CGCYBER TASKORD 23-0022 Cisco EX90 SVTC End of Life.pdf

UNCLASSIFIED//FOR OFFICIAL USE ONLY//

PTTUZYUW RHOIAAA0001 1381518 UUUU RHSSSUU.

ZNR UUUUU

P 181514Z MAY 23

FM COGARD CYBERCOM WASHINGTON DC

TO TF 31

INFO COMDT COGARD WASHINGTON DC//DCO/CG-2/CG-6/CG-62/CG-68/CG-761/CG-791//

COMLANTAREA COGARD PORTSMOUTH VA//LANT-6//

COMPACAREA COGARD ALAMEDA CA//PAC-6//

BT

UNCLAS FOUO

SUBJ/ (U) CGCYBER TASKORD 23-0022 Cisco EX90 SVTC Discontinued Use due End of Life (EOL) (U//FOUO) // REF/A/DOC/ (U//FOUO) C5ISC Advisory C5ISC 23 018 / C5ISC / 16MAY2023 / / NARR/ (U//FOUO) Per REF (A), On 31AUG2022 Cisco ended all life cycle support (hardware and software) for the Telepresence EX90 desktop video conferencing system. With the discontinuation of all manufacturer support in August 2022, the EX90 is no longer authorized for Department of Defense Information Network (DoDIN) use. As such, this TASKORD directs all Task Force 31 (TF-31) Task Units (TU) to enumerate and remove any Cisco EX90 devices across NIPRNET and SIPRNET enclaves and report overall compliance IAW PARAS 5.A.1 and 5.A.2 below NLT

182359Z AUG 23.//

SITUATION/1. (U)

1.A. (U//FOUO) IAW REF (A), CGCYBER directs all TU to enumerate and remove all Cisco Telepresence EX90 devices from NIPRNET and SIPRNET enclaves NLT 182359Z

AUG 23.//

MISSION/2. (U)

2.A. (U//FOUO) The CGCYBER mission is to protect all USCG Cyberspace terrain across the Enterprise Mission Platform (EMP). CGCYBER directs that all Cisco Telepresence EX90 devices be enumerated and removed from NIPRNET and SIPRNET enclaves. Recommended hardware and software alternative solutions are listed in

REF (A).//

EXECUTION/3. (U)

3.A. (U) CONCEPT OF OPERATIONS.

3.A.1. (U//FOUO) COMMANDER'S INTENT. IAW REF (A), USCG will satisfy all EOL equipment removal and prohibition requirements set forth by REF (A).

3.A.1.A. (U//FOUO) PURPOSE. The purpose of this CGCYBER TASKORD is to remove all EOL Cisco EX90 devices from the NIPRNET and SIPRNET enclaves.

3.A.1.B. (U//FOUO) TIMELINE.

3.A.1.B.1. (U) 18MAY2023: Release TASKORD 23-0022. (CGCYBER) 3.A.1.B.2. (U//FOUO) 16JUN2023: Identify any Cisco Telepresence EX90 devices deployed within each respective TU AO. (TU) 3.A.1.B.3. (U//FOUO) 18AUG2023: Remove any Cisco Telepresence EX90 devices deployed within the respective TU AO. (TU) 3.A.1.B.4. (U) 18AUG2023: Report compliance to CGCYBER. (TU) 3.A.1.B.5. (U//FOUO) 18AUG2023: Report compliance to CGCYBER Leadership.

(CGCYBER)

3.A.1.C. (U//FOUO) ENDSTATE. IAW REF (A), all Cisco Telepresence EX90 products will be enumerated and removed from NIPRNET and SIPRNET enclaves. Recommended hardware and software alternative solutions are listed in REF (A).//

TASKS/4. (U)

4.A. (U) TF-31 TU.

4.A.1. (U//FOUO) NLT 16JUN2023: Identify any Cisco Telepresence EX90 devices deployed within each respective TU AO.

4.A.2. (U//FOUO) NLT 18AUG2023: Remove any Cisco Telepresence EX90 devices deployed within the respective TU AO.

4.A.2.A. (U//FOUO) Recommended hardware and software alternative solutions are listed in REF (A). Units must receive authorization to make hardware modifications or connect approved peripherals per REF (A).

4.A.3. (U//FOUO) NLT 18AUG2023: Complete Cisco Telepresence EX90 removal, enforce prohibition, and report compliance to CGCYBER IAW PARAS 5.A.1. and 5.A.2 below.

4.B. (U//FOUO) CGCYBER.

4.B.1. (U) NLT 18MAY2023: Release CGCYBER TASKORD 23-0022.

4.B.2. (U//FOUO) NLT 18AUG2023: Report compliance to CGCYBER Leadership.//

COMPLIANCE REPORTING/5. (U)

5.A. (U//FOUO) Action addressees acknowledge receipt of this message within 72 hours and report compliance via the CGCYBER Orders and Directives Management Portal: https://uscg.sharepoint-mil.us/sites/cybercom_spo/IAD/CRB1/Task /SitePages/Task Landing.aspx.

5.A.1. (U) Negative responses are required. Any task the TU deems not applicable must reflect that status in the portal by indicating "Not Applicable", indicating 100% complete, and report "All Systems Compliant" by selecting the box next to "Check for CGCC 35 review when all systems are compliant".

5.A.2. (U) For each applicable task in the Orders and Directives Portal, each TU should report the applicable status (Not Started, Not Applicable, In Progress, Completed, etc.), percent complete (0%, 20%, 50%, 80%, or 100%).

5.B. (U) Submit Requests for Information (RFI) regarding this order to the Orders & Directives Management Tool, RFI section: https://uscg.sharepoint -mil.us/sites/cybercom_spo/IAD/CRB1/Task/SitePages/CGCC-34%20Admin/CGCC-34_RFI _DB.aspx.

5.C. (U//FOUO) POAM and Waiver instructions are located on the Compliance and Orders Branch Portal Page: https://uscg.sharepoint-mil.us/sites/cg6/cg62 /SiteAssets/Forms/AllItems.aspx?id=%2Fsites%2Fcg6%2Fcg62%2FSiteAssets %2FSiteAssets%2FCG62%20Sharepoint%20Documents%2FPolicy%20Documents%2FPOAM %20Process%20Guide%5F08312022%2Epdf&parent %2Fsites%2Fcg6%2Fcg62%2FSiteAssets %2FSiteAssets%2FCG62%20Sharepoint%20Documents%2FPolicy%20Documents.

5.C.1. (U//FOUO) Any POAM submission must be accompanied by an Operational Risk Assessment (ORA). The ORA must be signed and approved by the Information System Owner (ISO) or Authorizing Official (AO). Samples are available on the Compliance and Orders POAM page identified in PARA (5.C.) above.

5.C.1.A. (U//FOUO) Due to the risk to the EMP and DODIN posed by continued use of end-of-life equipment, all POAM and ORA submissions will undergo critical analysis. Any TU wishing to submit a POAM shall provide clear milestones, list compensating controls, and shall seriously consider the impact upon the organization should the impacted assets be ordered disconnected until remediated.

5.C.2. (U) Submit POA&M questions to the POA&M Request for Information (RFI) to CGCYBER POC identified in PARA 6.B.1.A.//

COMMAND AND CONTROL/6. (U)

6.A. (U//FOUO) CGCYBER is the supported command. All others are the supporting commands.

6.B. (U) POINTS OF CONTACT (POC).

6.B.1. (U) PRIMARY.

6.B.1.A. (U) CGCYBER Compliance and Orders (CGCC-35-COB) NIPR: CGCYBER ORDERS@uscg.mil SIPR: USCG.D5.CGCYBER.LIST.CGCC34-OPS-CR@mail.smil.mil.

6.B.2. (U) ALTERNATE.

6.B.2.A. (U) After-Hours, 24/7: CGCYBER Cybersecurity Operations Center (CSOC) NIPR: CGCYBER SOC@uscg.mil SIPR: USCG.BEAU-ALEX.CYBERCOM.LIST.CGCYBER-SOC@mail.smil.mil

COMM: (202) 372-2900.//

BT

#0001

NNNN

UNCLASSIFIED//FOR OFFICIAL USE ONLY//