AFI 17-101.pdf

BY ORDER OF THE SECRETARY

OF THE AIR FORCE

AIR FORCE INSTRUCTION 17-101

6 FEBRUARY 2020

Cyberspace

RISK MANAGEMENT FRAMEWORK

(RMF) FOR AIR FORCE

INFORMATION TECHNOLOGY (IT)

COMPLIANCE WITH THIS PUBLICATION IS MANDATORY

ACCESSIBILITY: Publications and forms are available for downloading or ordering on the e-Publishing website at www.e-Publishing.af.mil

RELEASABILITY: There are no releasability restrictions on this publication

OPR: SAF/CNZ

Supersedes: AFI17-101, 23 January 2020

Certified by: SAF/CNZ

(Ms. Wanda E. Jones-Heath)

Pages: 41

This Air Force Instruction (AFI) implements Air Force Policy Directive (AFPD) 17-1, Information

Dominance Governance and Management, AFPD 33-3, Information Management, and associated processes outlined on the AF RMF Knowledge Service (KS), for managing the life-cycle cybersecurity risk to Air Force Information Technology (IT). This instruction is consistent with

Chairman Joint Chiefs of Staff Instruction 6510.01F, Information Assurance (IA) and Support to

Computer Network Defense (CND). This publication applies to all military (active, reserve, guard), civilians, and contractors. Ensure all records created as a result of processes prescribed in this publication are maintained in accordance with Air Force Manual 33-363, Management of Records, and disposed of in accordance with the Air Force Records Disposition Schedule located in the Air

Force Records Information Management System. Refer recommended changes and questions about this publication to the Office of Primary Responsibility listed above using the Air Force

Form 847, Recommendation for Change of Publication; route AF Forms 847 from the field through the appropriate chain of command. This publication may be supplemented at any level, but all supplements must be routed to the Office of Primary Responsibility listed above for coordination prior to certification and approval. The authorities to waive wing/unit level requirements in this publication are identified with a Tier (“T-0, T-1, T-2, T-3”) number following the compliance statement. See Air Force Instruction (AFI) 33-360, Publications and Forms Management, Table

1.1 for a description of the authorities associated with the Tier numbers. Submit requests for waivers through the chain of command to the appropriate Tier waiver approval authority, or alternately, to the Publication Office of Primary Responsibility (OPR) for non-tiered compliance items.

http://www.e-publishing.af.mil/

2 AFI17-101 6 FEBRUARY 2020

SUMMARY OF CHANGES

This document has been substantially revised and needs to be completely reviewed. Major changes include integration of Special Access Programs into the 17-series, updates to the IT Categorization and Selection Checklist (ITCSC) processes, and the incorporation of Air Force Guidance

Memorandum 2018-01 in its entirety.

Chapter 1—PROGRAM OVERVIEW 5

1.1. Purpose

Figure 1.1. Air Force IT Categories

1.2. Applicability

1.3. Objectives

Chapter 2—COORDINATING ROLES AND RESPONSIBILITIES 7

2.1. Under Secretary of the Air Force (USecAF)

2.2. Administrative Assistant to the Secretary of the Air Force (SAF/AA)

2.3. Secretary of the Air Force for Acquisition (SAF/AQ)

2.4. Deputy Chief of Staff, Intelligence, Surveillance, and Reconnaissance (AF/A2/6). 7

Chapter 3—RMF ROLES AND RESPONSIBILITIES 8

3.1. Secretary of the Air Force (SAF), Office of the Deputy Chief Information Officer

(SAF/CN)

3.2. Chief Information Security Officer (CISO), SAF/CNZ

3.3. Authorizing Official (AO)

3.4. Air Force Enterprise Authorizing Official (AF Enterprise AO)

3.5. AO Designated Representative (AODR)

3.6. Security Control Assessor (SCA)

3.7. Security Controls Assessor Representative (SCAR)

3.8. Agent of the Security Controls Assessor (ASCA)

3.9. Information System Owners (ISO)

3.10. Program Manager (PM)

3.11. Unit Communications Squadron Commander (CS/CC)

3.12. Information System Security Manager (ISSM)

AFI17-101 6 FEBRUARY 2020 3

3.13. Information System Security Officer (ISSO)

3.14. Information Systems Security Engineer (ISSE)

3.15. Information Owner/Steward

3.16. User Representative

3.17. Additional Responsibilities

Table 3.1. AF RMF Appointment Matrix

3.18. Cybersecurity Forums

Chapter 4—RMF METHODOLOGY 19

4.1. Overview

Figure 4.1. RMF for AF IT

4.2. PREPARE

4.3. CATEGORIZE System

4.4. SELECT Security Controls

4.5. IMPLEMENT Security Controls

4.6. ASSESS Security Controls

4.7. AUTHORIZE System

4.8. Denial of Authorization to Operate

4.9. MONITOR Security Controls

4.10. Resources and Tools

Chapter 5—AF IT ASSESS ONLY REQUIREMENTS 25

5.1. PIT Subsystems, PIT Products, IT Services, and IT Products

5.2. Reciprocity

5.3. Evaluated Products

5.4. Contingencies

5.5. Software Products Excluded from AF SACA

Chapter 6—APPROVAL TO CONNECT (ATC) PROCESS 28

6.1. Overview

6.2. Duration and Expiration

6.3. Note:

4 AFI17-101 6 FEBRUARY 2020

6.4. Connection to the DoD Information Network

6.5. Connection to the Air Force Information Networks (AFIN)

6.6. Guest System Registration

6.7. ATC Process for Air Force Functional/Mission Systems

6.8. Continuous Monitoring

6.9. Denial of Approval to Connect

Chapter 7—SECURITY CONTROL OVERLAYS 31

7.1. Overview

7.2. Policy

7.3. Development and Approval Process

7.4. Review and Coordinate Finalized Overlay

7.5. Coordinate with Defense Information Systems Agency to Implement Overlay in eMASS

Chapter 8—TRANSFER OF IT BETWEEN AUTHORIZING OFFICIALS 33

8.1. Overview

8.2. Transition Process

8.3. IT With No AO Assigned

Chapter 9—FINANCIAL IMPROVEMENT AND AUDIT READINESS (FIAR)

INFORMATION TECHNOLOGY (IT) 35

9.1. Overview

9.2. Definition

9.3. Responsibilities

9.4. FM Security control Implementation Guidance

Attachment 1—GLOSSARY OF REFERENCES AND SUPPORTING INFORMATION 37

AFI17-101 6 FEBRUARY 2020 5

Chapter 1

PROGRAM OVERVIEW

1.1. Purpose. This AFI provides implementation instructions for the implementation of the Risk

Management Framework (RMF) methodology for Air Force (AF) Information Technology (IT) in accordance with AFPD 17-1, and AFI 17-130, Air Force Cybersecurity Program Management.

1.1.1. The RMF incorporates strategy, policy, awareness/training, assessment, continuous monitoring, authorization, implementation, and remediation.

1.1.2. The RMF aligns with Secretary of the Air Force/ Deputy Chief Information Officer

(SAF/CN) strategic goals and objectives key concept of cybersecurity that works which requires robust risk assessment and management.

1.1.3. The RMF process encompasses life cycle risk management to determine and manage the residual cybersecurity risk to the AF created by the vulnerabilities and threats associated with objectives in military, intelligence, and business operations.

1.1.4. Privacy and security controls are implemented based on the assessed and mitigated residual risk. The controls align with Department of Defense Instruction (DoDI) 8510.01, Risk

Management Framework (RMF) for DoD Information Technology (IT) and are documented in the RMF security authorization package for AF IT.

Figure 1.1. Air Force IT Categories.

6 AFI17-101 6 FEBRUARY 2020

1.2. Applicability.

1.2.1. This includes IT supporting research, development, test and evaluation (T&E), and

DoD-controlled IT operated by a contractor or other entity on behalf of the DoD. AF IT (see

Figure 1.1) includes but is not limited to: information systems (major applications and enclaves), platform information technology (PIT) (PIT systems, PIT subsystems, and PIT products), IT services (internal & external), IT products (software, hardware, and applications) and boundary requirements for assess and authorize and assess only (see Chapter 5).

1.2.2. Risk management authorities for special access programs rest with SAF/CN and are executed via this instruction unless higher level guidance exists, in which case compliance will default to the more restrictive policies and directives. The responsible office in support of special access programs IT risk management is the Administrative Assistant to the Secretary of the Air Force and Air Force Senior Security Official (SAF/AA).

1.2.3. This AFI does not apply to the protection of sensitive compartmented information systems (IS) or intelligence, surveillance, reconnaissance mission and mission support systems.

1.2.4. Authority for AF space systems rests with AF Space Command as delegated by United

States Strategic Command. AF space systems follow AF cybersecurity policy and processes;

where exceptions exist, this Instruction is annotated accordingly. NOTE: Space systems supporting more than one DoD Component will follow cybersecurity policy and guidance in

DoDI 8581.01, Information Assurance (IA) Policy for Space Systems Used by the Department of Defense.

1.2.5. For IT not centrally managed or that has yet to be assigned an authorizing official (AO), the unit responsible for ownership or operation of the IT shall assign duties for the minimum

RMF relevant roles (see Table 3.1) required to comply with RMF. The duties shall include the roles and responsibilities for reporting, oversight, and risk management to the AF.

1.3. Objectives.

1.3.1. The RMF provides a disciplined and structured process to perform AF IT security and risk management activities and to integrate those activities into the system development life cycle. The RMF is a dynamic approach to risk management that effectively manages mission and cybersecurity risks in a diverse environment of complex, evolving, and sophisticated cyber threats and vulnerabilities.

1.3.2. The RMF ensures AF IT assets are assessed for cybersecurity risk. Discovered weaknesses are documented in a plan of action and milestones (POA&M) to mitigate residual risk. An AO, identified at Table 3.1, who is supported by an RMF team, accepts the risk for his/her area of responsibility, in accordance with DoDI 8510.01, and the Air Force RMF

Knowledge Service (See Resources and Tools).

AFI17-101 6 FEBRUARY 2020 7

Chapter 2

COORDINATING ROLES AND RESPONSIBILITIES

2.1. Under Secretary of the Air Force (USecAF). The Under Secretary of the Air Force serves as the Department of the Air Force’s Chief Information Officer (CIO) and serves as SecAF’s agent in assigned policy and program domains.

2.2. Administrative Assistant to the Secretary of the Air Force (SAF/AA).

2.2.1. Works with the Air Force Chief Information Security Officer (CISO/ SAF CNZ) to oversee the establishment of risk tolerance and security controls for IT owned by Air Force organizations.

2.2.2. Provides cybersecurity implementation guidance to the CISO in support of Air Force operational requirements.

2.2.3. Supports identification and oversight of tools to maintain visibility of the security posture of IT throughout the Air Force.

2.3. Secretary of the Air Force for Acquisition (SAF/AQ).

2.3.1. Acquires AF electronic systems including: commercial-off-the-shelf systems, or non-developmental item programs.

2.3.2. Works with the CISO to oversee the establishment of risk tolerance and security controls for AF IT. Provides guidance to organizations on how to implement cybersecurity solutions for operational requirements.

2.3.3. Ensures all security controls are translated into security requirements via systems security engineering and are written into the system requirement document (SRD) on all new and upgrade capability developments.

2.4. Deputy Chief of Staff, Intelligence, Surveillance, and Reconnaissance (AF/A2/6).

2.4.1. Maintains visibility of the cybersecurity posture of AF sensitive compartmented information and the DoD portion of the intelligence mission area IT through automated assessment and authorization tools.

2.4.2. Oversees the establishment of risk tolerance and baseline security controls for AF sensitive compartmented information and DoD portion of the Intelligence Mission Area IT.

2.4.3. Consults with SAF/CNZ as appropriate.

2.4.4. Provides RMF implementation guidance to AF intelligence surveillance and reconnaissance systems and network organizations.

8 AFI17-101 6 FEBRUARY 2020

Chapter 3

RMF ROLES AND RESPONSIBILITIES

3.1. Secretary of the Air Force (SAF), Office of the Deputy Chief Information Officer

(SAF/CN). SAF/CN:

3.1.1. Reports directly to USecAF for accomplishment of SAF/CN responsibilities.

3.1.2. Provides direction, policy, guidance and oversight for all matters pertaining to the formulation, review, and execution of plans, policies, programs, and budgets in support Air

Force Cybersecurity program and Risk Management Framework (RMF) implementation.

3.1.3. Appoints the Chief Information Security Officer (CISO) who develops, implements, maintains, and enforces the AF Cybersecurity Program.

3.1.4. Appoints AOs in coordination with the appropriate mission area owner.

3.1.5. Provides guidance to organizations on how to implement cybersecurity solutions for operational requirements in support of established national, DoD, Joint Chiefs of Staff, or AF security controls for IT and remain within established risk tolerance levels.

3.1.6. Serves as the final approval authority for National Security System designations.

3.1.7. Maintains visibility of the cybersecurity posture for AF IT through automated tools or designated repositories in support of Air Force CIO and appointed AOs.

3.1.8. Ensures an IS owner (ISO) is appointed for all AF IT.

3.1.9. Appoints the AF Chief Architect with responsibility for the AF Cybersecurity

Architecture IAW AFI 17-140, Architecting.

3.1.10. Is responsible for common control identification and implementation across the Air

Force Information Networks.

3.2. Chief Information Security Officer (CISO), SAF/CNZ. Will develop, implement, maintain, and enforce the AF Cybersecurity Program and the RMF process, roles, and responsibilities. The CISO will advocate for any budgets associated with duties below and advocate for AF-wide cybersecurity solutions through the planning, programming, budget and execution process on behalf of the SAF/CN. The CISO is required to be a DoD official (O-7 or

SES at a minimum) and a United States citizen. (T-1) The CISO:

3.2.1. Completes training and maintains cybersecurity certifications IAW AFMAN 17-1303, Cybersecurity Workforce Improvement Program.

3.2.2. Monitors, evaluates, and provides advice to the SAF/CN regarding AF cybersecurity posture.

3.2.3. Coordinates with the SAF/CN and AOs, ensure the cybersecurity risk posture, risk tolerance levels, and risk acceptance decisions for AF IT meet mission and business needs.

3.2.4. Serves as the security control assessor (SCA) or appoints SCAs.

3.2.5. Provides guidance and direction for the agent of the security control assessor (ASCA) establishment and licensing in support of RMF requirements.

AFI17-101 6 FEBRUARY 2020 9

3.2.6. Oversees the establishment and enforcement of the AF RMF, roles, and responsibilities;

review approval thresholds and milestones within the RMF.

3.2.7. Serves as the chair of the Air Force Risk Management Council.

3.2.8. Participates in Federal, joint, DoD, and AF cybersecurity and RMF technical working groups and forums (e.g., Defense Information Assurance Security Accreditation Working

Group).

3.2.9. Adjudicates IT determinations, when a conflict in the IT determination process is identified, in coordination with the Air Force Risk Management Council.

3.2.10. Appoints AF members to the DoD RMF Technical Advisory Group.

3.2.11. Reviews and approves Privacy Impact Assessments (PIAs) submitted IAW AFI 33-

332, The Air Force Privacy and Civil Liberties Program. The approval of the privacy impact assessment cannot be delegated.

3.2.12. Ensures AF RMF guidance is posted to the AF Component Workspace portion of the

DoD Knowledge Service and is consistent with DoD policy and guidance.

3.3. Authorizing Official (AO). The AO is the official with the authority and responsibility for accepting risk for an IT system. With the exception of unmitigated “Very High” and “High” risk, (see Terms) the AO balances the level of risk for a system with mission requirements. The AO is the only person with authority to grant authorization decisions within their area of responsibility.

All AOs have the flexibility in augmenting, executing, and implementing RMF for systems in their

AOR. For example, an AO can create a community-specific guidebook to better clarify guidance.

AOs:

3.3.1. Must be a DoD official (O-7 or SES at a minimum) and a U.S. citizen. (T-1).

3.3.2. Will complete training and certification requirements IAW AFMAN 17-1303. (T-1).

3.3.3. Are appointed by SAF/CN, in coordination with the appropriate Mission Area Owner.

The appointment grants authority to authorize IT as defined in the AO appointment memo.

3.3.4. Advocate for cybersecurity-related positions in accordance with DoDI 8500.01, (T-0)

AFI 17-130, and AFMAN 17-1303. (T-2)

3.3.5. Must ensure an IS owner is appointed prior to issuing an authorization decision. (T-1)

3.3.6. Ensure ISOs participate throughout the RMF process and understand the risk imposed on the mission due to operating the IT.

3.3.7. Must ensure verification through the AF Ports, Protocols, and Services Office

(af.pps@us.af.mil) that internet protocols, data services, and associated ports (internal and external) of the system/enclave comply with the requirements outlined in DoDI 8551.01 Ports, Protocols, and Services Management (PPSM). (T-0)

3.3.8. Assist the SAF/CN in providing guidance to organizations on how to implement solutions for operational requirements exceeding the established National, DoD, Joint Chiefs of Staff, or AF baseline controls for IT.

mailto:af.pps@us.af.mil

10 AFI17-101 6 FEBRUARY 2020

3.3.9. Will approve initial National Security System designations via the Information

Technology Categorization & Selection Checklist for AF IT. (T-1) NOTE: The IT

Categorization and Selection Checklist (ITCSC) is available on the Air Force RMF Knowledge

Service (See Resources and Tools).

3.3.10. Must render authorization decisions that balance mission needs with security concerns for IT within the AO’s area of responsibility. The authorization decision documentation will be digitally signed and generated via Enterprise Mission Assurance Support Service (eMASS).

Any exceptions to, or conditions of, the authorization decision must be articulated within the authorization decision document. (T-1)

3.3.11. Will ensure a Privacy Impact Assessment (DD Form 2930) is completed for all IS. (T-

3)

3.3.12. Will review the security assessment report, risk assessment report, and plan of actions and milestones to ensure there is a clearly defined course of action (see also National Institute of Standards (NIST) Special Publication (SP) 800-30, Guide for Conducting Risk

Assessments). An AO may downgrade or revoke an authorization decision at any time. (T-3)

3.3.13. Will review and approve the security assessment plan, the security plan, and system-level Information Security Continuous Monitoring (ISCM) strategy. (T-3)

3.3.14. Must ensure all AF IT comply with DoD and AF connection approval processes. See

Chapter 5, Approval to Connect (ATC) Process. (T-1)

3.3.15. Will not delegate authorization decision authority (i.e., to formally accept risk for a system) in accordance with DoDI 8510.01. (T-0)

3.3.16. Note: Appointment letters and AO boundaries are located on the AF RMF Knowledge

Service.

3.4. Air Force Enterprise Authorizing Official (AF Enterprise AO). The AF Enterprise AO is the only authority permitted to grant an approval to connect (ATC) to Air Force Information

Networks. ATC authorities for other AF appointed AO’s may be approved by SAF/CN in coordination with the Enterprise AO. In addition to the AO responsibilities in paragraph 3.3 above, the Enterprise AO:

3.4.1. Will establish acceptable security controls and risk tolerance for connecting to the Air

Force Information Network and provide guidance to implementing organizations to mitigate risk commensurate with established risk tolerance. (T-1)

3.4.2. Must, at a minimum, review the security authorization package for all requests to connect to the Air Force Information Network and assess the impact to enterprise community risk. (T-2)

3.4.3. Will render Air Force Information Network connection decisions in the form of an approval to connect (see Chapter 6) for non-AF systems and for AF systems falling under another AO. (T-2)

3.4.4. Expediently respond to urgent/emergency requests to connect to the Air Force

Information Network. This may be delegated to an Enterprise AO designee.

AFI17-101 6 FEBRUARY 2020 11

3.5. AO Designated Representative (AODR). The AODR:

3.5.1. Will be appointed by the AO, and at a minimum, be an O-5 or GS-14. Appointments will be in writing (to include all duties and responsibilities) to support the RMF. Digital signatures are authorized for appointment letters. (T-1)

3.5.2. Note: This role can be supplemented with contractor support; however contractors are not permitted to make decisions on behalf of the government and may only provide advice and guidance.

3.5.3. Must complete AO training and any other training or certification requirements consistent with assigned duties and responsibilities. (T-1)

3.5.4. Will provide recommendations to the AO to render authorization decisions based on input from the SCA, ISO, Program Manager (PM), and other AOs and AO Designated

Representative (AODR). (T-3)

3.5.5. Will perform any and all duties of an AO except for accepting risk by issuing an authorization decision IAW DoDI 8510.01. (T-0)

3.6. Security Control Assessor (SCA). The SCA:

3.6.1. Will be appointed by the CISO and will be at least an O-4 or GS-13 with the authority and responsibility for the assessment determination within their assigned area of responsibility.

(T-1)

3.6.2. Must complete training and maintain appropriate cybersecurity certification IAW

AFMAN 17-1303. (T-1) Note: It is highly recommended SCAs complete both the AO training module and attain the Committee on National Security Systems Instruction (CNSSI) No. 4016, National Information Assurance Training Standard for Risk Analysts, certificate for supplemental training (See Resources and Tools).

3.6.3. Will ensure the development of the security assessment plan and ensure its integration into the program office’s Test and Evaluation Master Plan IAW DoDI 5000.02, Operation of the Defense Acquisition System. (T-0)

3.6.4. Must prepare the security assessment report documenting the issues, findings, and recommendations from the security control assessment, and reassess remediated controls, as required. (T-3)

3.6.5. Will periodically assess security controls employed within, and inherited by the IT IAW the Information Security Continuous Monitoring strategy. (T-3)

3.7. Security Controls Assessor Representative (SCAR). This position may be an organic or contracted resource. Should the security controls assessor representative be a contractor, they are not permitted to make decisions on behalf of the government but can only provide advice and guidance. The security controls assessor representative works with the Program Manager (PM), IS security manager (ISSM), IS security officer (ISSO), and RMF team to assess security controls for the security controls assessor. The security controls assessor representative:

3.7.1. Will complete training and maintain appropriate cybersecurity certification IAW

AFMAN 17-1303. (T-2) Note: It is recommended that Security Controls Assessor

Representatives (SCAR) also complete the AO training module and attain the CNSSI No. 4016 certificate for supplemental training.

12 AFI17-101 6 FEBRUARY 2020

3.7.2. Ensures security controls are implemented IAW the security plan and are assessed IAW the Security Authorization Package in accordance with DoDI 8510.01. (T-0)

3.7.3. Validates assessment results from others' (e.g., Agent of the Security Controls Assessor or ISSM) hands-on, comprehensive evaluations of the technical and non-technical security controls for the IT to determine the degree to which the IT satisfies the applicable security controls.

3.8. Agent of the Security Controls Assessor (ASCA). The Agent of the Security Controls

Assessor (ASCA) is a licensed 3rd-party agent that assists in assessment activities and provides an independent report for the SCA. This position cannot make decisions on behalf of the government;

the ASCA can only provide advice and guidance. The ASCA:

3.8.1. Must achieve and maintain an ASCA license per the AF and Space ASCA Licensing

Guide. (T-1)

3.8.2. Responds to PM, ISO, SCA SCAR, and AO requests for information regarding their respective systems.

3.8.3. Performs comprehensive evaluation of the technical and non-technical security controls for the IT to determine the degree to which the IT satisfies the applicable security controls, and provide mitigation recommendations.

3.8.4. Will perform assessment procedures for each applicable security control as outlined in the DoDI 8510.01. (T-0)

3.8.5. Will meet the intent of RMF independence between the PM or ISO and the individuals performing security control assessments; the ASCA reports only to the SCA. (T-2)

3.8.6. Will not be part of the development team or program office. The PM or ISO provides funding for organizations or contractors to perform ASCA responsibilities. The PM or ISO may not provide direction or oversight to organizations or contractors in support of ASCA responsibilities. (T-1)

3.8.7. Will document agreements that include safeguards to prevent a conflict of interests with the development team. (T-2)

3.9. Information System Owners (ISO). Official responsible for the overall procurement, development, integration, modification, and operation and maintenance of AF IT. (T-2) An ISO is appointed and performs all PM roles and responsibilities when a PM is not assigned. For AF-wide systems (e.g., Air Force Networks (AFNET) Headquarters Air Force (HAF) and Logistics Model), the ISO will be appointed by the HAF/SAF 3-letter responsible for the capability. For Major

Command (MAJCOM)-level or base-level IT, to include base enclaves, and PIT, the appropriate

MAJCOM 2-letter appoints the ISO. (T-3) No further appointment is required The ISO:

3.9.1. Will identify the requirement for the IT and request funds to operate and maintain the

IT in order to assure mission effectiveness. (T-2)

3.9.2. Will ensure, with coordination of the PM staff, the development, maintenance, and tracking of the system security plan for the assigned IT. (T-2)

3.9.3. Must ensure, with coordination of the PM staff, the development of an ISCM strategy consistent with DoDI 8510.01. (T-0)

AFI17-101 6 FEBRUARY 2020 13

3.9.4. Reports the security status of the IT including the effectiveness of all implemented security controls in accordance with the ISCM strategy.

3.9.5. Will manage access control requirements, including privileged users, and ensure all personnel receive the requisite security training. (T-3)

3.9.6. Conducts the initial remediation actions on security controls based on the findings and recommendations of the security assessment report and work with the SCA to reassess remediated controls.

3.9.7. Ensures the plan of action and milestones is developed for all identified weaknesses and the appropriate steps to mitigate those weaknesses are identified.

3.9.8. Ensures appropriate steps are taken to reduce or eliminate identified weaknesses, then generates the security authorization package and submits the package to the SCA for assessment.

3.9.9. Must Ensure open plan of action and milestones items are updated and closed in a timely manner. (T-2)

3.9.10. Ensures consolidated RMF documentation is maintained for systems with instances at multiple locations.

3.9.11. Thoroughly reviews security controls assessment and risk assessment results before submitting the security authorization package to the AO, ensuring the system’s cybersecurity posture satisfactorily supports mission, business, and budgetary needs (i.e., indicates the mission risk is acceptable).

3.9.12. Will ensure, with the assistance of the ISSM, and coordination with the PM staff, the system is deployed and operated according to the approved security plan and the authorization package (i.e., the AO’s authorization decision). (T-3)

3.10. Program Manager (PM). The ISO is assigned the PM duties when no PM is assigned. The

PM:

3.10.1. Must identify, implement, and ensure full integration of cybersecurity into all phases of the acquisition, upgrade, or modification programs, including: initial design, development, testing, fielding, operation, and sustainment IAW DoDI 8510.01, AFI 63-101_20-101, Integrated Life Cycle Management, and the DoD Program Manager’s Guidebook for

Integrating the Cybersecurity Risk Management Framework (RMF) into the System

Acquisition Lifecycle. (T-0) NOTE: The DoD Program Manager’s Guidebook is available on the Air Force RMF Knowledge Service Administrative Assistant to the Secretary of the Air

Force and Air Force Senior Security Official.

3.10.2. Will ensure the program management office is resourced to support IS security engineering requirements and security technical assessments of the IT for the SCA’s recommendation, the AOs authorization decision, and other security-related assessments (e.g., Financial Improvement and Audit Readiness IT testing, Inspector General audits). (T-2)

3.10.3. Must ensure cybersecurity-related positions are assigned in accordance with Table 3.1 and AFMAN 17-1303. (T-1)

3.10.4. Will appoint an ISSM, IAW DoDI 8510.01 (T-0), for the program office and ensure the ISSM is certified IAW AFMAN 17-1303. (T-1)

14 AFI17-101 6 FEBRUARY 2020

3.10.5. Will ensure the IT is registered IAW AFI 17-110, Information Technology Portfolio

Management and Capital Planning and Investment Control. (T-3)

3.10.6. Will approve initial National Security System designations via the Information

Technology Categorization & Selection Checklist for AF IT. (T-1)

3.10.7. Will ensure the development and implementation of a cybersecurity strategy for IT

IAW AFMAN 17-1402, Air Force Clinger-Cohen Act (CCA) Compliance Guide, and AFI 63-

101_20-101. (T-3)

3.10.8. Will ensure applicable cyber tasking orders are received and acted upon per cyber tasking order directions. (T-3)

3.10.9. Ensures periodic reviews, testing, or assessment of assigned IT are conducted at least annually, and IAW the ISCM strategy.

3.10.10. Will ensure operational systems maintain a current authorization to operate and recommend to the AO that systems without a current authorization are identified for removal from operation. (T-1)

3.10.11. Ensures all system changes are approved through a configuration management process, are assessed for cybersecurity impacts, and coordinated with the SCA, AO, and other affected parties, such as IOs/Stewards and AOs of interconnected boundaries.

3.10.12. Will manage the corrective actions identified in the plan of action and milestones, in order to provide visibility and status to the ISO, information owner, AO, and CISO in accordance with DoDI 8510.01. (T-0)

3.10.13. Reports security incidents to stakeholder organizations and the SCA. Conduct root cause analysis for incidents and develop corrective action plans as input to the plan of action and milestones.

3.10.14. Will ensure a privacy impact assessment is completed (DD Form 2930) for all IS

IAW AFI 33-332, Air Force Privacy and Civil Liberties Program. (T-3)

3.11. Unit Communications Squadron Commander (CS/CC). Serves as the PM or ISO for the base enclave and performs duties IAW DoDI 5000.02 and AFI 17-130.

3.12. Information System Security Manager (ISSM). The ISSM is the primary cybersecurity technical advisor to the AO, PM, and ISO. For base enclaves, the ISSM manages the installation cybersecurity program, typically as a function of the Wing Cybersecurity Office. That program

ISSM may also serve as the system ISSM for the enclave and reports to the CS/CC as the PM for the base enclave. The ISSM:

3.12.1. Ensures the integration of cybersecurity into, and throughout the lifecycle of the IT, on behalf of the AO and in accordance with DoDI 8510.01. (T-0)

3.12.2. Completes and maintains required cybersecurity certification IAW AFMAN 17-1303.

Individuals in this position must be U.S. citizens. (T-1)

3.12.3. Ensures all AF IT cybersecurity-related documentation is current and accessible to properly authorized individuals. (T-3)

AFI17-101 6 FEBRUARY 2020 15

3.12.4. Supports the PM or ISO in maintaining current authorization to operate, and approval to connect (if required), and in implementing corrective actions identified in the plan of action and milestones.

3.12.5. Coordinates, with the PM and AO staffs, development of an ISCM strategy and monitor any proposed or actual changes to the system and its environment.

3.12.6. Continuously monitors the IT and environment for security-relevant events, assess proposed configuration changes for potential impact to the cybersecurity posture, and assess the quality of security controls implementation against performance indicators. (T-3)

3.12.7. Ensures cybersecurity-related events or configuration changes that impact AF IT authorization or adversely impact the security posture are formally reported to the AO and other affected parties, such as IOs and stewards and AOs of interconnected IT.

3.12.8. Appoints IS Security Officers (ISSOs) and provides oversight to ensure ISSOs follow established cybersecurity policies and procedures IAW DoDI 8500.01. (NOTE: ISSO appointments are not required if the ISSM has purview over a small amount of IT, but ISSO appointments are advisable when the ISSM has purview over multiple IT). (T-3)

3.12.9. Ensures all ISSOs and privileged users receive necessary technical training and obtain cybersecurity certification IAW AFMAN 17-1301, Computer Security (COMPUSEC), AFMAN 17-1303 and maintain proper clearances IAW DoDI 8500.01. (T-0)

3.12.10. Ensures the AF IT is acquired, documented, operated, used, maintained, and disposed of properly and IAW DoDI 5000.02 and DoDI 8510.01. (T-0)

3.13. Information System Security Officer (ISSO). The ISSO is responsible for ensuring the appropriate operational security posture is maintained for the assigned IT. The ISSM will take on these responsibilities should no ISSO be assigned. This includes the following activities related to maintaining situational awareness and initiating actions to improve or restore cybersecurity posture. The ISSO:

3.13.1. Implements and enforce all AF cybersecurity policies, procedures, and countermeasures. (T-3)

3.13.2. Completes and maintains required cybersecurity certification IAW AFMAN 17-1303.

Individuals in this position must be U.S. citizens. (T-3)

3.13.3. Ensures all users have the requisite security clearances and need-to-know, complete annual cybersecurity training, and are aware of their responsibilities before being granted access to the IT according to AFMAN 17-1301. (T-3)

3.13.4. Maintains all authorized user access control documentation IAW the applicable AF

Records Information Management System. (T-3)

3.13.5. Ensures software, hardware, and firmware complies with appropriate security configuration guidelines (e.g., security technical implementation guides /security requirement guides). (T-3)

3.13.6. Ensures proper configuration management procedures are followed prior to implementation and contingent upon necessary approval. Coordinate changes or modifications with the system-level ISSM, SCA, and/or the Wing Cybersecurity office. (T-2)

16 AFI17-101 6 FEBRUARY 2020

3.13.7. Initiates protective or corrective measures, in coordination with the ISSM, when a security incident or vulnerability is discovered.

3.13.8. Reports security incidents or vulnerabilities to the system-level ISSM and wing cybersecurity office according to AFI 17-203, Cyber Incident Handling. (T-2)

3.13.9. Initiates exceptions, deviations, or waivers to cybersecurity requirements. (T-3)

3.14. Information Systems Security Engineer (ISSE). IAW DoDI 5000.02, and NIST SP 800-

160v1, Systems Security Engineering: Considerations for a Multidisciplinary Approach in the

Engineering of Trustworthy Secure Systems, information system security engineering is an individual, group, or organization responsible for conducting information system security engineering activities. The information system security engineering entity or function:

3.14.1. Employs best practices when implementing security controls, including software engineering methodologies, system/security engineering principles, secure design, secure architecture, and secure coding techniques. (T-3)

3.14.2. Coordinates their security-related activities with the information security architect, ISSO, ISO, and common control provider. (T-3)

3.14.3. Completes training and maintain certification IAW AFI 17-1303. Personnel performing any information assurance Workforce System Architecture and Engineering specialty function(s) (one or more functions) at any level must be certified to the highest level function(s) performed. (T-2)

3.15. Information Owner/Steward. An organizational official with statutory, management, or operational authority for specified information and the responsibility for establishing the policies and procedures governing its generation, classification, collection, processing, dissemination, and disposal as defined in CNSSI No. 4009, Glossary. The Information Owner/Steward:

3.15.1. Provides input to the ISO regarding security requirements and security controls for the

IT where the information is processed, stored, or transmitted. (T-3)

3.15.2. Establishes the rules for appropriate use and protection of the information, during processing, storage, transmission, and disposal.

3.15.3. Retains responsibility for the protection of the information even when the information is shared with or provided to other organizations. (T-3)

3.16. User Representative. The User Representative is the individual or organization that represents operational and functional requirements of the user community for a particular system during the RMF process. The User Representative supports the security controls selection, implementation, and assessment to ensure user community needs are met. While this role is not mandatory, it is highly recommended this role be used. The individuals in this role understand the operating environment, mission criticality, reliability and survivability requirements, etc., of the system.

3.17. Additional Responsibilities. Additional responsibilities and authorities relevant to the roles listed above can be found on the AF RMF KS.

AFI17-101 6 FEBRUARY 2020 17

Table 3.1. AF RMF Appointment Matrix.

Role Appointed/ Identified By Rank

Minimum Reference(s)

SAF/CN+ USecAF (established) O-9 HAF MD1-26, Deputy Chief

Information

Officer

CISO SAF/CN O-7 / SES Title 40 United

States Code

Section 3554;

DoDI 8510.01

Mission Area

Owner

Identified O-7 / SES AFPD 16-14, Security

Enterprise

Governance;

DoDI 8510.01

AO*+ SAF/CN O-7 / SES 40 USC §3506;

DoDI 8510.01

AODR AO O-5 / GS-14 DoDI 8510.01

SCA*+ CISO O-4 / GS-13 40 USC §3554;

DoDI 8510.01

SCAR SCA Any AFI 17-101

PM+ For programs of record, Service

Acquisition Executive (SAE) (as applicable); otherwise, ISO performs duties.

Any government official

DoDI 5000.02

ISO*+ For programs of record, Service

Acquisition Executive (SAE) (as applicable); otherwise, HAF/SAF 3-letter or MAJCOM 2-letter (as applicable)

Any CNSSI No. 4009

IO/Steward Identified by the ISSM Any DoDI 8500.01, NIST SP 800-

37r2, Risk

Management

Framework for

Information

Systems and

Organizations: A

System Life Cycle

Approach for

Security and

Privacy

18 AFI17-101 6 FEBRUARY 2020

ISSE+ PM Any DoDI 8510.01

ISSM*+ PM or ISO Any DoDI 8510.01

ISSO+ ISSM Any DoDI 8510.01

UR ISO Any DoDI 8510.01

1. * Denotes minimum system-level RMF positions

2. + Denotes additional responsibilities and authorities assigned in Attachments

3.18. Cybersecurity Forums. The AF leverages existing DoD and AF governance bodies (e.g., Air Force Security Enterprise Executive Board, Information Technology Governance Executive

Board) to discuss cybersecurity risk topics and make organizational and mission area risk decisions. The following forums and online resources provide focused management and oversight of the AF Cybersecurity Program.

3.18.1. Air Force Cybersecurity Technical Advisory Group. The AF Cybersecurity Technical

Advisory Group provides technical cybersecurity subject matter experts from across the

MAJCOMs and functional communities to facilitate the management, oversight, and execution of the AF Cybersecurity Program. The AF Cybersecurity Technical Advisory Group examines cybersecurity-related issues common across AF entities and provides recommendations to the

CISO and Defense Information Assurance Security Accreditation Working Group on changes to the minimally required security and privacy controls (for Air Force Information Network connection) or configurations.

3.18.2. Air Force Risk Management Council (AFRMC). The Air Force Risk Management

Council (AFRMC) provides a forum for the senior cybersecurity professionals to discuss issues concerning cybersecurity risk from a mission and business perspective. The council reviews proposed Mission Area or AF RMF control overlays, and RMF guidance. The council standardizes the cybersecurity implementation processes for both the acquisition and lifecycle operations for IT. The Air Force Risk Management Council advises and makes recommendations to existing governance bodies. Finally, the Air Force Risk Management

Council recommends assignment of IT to the appropriate AO for systems that fall outside of all defined authorization boundaries.

3.18.3. AF AO Summit. The AO Summit is not a governance body but rather an enabler for both an enterprise-wide and converged organizational perspective to cybersecurity policy development, oversight, implementation, and training. This venue provides the SAF/CN and

AOs an opportunity to discuss issues relevant to the RMF, AO Boundaries, IT, AOs, and SCAs.

AFI17-101 6 FEBRUARY 2020 19

Chapter 4

RMF METHODOLOGY

4.1. Overview. The 7-Step RMF process at is based on the process outlined in NIST SP 800-

37r2 and DoDI 8510.01 and is illustrated in Figure 4.1. Where possible, this Instruction also identifies steps required for the “Assess Only” (see Chapter 5) process. This process is iterative throughout the entire lifecycle for IT IAW DoDI 5000.02 and the DoD Program Manager’s

Guidebook for Integrating the Cybersecurity Risk Management Framework (RMF) into the System

Acquisition Lifecycle (DoD PM Guidebook).

4.1.1. The DoD RMF KS (https://rmfks.osd.mil/rmf/Pages/default.aspx) is the authoritative source for RMF implementation, planning, and execution.

4.1.2. This chapter highlights the AF-specific implementation, key AF roles in each step, and additional resources required to complete the process. This instruction is intended to be a companion to the DoD implementation instructions.

Figure 4.1. RMF for AF IT.

4.2. PREPARE. References CNSSI No.4009, NIST SP 800-37r2, and the DoD and AF RMF KS

(OPR: PM/ISO). The purpose of Prepare step of the RMF is to identify essential activities of organization, mission and business processes. The program manager/ RMF team is required to fill out the ITCSC during this step to identify and prepare for the management of cybersecurity and privacy risks.

https://rmfks.osd.mil/rmf/Pages/default.aspx

20 AFI17-101 6 FEBRUARY 2020

4.3. CATEGORIZE System. References DoDI 8510.01, CNSSI No.1253, Security

Categorization and Control Selection for National Security Systems, NIST SP 800-53r4, Security and Privacy Controls for Federal Information Systems and Organizations, NIST SP 800-60, Volume 1 and 2, Guide for Mapping Types of Information and Information Systems to Security

Categories, and the DoD and AF RMF KS (OPR: PM/ISO).

4.3.1. Begin this step by completing the RMF ITCSC and DD Form 2930. During this process, the impact of confidentiality, integrity, and availability is categorized into one of three designations (low, moderate, or high) to address the impact of a potential loss of data.

4.3.2. If the program’s primary mission is not represented on the form’s authorization boundary list, the PM or ISO will check “other” on the ITCSC and submit the completed document to the AF risk Management Council for disposition; send to SAF/CNZR

Cybersecurity Division, usaf.pentagon.saf-cio-a6.mbx.a6zr-workflow@mail.mil.

4.3.3. All AF IT, IAW AFI 17-110, the Program Manager/ Project Manager must register the

IT in AF IT Investment Portfolio Suite (ITIPS), as the governance tool for the AF CIO, with the exception of those identified by other policy (i.e., space, nuclear command, control, and communication, Joint) to be registered in another repository. (T-3)

4.3.4. ITIPS will systematically assign a temporary registration number for each registered IT until the next scheduled replication with DoD Information Technology Portfolio Repository.

A DoD Information Technology Portfolio Repository number will then be systematically assigned, and included in ITIPS as the permanent official IT registration number for all registered AF IT.

4.3.5. The dual signed ITCSC will be posted to ITIPS an artifact upon initial registration or when a substantial modification or update is planned or completed. The dual signed ITCSC documents PM and AO concurrence on RMF CATEGORIZE and SELECT elements. (T-3)

NOTE: Posting of the ITCSC in eMASS is encouraged, but not required.

4.3.6. All AF IT will be registered in the appropriate eMASS instance: NIPRNet; SIPRNet;

DoD Special Access Programs; or Joint Worldwide Intelligence Communications System. (T-

1)

4.3.7. The organization’s eMASS Account Manager/ Organizational System Administrator

(See Resources and Tools) grants access to eMASS and grants required permissions based on duties and responsibilities. A listing of Account Managers for the AF organizations can be found on the AF RMF KS.

4.3.8. The minimum set of documentation required in support of an RMF authorization decision is the security authorization package and consists of:

4.3.8.1. The security plan

4.3.8.2. The security assessment report

4.3.8.3. The plan of action and milestones

4.3.8.4. The authorization decision document

mailto:usaf.pentagon.saf-cio-a6.mbx.a6zr-workflow@mail.mil

AFI17-101 6 FEBRUARY 2020 21

4.3.9. Note: If the aggregation of information in any single document raises the classification beyond the limits of the registered eMASS instance, host that document in the appropriate eMASS instance consistent with the classification of the information therein. Protect all information commensurate with its classification and or applicable security classification guide.

4.3.10. All RMF documentation must be available upon request and will be regularly reviewed to ensure accuracy and completeness, and may be audited by SAF/CNZR, the AO, or SCA at any time.

4.4. SELECT Security Controls. References DoDI 8510.01, CNSSI No.1253, NIST SP 800-30, NIST SP 800-53r4, and the DoD and AF RMF KS (OPR: PM/ISO).

4.4.1. The process for selection of security controls is documented at DoDI 8510.01, Figure

3, RMF for IS and PIT Systems. (Users are advised to consult the DoD and AF RMF KS until static references are updated)

4.4.2. Common Control Identification (available via eMASS).

4.4.2.1. DoD/AF Tier 1and 2 (Inheritance model: Common Controls (Policy) NOTE: For information on the three-tiered approach to cybersecurity risk management see DoDI

8510.01, Enclosure 4, Figure 2 (See Resources and Tools).

4.4.2.2. Air Combat Command, the enterprise AO and common control provider, provides the Tier 2 Common Controls (Inheritance) available in eMASS for AF IT use.

4.4.2.3. Air Force Network Non-Secure Internet Protocol Router Network (NIPRNet)

RMF Inheritance – Core Services; this AFNET RMF package provides inheritance for

AFNET Core Services for NIPRNet systems.

4.4.2.4. Air Force Network NIPRNet RMF Inheritance – Security; this AFNET RMF package provides inheritance for AFNET Security for NIPRNet systems.

4.4.2.5. Air Force Network NIPRNet RMF Inheritance – Transport; this AFNET RMF package provides inheritance for AFNET Transport Services for NIPRNet systems.

4.4.2.6. Air Force Network NIPRNet RMF Inheritance – Circuit Enclave (combined); this

AFNET RMF package provides security, transport, and core inheritance for AFNET systems.

4.4.2.7. Air Force Network Secure Internet Protocol Router Network (SIPRNet) RMF

Inheritance – Circuit Enclave (combined); this Air Force Network – SECRET (AFNET-S)

RMF package provides security, transport, and core inheritance for AFNET-S systems.

4.4.3. The security control baseline is selected based on the IT categorization.

4.4.4. Identify and apply overlays that apply to the AF IT. See Chapter 7.

4.4.5. Tailor controls as required. Every selected control must be accounted for either by the organization or the ISO. If a control is added or de-selected from the baseline (i.e., tagged as not applicable), then a risk-based rationale must be documented in the security plan and

POA&M.

22 AFI17-101 6 FEBRUARY 2020

4.4.6. ISCM strategy. Develop and document a system-level ISCM strategy for the continuous monitoring of the effectiveness of security controls employed within or inherited by the system, and monitoring of any proposed or actual changes to the system and its environment of operation.

4.4.7. ISCM Capabilities. Ensure compliance with all applicable cyber tasking orders related to host based security system and assured compliance assessment solution tools in support of continuous monitoring.

4.4.8. ISCM strategy review and approval. The AO’s staff will develop and implement processes whereby the AO (or designee) reviews and approves the security plan and ISCM strategy submitted by the PM or ISO.

4.5. IMPLEMENT Security Controls. References DoDI 8510.01, NIST SP 800-53r4, applicable security technical implementation guides, security requirements guides, and the DoD and AF RMF KS. (OPR: PM/ISO).

4.6. ASSESS Security Controls. References DoDI 8510.01, NIST SP 800-30, NIST SP 800-

53Ar4, Assessing Security and Privacy Controls in Federal Information Systems and

Organizations: Building Effective Assessment Plans, applicable Security Technical

Implementation Guide, Security Requirements Guides, and the DoD and AF RMF KS. Use DoDI

8510.01, enclosure 6 instructions for details for assessing security controls (OPR: SCA).

4.7. AUTHORIZE System. After reviewing the security authorization documentation, the AO formally…