, programming, budgeting, and execution process.

g. Incorporate cybersecurity risk assessments and decisions, in accordance with DODI 8510.01, into Army mission and business risk management processes.

h. Ensure consistent development and incorporation of cybersecurity requirements into plans and procedures across their areas of responsibility.

i. Maintain ongoing awareness of cybersecurity threats and vulnerabilities to support risk management decisions. En-sure that real-world threat data and analysis inform risk decisions. Consider shared risks. Take no unnecessary risk, but do not be risk-averse.

https://atc.us.army.mil/

4 AR 25–2 • 4 April 2019

j. Integrate security early and throughout the IT development life cycle, capital planning, investment control, portfolio management, and enterprise architecture processes in accordance with the DOD Cybersecurity Architecture and other applicable DOD and Army issuances.

k. Integrate security standards into acquisition planning and contract administration. Ensure that contracts and other agreements include specific requirements to provide cybersecurity for information and the IT used to process that infor-mation in accordance with DODI 8500.01 and DODI 8510.01. Document baseline cybersecurity requirements as a condi-tion of contract award for acquisitions utilizing IT.

l. Ensure that incident response and reporting programs are followed, and personnel are aware of, and held accountable for, daily practices that protect against suspected intrusions, unauthorized activity, suspected attacks, and other anomalous activity. Report suspected or confirmed incidents in accordance with Army regulations relevant to the specific incident, Army Cyber Command (ARCYBER) or supporting cybersecurity service provider’s published procedures, and formal internal policies and procedures.

m. Ensure that maintenance and disposal of information on IT comply with the provisions of DODI 5015.02 and AR 25 – 400 – 2.

n. Comply with the specific policies developed by the CIO/G – 6 for the Army Cybersecurity Program, in accordance with the statutory requirements outlined in FISMA.

o. For all assigned IT, comply with AO decisions.

p. Comply in a timely and efficient manner with DOD and Army cybersecurity issuances for mitigating and taking corrective action in defense of the DODIN.

q. Conduct DODIN operations and defensive cyberspace operations - internal defense measures (DCO – IDM) when directed by ARCYBER.

2 – 2. Assistant Secretary of the Army (Acquisition, Logistics, and Technology) In addition to the responsibilities in paragraph 2 – 1, the ASA (ALT) will–

a. Ensure that DODI 8510.01 processes are appropriately integrated into the Defense Acquisition System processes for IT procurement.

b. Verify that adequate support for cybersecurity requirements is planned, resourced, and documented, and can be ex-ecuted in a timely manner in accordance with DODI 8510.01 and other applicable NIST, CNSS, DOD, and Army issu-ances.

c. Ensure that solutions meet DODI 8510.01, system survivability key performance parameters, and requirements for cyber resiliency.

d. Issue policy and guidance to ensure that systems security engineering (SSE) and the trusted systems and networks processes, tools, and techniques described in DODI 5200.44 are incorporated into the acquisition of all applicable IT.

e. Implement DOD-wide cybersecurity solutions when possible.

f. Ensure that contracts and other agreements include specific requirements to provide cybersecurity for information and IT, including platform IT and control systems, in accordance with DOD policies, procedures, standards, and other guidance.

g. Issue policy and guidance to ensure that cybersecurity testing and evaluation (T&E) are conducted throughout the acquisition life cycle and are integrated with interoperability and other functional testing.

h. Ensure that a cybersecurity representative participates in planning, execution, and reporting of integrated T&E ac-tivities in accordance with DODI 5000.02.

i. Verify that adequate T&E support for cybersecurity requirements is planned, resourced, and documented, and can be executed in a timely manner in accordance with DODI 5134.17 and applicable Director, Operational Test and Evaluation memoranda.

j. Ensure that policy and procedures for developing program protection plans, as required by DODI 5000.02, include cybersecurity strategy requirements in accordance with DODI 8500.01 and other applicable DOD and Army issuances.

k. Ensure that program protection plan cybersecurity strategy annexes for systems are developed, implemented, and maintained consistent with DODI 5000.01, DODI 8510.01, NIST and DOD standards, and DOD architectures for all IT;

that the annexes have been validated by the Army CIO/G – 6; and that they enable receiving units to comply with DOD-and Army-approved processes into the sustainment phase.

l. Ensure that acquisition community personnel with IT development responsibilities meet the standard qualification criteria in accordance with DOD 8570.01 – M.

m. Issue policy and guidance to ensure the mitigation of vulnerabilities that are successfully exploited during the Army Interoperability Certification System-of-Systems Network Vulnerability Assessment.

AR 25–2 • 4 April 2019 5

n. Review system sustainment plans for both new and existing systems, in coordination with the U.S. Army Materiel Command (AMC), to ensure cybersecurity sustainment for the system after fielding and continued compliance with DODI 8510.01.

o. Provide a capability to inventory IT assets that automatically generates a complete view of vulnerabilities and intru-sion detection activities.

p. Provide an automated patch management capability as part of life-cycle management in order to minimize system downtime and to prevent adding personnel requirements to organizations using the systems.

q. Provide IT threat data support to AOs for development and execution of plan of action and milestones (POA&Ms) to address known vulnerabilities in IT, in coordination with the Army Research Laboratory System Lethality Analysis Directorate and ARCYBER.

r. Ensure that technical and equipment publications for IT-enabled end items include any cybersecurity-related require-ments in accordance with the AO's ATO, for example, software patching requirements as part of preventative maintenance checks and services.

s. Support the Army CIO/G – 6 and Army stakeholders during the development, implementation, and maintenance of an effective cybersecurity strategy, for both new and existing systems. This strategy will be consistent with DOD policies, standards, and architectures for all IT and will enable receiving units to comply with DOD- and Army-approved processes into the sustainment phase.

t. Oversee the transition of legacy or end-of-life CDS to CDS on the CDS baseline list managed by the UCDMO.

2 – 3. Assistant Secretary of the Army (Financial Management and Comptroller) In addition to the responsibilities in paragraph 2 – 1, the ASA (FM&C) will—

a. In coordination with DCS, G – 8 and ASA (ALT) verify that programmed and budgeted resources are incorporated into budget justification material for IT investments in order to ensure understanding of approved requirements that support

DODI 8510.01.

b. Develop, implement, and maintain an IT security plan, as defined by DODI 8510.01, for each ASA (FM&C) IT system, to include a list and the implementation status of all required controls.

2 – 4. Assistant Secretary of the Army (Installations, Energy and Environment) In addition to the responsibilities in paragraph 2 – 1, the ASA (IE&E) will ensure that cybersecurity requirements and operational concerns are considered and integrated into Army efforts related to installations, Army real estate, energy security and sustainability, and the environment during all phases of planning and development.

2 – 5. Assistant Secretary of the Army (Manpower and Reserve Affairs) In addition to the responsibilities in paragraph 2 – 1, the ASA (M&RA) will—

a. Ensure that personnel policies implement applicable cybersecurity controls required across the Army, per DODI 8510.01.

b. Ensure that modified table of equipment, table of organization and equipment, military occupational specialties, and civilian occupational series are updated in order to meet requirements for cyber-related functional areas, military and ci-vilian work roles, credentials, and security clearances. Use existing personal assignment processes and guidelines to sup-port ongoing changes. Integrate approved cybersecurity tools, doctrine, procedures, including the risk management frame-work (RMF), and legal requirements into applicable programs of instruction for U.S. Army Training and Doctrine Com-mand (TRADOC) schools.

c. Ensure that SSE functions are integrated into the systems engineering workforce and curriculum, in accordance with

DODI 5134.16.

d. Coordinate with the Army CIO/G – 6 regarding implementation of cybersecurity requirements for effective manning, management, and readiness assessments of the cybersecurity workforce.

2 – 6. Administrative Assistant to the Secretary of the Army In addition to the responsibilities in paragraph 2 – 1, the Administrative Assistant to the Secretary of the Army will ensure development of procedures for managing and reporting loss or unauthorized disclosure of personally identifiable infor-mation (PII), or other Privacy Act information, including information in electronic format.

2 – 7. Army Chief Information Officer/G – 6 In addition to the responsibilities in paragraph 2 – 1, as the Army CIO, the CIO/G – 6 will—

6 AR 25–2 • 4 April 2019

a. In accordance with DODI 8500.01, on behalf of the Secretary of the Army, establish policy, resourcing, and oversight of the Army Cybersecurity Program that is consistent with DOD Senior Information Security Officer strategy and the Defense Cybersecurity Program, and complies with DODI 8500.01.

b. Issue policies and guidance for Army cybersecurity activities to support DODIN operations as described in DODI 8530.01.

c. Set the strategic direction and policy, and verify that enterprise resources are used effectively for Armywide activities, to design, build, configure, secure, operate, maintain, modernize, and sustain the Army-managed portion of the DODIN;

and to protect and defend IT by ensuring availability, integrity, authentication, confidentiality, and non-repudiation.

d. Promulgate policies and guidance to ensure that all IT complies with applicable law and national, Federal, and DOD issuances, to include National Security Agency (NSA) issuances, NIST standards, DOD STIGs, and DOD SRGs, with exceptions documented and approved by the responsible AO.

e. Ensure that support for the DOD cybersecurity architecture, which is used to manage the Enterprise Information Environment Mission Area (EIEMA) portfolio, is provided as described in DODD 8115.01.

f. Validate that IT investments comply with DODI 8500.01, to include leveraging DOD-wide cybersecurity solutions to the extent practical, and DODI 8530.01; and are consistent with DOD and Army cybersecurity architecture.

g. As the Army EIEMA lead, manage the portfolio of cybersecurity capabilities in accordance with DODD 8115.01 and DODI 8115.02 to ensure that investments support DOD requirements, as described in DODI 8530.01.

h. In conjunction with DOD, ensure that in-depth cybersecurity orientation, training, certification, and awareness pro-grams are developed and made available to all Army personnel.

i. Serve as the principal Army member of the CNSS.

j. Serve as the approval authority for Army Interoperability Certification.

k. Serve as the Army registration authority for the public key infrastructure (PKI) of the Army-managed portion of the

DODIN in accordance with DODI 8520.02.

l. Serve as the Service component lead for DOD PKI. The CIO/G – 6 holds responsibility, authority, and oversight, and develops policy, for cybersecurity activities, including PKI and public-key enabling technologies. The CIO/G – 6 also en-sures compliance with DOD, NSA, DISA, and Army policy.

m. Issue policy and guidance to ensure that Armywide activities implement CNSS and DOD COMSEC-related issu-ances.

n. Oversee implementation of the Army COMSEC Program, including enforcement of all applicable DOD and Army COMSEC policies, directives, criteria, standards, and doctrine, to include—

(1) Develop policy and procedures for the COMSEC material control system key management infrastructure (KMI).

(2) Oversee modernization of the Army-managed portion of the KMI.

(3) Develop policy and procedures for COMSEC account establishment.

(4) Oversee distribution of cryptographic hardware.

(5) Review proposed COMSEC programs and the associated resource requirements, and recommend resource alloca-tions.

(6) Establish procedures ensuring that KMI operating account managers and alternate KMI operating account managers are properly appointed and trained.

(7) Review and validate all Army requirements for COMSEC products and services, and forward to the DCS, G – 3/5/7 for prioritization of support to execute Army General Order (AGO) 2017 – 01 responsibilities and request NSA technical services.

(8) Forward validated and prioritized Army requirements for COMSEC products and services to the Director, NSA to support procurement activities.

(9) Oversee COMSEC operations, policy, procedures, and training.

(10) Provide management oversight of the Army Key Management Enterprise Infrastructure, including implementation of the KMI, the Electronic Key Management System, and the Army Key Management System.

(11) Appoint an Army voting member to the Key Management Executive Committee and Joint KMI working group.

(12) Appoint the chairperson and alternate chairperson for the Tier 1 System Management Board, which has operations management responsibilities for the Electronic Key Management System Common Tier 1 System.

o. Appoint AOs when deemed necessary.

p. Issue policy and guidance to appointed Army AOs, in accordance with DODI 8510.01, to ensure that AO decisions are integrated and synchronized with the conduct of DODIN operations.

q. Ensure that appropriate authorizations are obtained and maintained throughout the system life cycle.

r. Coordinate with ARCYBER regarding any system that introduces a "very high" or "high" risk level to determine under what conditions such a system may operate due to mission criticality.

s. Represent the Army at DOD, Federal, Joint and Army-level AO forums.

AR 25–2 • 4 April 2019 7

t. Appoint the Army senior information security officer (SISO).

u. Appoint the Army code signing AO.

v. Advise the ASA (ALT) to ensure that all IT is acquired in accordance with DOD and Army cybersecurity issuances.

w. Advise Army mission area leads to ensure that cybersecurity requirements are addressed for all IT.

x. Oversee transition of legacy or end-of-life CDS to CDS on the CDS baseline list managed by UCDMO.

y. When a CDS is required, promote use of DISA-provided cross-domain services to the extent possible.

z. Ensure that appropriate notice of privacy rights and monitoring policies are provided to all individuals accessing

Army-owned or controlled IT.

aa. Issue policy and guidance to ensure that cybersecurity solutions do not unnecessarily restrict the use of assistive technology by individuals with disabilities, or access to or use of information and data by individuals with disabilities, in accordance with law and DOD issuances.

bb. Ensure that cybersecurity requirements are addressed and visible in all capability portfolios, and are properly ad-dressed during IT development in the non-kinetic (cyber) piece of the systems survivability key performance parameters, technical architectures, IT life-cycle management processes, and investment programs that incorporate IT.

cc. As the functional proponent and Army staff integrator for Information Technology and Information Management, coordinate and advocate for resources for Armywide cybersecurity solutions with appropriate Program Evaluation Groups (PEGs), to include overseeing appropriations allocated to the Army Cybersecurity Program.

dd. Ensure that system-of-systems network vulnerability assessments are integrated into the Army Interoperability Cer-tification program.

ee. Coordinate with the Inspector General (DAIG) and the Army Auditor General to identify root causes and solutions for systemic and critical cybersecurity issues reported to the Army Risk Management Council (ARMC).

ff. Issue and annually review the requirements governing the appropriate use of Army IT, which will be included in all Army IT user agreements.

gg. Validate whether program protection plan cybersecurity strategy annexes comply with DODI 8510.01 and DODI 5000.02.

hh. Sustain an Armywide PKI for the Army-managed portion of the DODIN, in accordance with DODI 8520.02.

ii. Oversee the Army registration authority for the issuance of PKI credentials.

jj. Provide guidance and oversight of Army IT implementation to ensure that ports, protocols, and services follow the requirements outlined in DODI 8551.01. Designate, in writing, a primary and one or more alternate voting representatives to the DOD Ports, Protocols, Services Management Configuration Control Board and ensure representation at all Ports, Protocols, Services Management Configuration Control Board meetings. Representatives will be designated in accordance with the requirements identified in DODI 8551.01.

kk. Provide regulatory and policy direction and oversight for the ATO and authority to connect processes.

ll. Coordinate with the DCS, G/3/5/7 regarding the issuance of appropriate implementation instructions to ensure that all Army organizations are responsive to ARCYBER DODIN operations and DCO – IDM directives.

mm. Develop and publish common cybersecurity assessment benchmarks based on the DOD RMF and in accordance with NIST guidance.

nn. In addition to the responsibilities in paragraph 2 – 1, as the Army Staff G – 6, the CIO/G – 6 will—

oo. Promote and facilitate the Army Cybersecurity Program and related activities to support DODIN Operations and

DCO, as described in DODI 8530.01.

pp. Oversee management of cybersecurity activities to support DODIN operations and DCO – IDM, as described in

DODI 8530.01.

qq. Maintain an Army cross-domain support element to coordinate cross-domain activities with the Unified Cross-

Domain Services Management Office, in accordance with DOD CIO guidance. Ensure use of DISA-provided cross-do-main services as the preferred method of addressing cross-domain requirements for secret networks. Cross-domain systems for domains above secret will adhere to cross-domain intelligence community standards and requirements.

rr. Manage resources for Army cybersecurity programs, to include Army Joint Worldwide Intelligence Communica-tions System (JWICS), in accordance with ASA (FM&C) directives and guidance published in the Army Planning Priori-ties Guidance and the Army Programming Guidance Memorandum.

ss. Ensure that cybersecurity inspections and compliance oversight activities are accomplished in coordination with AR 525 – 2, and that the cybersecurity trend information is shared with key stakeholders.

tt. Integrate Federal-, DOD-, and Joint-directed cybersecurity requirements into the Army technical architecture and capability sets.

2 – 8. The Inspector General In addition to the responsibilities in paragraph 2 – 1, the DAIG will—

8 AR 25–2 • 4 April 2019

a. Conduct an annual independent evaluation to determine the effectiveness of the Army Cybersecurity Program and cybersecurity practices, as required by 44 USC 3555.

b. As part of the evaluation of the Army Cybersecurity Program and cybersecurity practices, leverage FISMA Inspector General metrics to assess the maturity of the Army's implementation of framework functions to address risks.

c. Leverage the cybersecurity mission-essential task list to identify systemic readiness issues and report the root causes of such at least annually.

d. Coordinate with the Army CIO/G – 6 and the Army Auditor General to identify root causes and support identification of solutions for systemic and critical cybersecurity issues reported to the ARMC.

2 – 9. Army Auditor General In addition to the responsibilities in paragraph 2 – 1, the Auditor General will—

a. Help resolve cybersecurity issues by identifying solutions for issues that cause unacceptable Army-wide risk or in-efficient use of resources.

b. Coordinate with the Army CIO/G – 6 and the DAIG to identify solutions for root causes of systemic and critical cybersecurity issues reported to the ARMC.

2 – 10. Deputy Chief of Staff, G – 1 In addition to the responsibilities in paragraph 2 – 1, the DCS, G – 1 will—

a. Assign a position designation (PD) for personnel occupying cybersecurity positions using the criteria found in DODM 5200.02 and DODI 1400.25, Vol. 731; and document the PD in the Defense Civilian Personnel Data System.

b. Ensure that the PD includes the associated suitability and fitness requirements in accordance with DOD policies, procedures, standards, and other guidance, as described in DODI 1400.25, Vol 731.

c. The ASA (M&RA), in delegating operational responsibilities for the human resources management domain, directs the DCS, G – 1 to provide oversight of all IT business systems in the human resource management domain within the business mission area.

2 – 11. Deputy Chief of Staff, G – 2 In accordance with IC directives, the DCS, G – 2 is the Army's senior intelligence officer and serves as the Army intelligence element lead. In this capacity, the DCS, G – 2 has delegated authority from the DNI over IC operating environments, to include the Top Secret DOD Intelligence Information System's JWICS and standalone SCI systems. On the DCS, G-2's behalf, the Director, Intelligence Community Information Management (DAMI – IM) serves as the Army's Intelligence CIO, AO, and security control assessor (SCA). The DAMI – IM promulgates policies and guidance that govern operations and ensure the Army's adherence to IC directives and IC standards. Nothing in this regulation alters or supersedes the existing authorities and policies of the DOD or the DNI regarding the protection of SCI, as directed by EO 12333. The DNI has delegated authority for all Army SCI systems to the DCS, G – 2. In addition to the responsibilities in paragraph 2 – 1, the DCS, G – 2 will—

a. Serve as the Army senior intelligence officer and Army Intelligence lead with purview over IT that processes SCI.

(1) Oversee Armywide activities to manage the Army portion of the JWICS and SCI systems, in accordance with DNI issuances.

(2) Issue policy and guidance to manage the Army portion of the JWICS and SCI systems, in accordance with DNI issuances.

b. Include the DOD cybersecurity architecture in their management of the Army portion of the Defense Intelligence mission area portfolio as described in DODD 8115.01.

c. Ensure that IT investments in the Defense Intelligence mission area portfolio comply with DODI 8500.01.

d. Issue procedures for promptly managing and reporting actual or potential compromise of classified information and unauthorized disclosure of controlled unclassified information (CUI) in an electronic format, to include such losses on cleared contractor systems.

e. Develop a policy for and ensure the collection, analysis, and dissemination of national, DOD, theater, and Army-level cyber threat data, in accordance with applicable national, DOD and Army issuances.

f. Prescribe the activities, policies, processes, procedures, and protocols for reportable intelligence and information related to cyberspace.

g. Review programs to evaluate physical security compliance with COMSEC policies and procedures issued by CNSS, NIST, DOD, the Joint Staff, and the Army.

h. Develop policy and procedures for safeguarding and controlling COMSEC, controlled cryptographic items (CCIs) and cryptographic high-value product (CHVP) material.

AR 25–2 • 4 April 2019 9

i. Develop policy and procedures for COMSEC monitoring.

j. Make final adjudication decisions to determine when reported COMSEC incidents result in COMSEC insecurities.

k. Manage the DA Cryptographic Access Program.

l. Coordinate with the Army CIO/G – 6 and the NSA, as appropriate, regarding the release of Army COMSEC material or foreign COMSEC material in the Army’s custody to nonmilitary agencies, the general public, foreign nationals, or foreign governments.

m. Accept the cryptographic access granted by other DOD components.

n. Ensure that CNSS requirements, as they apply to DCS, G – 2 responsibilities, are met.

o. The Director, Intelligence Community Information Management serves as the Army’s intelligence chief information officer for IT that processes SCI.

(1) Serve as the approval authority for external information systems’ penetration and exploitation testing of JWICS and

SCI intelligence networks.

(2) Oversee security control assessors for the Army-managed portion of the JWICS and SCI systems.

p. Oversee the hardware programming life cycle of Army JWICS IT.

q. Oversee vulnerability and risk assessment of JWICS IT…