DOD MANUAL 5205.07.pdf

DOD MANUAL 5205.07

SPECIAL ACCESS PROGRAM SECURITY MANUAL

Originating Component: Office of the Under Secretary of Defense for Intelligence and Security

Effective: January 17, 2025

Releasability: Cleared for public release. Available on the Directives Division Website at https://www.esd.whs.mil/DD/.

Reissues and Cancels: DoD Manual 5205.07, Volume 1, “DoD Special Access Program (SAP)

Security Manual: General Procedures,” June 18, 2015, as amended

Incorporates and Cancels: See Paragraph 1.2.

Approved by: Milancy D. Harris, Acting Under Secretary of Defense for Intelligence and

Security

Purpose: In accordance with the authority in DoD Directive (DoDD) 5143.01, this issuance assigns responsibilities and provides procedures to implement the policy established in DoDD 5205.07 and DoD Instruction (DoDI) 5205.11 for DoD special access programs (SAPs).

DoDM 5205.07, January 17, 2025

TABLE OF CONTENTS 2

TABLE OF CONTENTS

SECTION 1: GENERAL ISSUANCE INFORMATION

1.1. Applicability

1.2. Summary of Incorporation and Cancellation

1.3. Forms

SECTION 2: RESPONSIBILITIES

2.1. Under SecretAry of Defense for Intelligence and Security (USD(I&S))

2.2. Director for Defense Intelligence (Counterintelligence, Law Enforcement, and Security)

(DDI(CL&S))

2.3. Director, DCSA

2.4. Director, DoD SAPCO

2.5. DoD Chief Information Officer (DoD CIO)

2.6. DoD Component Heads and PSAs with CA over SAPs

SECTION 3: GENERAL PROVISIONS AND REQUIREMENTS

3.1. Functional Roles and Responsibilities

a. CA SAPCOs

b. CA SAPCO Security Directors

c. AAA. 14

d. GAM. 14

e. PSM and PSO

f. GSSO and CSSO

g. SAPF-AO

h. CAMs and Contractor Program Managers

i. SAP Accountability Officer

j. SPO. 19

k. National Manager for NSSs

3.2. SOPs

3.3. FWAC

3.4. OPSEC

3.5. PPP

3.6. Consequence Management Plan (CMP)

3.7. IP Strategy and procedures

3.8. Arms Control AGREEMENTS AND INTERNATIONAL LAW

3.9. SCGs

a. Enterprise SCG

b. Umbrella SCGs

c. SCG Annexes

3.10. Litigation and Public Proceedings

3.11. CI Support

3.12. Communications Security

3.13. International SAP Security Requirements

a. Pre-release Procedures

b. Post-release Procedures

c. Visits and Assignments of Foreign Nationals Procedures

TABLE OF CONTENTS 3

d. Foreign SAPs Shared with the United States

e. Security Incidents and Inquiries

f. Other Matters

3.14. Records Management

SECTION 4: SAFEGUARDING CLASSIFIED INFORMATION

4.1. Handle Via Special Access Channels Only (HVSACO)

a. HVSACO Usage

b. Training and Procedures

c. HVSACO Storage

d. Transmission of HVSACO Material

e. Reproduction of HVSACO Material

f. Accountability and Destruction

g. Reporting Requirements

4.2. Use of Secure Encryption Devices and Electronic Transmission Equipment

a. Secure Encryption Devices

b. Electronic Transmission

4.3. Accountability

4.4. Annual Inventory

4.5. Transmission and Preparation of SAP-Classified Material

a. General Procedures

b. Package Preparation and Handling

c. Courier Guidance

d. Transportation Plans

4.6. Airport Screening Guidelines for CLASSIFIED Material

a. Transportation Security Administration Guidelines

b. Travel to or From Locations Outside the United States

4.7. Review and Release of Information

4.8. Reproduction

4.9. Destruction

4.10. Classified Marking Requirements

SECTION 5: CYBERSECURITY

SECTION 6: SETA

6.1. General

6.2. PSM or PSO

6.3. GSSO and CSSO

6.4. Initial and Annual Training

SECTION 7: SECURITY INCIDENTS, INQUIRIES, AND RECONSIDERATIONS

7.1. Security Incidents

7.2. Security Inquiries

a. Security Inquiry and Scope

b. Initial PSM or PSO Recommendation

c. Initial CA SAPCO Corrective Action Determination

d. Initial Determination Notification and Reporting

e. Final PSM or PSO Report and Recommendation

f. Final CA SAPCO Determination

TABLE OF CONTENTS 4

g. Final Determination Notification and Reporting

7.3. Reconsiderations

SECTION 8: SAP SECURITY COMPLIANCE INSPECTIONS

8.1. General

8.2. External Inspections

a. Core Compliance Inspections

b. General Inspections

c. Re-inspections

d. Unannounced or No Notice Inspections

8.3. External Inspection Coordination and Reporting

8.4. Internal or Self Inspections

8.5. Staff Assistance Visit (SAV)

8.6. Deficiencies

8.7. Ratings

SECTION 9: VISIT PROCEDURES

9.1. General

a. Industry to Industry

b. Industry to Government

c. Government to Government

d. Government to Industry

9.2. Advance Notice

9.3. Unannounced and Non-Validated Arrivals

9.4. Visitor Identification Validation

9.5. Visitor Escort

9.6. Visit Request Termination or Cancellation

9.7. Visitor Records

9.8. Congressional Visits

SECTION 10: CONTRACTING

10.1. General

10.2. Clearance Status of Contractors

10.3. Security Agreements and Briefings

10.4. Independent Research and Development (IR&D)

10.5. Disposition and Close-Out Actions

SECTION 11: SAP TECHNOLOGY TRANSFER

11.1. Technology Transfer

11.2. System or Capability Transfers

SECTION 12: PERSONNEL VETTING INFORMATION

12.1. Introduction

12.2. SAP Reciprocity

12.3. Indoctrination Briefings

12.4. Polygraphs

12.5. Billet Management

12.6. Personnel Vetting Files

12.7. Congressional Access Requirements

12.8. Individual Reporting Requirements

TABLE OF CONTENTS 5

12.9. GSSO and CSSO Reporting Requirements

12.10. Deployed or Temporarily Assigned Personnel

12.11. COA

12.12. Debriefing Acknowledgments

12.13. Administrative Debriefings

12.14. SAP Access Suspension and Revocation

SECTION 13: SAPNP

13.1. Introduction

13.2. Nomination Requirements

13.3. Nomination Packages

13.4. Nomination Review Process

13.5. Continued SAP ACCESS

13.6. Disapprovals

SECTION 14: FOREIGN TRAVEL REPORTING

14.1. General

14.2. Official Government Business Travel

14.3. Unofficial Travel

14.4. Individuals Assigned To Foreign Countries

14.5. Foreign Travel Records

SECTION 15: PHYSICAL SECURITY PROCEDURES

15.1. General

15.2. Discussion, Handling, and Processing of SAP in an Accredited SCIF

a. Acceptance of Existing Accreditation

b. Discussion

c. Handling and Processing

15.3. SAP-Accredited Areas

15.4. Risk Management

15.5. Physical Security Preconstruction Review and Approval

15.6. SAP Construction Procedures

15.7. Accreditation

15.8. CUA and Co-Accreditation

15.9. Physical Access Controls

15.10. Control of Combinations

15.11. Entry-Exit Inspections

15.12. Control of Electronic Devices and Other Items

15.13. TEMPEST Requirements

GLOSSARY

G.1. Acronyms G.2. Definitions

REFERENCES

TABLES

Table 1. Summary of Collaboration Peripherals in SAPF DoD Secure Spaces

SECTION 1: GENERAL ISSUANCE INFORMATION 6

SECTION 1: GENERAL ISSUANCE INFORMATION

1.1. APPLICABILITY.

This issuance applies to:

a. OSD, the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of Inspector General of the Department of Defense, the Defense Agencies, the DoD Field Activities, and all other organizational entities within the DoD (referred to collectively in this issuance as the “DoD Components”).

b. All OSD and DoD Component contractors and consultants who require access to DoD SAPs pursuant to the terms and conditions of the contract or agreement.

c. Non-DoD U.S. Government (USG) departments, activities, agencies, and all other organizational entities that require access to DoD SAPs pursuant to the terms and conditions of a memorandum of agreement (MOA), memorandum of understanding, or other interagency agreement established with the DoD.

1.2. SUMMARY OF INCORPORATION AND CANCELLATION.

This issuance incorporates and cancels:

a. DoD Manual 5205.07, Volume 2, “Special Access Program (SAP) Security Manual:

Personnel Vetting,” November 24, 2015, as amended.

b. DoD Manual 5205.07, Volume 3, “Special Access Program (SAP) Security Manual:

Physical Security,” April 23, 2015, as amended.

c. Office of the Under Secretary of Defense for Intelligence and Security and DoD Special Access Program Central Office Memorandum, “Enrollment in Continuous Evaluation/Continuous Vetting as a Valid Prerequisite for Special Access Program Access,” September 28, 2022.

d. Under Secretary of Defense for Intelligence and Security Memorandum, “Discussion, Handling, and Processing of Special Access Program Information in Accredited Sensitive Compartmented Information Facilities,” November 21, 2023.

1.3. FORMS.

This issuance refers to forms managed or sponsored by the DoD. Unless otherwise mentioned in their citation, these forms are available at https://www.esd.whs.mil/Directives/forms/.

SECTION 2: RESPONSIBILITIES 7

SECTION 2: RESPONSIBILITIES

2.1. UNDER SECRETARY OF DEFENSE FOR INTELLIGENCE AND SECURITY

(USD(I&S)).

In addition to the responsibilities in Paragraph 2.6., the USD(I&S):

a. Establishes, develops, and coordinates DoD SAP security policy and provides security oversight in accordance with DoDDs 5143.01 and 5205.07.

b. Coordinates with the Director, DoD Special Access Program Central Office (SAPCO), and the Director, Defense Counterintelligence and Security Agency (DCSA), or other DoD adjudication facility, to obtain details informing access decisions regarding any condition, deviation, or waiver approved in accordance with the December 12, 2005 Office of Management and Budget Memorandum associated with an individual nominated for access to a DoD SAP.

c. May delegate approval authority for specific exceptions to policy.

2.2. DIRECTOR FOR DEFENSE INTELLIGENCE (COUNTERINTELLIGENCE, LAW

ENFORCEMENT, AND SECURITY) (DDI(CL&S)).

Under the authority, direction, and control of the USD(I&S), the DDI(CL&S):

a. Develops policy in relation to, oversight of, and implementation of this issuance.

b. Processes requests for exceptions to the requirements of this issuance received from DoD SAPCO on behalf of the DoD Components and the Offices of the Principal Staff Assistants (PSAs) with cognizant authority (CA) over SAPs. Notifies DoD SAPCO of each approved exception.

2.3. DIRECTOR, DCSA.

Under the authority, direction, and control of the USD(I&S), the Director, DCSA:

a. Administers the National Industrial Security Program (NISP) for collateral classified requirements within the scope of contracts also involving SAPs in accordance with DoDI 5220.31 and Volume 1 of DoD Manual (DoDM) 5220.32.

b. In coordination with the DoD SAPCO, develops training for SAP security and administration professionals, implemented by CA SAPCOs, that adheres to the SAP security requirements in this issuance.

c. Develops and conducts SAP training, education, and certification in accordance with DoDD 5205.07 and DoDI 3305.13.

SECTION 2: RESPONSIBILITIES 8

d. Oversees compliance with currently assigned industrial security requirements of defense contracts that require access to SAP information. No later than July 31, 2029, this responsibility will transfer to the CA responsible for the program.

e. Coordinates with the designated counterintelligence (CI) component to provide cross-sharing of threat and incident information affecting the security of the facility, defense information, or cleared personnel in accordance with Tables 1 through 4 of DoDI O-5240.10, when requested.

f. Conducts necessary investigative and adjudicative activities outlined in DoDI 5200.02 and DoDM 5200.02 for initial and continued eligibility to occupy a sensitive position or otherwise access classified information, suitability, or fitness for Federal employment for personnel nominate for or currently determined admissible to a DoD SAP.

g. No later than 180 days from approval of this issuance and in coordination with the DoD SAPCO Security Director, will complete creation of a SAP security role in Defense Information System for Security (DISS) and National Background Investigation Services. This role will be maintained for use as a primary vetting tool for SAP nomination process (SAPNP) eligibility determinations.

2.4. DIRECTOR, DOD SAPCO.

Under the authority, direction, and control of the Deputy Secretary of Defense (DepSecDef), the Director, DoD SAPCO:

a. Within 180 days from this issuance’s effective date, will develop, in coordination with SAP Senior Working Group members as established in DoDD 5205.07, guidance to standardize the DoD approach to acquisition and management of SAP-protected intellectual property (IP), including patents, technical data, computer software, and associated license rights, as described in Section 3.

b. Serves as the DoD-designated original classification authority (OCA) for DoD SAP umbrella security classification guides (SCGs) on behalf of the Secretary of Defense (SecDef).

See DoDM 5200.45 for guidance on OCAs and SCGs, Volume 1 of DoDM 5200.01 for information security requirements, and Volume 2 of DoDM 5200.01 for marking requirements.

c. Functions as the DoD single point of congressional liaison concerning SAPs and verifies that the congressional offices that are approved to process and store DoD SAP information implement the security requirements in this issuance.

d. Coordinates with the CA SAPCOs on SAP security matters, identifies trends, and makes SAP security policy recommendations to the USD(I&S).

e. Ensures the CA SAPCOs implement USD(I&S)-issued security policies and training requirements through the DoD SAP governance bodies established in DoDD 5205.07 and DoDI 5205.11.

SECTION 2: RESPONSIBILITIES 9

f. In coordination with the USD(I&S), develops, maintains, and updates procedures for engagement with DCSA to request the adjudication service’s rationale for approving any condition, deviation, or waiver associated with a nominated individual’s clearance.

g. Supports the DCSA Center for the Development of Security Excellence in developing training for SAP security and administration professionals.

h. Develops, establishes, and maintains SAP facility (SAPF) accrediting official (SAPF-AO) training standards in coordination with the PSAs with CA over SAPs, the Director for National Intelligence, and the SAP security directors of the Military Services.

i. Develops and issues:

(1) The DoD SAP Enterprise SCG and Tier 1 umbrella SCGs.

(2) DoD-wide SAP inspection special emphasis items (SEIs).

j. Issues retention guidelines for SAP-related security documentation in accordance with DoDI 5015.02.

k. Develops, coordinates, and issues enterprise self-inspection documentation. Revised self-inspection documentation will be provided to DCSA for maximum awareness and availability.

l. Notifies the DDI(CL&S) of all exceptions established in accordance with Paragraph 2.1.c.

2.5. DOD CHIEF INFORMATION OFFICER (DOD CIO).

In coordination with the Director, DoD SAPCO, and the USD(I&S), the DoD CIO:

a. Establishes and administers governance and risk management policies to develop enterprise SAP information technology (IT) strategy, telecommunications infrastructure policy, SAP network IT requirements, and network and systems funding oversight policy in accordance with DoDI 5205.11.

b. For information systems (ISs) that fall under DoD SAPCO cognizance, authorizes DoD SAP networks, databases, and ISs, including those that support SAP oversight and governance and delegates system owners in writing. For ISs that fall under the purview of the CA SAPCOs, delegates authorizing responsibility to the CA SAPCO and corresponding authorizing official

(AO).

c. Plans and budgets for cybersecurity resources for SAPs under their purview.

d. Sets the baseline for cybersecurity requirements within the DoD SAP Enterprise, through the DoD Joint Special Access Program Security Implementation Guide (JSIG) or its successor.

Maintains, annually reviews, and updates the DoD JSIG or its successor to require uniform, baseline security controls for confidentiality, integrity, and availability on DoD SAP IT that meet

SECTION 2: RESPONSIBILITIES 10

or exceed all other applicable requirements for classified national security systems (NSS) in law, regulation, or USG policy.

e. Oversees complete and thorough tracking of SAP IT equipment in coordination with the CA SAPCOs.

f. Oversees and implements comprehensive cybersecurity strategies, including continuous monitoring, risk assessments, and incident responses, pursuant to Chapter 35 of Title 44, United States Code (U.S.C.).

g. Appoints an OSD or DoD-level AO to authorize SAP IS that process, store, or transmit OSD and DoD-level SAPs.

h. Maintains the system of record in a central database for all DoD SAP personnel and facility information.

i. Establishes and maintains a tool to consolidate and track SAP IT equipment.

j. Provide AO support for joint and enterprise level SAP systems. Define cybersecurity assessment and authorization support funding requirements for those SAP Enterprise or joint systems that are not directly funded by the DoD CIO.

k. Oversees compliance in IT investment management and review of and modification of IT projects based on performance pursuant to Chapter 113 of Title 40, U.S.C.

l. Follows requirements and procedures for NSSs as defined in Sections 3552(b)(6), 3553(e)(2), and 3553(e)(3) of Title 44, U.S.C., and established by the National Manager for NSS in accordance with National Security Directive 42, National Security Memorandum 8, and DoDD 5144.02.

2.6. DOD COMPONENT HEADS AND PSAS WITH CA OVER SAPS.

The DoD Component heads and PSAs with CA over SAPs:

a. Oversee their Component’s implementation of this issuance.

b. Initiate actions to replace DCSA security cognizance activities, also known as “carve out,” in accordance with DoDI 5205.11.

c. Notify DCSA of activities or areas for which DCSA is relieved from inspection authority.

d. Ensure that, as appropriate and in accordance with law and regulation, for all contractors who require access to DoD SAPs, the contract includes terms and conditions necessary to effectuate contractor compliance with all applicable responsibilities and procedures identified in this issuance.

SECTION 2: RESPONSIBILITIES 11

e. Provide oversight, guidance, and administrative support to subordinate offices or activities related to DoD SAP policy and procedures in accordance with DoDD 5205.07, DoDI 5205.11, and this issuance.

f. Ensure complete and thorough accountability of SAP IT equipment.

g. In coordination with other stakeholders, develop SCG annexes for SAP compartments and sub-compartments for which the CA SAPCO is the primary stakeholder. If the CA has OCA delegated to it by position, the CA SAPCO will serve as the SCG annex OCA. If the CA SAPCO does not have delegated OCA, the CA SAPCO will utilize OCA within its chain of command in accordance with Volume 1 of DoDM 5200.01.

h. Coordinates with other stakeholders on the joint use of SAPs.

i. Ensure programs with CPI evaluate anti-tamper protections for CPI in accordance with DoDD 5200.47E and DoDI 5000.83.

SECTION 3: GENERAL PROVISIONS AND REQUIREMENTS 12

SECTION 3: GENERAL PROVISIONS AND REQUIREMENTS

3.1. FUNCTIONAL ROLES AND RESPONSIBILITIES.

a. CA SAPCOs.

CA SAPCOs will:

(1) In coordination with DCSA, oversee their Component’s continuing security awareness training and program requirements.

(2) Establish a SAP information security program to implement SAP accountability requirements and provide program security oversight and support in accordance with the requirements in this issuance.

(3) Implement and adhere to training guidelines issued by the DoD SAPCO and designate SAPF-AOs in writing.

(4) In coordination with the DoD SAPCO, submit requests for exception to any provisions of this issuance thru DDI(CL&S) for USD(I&S) decision. At a minimum, requests for an exception must include a risk assessment and operational requirements.

(5) Oversee SAP security, audit, compliance, cybersecurity activities, and reporting requirements for assigned SAPs and SAP accredited spaces.

(6) Designate personnel who may contact and provide information to and request information from the DoD Consolidated Adjudications Services and appoint SAP personnel vetting officials (SPOs).

(7) Evaluate information contained in a letter of compelling need (LOCN) to support access determinations for personnel nominated for DoD SAPs under their CA, or for which they are delegated access approval authority (AAA).

(8) Report any security issues that may result in the loss or compromise of SAP information to the DoD SAPCO within 48 hours. Security issues attributed to an individual will be reported to the applicable DoD adjudication authority.

(9) Ensure CI, law enforcement (LE), and security are integrated into risk management reviews of DoD SAPs.

(10) Develop and maintain a SCG annex for all content SAPs (See Paragraph 3.9.c. for additional information).

(11) Appoint CA SAPCO security directors who are in the 0080 Security Administration Series.

(12) Appoint an AAA.

SECTION 3: GENERAL PROVISIONS AND REQUIREMENTS 13

(13) Protect all SAP systems and networks as NSSs in accordance with National Security Directive 42; National Security Memorandum 8; Sections 3552(b)(6), 3553(e)(2), and 3553(e)(3) of Title 44, U.S.C; and DoDD 5144.02.

(14) Oversee the integration of cybersecurity support within SAPs and subordinate tiers.

b. CA SAPCO Security Directors.

Security directors appointed by a CA SAPCO director:

(1) On behalf of the Component head, are responsible for implementation of security requirements of this issuance for all assigned SAPs and subordinate tiers, to include leading the Component’s efforts to develop SCG annexes for each SAP in which the CA is a stakeholder.

(2) Oversee security management of subordinate offices and manage execution of all security policies and requirements for assigned SAPs in accordance with this issuance.

(3) Ensure that credible derogatory information is reported to the DoD Consolidated Adjudications Services.

(4) Oversee decisions to suspend, revoke, and reinstate SAP access for personnel and SAPs and subordinate tiers under their responsibility.

(5) Oversee, establish, and manage their Component’s continuing security awareness training and program requirements to support the implementation of SAP security. Provide recommendations to the DoD SAPCO for training requirements and curriculum at the DCSA Center for Development of Security Excellence.

(6) Provide overall oversight and direction to program security managers (PSMs), program security officers (PSOs), SPOs, SAPF-AOs, government SAP security officers (GSSOs), and as appropriate, contractor SAP security officers (CSSOs).

(7) Formally appoint individuals to serve as SPOs, or delegate appointment authority in writing. Additionally, the security director may appoint GSSOs and approve appointment of CSSOs in organizations that do not have PSMs or PSOs to do this.

(8) Maintain a repository of all program protection plans (PPPs) under their cognizance, to ensure compliance with DoDI 5000.83 requirements. The PPP repository must be validated annually, at minimum.

(9) Ensure actions taken against an individual’s SAP access are properly documented in the system of record and notifications are sent to DoD SAPCO to send actions to all DoD SAP security directors. Additional notifications must be made through collateral and sensitive compartmented information (SCI) security offices as appropriate.

(10) Approve technology transfer agreements on a case-by-case basis.

SECTION 3: GENERAL PROVISIONS AND REQUIREMENTS 14

c. AAA.

The AAA:

(1) Makes SAP access approval or disapproval decisions, including evaluating a nominated individual’s admissibility when a unique risk is identified.

(2) Coordinates with the SPO and the PSO, the government activity manager (GAM), the contractor activity manager (CAM), the supervisor, the commanding officer, or appropriate industry official to make informed decision on program access requests (PARs).

(3) Receives annual training on their authorities, standards, and limitations in accordance with CA SAPCO guidance.

d. GAM.

The GAM, as appointed by the CA SAPCO:

(1) Manages assigned SAP(s) and assumes the responsibility for overall security management of assigned SAPs.

(2) Coordinates with DoD CIO through their Component chief information officer and CA SAPCO, and with PSMs and PSOs to implement security, cybersecurity, program protection, and CI initiatives for critical technologies throughout the life cycle of a system, service, or critical technology.

(3) Allocates personnel, financial resources, and facilities to support SAP execution and maintain security compliance.

(4) Implements treaty and arms control measures, as applicable.

(5) Implements operations security (OPSEC) needed to support assigned SAPs.

(6) Ensures a tailored security education and training awareness (SETA) program for all personnel accessed to the assigned SAP.

(7) Coordinates with the resource authority and the information system security manager (ISSM) to:

(a) Plan and budget for program cybersecurity resources.

(b) Ensure compliance with established cybersecurity policy for all systems, including those under contract or vendor provided.

(c) Comply with all applicable cybersecurity and technology acquisition requirements, to include those set forth in DoDD 5000.01 and DoDI 5000.82 for all acquisitions including those for IS.

(d) Serve as the IS owner and ensure compliance with the DoD JSIG or its successor

SECTION 3: GENERAL PROVISIONS AND REQUIREMENTS 15

(8) Plans and budgets for program security manpower resources, ensuring compliance with established SAP security policy for all operational locations, including those under support contract.

(9) In coordination with the PSM or PSO, reviews and endorses--annually, at minimum--all PPPs under their cognizance to ensure compliance with DoDI 5000.83 requirements. This includes ensuring the PSM or PSO provides a copy to the CA SAPCO security director, as required.

(10) Refers emerging technologies with potential for SAP protections, in accordance with Executive Order (E.O.) 13526 or any successor order, to the CA SAPCO for review.

(11) Maintains records of all technology transfers.

e. PSM and PSO.

(1) The PSM, as appointed by the CA SAPCO or designated security director:

(a) Manages the security oversight, guidance, and implementation of all insider threat, program protection, OPSEC, and security compliance activities for assigned SAPs (and any subordinate tiers or projects) employed across the joint force or interagency.

(b) Coordinates with the security director, GAM, and GSSOs to develop, implement, and enforce a security program that protects all facets of the assigned SAP compartments and sub-compartments to ensure security alignment and horizontal protections across the joint force and interagency.

(c) Assesses unique risks with all eligibility determinations granted with an exception code, unresolved derogatory information, or information derived from the pre-screening questionnaire (PSQ), and coordinates with the respective CI support activity, Insider Threat Cell.

or the DoD Consolidated Adjudications Services, as necessary.

(d) Provides oversight and direction to PSOs, GSSOs, and, as appropriate, CSSOs to support assigned SAPs (or subordinate tiers or projects).

(e) Reviews the SAP nomination package and makes an access recommendation to the AAA.

(f) In coordination with the GAM, reviews and endorses--annually, at minimum--all PPPs under their cognizance to ensure compliance with DoDI 5000.83 requirements. This includes sending a copy to the CA SAPCO security director, as required.

(g) May perform PSO duties, as directed by the CA SAPCO or designated security director.

(h) Takes the appropriate security management office relationship in DISS, or successor system, to effectively manage individual personnel vetting information concerning an individual’s eligibility for SAP access.

SECTION 3: GENERAL PROVISIONS AND REQUIREMENTS 16

(i) Evaluates information developed from continuous vetting checks to ensure personnel continue to meet suitability for continued access to SAP.

(2) The PSO, as appointed by the CA SAPCO or designated security director:

(a) Is designated based on one of three categorizations: PSO, geographical PSO, or agency/organizational PSO.

1. The PSO exercises full-time responsibility for the overall security of their assigned SAP(s) implementing all security requirements and procedures prescribed in this issuance and other DoD security policy applicable to their program. Examples include:

a. Security oversight for SAP contracts.

b. On-site security support.

c. Protection of intelligence elements of an intelligence SAP.

d. Protection of structure or processes in an infrastructure program.

2. The geographical PSO:

a. Oversees SAP security activities within a geographical area.

b. Coordinates with the PSO to ensure security activities within a respective geographical area are conducted in accordance with this issuance, the relevant SCG(s) and SAP security guidance established by the PSM or PSO.

3. The agency/organizational PSO is appointed to a specific agency or organization to ensure security activities within a respective organization are conducted in accordance with this issuance, the relevant SCG(s) and SAP security guidance established by the PSM or PSO.

(b) Works with the GAM and GSSO to develop, implement, and enforce a security program that protects all facets of the assigned SAP compartments and sub-compartments.

(c) Provides security subject matter expertise to the GAM and GSSO and oversight of assigned SAP compartments and sub-compartments to ensure compliance with all established policy and procedures.

(d) Ensures the sufficient development and employment of SETA programs as described in Section 6.

(e) Oversees and works in tandem with GSSOs and CSSOs designated to support assigned SAP compartments and sub-compartments.

(f) Verifies annually that all SAPFs, as accredited by a CA SAPCO-approved SAPF- AO, are properly inspected for security compliance by:

SECTION 3: GENERAL PROVISIONS AND REQUIREMENTS 17

1. Validating that each assigned GSSO and CSSO conducts and documents annual self-inspection and evaluates all inspection documentation in accordance with Section 8.

2. Approving the resultant corrective actions to establish or ensure compliance.

Corrective actions will be reviewed every 30 days until all findings or deficiencies are satisfactorily addressed and approved by the PSO.

(g) Coordinates with IS AOs for ISs storing, processing, transmitting, and displaying special access required (SAR) information that the PSO is responsible for and applies risk management principles to SAP security architectures and environments.

1. Obtains threat and vulnerability information for identified assets and assesses the impact of potential attacks to determine the associated risk.

2. Assesses the vulnerability of critical program information (CPI), assets, or operations to specific threats.

3. Identifies risk mitigation measures, to include required costs and resources.

(h) In coordination with their SAP IS AO, approves changes to the IS security environment and operational needs that could affect the security authorization in accordance with the signed and approved authority to operate (ATO).

(i) During security compliance inspections, verifies that:

1. GSSOs and CSSOs are appointed in writing by the appropriate official, (i.e., by the commanding officer or GAM for GSSOs and by the CAM or appropriate industry official for a specific facility unit or location for CSSOs).

2. The GSSO or CSSO are routinely present to provide day-to-day security oversight in the facility or complex where the SAP work is conducted.

(j) Evaluates SPO’s access eligibility recommendation and any additional information the nominated individual provides to “yes” answers on their PSQ.

(k) Assesses unique risks with all eligibility issues and coordinate with the respective CI support activity or the DoD Consolidated Adjudications Services, as necessary.

(l) Reviews the SAP nomination package and makes an access recommendation before forwarding it to the AAA for decision. If recommending the AAA non-concur, the PSM or PSO must provide additional justification in the PAR remarks section or in a separate memorandum.

(m) Ensures facility fraud, waste, abuse, and corruption (FWAC) information is prominently displayed.

(n) Appoints SPOs.

SECTION 3: GENERAL PROVISIONS AND REQUIREMENTS 18

f. GSSO and CSSO.

(1) GSSOs and CSSOs will:

(a) Coordinate with the CA SAPCO, the PSM, the PSO, the GAM or the CAM, the commander, facility owner, or appropriate industry leader to create a secure environment to protect SAP information at each SAPF at a contractor location.

(b) Be responsible for security management, to include SETA, and related operations within their assigned activity, organization, or office.

(c) Implement and execute all SAP security requirements in this issuance, as well as any additional guidance issued by the CA SAPCO security director.

(d) Coordinate SAP security matters, including personnel vetting issues and security incidents, with the CA SAPCO, the PSM, the PSO, the GAM, or the CAM, as applicable, the commander, the facility owner, or appropriate industry leader, as well as ensure records are updated in the SAP personnel vetting system Joint Access Database Environment (JADE) or successor systems to ensure security professionals are aware of actions.

(e) Establish, conduct, and document initial, situational, and annual refresher training for all assigned SAP-accessed individuals.

(f) Conduct an annual self-inspection, document the self-inspection and any necessary corrective action plan, and submit the corrective action plan to the CA SAPCO PSM or PSO.

1. Before providing the corrective action plan to the PSM or PSO, the GSSO or the CSSO, will coordinate the self-inspection and proposed corrective action plan with organizational leadership for approval.

2. After submitting the leadership-approved corrective actions to the PSM or the PSO, provide updates to the PSM or the PSO every 30 days until all findings or deficiencies have been satisfactorily addressed and approved by the PSM or the PSO.

(g) Interface with SAP cybersecurity ISSMs to ensure the full protections of SAP material access is known, shared, and integrated into GSSO or CSSO, as applicable, and ISSM standard operating procedures (SOPs) to cover the full picture of SAP protection.

(h) Develop, maintain, and submit to the GAM or CAM, as applicable, for endorsement, all program protection implementation plans under their cognizance annually, at a minimum, to ensure compliance with DoDI 5000.83 requirements.

(2) GSSOs, as delegated by the PSM or PSO, will:

(a) Appoint SPOs. This authority may only be delegated to the GSSO if the PSM or the PSO has been delegated this authority by the CA SAPCO.

SECTION 3: GENERAL PROVISIONS AND REQUIREMENTS 19

(b) Sign courier memorandums.

(c) Authorize and sign courier cards.

(d) Sign PAR PSO block when a nominee’s PSQ contains all “no” answers.

g. SAPF-AO.

The CA SAPCO, or their designee in writing, will appoint in writing an individual to serve as SAPF-AO. The SAPF-AO is responsible for reviewing and approving or disapproving physical security preconstruction plans for, and physically inspecting and accrediting, reaccrediting, and de-accrediting, a SAPF. The SAPF-AO will provide SAPF accreditation-related actions to the GSSO or the CSSO, as applicable, to upload into the DoD system of record.

h. CAMs and Contractor Program Managers.

(1) CAMs are responsible for:

(a) Execution of and compliance with all applicable contractual performance requirements and other obligations to include security compliance.

(b) Reviewing all program protection implementation plans under their cognizance annually, at a minimum, to ensure compliance with DoDI 5800.83 requirements.

(2) Contractor program managers will appoint and submit, in writing for PSO consideration and approval, a CSSO to serve as the SAP security official at each contractor SAPF location.

i. SAP Accountability Officer.

The GAM or CAM will designate accountability officers in writing. When the PSO determines a program requires a SAP accountability officer, one will be appointed in writing by the GAM or the CAM.

(1) Accountability officers will account for all TOP SECRET (TS) SAR material, media, hardware, and equipment utilizing a CA SAPCO-approved accountability system.

Accountability officers will account for all accountable SCI and collateral material, media, hardware, and equipment utilizing the same system.

(2) Accountability officers will account for all SECRET//SAR material, media, hardware, and equipment when directed by the CA SAPCO.

j. SPO.

The SPO will be responsible for the completeness and accuracy of information submitted in nominated individual’s packages and make initial access determinations of recommendations in accordance with this issuance.

SECTION 3: GENERAL PROVISIONS AND REQUIREMENTS 20

k. National Manager for NSSs.

In cooperation with the responsible CA SAPCO and the DoD CIO, the National Manager for NSSs has oversight of cybersecurity for all NSSs which include SAP networks.

3.2. SOPS.

a. The GSSO or the CSSO will prepare SOPs to implement the security policies and requirements applicable to their facilities, unit, organization or location, and the SAP(s) being executed therein. A single SOP can be written for a location with multiple SAPFs if any unique conditions or requirements for individual facilities are called out in the SOP, or a facility-specific appendix or annex to the SOP.

b. The GSSO or the CSSO will coordinate the proposed SOPs and SOP changes through organizational leadership before forwarding the proposed SOPs and SOP changes to the GAM or CAM, as applicable, for approval, if required by the CA SAPCO. After approval, the GAM or the CAM sends the document(s) to the PSM or PSO for policy compliance review and concurrence.

c. When a contractor is responding to a pre-solicitation activity, research and development announcement, request for proposal, or request for information, they will provide the government activity a description of the security processes and procedures that will be implemented to ensure only appropriately briefed personnel will have access to SAP information and material relevant to their response to the government.

d. CA SAPCOs will make SOP templates available to SAPs and subordinate tiers within their responsibility.

e. At a minimum, SOPs must include guidance on:

(1) General provision and requirements.

(2) Reporting requirements.

(3) Security clearances.

(4) SETA program.

(5) Visits and meetings.

(6) Subcontracting, as applicable.

(7) ISs.

(8) Sanitization, storage, and destruction.

(9) Reproduction procedures.

SECTION 3: GENERAL PROVISIONS AND REQUIREMENTS 21

(10) Maintenance procedures.

3.3. FWAC.

a. Collateral FWAC reporting channels may not be used for FWAC complaints related to SAPs and subordinate tiers and information those protect.

b. Government and industry personnel will use only those FWAC reporting channels and phone numbers provided by the CA SAPCO security director.

c. PSM- or PSO-approved FWAC reporting information will be conspicuously posted in all SAPFs.

d. Individuals are not required to consult with or obtain approval from management before making FWAC reports.

3.4. OPSEC.

a. All SAPFs will have an OPSEC plan in accordance with DoDD 5205.02E. These OPSEC plans will be coordinated with the CA SAPCO or designated security director, must consider program-specific concerns, and be reviewed at least annually for updates.

b. OPSEC plans are also required for each SAP, subordinate tiers, or projects, which must be included within the establishment documentation. The OPSEC plans will be reviewed annually and updated at each lifecycle milestone or when missions dictate.

c. The OPSEC plans will include, as applicable:

(1) Related SAPs and subordinate tiers.

(2) Financial information.

(3) Manufacturing processes.

(4) Sub-contracting.

(5) Supply chain.

(6) Test and evaluation.

3.5. PPP.

a. All SAPs that manage activities to protect and enable technology innovation for present and future warfighting capabilities and programs will develop, implement, and maintain a PPP, informed by relevant science and technology protection plans and technology area protection plans, as appropriate, in accordance with DoDI 5000.83. They may also use alternative

SECTION 3: GENERAL PROVISIONS AND REQUIREMENTS 22

documents that, when combined, meet the intent of the PPP. If a PPP would not be required for an equivalent non-SAP program, a PPP or set of alternative documents that when combined must:

(1) Identify CPI and critical components.

(2) Identify anticipated risks the program will encounter.

(3) Use threat intelligence from the Defense Intelligence Agency (DIA), DoD Component intelligence and CI activities, DCSA, or the Joint Acquisition Protection and Exploitation Cell.

(4) Incorporate information on foreign intelligence entity, cyber, and supply chain threats.

(5) Establish the CI support plan in accordance with DoDI O-5240.24.

(6) Establish a cybersecurity strategy.

(7) Address horizontal protection considerations for CPI and utilize the Acquisition Security Database as appropriate to track organic and inherited CPI eligible for anti-tamper.

(8) Have GAM and PSM or PSO endorsement.

(9) Complete an anti-tamper plan for all CPI identified.

b. PPPs will be reviewed annually, updated as needed to address current threats, validated with a signature by the GAM and PSM or PSO, and submitted to the CA SAPCO.

c. In coordination with the GAM, CAMs will submit a program protection implementation plan to the PSM or the PSO for all activities utilizing a SAP that is associated with a contract issued from a GCA.

3.6. CONSEQUENCE MANAGEMENT PLAN (CMP).

a. All capabilities or information protected by DoD SAPs that are fielded or deployed in a test or operational environment must have a CMP that establishes the plans and procedures for the recovery, reconstitution, and disposition or destruction of SAP-protected systems to account for a loss or suspected loss.

b. The PSM or the PSO and the GAM will coordinate CMPs with the appropriate DoD Component to sufficiently develop an integrated plan that will, at a minimum:

(1) Identify critical components and CPI.

(2) Provide guidance, describe general procedures, and identify coordination requirements for employment of the CMP.

SECTION 3: GENERAL PROVISIONS AND REQUIREMENTS 23

(3) Assign general component levels tasks for the recovery, reconstitution and disposition, or destruction of SAP system to account for a mishap.

(4) Identify the specific operation or mission, to include scenario-based considerations that could lead to the use of the CMP.

(5) Establish a feasibility assessment, risk assessment, and concept of operations.

(6) Plan for control of public information release or distribution of video and images.

(7) If CPI utilizes anti-tamper protection, ensure the CMP includes notifying the Anti- Tamper Executive Agent or Component representative.

c. The CMP will be reviewed and updated annually and endorsed at a minimum by the GAM and the PSM or the PSO.

d. CA SAPCOs will ensure CMPs and their implementing procedures are established for the recovery, reconstitution, disposition, and destruction of SAP systems sold via foreign military sales. CA SAPCOs will coordinate CMPs associated with foreign military sales to oversight authority (OA) SAPCOs and DoD SAPCO.

3.7. IP STRATEGY AND PROCEDURES.

The OA or the CA SAPCO will develop procedures for reviewing patent applications involving SAPs consistent with DoDD 5535.02. The CA SAPCO and the OA SAPCO will coordinate with the Office of the DDI(CL&S) through the DoD SAPCO for patent security reviews for patent applications associated to subject inventions made in the performance of DoD contracts and government employee inventions.

3.8. ARMS CONTROL AGREEMENTS AND INTERNATIONAL LAW.

a. DoD SAPs must be protected against unauthorized or inadvertent disclosure during USG participation in authorized verification activities and confidence-building measures, such as overflights.

b. DoD will comply with applicable international law. However, the need to comply with an international organization does not, by itself, authorize exposing or revealing SAP information unless such measures are approved in accordance with this issuance. Additional guidance on arms control agreements can be found in DoDD 2060.01. Components will consult with their assigned Office of General Counsel and, as needed, with the DoD SAPCO.

3.9. SCGS.

SAP SCGs will be created, maintained, and updated in accordance with DoDD 5205.07, DoDI 5205.11, and DoDM 5200.45.

SECTION 3: GENERAL PROVISIONS AND REQUIREMENTS 24

a. Enterprise SCG.

DoD SAPCO’s Enterprise SCG, will:

(1) Introduce horizontal protection of DoD SAP information throughout the SAP Enterprise and architecture.

(2) Include standardized language applicable to all DoD SAP SCGs.

(3) Identify “Enterprise” processes and information that will be protected consistently across the SAP Enterprise (e.g., SAP nicknames, program identifiers (PIDs), and facts related to the number of people, and number of SAPs and subordinate tiers).

(4) Contain general administrative security classification guidance for all DoD SAPs.

b. Umbrella SCGs.

In collaboration with the CA SAPCOs, the DoD SAPCO will develop and publish one SCG for each SAP umbrella. Umbrella SCGs contain classification guidance for all SAP compartments or sub-compartments within the umbrella. The umbrella SCG will:

(1) Describe the umbrella-specific hierarchy of compartments and sub-compartments.

(2) Provide the scope of SAP protection specific to the umbrella.

(3) Provide broad descriptions and classification guidance for all CPI protected within the umbrella.

c. SCG Annexes.

CA SAPCOs, working collaboratively under the leadership of the office of primary responsibility (OPR) CA when there are multiple stakeholders, will develop one SCG annex for each content SAP compartment and sub-compartment in which the CA SAPCO is a stakeholder to identify CPI for the particular compartment or sub-compartment. SAP SCG annexes will contain security tables detailing the classification of specific CPI by reference to the umbrella SCG. SCG annexes will also contain other classification information that users will need to protect such information.

(1) SCG annexes will conform to Office of the USD(I&S) (OUSD(I&S)) guidance and will not exceed the scope or overarching classification guidance contained in the umbrella SCG.

DoD SAPCO, in collaboration with the OUSD(I&S), will provide a template for SCG annexes.

(2) The OPR will lead development and maintenance of SCG annexes and collaboration among stakeholders for SAP compartment or sub-compartments with multiple stakeholders.

Each OPR will determine and document the process for developing and updating SCG annexes the OPR deems most effective and efficient. DoD SAPCO will provide oversight of SCG annexes to ensure horizontal protection of CPI across the SAP Enterprise.

SECTION 3: GENERAL PROVISIONS AND REQUIREMENTS 25

(3) The SCG annex cover page will list all stakeholders in the SAP compartment or sub-compartment.

(4) In signing and approving an SCG annex, the OPR CA or designated individual certify compliance with this section.

(5) The OPR CA or designated individual will submit the approved annex to DoD

SAPCO.

(6) Upon receipt of a signed annex DoD SAPCO will:

(a) Annotate the SCG annex approval date in the umbrella SCG.

(b) Update the JADE, or any successor system, to reflect the action.

(c) Place the SCG annex into the appropriate DoD SAPCO-designated SAP SCG system of record.

(7) Stakeholders may request changes to an SCG annex through their CA SAPCO, who will coordinate with the OPR and other stakeholders to implement changes as needed.

3.10. LITIGATION AND PUBLIC PROCEEDINGS.

a. Threatened or actual litigation, administrative investigations or inquiries, or public proceedings at the international, Federal, State, tribal, or local levels that may involve a SAP will be reported to the appropriate CA SAPCO and DoD SAPCO.

(1) The DoD SAPCO will notify the designated focal point for the Office of the General Counsel of the Department of Defense of potential litigation involving SAPs at the earliest possible opportunity, not to exceed 48 hours after initial notification.

(2) CA SAPCOs will notify their designated legal counsel of potential litigation involving SAPs at the earliest possible opportunity, not to exceed 48 hours after initial notification. The designated legal counsel will notify the designated focal point for the Office of the General Counsel of the Department of Defense immediately upon receipt of such notification.

(3) These requirements apply to all legal or administrative actions in which the prime contractor, subcontractors, government organizations, or SAP-accessed individuals are a named party of the litigation, or are otherwise affected.

b. Individuals accessed to a SAP will immediately inform: (1) for government personnel, the PSM or the PSO, the GAM, the GSSO, or the commander/Director; or (2) for contractor personnel, the CAM, or appropriate industry official, of:

(1) Any litigation actions that may pertain to a SAP. PSMs or PSOs must also be notified of employee or union strikes, employer discrimination complaints, equal employment

SECTION 3: GENERAL PROVISIONS AND REQUIREMENTS 26

opportunity cases, Merit Service Protection Board reconsiderations, litigation, etc., in accordance with the timelines required by DoDI 5205.11.

(2) Any event that could affect mission readiness, the safety and security of the facility, or cause a public disturbance. Notifications must also be made within 48 hours of becoming aware of allegations, investigations, or proceedings.

3.11. CI SUPPORT.

a. The organic CI entity or pertinent Military Department CI organization (MDCO) will assess foreign intelligence threats and risks to SAP information, material, personnel, systems, facilities (e.g., SAPF, destruction facilities), and activities in accordance with DoDD 5240.02 and DoDI O-5240.10. Information that may have a bearing on the foreign intelligence threat to a SAP or subordinate tier will be provided by the organic CI entity or pertinent MDCO to the affected GAM, PSM or PSO, commander, or appropriate industry official.

b. Contractors may request CI support to enhance or assist threat and risk planning and safeguarding in connection with contract performance. Requests for SAP-applicable CI support will be made to the respective PSM or PSO for approval before contractors receive such support.

c. Personnel will immediately report any attempt by unauthorized personnel to obtain SAP…