AFI33-115V1.pdf

BY ORDER OF THE

SECRETARY OF THE AIR FORCE

AIR FORCE INSTRUCTION 33-115, VOLUME 1

24 MAY 2006

Communications and Information

NETWORK OPERATIONS (NETOPS)

COMPLIANCE WITH THIS PUBLICATION IS MANDATORY

ACCESSIBILITY: Publications and forms are available on the e-Publishing website at www.e-publishing.af.mil for downloading or ordering.

RELEASABILITY: There are no releasability restrictions on this publication.

OPR: HQ AFCA/ECF Certified by: SAF/XCIF (Col Porter Clapp) Supersedes AFI 33-115, Volume 1, 3 May 2004 Pages: 84

This Air Force instruction (AFI) implements Air Force Policy Directive (AFPD) 33-1, Command, Con-trol, Communications, and Computer (C4) Systems (will become Information Resources Management).

This instruction provides the overarching policy, direction, and structure for the Air Force Global Infor-mation Grid (AF-GIG) and procedures necessary to manage the increasingly complex network environ-ment. This instruction applies to the Air National Guard (ANG) and the Air Force Reserve unless indicated otherwise. Send recommended changes or comments to Headquarters Air Force Communica-tions Agency (HQ AFCA/EASD), 203 West Losey Street, Room 1100, Scott AFB IL 62225-5222, through appropriate channels, using AF IMT 847, Recommendation for Change of Publication, with an information copy to HQ AFCA/ECFP, 203 West Losey Street, Room 2100, Scott AFB IL 62225-5222, and Secretary of the Air Force, Office of Warfighting Integration and Chief Information Officer (SAF/ XCIF), 1030 Air Force Pentagon, Washington DC 20330-1030. Major command (MAJCOM) supple-ments to this AFI will not reduce stated requirements. Ensure that all records created as a result of pro-cesses prescribed in this publication are maintained in accordance with Air Force Manual (AFMAN) 37-123, Management of Records (will become AFMAN 33-363) and disposed of in accordance with Air Force Records Information Management System (AFRIMS) Records Disposition Schedule (RDS) located at https://afrims.amc.af.mil/rds_series.cfm. See Attachment 1 for a glossary of references and supporting information. The use of the name or mark of any specific manufacturer, commercial product, commodity, or service in this publication does not imply endorsement by the Air Force.

SUMMARY OF CHANGES

This revision makes this instruction applicable to Air Force Reserve and Air National Guard units at all levels except where explicitly identified. This revision includes office symbol changes and consolidation of the duties and responsibilities of SAF/XCI functions in Chapter 3. Air Force Network Operations and Security Center (AFNOSC) roles and responsibilities have been updated in Chapter 4. Service Level Agreements have moved to Chapter 13 and Chapter 9 has been added which requires use of a mainte-nance contract and warranty plan; Chapter 10 addresses vulnerability assessment tools; Chapter 11 cov-ers Simple Network Management Protocols (SNMP); Chapter 12 has been added to cover Domain Name

2 AFI33-115V1 24 MAY 2006

Service Management; Chapter 13 provides guidance on Service Level Agreements (SLA), and Chapter 14 covers Records and Forms Management. Other key changes include removing any reference to NOSC-Ds, inserting E-mail updates required by HQ USAF/DP, updating references to field operating agencies (FOA) and direct reporting units (DRU), defining Program Management Office & System Pro-gram Office limitations, defining warfighting headquarters (WFHQ) roles and responsibilities, establish-ing the "edu.af" domain, clarifying the third tier naming structure and removes all references to the Air Force Enterprise Network (AFEN). Additional minor administrative corrections were made and refer-ences updated.

AFI33-115V1 24 MAY 2006 3

Chapter 1

GENERAL INFORMATION

1.1. Background.

1.1.1. This AFI provides the overarching policy, direction, and structure for the Air Force-Global Information Grid (AF-GIG). It is a key component in the efforts to Operationalize and Professionalize the Network (OPTN). The goal of Network Operations (NETOPS) is to provide effective, efficient, secure, and reliable information network services used in critical Department of Defense (DOD) and Air Force communications and information processes. This instruction provides the guidance neces-sary to manage the increasingly complex network environment and provide customers high quality services. Our networks have evolved into mission critical systems supporting Air Expeditionary Forces (AEF) and joint operations. Continued reliance on information-based weapons systems drives the need for a cohesive Air Force network.

1.1.2. Previously, management of the AF-GIG was centered around the base Network Control Cen-ters (NCC). Today, our goal for managing the AF-GIG is to migrate to a hierarchical environment whereby management of the AF-GIG is distributed across three management tiers (see Table 2.1.).

This operational concept has evolved over time with the explosive growth and increasing interconnec-tivity of the many networks and information services that make up the AF-GIG. What is needed is a new way to manage and control the AF-GIG so it can support the increasing demands placed on it by the warfighters, policy makers, and support personnel.

1.2. Air Force Network Operations (AFNETOPS) Scope.

1.2.1. General.

1.2.1.1. Global Information Grid (GIG). The GIG is the globally interconnected, end-to-end set of information capabilities, associated processes, and personnel for collecting, processing, storing, disseminating and managing information on demand to warfighters, policy makers, and support personnel. The GIG includes all owned and leased communications and computing systems and services, software (including applications), data, security services, and other associated services necessary to achieve Information Superiority. It also includes National Security Systems (NSS) as defined in section 5142 of the Clinger-Cohen Act of 1996. The GIG supports all DOD, national security, and related Intelligence Community missions and functions (strategic, operational, tacti-cal, and business), in war and in peace. The GIG provides capabilities from all operating locations (bases, posts, camps, stations, facilities, mobile platforms, and deployed sites). The GIG provides interfaces to coalition, allied, and non-DOD users and systems. It includes any system, equipment, software, or service that meets one or more of the following criteria: transmits information to, receives information from, routes information among, or interchanges information among other equipment, software, and services; provides retention, organization, visualization, information assurance, or disposition of data, information, and/or knowledge received from or transmitted to other equipment, software, and services; processes data or information for use by other equipment, software, or services. (DODD 8100.1, Global Information Grid (GIG) Overarching Policy).

1.2.2. Applicability.

4 AFI33-115V1 24 MAY 2006

1.2.2.1. This instruction applies to the Air Force Total Force which includes HQ USAF, functional communities, MAJCOMs, direct reporting units (DRU), field operating agencies (FOA), Air Force Reserve and ANG. ANG units at all levels except where explicitly identified in the appropri-ate paragraph will follow this instruction. In all cases ANG personnel who deploy in support of active duty missions will comply with this instruction. This instruction also applies to units and work centers which perform Functional System Administrator (FSA) duties on Air Force systems operated on Air Force networks.

1.2.2.2. The AF-GIG includes any Air Force-provisioned system, equipment, software, or service residing on the Nonsecure Internet Protocol Router Network (NIPRNET), Secret Internet Protocol Router Network (SIPRNET) or ConstellationNet.

1.2.2.2.1. Transmits information to, receives information from, routes information among, or interchanges information with other equipment, software, and/or services.

1.2.2.2.2. Processes data or information for use by other equipment, software, and/or services.

1.2.3. The dynamic and complex nature of the AF-GIG requires an organized management methodol-ogy. The Information Technology Infrastructure Library (ITIL) has become the de facto information technology (IT) management standard across both industry worldwide and DOD. This instruction implements guidance that fits into the ITIL. More information about the ITIL can be found at http:// www.ogc.gov.uk/index.asp.

AFI33-115V1 24 MAY 2006 5

Chapter 2

NETWORK OPERATIONS HIERARCHY

2.1. Overview.

2.1.1. The Defense Information Infrastructure Control Concept (DIICC) and AFNETOPS Relation-ship.

2.1.1.1. The AFNETOPS hierarchy adheres to the DIICC. The DIICC consists of three areas of distributed responsibility at global, regional, and local levels. The AFNETOPS relationships and responsibilities span all three levels. However, within the DOD hierarchy, the Air Force Network Operations and Security Centers (AFNOSC) and MAJCOM Network Operations and Security Centers (NOSC) are all considered regional organizations in recognition of Defense Information Systems Agency’s (DISA) overarching responsibility for other military services and other DOD agencies. The Air Force NETOPS organizations and their span of responsibilities within the Air Force are depicted in Table 2.1.

Table 2.1. Hierarchy of AFNETOPS.

2.1.1.2. Table 2.1. provides examples of major support activities aligned with each level of the AFNETOPS hierarchy. Figure 2.1. depicts the AFNETOPS command relationships between the global, regional, and local levels. The associated Joint, DISA, MAJCOM, and base-level elements are also shown. These relationships are the means for ensuring global systems interoperate with-out diminishing the authority of local commanders to direct and manage the IT and communica-tions assets under their control. Processes and procedures governing these relationships are meant to be complementary and minimize redundancy.

2.1.1.3. Vice Chief of Staff of the Air Force (VCSAF) message, Command and Control of Air Force Network Operations, dated 3 July 2003, directed the appointment of the Air Force NETOPS Commander as the single Air Force commander responsible for applying network control and defensive measures in a coherent, disciplined fashion to protect the AF-GIG and the advantages it affords to enable Air Force operations.

2.1.1.3.1. The AFNETOPS/CC has the authority to implement the Standardization and Evalu-ation (Stan/Eval) program over the entire AF-GIG, as depicted in Figure 2.2. The AFNE- TOPS/CC will also be authorized Direct Liaison Authority (DIRLAUTH) to MAJCOM SCs

AFNETOPS Level Responsible Air Force Organizations Global

(Tier 1)

AFNOSC, DISA’s Global NOSC (GNOSC)

Regional

(Tier 2)

NOSC, AFRC and ANG NOSC, Functional Awareness Cell (FAC)

ANG SIPRNET ROSC

Local

(Tier 3)

Active Duty, AFRC and ANG NCC, ANG ROSC, NCC-Deployed (NCC-D)

SIPRNET System Administrators

6 AFI33-115V1 24 MAY 2006

and NOSCs. The 8 AF/CC serves as both the AFNETOPS/CC and the Commander of Air Force Forces (COMAFFOR) to the Joint Task Force-Global Network Operations (JTF-GNO) and is responsible for ensuring Air Force forces perform the missions and tasks assigned by the JTF-GNO. The COMAFFOR to JTF-GNO exercises Operational Control (OPCON) over attached units and supported commander directive authority or Air Force tasking authority over supporting forces to implement NETOPS and Network Defense (NetD) actions in sup-port of joint objectives. The AFNETOPS/CC may delegate directive authority to the AFNOSC Director.

2.1.1.4. The 8 AF/CV is also the AFNOSC Director and will be responsible for integrating AFNETOPS and NetD activities across the AF-GIG.

2.1.1.4.1. Under the integrated AFNETOPS/NetD Command and Control (C2) construct, the COMAFFOR to JTF-GNO will have the authority to assign tasks in response to events that cross MAJCOMs, affect the preponderance of the AF-GIG, or are time-critical to assure net-work availability and security. In general, this will include taskings to direct NOSCs’ and NCCs’ configuration changes, Information Operations Condition (INFOCON) changes, and changes to security postures. Theater supporting plans will define situations and objectives under which each supported/supporting relationship occurs.

NOTE: ANG units remain under control of their respective state unless activated by the President.

Therefore, this must be taken into consideration when executing C2 of the AF-GIG.

AFI33-115V1 24 MAY 2006 7

Figure 2.1. Air Force Network Operations Command Relationships.

2.1.2. Deployed AFNETOPS Hierarchy.

2.1.2.1. The relationship between the fixed and equivalent deployed AFNETOPS hierarchy is also shown in Figure 2.1. The Combatant Command J-6 establishes the Joint Communications Control Center (JCCC) for the JTF AOR, and gives direction through the service’s Air Communications Control Center (ACCC). The JCCC does the planning and high-level management of the Joint net-work and provides specific guidance on Joint circuits.

2.1.2.2. DISA’s span of control in the deployed environment extends to the JTF systems control (SYSCON). When deployed, Air Force component ACCC supporting NOSC and NCC-Ds will use the approved joint suite of AFNETOPS tools (e.g., Joint Network Management System [JNMS]) to execute their responsibilities and forward network status to the JTF SYSCON.

8 AFI33-115V1 24 MAY 2006

Figure 2.2. Notional AFNETOPS Organization.

2.2. Global (DISA/AFNOSC), Regional (NOSC) and Local (NCC) Organizations.

2.2.1. Global.

2.2.1.1. DISA’s Global NOSC (GNOSC) is responsible for the worldwide management and oper-ational oversight of the Defense Information Infrastructure (DII). DII network and systems man-agement policy and standards are developed jointly by DISA, the services, and agencies.

2.2.1.2. DISA’s span of control ends at the Air Force base network and ANG ROSCs Service Delivery Points (SDP) for fixed communications, and at the Joint SYSCON SDP for deployed operations.

2.2.1.3. All DOD organizations are responsible for complying with the published policies and standards. The NOSCs and NCCs are the primary Air Force organizations responsible for apply-ing and enforcing these policies at the regional and local level.

2.2.1.4. The AFNOSC executes AFNETOPS and NetD through distributed operations. Although elements of the AFNOSC may be physically separated, it will remain one staff under the com-mand and direction of the AFNOSC Director/COMAFFOR to JTF-GNO.

AFI33-115V1 24 MAY 2006 9

2.2.2. Regional.

2.2.2.1. Regional operation centers depicted in Table 2.1. perform NETOPS to ensure operational and administrative control by implementing Systems and Network Management (S&NM), Infor-mation Assurance/Network Defense (IA/NetD), and Information Dissemination Management (IDM) within their specific span of responsibilities.

2.2.2.2. The supporting MAJCOM NOSC is responsible for deployed AFNETOPS and reports to the JTF JCCC via the warfighting headquarters (WFHQ) ACCC .

2.2.2.3. Functional Awareness Cells (FAC). These regional level entities exist at the same NETOPS management tier as the Base NCC. They report to and take direction from the Base and supporting NOSC.

2.2.2.3.1. FACs require only a small amount of the equipment and perform situational aware-ness for a functional system or mission. They act as the point of contact for all computer sys-tem trouble calls supporting a particular functional system or group of functional systems.

FACs are typically owned and operated by the functional community that the computer system serves. The FAC evaluates problems and typically provides solutions for the application and data associated with that system(s).

2.2.2.3.2. To maintain base network integrity, FACs will not operate their networks, but will operate their own server systems in accordance with Service Level Agreements (SLA), Mem-orandums of Agreement (MOA), or Memorandums of Understanding (MOU) established with either the NCC or NOSC if an NCC does not exist. The SLA, MOA, or MOU will include how core services (paragraph 6.4.) are provided by the AFNOSC, NOSC, or NCC so not to jeopar-dize the integrity of the AF-GIG. See Attachment 2, Service Level Agreements, for policy and procedural guidance.

2.2.3. Local.

2.2.3.1. NCCs are the local network control elements through which NOSCs exercise manage-ment and operational direction over their MAJCOM network segments. NCCs also generate a sit-uational awareness picture and partner with NOSCs and ANG ROSCs to deliver S&NM, IA/ NetD, and IDM. They provide reliable, secure networks, and network services for base-level cus-tomers.

2.3. DRU and FOA NOSC realignment.

2.3.1. The 10th Wing and the United States Air Force Academy are aligned to the Air Force Space Command (AFSPC) NOSC.

2.3.2. The Air Force Pentagon Communications Agency (AFPCA) and the 11th Wing are aligned to the Air Mobility Command (AMC) NOSC.

2.3.2.1. All FOAs in the National Capitol region, that are not on Air Force installations, are aligned behind AFPCA as communications geographically separated units (GSU). AFPCA will represent these FOAs to the AMC NOSC. The 70th Wing at Fort Meade is also aligned behind

AFPCA.

2.3.3. All DRUs and FOAs on Air Force bases are aligned behind that base NCC and will comply with the “One Base – One Network” guidance.

10 AFI33-115V1 24 MAY 2006

2.4. NOSC Standardization.

2.4.1. Requirements identified by NOSCs and NCCs that are not addressed by the Combat Informa-tion Transport System (CITS) lead command manager or AFI 33-103, Requirements Development and Processing, must be approved in accordance with the following process:

2.4.1.1. Requirements must be identified by the MAJCOM and forwarded to the AFNETOPS/CC and SAF/XCIF for validation. (Possible solutions may also be identified.)

2.4.1.2. The AFNETOPS/CC and SAF/XCIF will send validated requirements to CITS Lead Command, HQ AFCA/ECN.

2.4.1.3. AFCA, representing the MAJCOM, SAF/XC and the AFNETOPS/CC, will bring the pro-posal to the Infrastructure Architecture Council (IAC).

2.4.1.4. If the IAC approves the tool, AFCA will develop a deployment plan and execute the plan under the purview of the AFNOSC and SAF/XC via the CITS program.

2.5. One Base-One Network.

2.5.1. All Air Force units on Air Force installations will comply with the one base-one network phi-losophy.

2.5.1.1. The base NCC or supporting NOSC will operate, maintain, configure, and control all base core services and network infrastructure.

2.5.1.2. Ownership of all said systems moves to the base NCC and supporting NOSC.

2.5.1.3. All program management office (PMO) and system program office (SPO) systems follow the same above guidance for one base-one network. In special cases, compliance waiver may be requested if funding restrictions prevent corrective actions or the corrections require extensive technical overhaul/analysis. Each exception to policy must include a plan to rectify the issue pre-cluding one base-one network compliance, no waiver will be permanent. Waiver requests must go to AFCA CITS Lead Command for review; then AFCA will forward to SAF/XCIF with recom-mendations for approval/disapproval.

2.5.2. Geographically Separated Units (GSU).

2.5.2.1. The GSU owning MAJCOM is required to pay for the circuit back to the supporting Air Force base based upon AFI 65-601 Volume 1, Budget Guidance and Procedures.

2.5.2.2. The base NCC and supporting NOSC will treat the GSU infrastructure as prescribed in paragraph 2.5.1.

2.5.2.3. The GSU must be aligned to the base that provides servicing MPF activities for GSU per-sonnel. If they are not currently aligned this way – they must realign appropriately.

2.5.2.4. The GSU will comply with base NCC and supporting NOSC policy, NOTAMs, TCNOs, and other directives as any unit on the base.

2.5.3. Security Enclave Determinations.

2.5.3.1. Units will not define themselves as security enclaves. SAF/XCIF makes the determina-tion as to if a system is to be a security enclave.

AFI33-115V1 24 MAY 2006 11

2.5.3.2. If a unit wishes to request an enclave determination, submit the request to AFCA for review. AFCA will forward the submission and their review to SAF/XCIF for final disposition.

2.5.3.3. If a unit is declared a security enclave, paragraph 2.5.1. still applies and the NCC or sup-porting NOSC will operate all security hardware and core services.

12 AFI33-115V1 24 MAY 2006

Chapter 3

ORGANIZATIONAL ROLES AND RESPONSIBILITIES

3.1. Secretary of the Air Force, Office of Warfighting Integration and Chief Information Officer (SAF/XC). SAF/XC will:

3.1.1. Develop, validate, and monitor execution of plans, policies, and requirements for moderniza-tion of Air Force Communications and Information Infostructure. Provide overall integrated oversight of requirements, plans, schedules, budgets, and performance criteria for all modernization efforts associated with communications and information infostructure.

3.1.2. Lead the development and implementation of communications and information architectures for the Air Force and represent the Air Force position for joint architectures.

3.1.3. Provide policy and guidance for IT registration and administration of the Enterprise Informa-tion Technology Data Repository (EITDR) according to AFI 33-202, Volume 1, Network and Com-puter Security (will be incorporated in forthcoming AFI 33-204, Information Assurance Awareness Program).

3.1.4. Work with program management offices to ensure all new community of interest systems/serv-ers are developed and implemented with the intent of the CSAF server consolidation effort. Consoli-dation should start at the DISA Defense Enterprise Computer Center (DECC), however, consolidation to the AFNOSC or NOSC is acceptable as well. Consolidation could include using remote manage-ment, co-location, or shared hosting consolidation as best fits the operational mission.

3.1.5. Provide the overarching policy and oversight for all Air Force operational, system, and techni-cal architectures, including establishing IT standards and providing architectural support to the core Air Force processes.

3.1.6. Integrate Air Force planning, budget, financial, and program management processes for IT investments.

3.1.7. Review all 33-series and 37-series AFIs for currency and relevance. The Air Force-Chief Infor-mation Officer (AF-CIO) will ensure updates are made and published for all policy documents related to communications and information.

3.1.8. Develop and define the Air Force IT services for the AF-GIG.

3.1.9. Provide oversight of the implementation status of Air Force IT services on behalf of the Secre-tary of the Air Force (SECAF) and Chief of Staff of the Air Force (CSAF).

3.1.10. Ensure Air Force IT services are in-line with the DOD GIG enterprise services.

3.1.11. Provide oversight of the AF-GIG performance by measurement and analysis of Air Force-level metrics on behalf of the SECAF and CSAF.

3.2. The Deputy Chief of Staff, Air and Space Operations (HQ USAF/XO). HQ USAF/XO is the office of primary responsibility (OPR) for all Air Force information operations matters. Other offices hav-ing responsibilities for individual elements affecting NetD will coordinate with HQ USAF/XO to ensure

AFI33-115V1 24 MAY 2006 13

the consistent and standardized application of NetD strategic planning, policy, guidance, and program-matic oversight.

3.3. The Director of Intelligence, Surveillance, and Reconnaissance (HQ USAF/XOI). HQ USAF/ XOI is the designated OPR and lead within HQ USAF/XO for coordinating overall NetD policy, guid-ance, doctrine strategy and investment priorities. Department of the Air Force (Headquarters Air Force, Air Staff and Secretariat) offices with NetD-related responsibilities will coordinate all such matters (to include promulgation of policy and guidance, requirements derivation, and programmatics) with HQ

USAF/XOI.

3.4. Information, Services and Integration Directorate (SAF/XCI). SAF/XCI will:

3.4.1. Oversee the day-to-day execution of Air Force communications and information programs, combat support, including wing-level C2, Air Force Forces (AFFOR) C2 and theater level operational support. Develop guidance for command and control, and intelligence, surveillance and reconnais-sance networks/nodes.

3.4.2. Develop and articulate positions for communications and information force structure and orga-nizational issues. Analyze proposed MAJCOM force structure and organizational changes and iden-tify impacts on communications and information resources.

3.4.3. Establish course requirements and planning guidance for the professional development, advanced education, and technical training of the communications and information workforce through government and civilian institutions.

3.4.4. Lead career field managers for the communications, information, postal, multimedia, and Com-munication-Electronic Maintenance (2E) career fields.

3.4.5. Be the lead for communications and information resources (Status of Resources and Training Systems [SORTS], AEF, Unit Type Code [UTC] Functional Area Manager). Determine training requirements and ensure implementation of training programs for assigned Air Force specialties.

3.4.6. Be the lead for establishing an Air Force policy on continuity of operations plans for the AFNOSC, the NOSCs and NCCs.

3.5. Air Force Communications Agency (AFCA). AFCA will:

3.5.1. Conduct network enhancement initiatives. Act as the policy and standards adjunct of SAF/XC.

AFCA will administer the OPTN program.

3.5.2. Support SAF/XC by managing the reviews of Information Support Plan (ISP) documents. AFI 33-108, Compatibility, Interoperability, and Integration of Command, Control, Communications and Computer (C4) Systems (title will become Interoperability and Supportability of Information Technol-ogy and National Security Systems) will contain Air Force ISP policy and format guidance when updated.

3.5.3. Address AF-GIG manpower issues. Identify future funding requirements and prepare Program Objective Memorandum (POM) submission in coordination with SAF/XC.

3.5.4. Develop, review, and update Air Force-level SLAs with external agencies as required.

3.5.5. Assist and advise NOSCs and NCCs on optimization of network infrastructures.

14 AFI33-115V1 24 MAY 2006

3.5.6. Perform Scope EDGE mission. Specifically conduct assessments of base and NOSC network configuration settings for compliance with directives and technical orders. Optimize and secure NOSC and base network configuration settings.

3.5.7. Employ network engineering analysis capabilities to perform quality of service (QoS) analysis for existing warfighter networked systems and applications when these systems and applications do not meet expected QoS.

3.5.8. Provide contract oversight of the Air Force Information Technology E-Learning System (dis-tant learning computer based training), the Books 24x7 on-line reference ware, and the Network Con-trol Center Structured On-the-Job Program for network professionals.

3.6. Air Force Command and Control & Intelligence, Surveillance, and Reconnaissance Center

(AFC2ISRC).

3.6.1. Force communications and information workforce are force multipliers which support all six distinctive capabilities the Air Force brings to any activity across the spectrum of military operations, whether as a single Service or in conjunction with other Services in joint operations: Air and Space Superiority, Global Attack, Rapid Global Mobility, Precision Engagement, Information Superiority, and Agile Combat Support. Two of our distinctive capabilities, Precision Engagement and Informa-tion Superiority, are information technology driven and information dependent. This is where the communications and information community plays a substantial role. The essence of precision engagement lies in the ability to apply selective force against specific targets and achieve discrete and discriminate effects. Success in doing this means correct use of enormous amounts of information – information that is timely, accurate and useable. Information technology enables us to find, fix, track, and target anything that moves on the surface of the earth. Again, success depends upon a vast amount of the right information, at the right place, at the right time, and in the right format via terrestrial, air-borne and space networks seamlessly. AFC2ISRC will:

3.6.2. Review all policy and guidance to ensure network solutions meet warfighter requirements.

3.6.3. Support end-to-end interoperability of network solutions.

3.6.4. Advocate and support appropriate technology and platform implementations.

3.7. Air Force Network Operations and Security Center (AFNOSC). AFNOSC will:

3.7.1. Provide Air Force level C2 and situational awareness for the AF-GIG. Exercise distributed pos-itive control for the classified and unclassified wide area network (WAN) connectivity.

3.7.2. Enforce compliance with accreditation and other network policy.

3.7.3. Develop options and direct configuration changes, INFOCON changes, and changes to security postures in response to vulnerabilities and incidents, JTF-GNO direction, and outages that cross MAJ- COMs, affect the preponderance of the AF-GIG, or are time critical in nature.

3.7.4. Issue NETOPS tasking orders (NTO) as well as track, document, and report compliance with Time Compliance Network Orders (TCNO) and C4 Notice to Airmen (NOTAM) provisions of AFI 33-138, Enterprise Network Operations Notification and Tracking.

3.7.5. Direct specific actions related to network defense.

3.7.6. Evaluate and respond to Air Force network intrusions and malicious logic events.

AFI33-115V1 24 MAY 2006 15

3.7.7. Identify Network Attack (NetA) threats by collecting and analyzing intelligence products, and developing and executing countermeasures to network vulnerabilities in coordination with all applica-ble organizations. Coordinate network restoration after attacks.

3.7.8. Assist NOSCs/NCCs with computer attack damage control and recovery procedures.

3.7.9. Provide top-level tier of technical support for NOSC and NCC WAN operations between SDPs.

Technologies and programs to be supported include Domain Name Service (DNS), Air Force Virtual Private Network (VPN), and SDP technology insertion. Specific operational roles and responsibilities are listed in paragraph 4.2.

3.7.10. Provide senior leaders with global visibility and situational awareness for operational status of AF-GIG resources and capabilities, including NIPRNET, SIPRNET, ConstellationNet and provide information protection related incidents and network outage via Commander’s Situation Report (SITREP) and Operational Reports (OPREP). Maintain awareness of potential or ongoing Combat Air Forces (CAF)/Mobility Air Forces (MAF) operations in order to ensure activities on the AF-GIG do not hinder Air Force operations.

3.7.11. Maintain an enterprise-centric view of the AF-GIG.

3.7.12. Identify and submit network upgrade and operational requirements to Combat Information Transport System (CITS) Lead Command (HQ AFCA/ECN).

3.7.13. Make appropriate joint and Air Force notifications of ongoing or potential NetA activities.

3.7.14. Perform trend analysis and correlation of threat and performance metrics.

3.7.15. Provide command uptime rates for systems and services to include posting uptime rates on a web page.

3.7.16. Establish a Standardization/Evaluation (Stan/Eval) program to encompass the NOSC and NCC operations according to AFI 33-115, Volume 2, Licensing Network Users and Certifying Net-work Professionals (will become Network Operations Training and Standards).

3.8. Air Force Information Warfare Center, Information Operations Directorate (AFIWC/IO).

AFIWC/IO will:

3.8.1. Maintain and sustain subject matter expertise in Network Defense (NetD) for all networks.

Supplement AFNOSC, NOSC and NCC with NetD technical expertise as required for effective response to network attacks. Provide development and employment support for AFIWC developed network sensors and NetD weapons systems (AFIWC/IOD), as well as computer and network threat awareness, analysis, and intelligence support (AFIWC/IOA).

3.8.2. Report to AFNOSCs and MAJCOM NOSCs all backdoors and unauthorized connections to Air Force networks discovered during the course of operations. Reports will be made immediately upon discovery if associated with an on-going incident and within 48 hours from discovery if not associated with an incident response action.

3.8.3. Ensure the 23d Information Operations Squadron develops Tactics, Techniques, and Procedures (TTP) for conducting Information Operations.

3.8.4. Ensure the 92d Information Warfare Aggressor Squadron provides assistance to MAJCOMs by conducting computer and network vulnerability assessments and exercise red team support.

16 AFI33-115V1 24 MAY 2006

3.8.5. Ensure the 346th Test Squadron conducts formal testing and evaluation of NetD weapon sys-tems, as well as implementation assistance.

3.9. Major Commands (MAJCOM). Each MAJCOM (ANG operates as a MAJCOM) will:

3.9.1. Establish and maintain a NOSC to provide command and control of the MAJCOM network (specific NOSC roles and responsibilities are listed in paragraph 4.3.).

3.9.2. Develop policies, procedures, and special instructions that pertain to the MAJCOM network.

3.9.3. Identify and submit network upgrade and operational requirements to CITS Lead Command

(HQ AFCA/ECN).

3.9.4. Provide network support such as engineering, strategic planning, risk management, developing SLAs, budgeting, inspecting, and contract management to subordinate units. Authorize adequate down time in order to support preventive maintenance inspections.

3.10. Air Education and Training Command (AETC). AETC will:

3.10.1. Manage and provide formal training in support of initial, advanced, supplemental, and quali-fication training, delivered in-residence and through distance learning.

3.10.2. Identify and submit course resource estimate inputs to the 2E, 3A, 3C, 3V and 33S Career Field Managers for training. Provide oversight of Air Force supplemental technical training. To obtain formal training quotas, refer to Air Force Catalog (AFCAT) 36-2223, USAF Formal Schools, and AFI 36-2201, Volume 3, Air Force Training Program, On the Job Training Administration.

3.10.3. Identify all training resources required to Career Field Managers.

3.10.4. Plan and program classroom desktop equipment and training aids.

3.10.5. Work, with other MAJCOMs where appropriate, to establish and maintain one “af.edu” domain. Members logged into this domain will not have access to the base infrastructure domain, but, all Air Force members in the .edu domain are required to have “basename.af.mil” E-mail accounts provided by the local base. The purpose of this domain is to establish a unique security enclave con-ducive to educational exchange and research without exposing the af.mil network to security risks.

3.10.5.1. The AETC NOSC is responsible for the Air Force level functional management of this domain and must work with the other supporting NCCs and MAJCOMs to provide the appropriate level of service.

3.10.5.2. Members of this domain are students and faculty at the United States Air Force Acad-emy, the Air Force Institute of Technology, and the Air University system.

3.10.5.3. The af.edu domain will be its own separate stand alone Active Directory Forrest with independent core services all managed by the AETC NOSC. The infrastructure at each base remains the responsibility of the base NCC and MAJCOM NOSC – this is a logical overlay/sepa-ration only.

3.11. Air Force Materiel Command (AFMC). AFMC will:

3.11.1. Provide POM inputs for technical solutions and life-cycle support to AFCA.

AFI33-115V1 24 MAY 2006 17

3.11.2. Review all TCNO and C4 NOTAMs for applicability to all AFMC provided information sys-tems.

3.12. Wings and Air Base Host Units. Hosting base units will:

3.12.1. Operate and manage NCCs to provide base level network services not managed by NOSC.

Specific NCC operational roles and responsibilities are listed in paragraph 4.4.

3.12.2. Submit networking sustainment and upgrade requirements to their respective MAJCOM or applicable supporting agency for DRUs and FOAs.

3.12.3. Ensure units coordinate with MAJCOMs or applicable agencies for formal training require-ments.

3.12.4. Ensure unit commanders appoint 3As as client support administrators (CSA) consistent with paragraph 4.7.

3.12.5. Grant AFCA Scope EDGE personnel administrative access to base networks to perform com-pliance assessments and optimization activities, as requested by their parent MAJCOM.

3.13. Air Force Program Management Offices (PMO) and System Program Offices (SPO). PMOs and SPOs will:

3.13.1. Not deliver or operate network infrastructure hardware without IAC approval.

3.13.2. Use base NCC or supporting NOSC provided network services and network core services.

3.13.3. PMO/SPO must comply with one base-one network policy; all systems on the network must be configured to operate within this construct.

3.13.4. Develop Information Support Plans in accordance with Air Force guidance, CJCSI 6212.01D, Interoperability and Supportability of Information Technology and National Security Systems, and DODI 4630.8, Procedures for Interoperability and Supportability of Information Technology (IT) and National Security Systems (NSS), for any IT or NSS system that exchanges information external to itself, and/or is connected to the GIG.

3.14. Warfighting Headquarters (WFHQ). WFHQ will:

3.14.1. Not operate or maintain network infrastructure hardware or core services.

3.14.2. Use base NCC or supporting NOSC provided network services and network core services.

3.14.3. Provide System Administration support for Air Operations Center delivered C2 systems only.

3.15. Lead Command Managers (LCM). LCMs are:

3.15.1. Responsible for communications and information systems, equipment, commodities or ser-vices operated/used by more than one Air Force MAJCOM, DRU or FOA. Lead commands as advo-cates involves requirements, life-cycle planning, sustainment and resource management and must comply with AFI 10-901, Lead Operating Command—Communications and Information Systems Management.

18 AFI33-115V1 24 MAY 2006

Chapter 4

OPERATIONAL ROLES AND RESPONSIBILITIES

4.1. General. The AFNOSC, NOSC, and NCC are the tiered levels of AF-GIG operations working in concert to ensure networks are available to support mission demands. These centers perform the AF-GIG mission operation areas described in Chapter 6. Specific definitions of each tier, as well as roles and responsibilities, are discussed in this chapter.

4.2. Air Force Network Operations and Security Center (AFNOSC). The AFNOSC i s t he A i r Force’s top network operations tier. The AFNOSC develops options and directs configuration changes and changes to security postures in response to vulnerabilities and incidents, JTF-GNO direction, and out-ages that cross theater NOSCs, affect the preponderance of the network, or are time critical in nature. The AFNOSC provides Air Force-level metrics, situational awareness, and enforces compliance with accred-itation and other network policy. Although the AFNOSC represents the top tier of the AF-GIG, it does not relieve theater NOSC from managing, resourcing, and implementing the AF-GIG within their respective theaters. The AFNOSC has tactical control (TACON) over the theater NOSC, base NCC and the mission support center (MSC) or FAC to direct configuration changes, INFOCON changes, and changes to the security posture of the AF-GIG. The AFNOSC will:

4.2.1. Operate 24-hours-a-day, 7-days-a-week.

4.2.2. Interact with DISA, JTF-GNO, theater NOSCs, and the commercial sector to identify and cor-rect anomalies in Air Force networks, systems, and applications.

4.2.3. Exercise DIRLAUTH for the Air Force to MAJCOMs, other Air Force agencies, sister ser-vices, and other external agencies for network operations and network security issues.

4.2.4. Perform Information Dissemination Management.

4.2.4.1. Issue NTOs as well as track, document, and report compliance with TCNOs according to AFI 33-138, directing all AF-GIG operational, security, and configuration based changes. Ensure two-person compliance procedures are followed according to AFI 33-138 when implementing TCNOs. Issue Air Force-level C4 NOTAMs according to AFI 33-138.

4.2.4.2. Direct all AF-GIG operational, security, and configuration based changes.

4.2.4.3. Draft SITREPs according to AFI 10-206, Operational Reporting. Draft Operational Event/Incident Reports (OPREP3) according to AFI 10-206 to document and report significant network events affecting Defense Information Systems Network (DISN) connections not previ-ously reported in SITREPs.

4.2.4.4. Provide Help Desk services to theater NOSCs as a focal point for AF-GIG problem reso-lution.

4.2.4.5. Document and track trouble calls to final resolution.

4.2.4.6. Utilize Network Common Operating Picture (NETCOP) to consolidate NOSC up-chan-neled metrics of C4 systems and report overall AF-GIG metrics to SAF/XC, and other senior lead-ers as required.

AFI33-115V1 24 MAY 2006 19

4.2.4.7. Monitor and report status and critical metrics of Air Force IT services, as defined by the AF-CIO, NIPRNET, SIPRNET, and JWICS connections to senior leaders and theater NOSC, MSC, FAC, and base NCCs as needed or required.

4.2.4.8. Supply data to program offices, DISA, JTF-GNO, and other agencies, as required, ensur-ing systemic Air Force-level problem areas are tracked and fixed.

4.2.4.9. Provide status of on-going law enforcement investigations related to computer security incidents to COMAFFOR to JTF-GNO.

4.2.4.10. Report to JTF-GNO COMAFFOR validated NetAs, suspicious activities, and security incidents to DOD CERT, GNOSC, Air Force Office of Special Investigations (AFOSI), Informa-tion Warfare Flights, theater NOSCs, NCCs, and other activities, in accordance with DOD and Air Force guidelines.

4.2.5. Perform System and Network Management.

4.2.5.1. Perform continuous voice, video and data network monitoring and analysis of operations for identification of network availability or degradation events.

4.2.5.2. Ensure situational awareness of CITS equipment is maintained and respond/report any system degradation events.

4.2.5.3. Manage Air Force level (af.mil and af.smil.mil) DNS, naming convention for the Air Force, maintain a Name Server (NS) record for all Air Force name servers in the af.mil zone and provide technical support for the af.mil and af.smil.mil domain and sub-domains.

4.2.5.4. Monitor Air Force-level Internet Protocol (IP) address space.

4.2.5.5. Manage the Tactical Internet Protocol (TAC-IP) Program to provide temporary IP address space for deployed units.

4.2.5.6. Administer and maintain Air Force-level system capabilities as negotiated in SLAs.

4.2.5.7. Manage the USAF Circuit Upgrade Program, identify and report circuits that exceed established thresholds to the Air Force Systems Network (AFSN) office.

4.2.6. Perform Information Assurance/Network Defense.

4.2.6.1. Perform continuous network monitoring operations for identification of on-going attacks against the network or interconnected systems.

4.2.6.2. Provide real-time analysis, response and reporting according to AFI 33-138 for network attacks and security incidents.

4.2.6.3. Correlate network events with supporting network data, threat data, and technical vulner-ability information.

4.2.6.4. Maintain global situational awareness of events threatening Air Force networks.

4.2.6.5. Manage Air Force long-haul user VPN.

4.2.6.6. Maintain secure communications with NOSCs.

4.2.6.7. Update Access Control Lists on SDP routers.

20 AFI33-115V1 24 MAY 2006

4.2.6.8. Analyze NETOPS security posture using security management software tools such as intrusion detection and vulnerability assessment.

4.2.6.9. Analyze customer impact of all network incidents, problems and alerts, and develop cor-rective actions or management changes.

4.2.6.10. Require network defense countermeasures and other defensive or corrective actions in response to command direction, INFOCONs, or vulnerability alerts.

4.2.6.11. Develop and/or exercise contingency plans to continue operations in at least one loca-tion in the local area and at least one location outside the local area in the event of natural or unnat-ural disaster, utilities failure, and contractor issues.

4.2.6.12. Conduct NetA assessments, correlate incidents, conduct spot check compliance, and conduct on-line surveys for suspicious activities (internal and external) across Air Force network domains. Notify COMAFFOR and the JTF-GNO of attacks and suspicious activities. Conduct trend analysis to determine patterns of attack.

4.2.6.13. Conduct and manage Air Force vulnerability analysis and assistance functions in accor-dance with AFI 33-207, Computer Security Assistance Program. Notify COMAFFOR to JTF-GNO of technical vulnerabilities impacting Air Force computers and computer networks.

4.2.6.14. Assist the COMAFFOR to JTF-GNO in implementing the Air Force INFOCON pro-gram.

4.2.7. Coordinate with base NCC and theater NOSC to ensure presence of site personnel for trouble-shooting operations when requested by JTF-GNO.

4.2.8. Participate in AFSN-led configuration control board to address AF-GIG requirements.

4.2.9. Provide situational awareness and status of the AF-GIG to SAF/XC, AFCA and to leaders at all levels based on their operational needs.

4.2.10. Assist COMAFFOR to JTF-GNO in building upon current Air Force policies and programs to implement and maintain a network security posture that will defeat hostile NetA and attempts to exploit the Air Force network.

4.2.11. Serve as the Air Force single point-of-contact for receiving reports from and reporting com-puter security incidents and vulnerabilities to organizations external to the Air Force.

4.3. Network Operations and Security Center (NOSC). The theater NOSC is the mid-level organiza-tion in the three-tiered NETOPS structure. A theater NOSC provides commanders with real-time opera-tional network intrusion detection and perimeter defense capabilities, as well as theater-level NETOPS and fault resolution activities. This NETOPS entity is employed at the commander’s direction to defend information networks both in-theater and in-garrison. NOSC personnel monitor and support the day-to-day operational issues associated with their subordinate bases and units. Their mission focus is to ensure their theater’s operational and support systems are fully capable. As appropriate, they support their commanders with information assurance capabilities, such as information systems security, decision anal-ysis, and other technological capabilities. Theater NOSCs will:

4.3.1. Operate 24-hours-a-day, 7-days-a-week.

AFI33-115V1 24 MAY 2006 21

4.3.2. Assist the AFNOSC (and DISA when requested through the AFNOSC) with ensuring presence of on-site personnel when requested by AFNOSC Net Operations Division to perform troubleshooting procedures to restore faulty, Air Force owned and operated, WAN transmission equipment and cir-cuits.

4.3.3. Establish SLA, MOA, or MOU with Main Operating Bases (MOB), GSUs, tenant units, Air Force, and MAJCOM functional communities of interest defining agreed upon levels of support.

Additionally, maintains SLA, MOA, or MOU with other NOSCs for providing back–up services as needed.

4.3.4. Perform Information Dissemination Management.

4.3.4.1. Implement, track, document, and report compliance with TCNOs directed by the AFNOSC. Issue NTOs, implement, track, document and report compliance with MAJCOM-level TCNOs. Ensure two-person compliance procedures are followed according to AFI 33-138 when implementing TCNOs. Issue and review all C4 NOTAMs for applicability to all theater unique information systems according to AFI 33-138.

4.3.4.2. Draft SITREPs according to AFI 10-206. Draft OPREP3s according to AFI 10-206 to document and report significant network events affecting theater-level systems.

4.3.4.3. Provide Help Desk services to NCCs and other NOSC customers for the theater; forward lessons learned and situations requiring additional assistance to next upper level tier Help Desk.

4.3.4.4. Provide situational awareness and visibility of the MAJCOM C4 systems as directed by the AFNOSC, but no less than every 12 hours, via NETCOP or other reporting methods as directed by the AFNOSC. As a minimum, NIPRNET, SIPRNET, Air Traffic Control and Landing Systems (ATCALS), Automated Security Incident Measurement (ASIM), weather systems, Auto-mated Message Handling System (AMHS), Global Command and Control System (GCCS) and base level Telephony connectivity will be monitored. Other systems may be added as require-ments dictate.

4.3.5. Perform System and Network Management.

4.3.5.1. Provide and manage external DNS service to assigned bases, and internal DNS service for IT services that are consolidated, and coordinate with AFNOSC Net Operations Division on Air Force-level DNS issues.

4.3.5.2. Manage theater-level (theater.af.mil, theater.ds.af.mil, theater.af.smil.mil, and the-ater.ds.af.smil.mil) DNS and assigned IP addresses. Those theater NOSCs that manage base-level IP addresses will follow guidance in paragraph 4.5.4.9.

4.3.5.3. Perform distributed control of remote access services for the theater. Follow guidance in paragraph 4.5.4.9.2.1.

4.3.5.4. Provide theater level Core Services (as defined in paragraph 6.4.) to assigned bases.

4.3.5.5. Provide Network Time Protocol (NTP) management. NOSCs will use NTP on all systems within the CITS Network Management and Network Defense (NM/ND) boundary to synchronize system clocks with a local Global Positioning System (GPS) receiver. Additionally, ensure that as a minimum NTP is enabled on all core servers and backbone equipment.

22 AFI33-115V1 24 MAY 2006

4.3.5.6. Detect, respond, and report network events affecting operational availability of theater network, user service levels, support to critical applications, and core services to the AFNOSC and others as appropriate.

4.3.5.7. Provide technical assistance to assigned NCCs.

4.3.5.8. Perform system backup and disaster recovery procedures on NOSC managed core ser-vices.

4.3.5.9. Maintain…