Encl 2-DAFMAN 17-1203 dtd 13 Sep 2022.pdf

BY ORDER OF THE

SECRETARY OF THE AIR FORCE

DEPARTMENT OF THE AIR FORCE

MANUAL 17-1203

13 SEPTEMBER 2022

Communications and Information

INFORMATION TECHNOLOGY ASSET

MANAGEMENT (ITAM) AND

ACCOUNTABILITY

COMPLIANCE WITH THIS PUBLICATION IS MANDATORY

ACCESSIBILITY: Publications and forms are available on the e-Publishing website at www.e-publishing.af.mil for downloading or ordering.

RELEASABILITY: There are no releasability restrictions on this publication.

OPR: SAF/CNS Certified by: SAF/CNS

(Venice Goodwine, SES) Supersedes: AFMAN 17-1203, 18 May 2018 Pages: 76

This Department of the Air Force Manual (DAFMAN) implements Department of the Air Force Policy Directive (DAFPD) 17-1, Information Dominance Governance and Management, and supports DAFPD 17-2, Cyber Warfare Operations and AFPD 10-6, Capability Requirements Development. This DAFMAN provides the overarching guidance and direction for managing Department of the Air Force (DAF) Information Technology (IT) hardware and software assets as defined in overarching requirements outlined in DODI 5000.64, Accountability and Management of DOD Equipment and Other Accountable Property, DODI 5000.76, Accountability and Management of Internal Use Software, DOD FMR, 7000.14-R, Volume 4, Chapter 25, General Equipment, and DOD FMR, 7000.14-R, Volume 4, Chapter 27, Internal Use Software.

This DAFMAN is applicable to all civilian employees and uniformed members of the Regular Air Force, United States Space Force (USSF), the Air National Guard, and the Air Force Reserve.

Ensure all records generated as a result of processes prescribed in this publication adhere to Air Force Instruction 33-322, Records Management and Information Governance Program, and are disposed in accordance with the Air Force Records Disposition Schedule, which is located in the Air Force Records Information Management System. Refer recommended changes and questions about this publication to the office of primary responsibility (OPR) using the AF Form 847, Recommendation for Change of Publication; route AF Forms 847 from the field through the appropriate chain of command. This publication may be supplemented at any level, but all supplements must be routed to the OPR of this publication for coordination prior to certification and approval. The authorities to waive wing/unit level or Space Force equivalent requirements in http://www.e-publishing.af.mil/

2 DAFMAN 17-1203 13 SEPTEMBER 2022

this publication are identified with a Tier (“T-0, T-1, T-2, T-3”) number following the compliance statement. See DAF Instruction (DAFI) 90-160, Publications and Forms Management, for a description of the authorities associated with the Tier numbers. Submit requests for waivers through the chain of command to the appropriate Tier waiver approval authority, or alternately, to the requestor’s commander for non-tiered compliance items. The use of a name or mark of any specific manufacturer, commercial product, commodity, or service in this publication does not imply endorsement by the DAF. Compliance with Attachments 2, 3, 4 and 5 in this publication is mandatory. This publication requires the collection and/or maintenance of information protected by the Privacy Act of 1974 authorized by Title 10 U.S.C., Sec 9013, Secretary of the Air Force.

SUMMARY OF CHANGES

This re-write incorporates updates to policy in the following areas: (1) redefining role and responsibilities for tech refresh for laptops and desktop computers, (2) redefining processes related to the IT hardware asset management throughout the asset lifecycle; (3) addresses changes to IT hardware acquisition due to AFway decommissioning, (4) clarifies roles and responsibilities for conducting inventory of assets while teleworking.

Chapter 1—Information Technology Asset Management 4

1.1. General Overview

1.2. Roles and Responsibilities

Chapter 2—HARDWARE ASSET MANAGEMENT 10

2.1. Scope

2.2. IT Hardware Definition and Types

2.3. Roles and Responsibilities

Figure 2.1. Property (Physical) Accountability Roles Overview

Figure 2.2. Asset (Financial) Reporting Roles Overview

2.4. Accountability Rules of IT Hardware Assets

2.5. Procurement of IT Hardware Assets

Table 2.1. End User Device Refresh Rate

2.6. Receipt and Acceptance of IT Hardware

Table 2.3. DPAS Structure Example

2.7. Sustainment of IT Hardware Assets

2.8. Disposition of IT Hardware Assets

2.9. Excess IT Hardware Assets

2.10. IT Hardware Assets Disposal

DAFMAN 17-1203 13 SEPTEMBER 2022 3

Chapter 3—SOFTWARE ASSET MANAGEMENT 29

3.1. Overview and Scope

Figure 3.1. Software Guidance Breakdown

3.2. Software Definition and Types

Figure 3.2. Internal Use Software Determination Flowchart

3.3. Internal Use Software Financial Criteria

3.4. IUS Roles and Responsibilities

Figure 3.3. Capital Internal Use Software (IUS) Roles

Figure 3.4. Non-Capital IUS Physical Accountability Roles

3.5. Capital Internal Use Software Accountability and Management

Figure 3.5. Capital Internal Use Software Lifecycle Guidance

Table 3.1. Internal Use Software Capitalization Cost Determination

3.6. Non-Capital IUS Accountability and Management

Figure 3.6. Non-Capital IUS Lifecycle Guidance

Attachment 1—GLOSSARY OF REFERENCES AND SUPPORTING INFORMATION 53

Attachment 2—DESIGNATED APSR GUIDANCE. 59

Attachment 3—TECH REFRESH GUIDANCE FOR STANDARD LAPTOP AND

DESKTOP COMPUTERS. 63

Attachment 4—IT HARDWARE ENTERPRISE INVENTORY PLAN. 66

Attachment 5—IT HARDWARE KEY SUPPORTING DOCUMENTS (KSDs) AND

MANDATORY DATA ELEMENTS. 68

Attachment 6—IUS AND NON-IUS EXAMPLES. 70

Attachment 7—PROCESS FLOW CHARTS. 73

4 DAFMAN 17-1203 13 SEPTEMBER 2022

Chapter 1

INFORMATION TECHNOLOGY ASSET MANAGEMENT

1.1. General Overview.

1.1.1. This DAFMAN provides guidance and direction for operational management of IT hardware and software assets. It also defines specific roles, responsibilities, and processes within information technology asset management.

1.1.2. Information Technology Asset Management (ITAM) is defined as a framework and set of processes, policies and material solutions that provide efficiency, legal and contractual licensing compliance, financial accountability, and inventory management for software and hardware. To comply with ITAM requirements outlined in this DAFMAN, technologies and techniques for continuous network monitoring and automatic tracking of hardware and software assets will be used to the maximum extent possible in place of manual physical inventories. Organizations must continue to use manual inventories and procedures for hardware or software that cannot be accounted for with automated tracking techniques due to assets not installed, not configurable as discoverable, or not connected to a monitored network.

(T-0).

1.2. Roles and Responsibilities.

1.2.1. Chief Information Officer (SAF/CN).

1.2.1.1. Is the lead office to establish and implement all ITAM policy, processes and requirements. (T-0).

1.2.1.2. Develops strategy, policy, and guidance for ITAM of IT hardware and software.

1.2.1.3. Resolves management issues and policy disagreements between major commands (MAJCOMs), field commands (FLDCOMs), functional managers, and non-DAF agencies for IT hardware and software assets.

1.2.1.4. Identifies, reviews, approves, and forwards formal ITAM training requirements to Headquarters Air Education and Training Command.

1.2.1.5. As the functional manager, must designate the Accountable Property System of Record (APSR) to support ITAM accountability. (T-0). The current designated APSR for Government Owned/Government Operated (GOGO) IT hardware assets is the Defense Property Accountability System (DPAS). The APSR requirements are further defined in Attachment 2.

1.2.1.6. Is designated as the official with the responsibility for executing Enterprise Agreements (EA).

1.2.1.7. Conducts data analysis of all DAF IT monetary spent on IT hardware and software assets and asset utilization.

1.2.2. Chief, Special Access Program (SAP) Information Technology and Support

(SAF/CNZC).

1.2.2.1. SAF/CNZC is the Department of the Air Force (DAF) lead for systems operating under Special Access Program (SAP) guidelines in accordance with AFPD 16-7, Special

DAFMAN 17-1203 13 SEPTEMBER 2022 5

Access Programs; AFI 16-701, Management, Administration, and Oversight of Special Access Programs, AFI 17-101, Risk Management Framework (RMF) for Air Force Information Technology (IT); AFMAN 17-1303, Cybersecurity Workforce Improvement Program. DAF Special Access Programs (SAP) IT hardware assets will not be tracked in

DPAS. (T-1).

1.2.2.2. SAF/CNZC is responsible for issuing AF Identification (AFID) numbers for SAP IT systems.

1.2.2.3. DAF IT hardware assets under the control of SAF/CNZC will be tracked in the designated APSR by AFID, or other approved accountable systems of record for accountability of hardware, as designated by SAF/CNZC in coordination with SAF/AAZ.

(T-1).

1.2.2.4. Software for SAP systems will be managed through SAP channels. Questions regarding Internal Use Software for SAP systems will be directed to SAF/CNZC. (T-1).

1.2.3. Deputy Chief of Staff, Intelligence, Surveillance, Reconnaissance and Cyber Effect Operations (AF/A2/6).

1.2.3.1. The AF/A2/6 is the DAF lead for systems in DAF Sensitive Compartmented Information Facilities (SCIFs), DAF Sensitive Compartmented Information (SCI) systems, and national-level intelligence, surveillance and reconnaissance systems in accordance with DODI 5200.01, DOD Information Security Program and Protection of Sensitive Compartmented Information (SCI), DAFPD 17-2, Cyber Warfare Operations, AFMAN 14-403, Sensitive Compartmented Information Security and Intelligence, Surveillance, and Reconnaissance Systems Cybersecurity and Governance, and AFI 17-130, Cybersecurity Program Management.

1.2.3.2. DAF IT hardware and software assets under the control of AF/A2/6 will be tracked in the designated APSR, or other approved accountable systems of record for accountability of hardware, as designated by AF/A2/6. (T-1).

1.2.3.3. DAF Chief Intelligence, Surveillance, and Reconnaissance (ISR) Information security officer will evaluate all security issues and concerns before directing how DAF SCI and ISR assets will be tracked. (T-1).

1.2.3.4. AF/A2/6 will provide guidance for meeting regulatory compliance for IT hardware and software assets not tracked in the designated APSR. (T-1).

1.2.3.5. AF/A2/6 must manage physical and virtual total lifecycle assets with an automated asset and licensing management system to comply with the Office of the Director of National Intelligence, Improving Cybersecurity for the Intelligence Community Information Environment Implementation Plan. (T-0). This will be accomplished via system configuration, network management, license management, and IT service management tools and processes.

1.2.4. Assistant Secretary of the Department of the Air Force, Acquisition, Technology and Logistics (SAF/AQ).

1.2.4.1. Sets acquisition requirements to support Integrated Life Cycle Management within the DAF. (T-1).

6 DAFMAN 17-1203 13 SEPTEMBER 2022

1.2.4.2. Executes Service Acquisition Executive (SAE) responsibilities outlined in DODI 5000.02, Operation of the Adaptive Acquisition Framework, DODI 5000.82 Acquisition of Information Technology, DoDI 5000.75, Business Systems Requirements and Acquisition, DAFI 63-144, Business Capability Requirements, Compliance, and System Acquisition, and all other applicable DOD policy and guidance for execution of DAF acquisitions. (T- 0).

1.2.4.3. Ensures programs, to include modifications, are properly defined and justified in budget documentation. (T-0).

1.2.4.4. Executes Title 10 United States Code Section 2464, Core logistics capabilities, and Title 10 USC § 2466, Limitations on the performance of depot-level maintenance of materiel. (T-0).

1.2.4.5. Ensures implementation across acquisition programs for compliance with core and organic requirements. (T-0).

1.2.4.6. Assigns Program Executive Officers (PEOs) to programs per AFI63-101/20-101, Integrated Lifecycle Management.

1.2.4.7. Ensures appropriate protection and cybersecurity measures are applied to IT HW &SW acquisitions in accordance with DODI 5000.83, Technology and Program Protection to Maintain Technological Advantage, DODI 5000.90, Cybersecurity for Acquisition Decision Authorities and Program Managers, and AFI 17-101, Risk Management Framework (RMF) for Air Force Information Technology.

1.2.5. Air Combat Command (ACC).

1.2.5.1. Serves as the DAF lead command and DAF-wide systems manager for assigned Systems. (T-1). As the lead command ACC advocates for multi-command (DAF-wide) systems. Advocacy includes planning and programming for acquisition, installation, training, sustainment, testing, and initial operating capability for new systems. The lead Command has total system oversight. (T-1).

1.2.5.2. Serves as lead for implementation and execution of the DAF ITAM program for IT hardware and software. (T-1).

1.2.5.3. Publishes software entitlements, implementation and ITAM account inventory metrics. (T-1).

1.2.5.4. Manages the DAF Evaluated Products List (EPL) and publishes to the DAF portal for the certified commercial-off-the-shelf (COTS) software products for use on DAF networks. (T-1).

1.2.5.4.1. Establishes evaluation and assurance methods and integrates them in the certification process to assure software in accordance with DODI 5000.83, Technology and Program Protection to Maintain Technological Advantage, and DODI 5200.44, Protection of Mission Critical Functions to Achieve Trusted Systems and Networks

(TSN).

1.2.5.4.2. Provides certification documentation to support Authority to Operate decisions when requested. (T-1).

DAFMAN 17-1203 13 SEPTEMBER 2022 7

1.2.5.5. Coordinates with SAF/CN, AF/A2/6, Air Force Materiel Command (AFMC), major commands (MAJCOMs) and field commands (FLDCOMs) for software license requirements and consolidates non-enterprise software agreements.

1.2.5.6. Identifies and forwards formal ITAM training requirements to SAF/CN.

1.2.5.7. Surveys, consolidates, validates, and tracks all Major Commands (MAJCOMs), FLDCOMs, Field Operating Agency (FOA), and Direct Reporting Unit (DRU) requirements for potential DAF enterprise software licenses for COTS software.

1.2.5.8. Recommends candidate software products for potential department-wide or DOD-wide licensing to the applicable AFMC and SAF/AQ designated offices with the responsibility for procurement of enterprise licenses as the purchasing agent.

1.2.5.9. Will serve as the DAF software license manager to review and consolidate the DAF-wide software license inventory. (T-1). MAJCOM/ FLDCOM base inventories include locally owned software and software not yet transferred to an enterprise software license agreement.

1.2.5.10. Must maintain a consolidated list of all enterprise and non-enterprise DAF software, to include software name, vendor, version, user (program/WS/MAJCOM/FLDCOM) and platform, and other required data elements as mandated by DODI 5000.76.

1.2.5.11. Designates a product center as the OPR for managing the DAF Enterprise Software License Program or establishing DOD-wide enterprise software license agreements, when designated, acts as executive agent for establishing DoD-wide enterprise software licenses. (T-1).

1.2.5.12. In coordination with SAF/AQ, develop and implement processes to ensures all COTS license requirements are purchased using approved DAF Enterprise License Agreements (ELAs), Joint Enterprise License Agreements (JELAs), DOD Enterprise Software Initiative (ESI) or other approved DOD/ DAF/intelligence community contract vehicles. (T-0). Processes will include methods for contracting officer engagement when the aforementioned agreements and vehicles cannot be used to meet COTS requirements.

(T-1).

1.2.5.13. Ensures review of software license agreement language, including coordination with legal and contracting professionals, as necessary. (T-1).

1.2.5.14. Designates the Managed Services Office (MSO) for managing the commoditized purchase of AF infrastructure and platform service components. The Managed Services Office (MSO) establishes AF enterprise commoditized purchase and provisioning of infrastructure ensuring the management of IT assets within the infrastructure. (T-1).

1.2.5.15. Designates a product center as purchasing agent for software licenses to support consolidated and programmatic DAF requirements. (T-1).

1.2.5.16. Manages Air Force Enterprise Software Licenses for COTS computer and network management software. (T-1).

1.2.6. HQ Cyberspace Capabilities Center (HQ CCC) within Air Combat Command

(ACC).

8 DAFMAN 17-1203 13 SEPTEMBER 2022

1.2.6.1. ACC delegated governance to HQ CCC. As such, HQ CCC is designated as Program Manager (PM)/lead for the implementation and execution of the DAF ITAM Program through the DAF ITAM Product Management Office (once established) for hardware and software in coordination with the DAF EIT Governance structure and as outlined in the EIT Governance Charter. (T-1).

1.2.6.2. Surveys and consolidates MAJCOM/Field Command, FOA, and DRU requirements for potential Air Force enterprise software licenses for COTS computer and network management software.

1.2.6.3. Hosts the following boards to support ACC’s lead command responsibilities:

1.2.6.3.1. Service Request Review Board (SRRB).

1.2.6.3.2. Service Design Review Board (SDRB).

1.2.6.3.3. Service Release and Deployment Board (SRDB).

1.2.6.4. Reviews, evaluates, and interprets issues and problems as the ITAM subject matter expert and makes recommendations on ITAM policy changes to SAF/CN.

1.2.6.5. Reviews request for waivers to this instruction and recommends appropriate actions.

1.2.6.6. Advocates for manpower standards, development and specialty utilization.

1.2.6.7. Assesses equipment, systems and software requirements as directed or requested.

1.2.6.8. Recommends candidate software products for potential DAF-wide licensing to the SAF/CN through the Application Decision Domain Lead and the Service Request Review Board (SRRB).

1.2.6.9. Consolidates new MAJCOM/Field Command training for managing software licenses (including computer-based initiatives) and sends them to Headquarters Air Education and Training Command for incorporating formal courses or in long-distance learning approaches.

1.2.6.10. Provides guidance and support to MAJCOMs/Field Commands, FOAs, and DRUs in managing DAF EIT hardware and software assets.

1.2.6.11. Acts as DAF ITAM functional manager for all proposed upgrades and/or modifications to DAF EIT hardware and software assets.

1.2.6.12. Must maintain the master list of designated Major Command Equipment Control Officers (MECOs) and Base/Tenant IT Equipment Control Officers (ECOs). (T-1).

1.2.6.13. Must manage associated accounts for MECOs and ECOs, to include approving new account requests and conduct annual review of open accounts. (T-1).

1.2.6.14. Must ensure that primary Accountable Property Officers (APOs) for software asset management are appointed in writing and retain appointment letters on file. (T-1).

1.2.6.15. Must act as the Information Owner (IO) for DPAS software and hardware sites, grants DPAS access to all relevant stakeholders (APOs, ECOs, PAs, BSLMs), monitor new access request and conduct annual review of open accounts. (T-1).

DAFMAN 17-1203 13 SEPTEMBER 2022 9

1.2.6.16. Must maintain the master distribution list of all appointed software roles (APOs, BSLMs, USLMs, and PA) and has the list readily available. (T-1).

1.2.6.17. Will monitor compliance with annual capital inventory requirements and escalate non-compliance to the Wing Commander. (T-1).

1.2.6.18. Will identify, review, approve, and conduct formal training for all relevant stakeholders for software and hardware asset management. (T-1).

1.2.7. Air Force Sustainment Center Contracting (AFSC/PZ) - 771st Enterprise Sourcing Squadron

1.2.7.1. The Air Force Sustainment Center Contracting (AFSC/PZ) will support DAF ITAM Managers and their teams in execution of assigned responsibilities by:

1.2.7.1.1. Conducting Opportunity Assessments. (T-1).

1.2.7.1.2. Supporting the ITAM Program through the ITAM Category Execution Plan (CEP) and in support of the CCC as the lead for the implementation and execution of the DAF ITAM Program for hardware and software. (T-1).

1.2.7.1.3. Executing acquisition solutions across the Category 1, Category Management category. (T-1).

1.2.8. Service Portfolio Managers (SPM). The Air Force provides IT through four mission area portfolios: Business, Warfighting, Defense Intelligence, and Information Environment.

EIT provides common IT resources, services, hardware, and software segmented into the following sub-portfolios: Protect, Connect, Compute/Store, Enterprise Services, and End User Devices per AFI 17-110, Information Technology Portfolio Management and Capital Planning and Investment Control, dated 23 May 2018.

1.2.8.1. Portfolio Owners currently consist of Headquarters Air Force, MAJCOM, USSF, and certain Combatant Command staffs that have DAF IT investments with IEMA sub-portfolios overseen and managed by SAF/CNS. Portfolio Owners will:

1.2.8.2. Be appointed by SAF/CNS as per the EIT Governance Structure and lead assigned Portfolio Managers (PfMs) and/or Category Leads activities on a daily basis. (T-1).

1.2.8.3. Lead Decision Domain/Portfolio members to prioritize at the enterprise-level based on the portfolio roadmap priorities, operational and executability assessments, and trade-off analysis. (T-1).

1.2.8.4. Posture the IT Category Manager and Council Director for the Quarterly DAF Category Management Council. (T-1).

1.2.8.5. Maintain a 12-month forecast of requirements for the Department of the Air Force to buy smarter and more like a single enterprise for all programs in their portfolio. (T-1).

1.2.8.6. Recommend Portfolio Manager/Category Lead assignments (may be the same person) to the SAF/CNS and IT Category Council Director. (T-1).

10 DAFMAN 17-1203 13 SEPTEMBER 2022

Chapter 2

HARDWARE ASSET MANAGEMENT

2.1. Scope.

2.1.1. The scope of IT hardware asset management encompasses business processes related to the asset management lifecycle including acquisition, receipt and acceptance, physical or automated inventory, transfer, management, disposal, and financial reporting.

2.1.2. IT hardware is a subset of the General Equipment (GE) Assessable Unit (AU), where IT hardware assets owned by the DAF are captured within the general ledger and reported on the financial statements.

2.2. IT Hardware Definition and Types.

2.2.1. IT hardware refers to devices such as computing systems and/or network systems that process, store, and distribute data. This includes but is not limited to computers, network equipment, printers/scanners, and servers. To determine if an IT hardware asset meets the criteria to be tracked within DPAS, refer to paragraph 2.4.

2.2.2. IT hardware typically utilizes a software and firmware. Software and firmware are covered within Chapter 3.

2.3. Roles and Responsibilities. Figure 2.1 and Figure 2.2 represent an overview of those hardware asset management roles and responsibilities from the DAF to the organizational level.

DAFMAN 17-1203 13 SEPTEMBER 2022 11

Figure 2.1. Property (Physical) Accountability Roles Overview.

Note: The APO role in DPAS is not the same as the host/tenant APO or Unit Accountable Property Officer (UAPO) level. The host/tenant APO and UAPO do not require DPAS access or training.

12 DAFMAN 17-1203 13 SEPTEMBER 2022

Figure 2.2. Asset (Financial) Reporting Roles Overview.

2.3.1. Department of the Air Force Equipment Control Office (DAFECO).

2.3.1.1. The Cyberspace Capabilities Center (CCC) within Air Combat Command (ACC) serves as the DAFECO for all DAF IT hardware assets within DPAS in accordance with Attachment 2.

2.3.1.2. Provides guidance and support to MAJCOMs, FLDCOMs, FOAs, and DRUs in managing IT hardware assets.

2.3.1.3. Reviews, evaluates and interprets issues and problems as the ITAM subject matter expert and makes recommendations on ITAM policy changes to SAF/CNS.

2.3.1.4. Coordinates with SAF/CNS to propose changes, upgrades, and/or modifications to DPAS in accordance with Attachment 2.

2.3.1.5. Tracks the appointment of FECOs.

2.3.1.6. Maintains a list of designated FECOs and ECOs.

2.3.1.7. Manages the implementation of DOD and DAF policy on Serialized Item Management (SIM) in accordance with DODI 8320.04, Item Unique Identification (IUID) Standards for Tangible Personal Property, for all IT hardware assets managed in DPAS in accordance with Attachment 2 as applicable. (T-0).

2.3.1.8. Maintains a list of host/tenant APOs appointments and notifies SAF/CNS of required appointments.

2.3.1.9. Monitors excess IT asset inventories in DPAS, monitors spare levels, and provides guidance on utilizing excess IT hardware assets.

2.3.1.10. Ensures compliance with this DAFMAN.

DAFMAN 17-1203 13 SEPTEMBER 2022 13

2.3.1.11. Resolves compliance issues that cannot be resolved at the host/tenant APO level.

2.3.1.12. Provides reports to MAJCOM/FLDCOM A6s or MAJCOM/FLDCOM inspection teams when requested.

2.3.1.13. Serves as DPAS Catalog Manager to standardize the catalog and create new catalog records for each unique stock number, manufacturer name, model number, and manufacturer Commercial and Government Entity (CAGE) code combination. Note:

CAGE code is available via: https://cage.dla.mil/Home/UsageAgree.

2.3.2. Functional Equipment Control Officer (FECO).

2.3.2.1. Serves as the liaison between the DAFECO and ECO.

2.3.2.2. Will not serve as FECO and ECO in the same command according to DOD FMR 7000.14-R, Volume 3, Chapter 8, Standards for Recording and Reviewing Commitments and Obligations and AFI 65-201, Enterprise Risk Management and Managers’ Internal Control Program Procedures. (T-0).

2.3.2.3. FECOs may be appointed for FOAs or DRUs where geographical separation from units and high rates of turnover requires an extra tier of oversight for IT Asset Management.

The DAFECO will approve FECO appointment requests for FOAs and DRUs. (T-1).

2.3.2.4. FECOs must be appointed in writing by FOA or DRU commander or equivalent with handwritten or digital signatures and provide a digital copy to the DAFECO. (T-1).

2.3.2.5. Completes additional training as directed by the DAFECO.

2.3.2.6. Answers inquiries for ECOs within their area of responsibility.

2.3.2.7. Will review System Authorization Requests (SARs) from their respective ECOs prior to submission to DAFECO. (T-1).

2.3.2.8. Will track appointment of ECOs within their area of responsibility. (T-1).

2.3.2.9. Will ensure ECOs are trained. (T-1). References for ECO training can be found on the DAFECO SharePoint site.

2.3.3. Host Installation Commander, Wing Commander (or equivalent).

2.3.3.1. Must appoint the host APO and maintains appointment letters on file. (T-1).

2.3.3.2. Must appoint tenant APOs in the host tenant support agreement (HTSA), as necessary. (T-1).

2.3.4. Host/Tenant Accountable Property Officer (APO).

2.3.4.1. Must be appointed by the host installation commander, wing commander (or equivalent). (T-1).

2.3.4.2. The host APO must be accountable for all accountable IT assets on their installation, unless otherwise delegated in an HTSA. (T-1). The tenant APO will serve as the accountable officer for all accountable IT hardware within their organization. (T-1).

2.3.4.3. Must appoint at least one primary and one alternate ECO, document acknowledgement of duties with handwritten or digital signatures, and provide a copy to the DAFECO/FECO. (T-1).

https://cage.dla.mil/Home/UsageAgree

14 DAFMAN 17-1203 13 SEPTEMBER 2022

2.3.4.4. Will ensure the DPAS inventory provides accountability of all accountable IT hardware assets in accordance with this manual. (T-1).

2.3.4.5. Will ensure assets are accounted for throughout their lifecycle. (T-1).

2.3.4.6. Will ensure assets are stored according to environmental specifications of a manufacturer. (T-1).

2.3.5. Equipment Control Officer (ECO).

2.3.5.1. Must be appointed as primary or alternate by the host/tenant APO. (T-1).

2.3.5.1.1. The Primary ECO will be, at a minimum, the rank of E-5 or GS-7. (T-1).

There is not a rank/grade minimum requirement for alternate ECOs.

2.3.5.1.2. Shall only be appointed as a property custodian (PC) for holding assets prior to distribution or disposal (e.g., holding accounts). (T-1).

2.3.5.1.3. Must not be resource advisor (RA) within the same unit in which they are performing duties as ECO, nor will they be the government purchase card (GPC) holder for IT assets. (T-1).

2.3.5.1.4. If contractor employees are assigned to perform ECO duties under the terms of a contract, the DAF will retain responsibility for determining which supplies and services to purchase. Contractor employees may be authorized to make purchases on the Government’s behalf in accordance with Federal Acquisition Regulation (FAR) 7.503(12)(i). Consult with the cognizant Contracting Officer to ensure compliance with contract terms and conditions. (T-1).

2.3.5.1.5. Will track appointment of PCs. (T-1).

2.3.5.2. Will process the receipt, transfer and disposal of all accountable IT assets and complete necessary documentation to establish custodial responsibility. (T-1).

2.3.5.2.1. Will assist PC in determining the ownership, reassignment, or disposition of all found-on-base accountable IT assets. (T-1).

2.3.5.2.2. Will direct PCs to conduct inventories in accordance with Attachment 4.

(T-1).

2.3.5.2.3. Will provide PCs with labels for assets in accordance with paragraph

2.6.1.4 (T-1).

2.3.5.3. Will monitor and subscribe to DAFECO SharePoint site for additional guidance and support. (T-1).

2.3.5.4. Will complete additional training as directed by the DAFECO/FECO. (T-1).

2.3.5.5. Will provide PCs with training on requirements and standardized procedures. (T- 1).

2.3.5.6. Will provide inventory assistance in accordance with Attachment 4. (T-1).

2.3.5.7. Will ensure on hand serviceable spares for desktops and laptops do not exceed 5% of the total inventory at their assigned unit. If 5% does not equal one asset, the spare level will be one asset. (T-1).

DAFMAN 17-1203 13 SEPTEMBER 2022 15

2.3.6. Unit APO (UAPO).

2.3.6.1. Organization commanders (or equivalent) shall serve as UAPO and are responsible for providing guidance and procedures to ensure adequate protection and oversight is afforded to safeguard IT assets under their control. (T-1).

2.3.6.2. Will appoint at least one primary and one alternate PC per account in accordance with DODI 5000.64, Accountability and Management of DOD Equipment and Other Accountable Property, section 3.2, paragraph f. (T-0). The UAPO will ensure appointed PCs acknowledge their duties with handwritten or digital signatures, and the UAPO will provide a copy of the documentation to the ECO. (T-2).

2.3.6.3. Must be responsible for the accountability of all accountable IT hardware assets assigned to their unit. (T-1).

2.3.6.4. Must approve purchase requests for systems to support mission needs in accordance with paragraph 2.5 (T-1).

2.3.6.5. Will ensure assets are inventoried according to Attachment 4. (T-1).

2.3.6.6. Will ensure PCs perform out-of-cycle inventories as directed. (T-1).

2.3.6.7. Must direct the primary PC to complete a gain-loss inventory no later than 30 calendar days prior to out processing for primary custodian changeover. (T-1).

2.3.6.8. Will monitor the acquisition, storage, utilization, and disposition of property within his or her assigned accountable area. Identify underutilized, impaired, or obsolete property and take appropriate actions to increase utilization or ensure disposition. (T-0).

2.3.6.9. Will develop physical inventory plans and procedures, schedule physical inventories, and assist in their completion in accordance with Attachment 4. (T-0).

2.3.6.10. Will ensure on hand serviceable spares for desktops and laptops do not exceed 5% of the total inventory at their assigned unit. If 5% does not equal one asset, the spare level will be one asset. (T-1).

2.3.6.11. Will ensure PCs complete required training. (T-2).

2.3.7. Property Custodian (PC).

2.3.7.1. UAPO must appoint primary and alternate PC in writing. (T-1). There is no minimum rank requirement for PCs.

2.3.7.2. Contractors may serve as PCs, if allowable under the contract terms and conditions and approved by the organization commander.

2.3.7.2.1. PCs shall be accountable for all assigned accountable IT hardware assets within their respective custodian accounts. (T-1).

2.3.7.2.2. PCs will ensure individuals receiving accountable assets validate acceptance with signed documentation i.e., AF Form 1297 or locally developed receipt. PC will retain a copy of the signed document. (T-1).

2.3.7.3. Will perform, at a minimum, an annual inventory of all accountable IT hardware assets under their purview, as prescribed in DODI 5000.64. (T-0).

16 DAFMAN 17-1203 13 SEPTEMBER 2022

2.3.7.4. Will ensure all accountable assets have labels containing serial number, part number, and manufacturer CAGE code affixed prior to being placed in service. (T-1).

2.3.7.5. Will ensure all shipments are sent to the ECO and will notify the ECO of all incoming and outgoing shipments, transfers, donations, or turn-ins of excess assets. (T-1).

2.3.7.6. Will provide appropriate documentation to the applicable ECO to clear the account of equipment that was shipped to another base/location, transferred to another account, or turned in to the Defense Logistics Agency Disposition Services (DLADS). (T- 1).

2.3.7.7. Must be approved to out-process by the UAPO and ECO. (T-1).

2.3.7.8. Upon discovery of lost, stolen, damaged, or destroyed assets will perform the following (refer to paragraph 2.7.2 for further FLI guidance):

2.3.7.8.1. Must notify the ECO and UAPO within 5 business days. (T-1).

2.3.7.8.2. Must report the loss of any IT hardware asset with persistent storage to the Information System Security Office (ISSO) or wing Information Assurance (IA), Information Protection (IP), or PII according to requirements outlined in DoDM 5200.01V3_AFMAN 16-1404V3, Information Security Program: Protection of Classified Information, and any local procedures. (T-1).

2.3.7.8.3. Will contact the local Financial Liability Investigation (FLI) office within 5 business days to determine if a FLI is required when any assets within the APSR are discovered lost, stolen, damaged, or destroyed. (T-1).

2.3.7.9. Must ensure hard drives are removed from assets prior to turn-in to DLADS and must contact ISSO or Cyber Security Office to obtain sanitization procedures for hard drives. (T-1).

2.4. Accountability Rules of IT Hardware Assets.

2.4.1. Accountability Technique Determination .

2.4.1.1. Accountability of IT hardware assets resides with the host/tenant APO or the UAPO, respectively. Physical and financial accountability takes place throughout the lifecycle of the asset. In accordance with DODI 5000.64, accountability of DAF IT hardware assets is determined as follows:

2.4.1.2. Must be established upon receipt, delivery, or acceptance. (T-0).

2.4.1.3. Is enabled by serialized numbering for identification, tracking, and management in accordance with DODI 8320.04. (T-0).

2.4.1.4. Is supported primarily by automated identification technology (AIT), to include the use of barcode printers, hand-held and tethered scanners, radio frequency identification, tablets, and common access card readers. AIT will be further supported by the use of electronic forms, attachments, or other soft copies of documentation where practicable.

2.4.1.4.1. Must use AIT to assist in property accountability unless it is unavailable or demonstrably proven through cost benefit or other analysis that implementation would not be practical. (T-0).

DAFMAN 17-1203 13 SEPTEMBER 2022 17

2.4.1.4.2. Decisions of “not practicable” must be documented by a memorandum of record and reevaluated and reaffirmed every 2 years. The memorandum of record must be signed by PC or ECO and provided to UAPO, and be available upon request (e.g., audit). (T-0).

2.4.1.5. Is maintained throughout the property’s useful life and through disposal regardless of the property’s status within the property life cycle (e.g., excess, obsolete or unserviceable, surplus) or its physical location (e.g., loading platform, in-transit, in theater). (T-0).

2.4.2. Controlled Inventory IT Hardware Assets.

2.4.2.1. Controlled Inventory IT assets are any IT hardware with persistent storage (e.g., laptop, desktop, server, tablet, smartphone, external hard drive, and thumb drive).

Persistent storage does not include device firmware.

2.4.2.2. Controlled inventory assets must be accounted for in DPAS in accordance with Attachment 2 due to their capability to process and/or transmit personally identifiable information or another sensitive agency information according to DODI 5000.64. (T-0).

Physical accountability of these items is required in support of IT configuration management and cybersecurity requirements. (T-1). Physical accountability supports the goal of automating the association of IT assets with network configuration management items and to enhance overall cyberspace situational awareness of physical assets.

2.4.3. Accountable Property Records (APR).

2.4.3.1. Accountable property records will be established in DPAS in accordance with Attachment 2 for:

2.4.3.1.1. All government property purchased or otherwise obtained having a unit acquisition cost of $5,000 or more. (T-0).

2.4.3.1.2. Assets obtained via a capital lease, as defined in DODI 5000.64. (T-0).

2.4.3.1.3. Classified assets as defined in DODI 5000.64, that are not tracked elsewhere in an approved APSR. (T-0).

2.4.3.1.4. Assets qualified as a sensitive asset as defined in DODI 5000.64. (T-0).

2.4.3.1.5. Assets that are categorized as Government Furnished Property (GFP) as defined in DODI 5000.64 and meets any of the criteria in paragraph 2.4.3 or paragraph 2.4.4 (T-0).

2.4.3.1.6. Core network and data management infrastructure with unit cost of more than $5,000. Core infrastructure are devices that enable management of network services, e.g., servers, routers, switches, and firewalls.

2.4.3.2. Any IT asset/item meeting the criteria for this category will be managed using DPAS in accordance with Attachment 2. (T-1).

2.4.3.3. PC will ensure accountable property records are kept current and reflect the current status, location, financial information, and condition of the asset until authorized disposition of the property occurs. (T-1). The property records must provide a comprehensive log of suitable key supporting documents (KSDs) for audit. (T-1). They

18 DAFMAN 17-1203 13 SEPTEMBER 2022

will also be the authoritative source for use in validating the existence of transactions and completeness of an asset. See Attachment 5 for a list of KSDs.

2.4.4. Accountability Record (AR) Process.

2.4.4.1. An IT asset/item will be accounted for using the AR process if the asset has a unit acquisition cost of less than $5,000 and any of the following criteria applies:

2.4.4.1.1. The asset/item is controlled or managed at the asset/item level in accordance with DODI 4151.19, Serialized Item Management (SIM) for Life-Cycle Management of Materiel. (T-0).

2.4.4.1.2. The asset/item has the capability to store personally identifiable information

(PII). (T-0).

2.4.4.1.3. The asset/item was obtained via an operating lease, as defined in DODI

5000.64. (T-0).

2.4.4.1.4. Core network and data management infrastructure with unit cost of less than $5,000. (T-0). Core infrastructure are devices that enable management of network services, e.g., servers, routers, switches, and firewalls.

2.4.4.2. Any IT asset/item meeting the criteria for this category will be tracked in DPAS in accordance with Attachment 2. (T-0).

2.4.5. Accounting for Information Technology Hardware Assets that do not meet the criteria for the APR or AR processes.

2.4.5.1. For an IT asset/item that does not meet any of the criteria described in paragraph

2.4.3 or paragraph 2.4.4, the DAF does not require accountability and tracking, but does not preclude an organization from doing so.

2.4.5.2. UAPOs may direct PCs to account for these assets with locally developed procedures.

2.4.5.3. Peripherals and other IT hardware that do not contain persistent storage capabilities and do not exceed $5,000 (e.g., mice, keyboards, monitors, displays, keyboard video mouse (KVM) switches, voice over internet protocol (VOIP) telephones, and video teleconferencing (VTC) devices, fax machines, mobile hotspots and printers that do not contain HDDs). These assets are not required to be tracked in DPAS, but unit APOs may direct PCs to account for these assets with locally developed procedures.

2.4.6. IT Hardware Accountability in DPAS.

2.4.6.1. Any asset recorded, tracked, and managed in the DPAS in accordance with Attachment 2 must:

2.4.6.1.1. Adhere to the requirements described in DODI 5000.64, Section 4. (T-0).

2.4.6.1.2. Be inventoried at least annually. (T-0).

2.4.6.1.3. Only be updated in DPAS in accordance with Attachment 2 with the appropriate documentation, such as disposal or transfer documentation, DD Form 200, Financial Liability Investigation of Property Loss, etc. (T-1).

2.4.7. IT Hardware Components of a Weapon System or other Similar Capability.

DAFMAN 17-1203 13 SEPTEMBER 2022 19

2.4.7.1. IT assets that are components of a Weapon System or other similar capability will be managed by this manual if both of the following apply:

2.4.7.2. The weapon system is not being managed in another APSR in accordance with Attachment 2, per DODI 5000.64_DAFI 23-111, Accountability and Management of DoD Equipment and Other Accountable Property, and AFI 21-103, Equipment Inventory, Status and Utilization Reporting. (T-1).

2.4.7.3. The IT components meet the requirements of paragraph 2.4.3 or paragraph

2.4.4 of this manual. (T-1).

2.5. Procurement of IT Hardware Assets.

2.5.1. Before purchasing standard laptop or desktop computers, review the guidance in Attachment 3, A.3.1.1.

2.5.1.1. Client computing devices shall be purchased using the Client Computing Solutions III (CCS-3) program including products under the Quantum Enterprise Buy (QEB) cycles as well as Rugged Product Buys (RPB) cycles. (T-0). There are two methods for purchasing the CCS-3 authorized products.

2.5.1.2. For orders restricted to GPC and single delivery location orders utilize the GSA AF Advantage portal.

2.5.1.3. Utilize the Direct to Vendor (DTV) method for delivery orders and BPA calls ensuring orders are transmitted to the specified vendor email addresses for acceptance of encrypted emails. (T-0). The following CCS-3 SharePoint site has the specific vendor contact cards for download to use for this purpose:

https://usaf.dps.mil/sites/aficc/afcc/AFICC/771ESS/SitePages/Client-Computing- Solutions-(CCS-3).aspx

Note: Refer to paragraph 2.6.1.2.2. in the event orders are not shipped directly to ECO.

2.5.1.4. All orders must be approved by the requesting UAPO, and the servicing ECO. (T- 1). Organizations must utilize the CCS-3 purchasing program as the primary means of acquiring client computing systems. (T-0). The products offered under CCS-3 meet all requirements listed above except for limited product types where industry does not have a fully compliant product. In those limited cases, those products are acceptable to purchase for mission requirements but should be limited in quantity. (T-0).

2.5.1.5. The Equipment Control Officer (ECO) will ensure the above standards are met prior to all purchases.

2.5.1.6. For further laptop or desktop acquisition information please contact the 771st ESS Enterprise Hardware Commodity Acquisition Programs (Formerly ITCC) Customer Support at IT.Contract.Flight@us.af.mil.

2.5.1.7. Research, Development, Test & Evaluation (RDT&E) units will be exempt. (T- 1).

2.5.1.7.1. RDT&E procurement of IT products are not destined for office automation use. Due to the nature of the customer-based IT requirements used in Data Centers or Test Enclaves to support specific mission objectives the standard IT products or configurations will not support the mission. The customer driven requirement directed https://usaf.dps.mil/sites/aficc/afcc/AFICC/771ESS/SitePages/Client-Computing-Solutions-(CCS-3).aspx https://usaf.dps.mil/sites/aficc/afcc/AFICC/771ESS/SitePages/Client-Computing-Solutions-(CCS-3).aspx mailto:IT.Contract.Flight@us.af.mil

20 DAFMAN 17-1203 13 SEPTEMBER 2022

by program offices or specific customers unique to the RDT&E mission must follow the approval process of the unit Information System Security Managers (ISSM) and Program Office Security personnel. (T-1).

2.5.1.7.2. RDT&E units will procure, where applicable, from CCS-3 or GSA 2GIT approved vendors to meet mission demands from sources identified in paragraph 2.5 to mitigate risk of infiltration of the supply chain by nation states. (T-1).

2.5.1.8. In the event that a mission requirement cannot be met by CCS-3 through the QEB, RPB or the Specialized Product Solicitation (SPS) request for quote process, organizations must obtain a waiver from the MAJCOM A6. (T-1). If approved, then seek the product using the Second-Generation IT (2GIT) buying program using the GSA portal. Products that are not in scope of CCS-3 do not require a waiver before seeking those products through 2GIT. However, the above technical requirements must be met for all products purchased through 2GIT. (T-0).

2.5.1.9. Digital Printing & Imaging (DPI) products including multifunction/single function printers, scanners, and associated consumables shall be purchased using the Product Selection Cycle (PSC) process. There are two methods for purchasing the DPI authorized products.

2.5.1.9.1. For orders restricted to GPC and single delivery location orders utilize the GSA AF Advantage portal. https://www.gsaadvantage.gov/.

2.5.1.9.2. Utilize the DTV method for delivery orders and BPA calls ensuring orders are transmitted to the specified vendor email addresses for acceptance of encrypted emails. (T-0). The following DPI SharePoint site has the specific vendor contact cards for download to use for this purpose:

https://usaf.dps.mil/sites/aficc/afcc/AFICC/771ESS/SitePages/Digital-Printing-and-Imaging-(DPI).aspx.

2.5.1.9.3. For further information please contact customer support at itccsupport@us.af.mil.

2.5.1.10. Cellular Services and Devices (CSD) are available through Navy Spiral 3 (current)/Navy Spiral 4 (future) and provide wireless devices and services.

https://my.navsup.navy.mil/apps/ops$ncmpo.view_topic?p_topic_id=TOPIC_144.

2.5.1.11. GSA 2nd Generation IT (2GIT) provides network Infrastructure hardware and services (servers, routers, switches, etc.), end user devices, and other IT hardware for purchase and should be accessed through GSA Advantage. (T-0).

https://www.gsaadvantage.gov/advantage/ws/department/adv2git.

2.5.1.12. Other Government-Wide Acquisition Contracts (GWACs) authorized for use.

2.5.1.12.1. The CCS-3 and DPI purchase sources are mandatory and take precedence over GSA 2GIT and other procurement sources, unless waived by the MAJCOM/Field Commands/A6s or equivalent. (T-1). Note: a waiver is not required to use 2GIT if the IT hardware requirement is outside of the scope of CCS-3 and DPI (i.e. network infrastructure requirements such as servers, routers, switches, etc.). (T-0).

https://www.gsaadvantage.gov/ https://usaf.dps.mil/sites/aficc/afcc/AFICC/771ESS/SitePages/Digital-Printing-and-Imaging-(DPI).aspx https://usaf.dps.mil/sites/aficc/afcc/AFICC/771ESS/SitePages/Digital-Printing-and-Imaging-(DPI).aspx mailto:itccsupport@us.af.mil https://my.navsup.navy.mil/apps/ops$ncmpo.view_topic?p_topic_id=TOPIC_144 https://www.gsaadvantage.gov/advantage/ws/department/adv2git

DAFMAN 17-1203 13 SEPTEMBER 2022 21

2.5.1.12.2. 2GIT is mandatory and takes precedence over other GWACs and other vendor authorized sources, unless waived by the MAJCOM/Field Command/A6s or equivalent/as designated. (T-1).

2.5.1.12.3. All managed print services will be procured using guidance in paragraph

2.5.3 (T-1).

2.5.1.12.4. All requests for servers must comply with current National Defense Authorization Act (NDAA). (T-0).

2.5.1.13. The minimum hardware specifications, processes and contract vehicles defined in this guidance are current as of February 2022 and subject to change. (T-0). Refer to the 771st ESS Enterprise Hardware Commodity Acquisition Programs (Formerly ITCC) Customer Support at IT.Contract.Flight@us.af.mil or ITCC.Support@us.af.mil for the latest direction regarding the purchase of IT hardware.

2.5.2. Procurement Process.

2.5.2.1. ECOs will ensure they provide complete information for shipping labels for ordered equipment. (T-1). Obtain confirmation that procurement officials specify, as a contractual requirement, that “Ship To” and “Mark For” information is detailed on the shipping labels. This will alleviate problems with the receipt and acceptance processing of new hardware assets. https://www.gsaadvantage.gov/

2.5.2.1.1. “Mark For” information will contain the recipient’s name and unit, and may contain Contract Number, Purchase Order Number, Address, Phone Number, E-mail Address, Resource Manager Name, and UAPO (when applicable). (T-1).

2.5.2.1.2. “Ship To” information will contain the complete delivery address. (T-1).

Assets shall be shipped to Central Receiving at the ECO’s location and must include the recipient’s name. (T-1). This will correspond to the DOD Activity Address Code (DODAAC) and the Automated Civil Engineer System-Real Property (ACES-RP) system of record for real property. (T-1). For further information please contact customer support at itccsupport@us.af.mil.

2.5.2.1.3. Central receiving facilities and warehouses must meet manufacturer operating and storage environment specifications, standard facility requirements and DAF safety standards to protect assets from physical damage and inclement weather.

(T-1).

2.5.2.2. All Accountable IT hardware assets must be added to DPAS in accordance with Attachment 2. (T-1).

2.5.2.2.1. If an asset is not loaded in the DPAS Catalog, the ECO must submit a catalog update request through the DAFECO SharePoint DPAS Catalog Update Request system. (T-1).

2.5.2.2.2. The manufacturer name, part number, model number and CAGE code must be provided along with documentation…