Appendix A - DoW ICAM Governing Authorities List.pdf

Appendix A

Appendix A – DoW ICAM Governing Authorities List

Table of Contents Table of Contents

1. Federal Laws, Executive Orders, & OMB Mandates

2. Core DoW / DoD ICAM Issuances

3. Broader DoW / DoD Cybersecurity & InfoSec Issuances

4 DoW / DoD CIO Memoranda, Strategies, & Frameworks

5. CNSS, NIST, & Federal PKI / Technical Standards

Below is the comprehensive, categorized running list of laws, executive mandates, policies, instructions, and standards that DoW Identity, Credential, and Access Management (ICAM) must adhere to, compiled directly from the governing ICAM issuances without commentary.

1. Federal Laws, Executive Orders, & OMB Mandates

Reference Official Title

5 U.S.C. § 552a Records maintained on individuals (The Privacy Act of 1974, as amended)

15 U.S.C. § 7001 General rule of validity (The Electronic Signatures in Global and National Commerce Act (E-SIGN))

44 U.S.C. § 3504, as amended by Title XVII of Pub. L. 105-277

The Government Paperwork Elimination Act (GPEA)

Public Law 113-283 Federal Information Security Modernization Act (FISMA) of

EO 12333 United States Intelligence Activities (as amended by EO 13526 and EO 14086)

EO 14028 Improving the Nation's Cybersecurity

HSPD-12 Policy for a Common Identification Standard for Federal Employees and Contractors

OMB M-19-17 Enabling Mission Delivery through Improved Identity, Credential, and Access Management

OMB M-21-31 Improving the Federal Government's Investigative and Remediation Capabilities Related to Cybersecurity Incidents

OMB M-22-09 Moving the U.S. Government Toward Zero Trust Cybersecurity Principles

Public Law 118-31 National Defense Authorization Act (NDAA) for Fiscal Year 2024 (Section 1005)

2. Core DoW / DoD ICAM Issuances

Reference Official Title

DoWI / DoDI 8520.02 Public Key Infrastructure (PKI) and Public Key (PK) Enabling

DoWI / DoDI 8520.03 Identity Authentication for Information Systems

DoWI / DoDI 8520.04 Access Management for DoW (DoD) Information Systems

DoDI 1000.13 Identification (ID) Cards for Members of the Uniformed Services, Their Dependents, and Other Eligible Individuals

DoDM 1000.13 (Vol 1–3) DoD Identification (ID) Cards: ID Card Life-Cycle

DoDI 1000.25 DoD Personnel Identity Protection (PIP) Program

DoDD 8521.01E Department of Defense Biometrics

DoDI 5010.40 DoD Enterprise Risk Management and Risk Management and Internal Control Program

DoDI 8520.04 Access Management for DoD Information Systems

3. Broader DoW / DoD Cybersecurity & InfoSec Issuances

Reference Official Title

DoDD 5144.02 DoD Chief Information Officer (DoD CIO)

DoWD / DoDD 8000.01 Management of the Department of War Information Enterprise

DoWD / DoDD 8140.01 Cyberspace Workforce Management

DoWI / DoDI 5000.82 Requirements for the Acquisition of Digital Capabilities

DoDI 5200.02 Procedures for the DoD Personnel Security Program (PSP)

DoDM 5200.01 (Vol 1–3) DoD Information Security Program

Reference Official Title

DoDI 5200.46 DoD Investigative and Adjudicative Guidance for Issuing the Common Access Card (CAC)

DoDI 5200.48 Controlled Unclassified Information (CUI)

DoWI / DoDI 5205.13 Defense Industrial Base (DIB) Cybersecurity (CS) Activities

DoDI 5210.83 DoD Unclassified Controlled Nuclear Information (UCNI)

DoDI 5230.09 Clearance of DoD Information for Public Release

DoDI 5230.24 Distribution Statements on Technical Documents

DoDI 5230.29 Security and Policy Review of DoD Information for Public Release

DoDM 5400.11 (Vol 2) DoD Privacy and Civil Liberties Programs: Breach Preparedness and Response Plan

DoDI 5530.03 International Agreements

DoDI 6010.23 DoD and Department of Veterans Affairs (VA) Health Care Resource Sharing Program

DoWI / DoDI 8010.01 Department of War Information Network (DOWIN) Transport

DoWI / DoDI 8110.01 Mission Partner Environment (MPE) Information Sharing Capability Implementation

DoWI / DoDI 8170.01 Online Information Management and Electronic Messaging

DoWI / DoDI 8310.01 Information Technology Standards in the DoW

DoWI / DoDI 8330.01 Interoperability of Information Technology (IT), Including National Security Systems

DoWI / DoDI 8500.01 Cybersecurity

DoWI / DoDI 8510.01 Risk Management Framework (RMF) for DoW Systems

Reference Official Title

DoDI 8530.01 Cybersecurity Activities Support to DoD Information Network Operations

DoDM 8530.01 Cybersecurity Activities Support Procedures

DoWI / DoDI 8540.01 Cross Domain (CD) Policy

DoWI / DoDI 8551.01 Ports, Protocols, and Services Management (PPSM)

DoWI / DoDI 8582.01 Security of Non-DoW Information Systems Processing DoW Information

DoDI 8910.01 DoD Implementation of the Paperwork Reduction Act

CJCSI 6510.01F Information Assurance (IA) and Support to Computer Network Defense (CND)

4 DoW / DoD CIO Memoranda, Strategies, & Frameworks

Reference Type Official Title

Strategy Department of Defense Identity, Credential, and Access Management (ICAM) Strategy

Reference Design DoD Enterprise Identity, Credential, and Access Management (ICAM) Reference Design

Framework DoD Identity, Credential, and Access Management (ICAM) Federation Framework

Implementation Guide DoD ICAM Workflow Implementation Guide: Automated Account Provisioning and Access Governance

Strategy DoW (DoD) Zero Trust Strategy

Reference Architecture DoW (DoD) Zero Trust Reference Architecture

Reference Architecture DoW (DoD) Cybersecurity Reference Architecture

Reference Type Official Title

Security Guide Department of Defense Cloud Computing Security Requirements Guide (CC SRG)

DoW CIO Memo Accelerating Adoption of Identity, Credential, and Access Management

DoW CIO Memo Adoption of Initial DoD Identity, Credential, and Access Management Enterprise Services

DoW CIO Memo Implementation of Enterprise Identity, Credential, and Access Management for the DoW Secret Fabric

DoW CIO Memo Modernizing System Access Authorization Requests and Account Provisioning through ICAM Workflows

DoW CIO Memo Multi-Factor Authentication (MFA) for Unclassified & Secret DoW Networks

DoW CIO Memo Remediation of Information Technology-based Material Weaknesses Impacting Financial Auditability

Inter-Agency MOA MOA Between the DoD and DHS Regarding DoD and US Coast Guard Cooperation on Cybersecurity and Cyberspace Operations

DoD CIO Memo Accelerating Adaption of ICAM, November 26, 2026

5. CNSS, NIST, & Federal PKI / Technical Standards

CNSSD 506 National Directive to Implement Public Key Infrastructure on Secret Networks

CNSSD 507 National Directive for Identity, Credential, and Access Management (ICAM) on National Security Systems

CNSSI 4009 Committee on National Security Systems (CNSS) Glossary

Reference Official Title

CNSSI 1253 Security Categorization and Control Selection for National Security Systems

CNSSP 11 Acquisition of Information Assurance (IA) and IA-Enabled Information Technology (IT) Products

ICD 503 Intelligence Community Information Technology Systems Security Risk Management, Certification and Accreditation

FIPS 140-3 Security Requirements for Cryptographic Modules

FIPS 199 Standards for Security Categorization of Federal Information and Information Systems

FIPS 200 Minimum Security Requirements for Federal Information and Information Systems

FIPS 201-3 Personal Identity Verification (PIV) of Federal Employees and Contractors

NIST SP 800-53 (Rev. 5) Security and Privacy Controls for Information Systems and Organizations

NIST SP 800-63-3 Digital Identity Guidelines (including 800-63A, 800-63B, and 800-63C)

NIST SP 800-73-4 Interfaces for Personal Identity Verification

NIST SP 800-76-2 Biometric Specifications for Personal Identity Verification

NIST SP 800-78-4 Cryptographic Algorithms and Key Sizes for Personal Identity Verification

NIST SP 800-79-2 Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI)

NIST SP 800-87 (Rev. 2) Codes for Identification of Federal and Federally-Assisted Organizations

Reference Official Title

NIST SP 800-131A Transitioning the Use of Cryptographic Algorithms and Key Lengths

NIST SP 800-157 Guidelines for Derived Personal Identity Verification (PIV) Credentials

NIST SP 800-162 Guide to Attribute Based Access Control (ABAC) Definition and Considerations

NIST SP 800-207 Zero Trust Architecture

NIST SP 800-217 Guidelines for Personal Identity Verification (PIV) Federation

FICAM Architecture Federal Identity, Credential, and Access Management (FICAM) Architecture

DoD X.509 CP United States Department of Defense X.509 Certificate Policy

DoD ECA CP DoD External Certification Authority (ECA) X.509 Certificate Policy

DoD Coalition CP DoD Coalition Public Key Infrastructure X.509 Certificate Policy

X.509 Certificate Policy United States Department of Defense Web Content Filter X.509 Certificate Policy

DoD KRP Key Recovery Policy for the United States Department of Defense (and External Certification Authorities)

FPKIPA FBCA CP X.509 Certificate Policy for the Federal Bridge Certification Authority (FBCA)

FPKIPA Common CP X.509 Certificate Policy for the U.S. Federal PKI Common Policy Framework

ACP 185 Allied Communications Publication 185: PKI Cross- Certification Between Combined Communications- Electronics Board (CCEB) Nations

NIAP PP Protection Profile Module for SSL/TLS Inspection Proxy