Appendice 7 - INFOSEC Program Protection.pdf

BY ORDER OF THE SECRETARY DEPARTMENT OF DEFENSE MANUAL 5200.01

OF THE AIR FORCE Volume 3

DEPARTMENT OF THE AIR FORCE MANUAL

16-1404, VOLUME 3

23 DECEMBER 2020

Operations Support

INFORMATION SECURITY PROGRAM

PROTECTION OF CLASSIFIED INFORMATION

COMPLIANCE WITH THIS PUBLICATION IS MANDATORY

ACCESSIBILITY: Publications and forms are available for downloading or ordering on the e-Publishing web site at www.e-Publishing.af.mil.

RELEASABILITY: There are no releasability restrictions on this publication.

OPR: SAF/AAZO Certified by: SAF/AAZ

(Mr. William E. MacLure)

Supersedes: AFI 16-1404, 29 May 2015 Pages: 141

This publication implements Department of the Air Force Policy Directive (DAFPD) 16-14, Security Enterprise Governance. Department of Defense Manual (DoDM) 5200.01, Volume 3 is printed word-for-word in regular font without change. The Air Force supplemental material is printed in bold font and indicated by “(Added)(AF).” The supplement describes Air Force responsibilities under the manual and establishes the Air Force requirement to support the

Department of Defense (DoD) Information Security Program. This publication applies to all members of the Department of the Air Force (DAF), including all civilian employees and uniformed members of the Regular Air Force, the Air Force Reserve, the Air National Guard, the

Civil Air Patrol when conducting missions as the official Air Force Auxiliary, and to the newly established United States Space Force (USSF). It applies to contractors when stated in the contract or Department of Defense Form 254, Department of Defense Contract Security

Classification Specification, except where noted otherwise. This publication may be supplemented at any level, but all supplements will be routed to the Office of Primary Responsibility (OPR) prior to certification and approval. Refer recommended changes and questions about this publication to the OPR using the Air Force (AF) Form 847, Recommendation for Change of

Publication; route AF Form 847 from the field through the appropriate functional chain of command. The authorities to waive wing/unit level requirements in this publication are identified with a Tier (“T-0, T-1, T-2, T-3”) number following the compliance statement. See Department of the Air Force Instruction (DAFI) 33-360, Publications and Forms Management, for a http://www.e-publishing.af.mil/ description of the authorities associated with the Tier numbers. Submit requests for waivers through the chain of command to the appropriate Tier waiver approval authority, or alternately, to the requestor’s commander for non-tiered compliance items. Ensure all records created as a result of processes prescribed in this publication are maintained in accordance with Air Force

Instruction (AFI) 33-322, Records Management and Information Governance Program, and disposed of in accordance with the Air Force Records Disposition Schedule located in the Air

Force Records Information Management System.

SUMMARY OF CHANGES

This publication was changed from an Air Force Instruction to an Air Force supplement to the

Department of Defense Manual. Air Force added highlights include responsibilities unique to the

DAF, specialized storage requirements for Air Force aircraft and flexibility when conducting security inquiries.

Department of Defense

MANUAL

NUMBER 5200.01, Volume 3

February 24, 2012

Incorporating Change 2, March 19, 2013

USD(I)

SUBJECT: DoD Information Security Program: Protection of Classified Information

References: See Enclosure 1

1. PURPOSE

a. Manual. This Manual is composed of several volumes, each containing its own purpose.

The purpose of the overall Manual, as authorized by DoD Directive (DoDD) 5143.01

(Reference (a)) and DoD Instruction (DoDI) 5200.01 (Reference (b)), is to reissue DoD 5200.1-

R (Reference (c)) as a DoD Manual to implement policy, assign responsibilities, and provide procedures for the designation, marking, protection, and dissemination of controlled unclassified information (CUI) and classified information, including information categorized as collateral, sensitive compartmented information (SCI), and Special Access Program (SAP). This guidance is developed in accordance with Reference (b), Executive Order (E.O.) 13526, E.O. 13556, and part 2001 of title 32, Code of Federal Regulations (CFR) (References (d), (e), and (f)). This combined guidance is known as the DoD Information Security Program.

b. Volume. This Volume:

(1) Provides guidance for safeguarding, storage, destruction, transmission, and transportation of classified information.

(2) Identifies security education and training requirements and processes for handling of security violations and compromise of classified information.

(3) Addresses information technology (IT) issues of which the security manager must be aware.

(4) Incorporates and cancels Assistant Secretary of Defense for Command, Control, Communications, and Intelligence Memorandums (References (g) and (h)).

2. APPLICABILITY. This Volume:

Change 3, 28 July 2020 4

a. Applies to OSD, the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the

Department of Defense, the Defense Agencies, the DoD Field Activities, and all other organizational entities within the Department of Defense (hereinafter referred to collectively as the “DoD Components”).

b. Does not alter existing authorities and responsibilities of the Director of National

Intelligence (DNI) or of the heads of elements of the Intelligence Community pursuant to policies issued by the DNI. Consistent with Reference (b), SCI shall be safeguarded in accordance with the policies and procedures issued by the DNI, as implemented by DoD

5105.21-M-1 (Reference (i)) and other applicable guidance.

3. DEFINITIONS. See Glossary.

4. POLICY. It is DoD policy, in accordance with Reference (b), to:

a. Identify and protect national security information and CUI in accordance with national-level policy issuances.

b. Promote information sharing, facilitate judicious use of resources, and simplify management through implementation of uniform and standardized processes.

c. Employ, maintain and enforce standards for safeguarding, storing, destroying, transmitting, and transporting classified information.

d. Actively promote and implement security education and training throughout the

Department of Defense.

e. Mitigate the adverse effects of unauthorized access to classified information by investigating and acting upon reports of security violations and compromises of classified information.

5. RESPONSIBILITIES. See Enclosure 2 of Volume 1.

6. PROCEDURES. See Enclosures 2 through 7.

7. INFORMATION COLLECTION REQUIREMENTS. All inspections, investigations, notifications, and audits required by this Volume are exempt from licensing according to paragraphs C4.4.1, C4.4.2, C4.4.7 and C4.4.8 of DoD 8910.1-M (Reference (j)).

8. RELEASABILITY. UNLIMITED. This Volume is approved for public release and is available on the Internet from the DoD Issuances Website at http://www.dtic.mil/whs/directives.

9. EFFECTIVE DATE. This Volume:

a. Is effective February 24, 2012.

b. Must be reissued, cancelled, or certified current within 5 years of its publication in accordance with DoD Instruction 5025.01 (Reference (ck)). If not, it will expire effective

February 24, 2022 and be removed from the DoD Issuances Website.

(Added)(AF) Anthony P. Reardon

Administrative Assistant

Enclosures

1. References

2. Safeguarding

3. Storage and Destruction

4. Transmission and Transportation

5. Security Education and Training

6. Security Incidents Involving Classified Information

7. IT Issues for the Security Manager

Glossary http://www.dtic.mil/whs/directives

DoDM5200.01 Volume 3_DAFMAN16-1404 Volume 3, 23 DECEMBER 2020

Change 3, 28 July 2020 6 CONTENT

TABLE OF CONTENTS

ENCLOSURE 1: REFERENCES……………………………………………………………….11

ENCLOSURE 2: SAFEGUARDING

CONTROL MEASURES

PERSONAL RESPONSIBILITY FOR SAFEGUARDING

ACCESS TO CLASSIFIED INFORMATION

DETERMINING NEED FOR ACCESS……………………………………………………..19

EMERGENCY AUTHORITY

ACCESS BY INDIVIDUALS OUTSIDE THE EXECUTIVE BRANCH

Congress

Government Printing Office (GPO)

Representatives of the Government Accountability Office (GAO)

Historical Researchers

Presidential or Vice Presidential Appointees and Designees

Use of Classified Information in Litigation

Special Cases

VISITS

PROTECTION WHEN REMOVED FROM STORAGE

END OF DAY SECURITY CHECKS

EMERGENCY PLANS

USE OF SECURE COMMUNICATIONS

REMOVAL OF CLASSIFIED INFORMATION FOR WORK AT HOME

Top Secret

Secret and Confidential

Residential Storage Equipment

Classified IT Systems

Foreign Country Restriction

WORKING PAPERS

EQUIPMENT USED FOR PROCESSING CLASSIFIED INFORMATION

REPRODUCTION OF CLASSIFIED MATERIAL

CLASSIFIED MEETINGS AND CONFERENCES

SAFEGUARDING FGI

North Atlantic Treaty Organization (NATO) Information

Other FGI

ALTERNATIVE COMPENSATORY CONTROL MEASURES (ACCM)

DoD Proponents for ACCM

ACCM Approval

Guidance on ACCM Use

Prohibited Security Measures

Prohibited Uses of ACCM

Documentation

Annual Reports of ACCM Use

Change 3, 28 July 2020 7 CONTENT

Sharing ACCM-Protected Information

Contractor Access to ACCM

Program Maintenance

Safeguarding ACCM Information

Security Incidents

ACCM Termination

Transitioning an ACCM to a SAP

(Added)(AF) APPENDIX TO ENCLOSURE 2

CLASSIFIED MEETING/BRIEFING/CONFERENCE CHECKLIST…………………42

ENCLOSURE 3: STORAGE AND DESTRUCTION

GENERAL REQUIREMENTS

LOCK SPECIFICATIONS

STORAGE OF CLASSIFIED INFORMATION BY LEVEL OF CLASSIFICATION

Top Secret

Secret

Confidential

RISK ASSESSMENT

U.S. CLASSIFIED INFORMATION LOCATED IN FOREIGN COUNTRIES

SPECIALIZED STORAGE

Military Platforms

IT Equipment

Map and Plan File Cabinets

Modular Vaults

Bulky Material

PROCURING NEW STORAGE EQUIPMENT

SECURITY CONTAINER LABELS

EXTERNAL MARKINGS ON CONTAINERS

SECURITY CONTAINER INFORMATION

COMBINATIONS TO CONTAINERS, VAULTS AND SECURE ROOMS

Protecting and Storing Combinations

Changing Combinations

ENTRANCES TO OPEN STORAGE AREAS FOR CLASSIFIED INFORMATION

INSPECTION OF STORAGE CONTAINERS PRIOR TO REMOVAL, REPAIR, ETC

NEUTRALIZATION AND REPAIR PROCEDURES

STORAGE OF FGI

RETENTION OF CLASSIFIED INFORMATION

DESTRUCTION OF CLASSIFIED INFORMATION

TECHNICAL GUIDANCE ON DESTRUCTION METHODS

Crosscut Shredders

Pulverizers and Disintegrators

Pulping

DESTRUCTION PROCEDURES

APPENDIX 1 TO ENCLOSURE 3:

PHYSICAL SECURITY STANDARDS

Change 3, 28 July 2020 8 CONTENT

(Added)(AF) APPENDIX 2 TO ENCLOSURE 3:

OPERATIONAL VISUAL CHECKLIST…………………………..………………...67

ENCLOSURE 4: TRANSMISSION AND TRANSPORTATION

TRANSMISSION AND TRANSPORTATION PROCEDURES

DISSEMINATION OUTSIDE THE DEPARTMENT OF DEFENSE

TRANSMISSION OF TOP SECRET INFORMATION

TRANSMISSION OF SECRET INFORMATION

TRANSMISSION OF CONFIDENTIAL INFORMATION

TRANSMISSION OF CLASSIFIED INFORMATION AND MATERIAL TO FOREIGN

GOVERNMENTS

SECURITY REQUIREMENTS FOR TRANSFERS OF DEFENSE ARTICLES TO

AUSTRALIA AND THE UNITED KINGDOM WITHOUT AN EXPORT LICENSE

OR OTHER WRITTEN AUTHORIZATION

Background

Applicability

Marking

Transfer

USE OF SECURE COMMUNICATIONS FOR TRANSMISSION OF CLASSIFIED

INFORMATION

Computer-To-Computer Transmission

Facsimile (Fax) Transmission

Telephone

SHIPMENT OF BULK CLASSIFIED MATERIAL AS FREIGHT

PREPARATION OF MATERIAL FOR SHIPMENT

USE OF BRIEFCASES OR ZIPPERED POUCHES FOR HAND-CARRYING

CLASSIFIED MATERIAL

ESCORT, COURIER, OR HAND-CARRY OF CLASSIFIED MATERIAL

Authority

Packaging Requirements

Responsibilities

Customs, Police and Immigration

Disclosure Authorization

ESCORT, COURIER, OR HAND-CARRY AUTHORIZATION

HAND-CARRYING OR ESCORTING CLASSIFIED INFORMATION ON

COMMERCIAL AIRCRAFT

APPENDIX:

TRANSFER OF CLASSIFIED INFORMATION OR MATERIAL TO

FOREIGN GOVERNMENTS

ENCLOSURE 5: SECURITY EDUCATION AND TRAINING

REQUIREMENT

SECURITY EDUCATION AND TRAINING RESOURCES

INITIAL ORIENTATION

SPECIAL TRAINING REQUIREMENTS

Change 3, 28 July 2020 9 CONTENT

OCA TRAINING

DECLASSIFICATION AUTHORITY TRAINING

ANNUAL REFRESHER TRAINING

CONTINUING SECURITY EDUCATION AND TRAINING

TERMINATION BRIEFINGS

MANAGEMENT AND OVERSIGHT TRAINING

PROGRAM OVERSIGHT

ENCLOSURE 6: SECURITY INCIDENTS INVOLVING CLASSIFIED INFORMATION . 101

INTRODUCTION

CONSEQUENCES OF COMPROMISE

REPORTING AND NOTIFICATIONS

CLASSIFICATION OF REPORTS

SPECIAL CIRCUMSTANCES

Security Incidents Involving Deliberate Compromise, a Foreign Intelligence Service or a Terrorist Organization

Security Incidents Involving Apparent Violations of Criminal Law

Security Incidents Involving COMSEC or Cryptologic Information

Security Incidents Involving SCI

Security Incidents Involving RD and/or FRD

Security Incidents Involving IT

Security Incidents Involving FGI or NATO Information

Security Incidents Involving Classified U.S. Information Provided to Foreign

Governments

Security Incidents Involving SAPs

Security Incidents Involving Improper Transfer of Classified Information

Security Incidents Involving On-Site Contractors

Security Incidents Involving Critical Program Information (CPI)

Security Incidents Involving ACCM-Protected Information

Absence Without Authorization

Coordination with Legal Counsel and the Department of Justice (DoJ)

SECURITY INQUIRIES AND INVESTIGATIONS

Requirement

Coordination with Criminal Investigative Organization or Defense CI Component

Coordination with OCA

Security Inquiries

Security Investigations

INFORMATION APPEARING IN THE PUBLIC MEDIA

RESULTS OF INQUIRIES AND INVESTIGATIONS

ACTIONS TO BE TAKEN BY THE OCA

DAMAGE ASSESSMENTS

VERIFICATION, REEVALUATION, AND DAMAGE ASSESSMENT TIME LINES ... 115

ACTUAL OR POTENTIAL COMPROMISES INVOLVING MORE THAN ONE

AGENCY

DEBRIEFING IN CASES OF UNAUTHORIZED ACCESS

REPORTING AND OVERSIGHT MECHANISMS

Change 3, 28 July 2020 10 CONTENT

APPENDIXES

1. SECURITY INCIDENT REPORTING FORMAT

2. DOJ MEDIA LEAK QUESTIONNAIRE

ENCLOSURE 7: IT ISSUES FOR THE SECURITY MANAGER

OVERVIEW

RESPONSIBILITY

IA ROLES AND FUNCTIONS

IA CONCEPTS

IA Attributes

System Categorization

Certification and Accreditation (C&A)

DATA SPILLS

DISPOSAL OF COMPUTER MEDIA

NON-TRADITIONAL WORK ENVIRONMENTS

REQUIREMENT FOR ENCRYPTION OF CERTAIN UNCLASSIFIED DATA

PII

NEW TECHNOLOGY AND EQUIPMENT

INTERNET-BASED SOCIAL NETWORKING SERVICES

MARKING REQUIREMENTS FOR ELECTRONIC INFORMATION

PROCESSING REQUIREMENTS FOR SPECIFIC TYPES OF INFORMATION

SCI

RD and Critical Nuclear Weapons Design Information (CNWDI)

SAP

Controlled Imagery

NATO Information

CUI

COMPILATION AND DATA AGGREGATION

GLOSSARY

PART I. ABBREVIATIONS AND ACRONYMS

PART II. DEFINITIONS

FIGURES

1. Conditions Governing Access to Official Records for Research Historical Purposes

2. Report of Security Incident Inquiry or Investigation

Change 2, 03/19/2013 11 ENCLOSURE 1

ENCLOSURE 1

REFERENCES

(a) DoD Directive 5143.01, “Under Secretary of Defense for Intelligence (USD(I)),”

November 23, 2005

(b) DoD Instruction 5200.01, “DoD Information Security Program and Protection of Sensitive

Compartmented Information,” October 9, 2008

(c) DoD 5200.1-R, “Information Security Program,” January 14, 1997 (cancelled by Volume

1 of this Manual)

(d) Executive Order 13526, “Classified National Security Information,” December 29, 2009

(e) Executive Order 13556, “Controlled Unclassified Information,” November 4, 2010

(f) Part 2001 of title 32, Code of Federal Regulations

(g) Assistant Secretary of Defense for Command, Control, Communications, and Intelligence

Memorandum, “Revised Alternative Compensatory Control Measures (ACCM)

Guidance,” April 18, 2003 (hereby cancelled)

(h) Assistant Secretary of Defense for Command, Control, Communications, and

Intelligence Memorandum, “Classified Information at Meetings and Conferences,”

October 26, 2001 (hereby cancelled)

(i) DoD 5105.21-M-1, “Department of Defense Sensitive Compartmented

Information Administrative Security Manual,” August 1998

(j) DoD 8910.1-M, “Department of Defense Procedures for Management of

Information Requirements,” June 30, 1998

(k) DoD Directive 5230.09, “Clearance of DoD Information for Public Release,” August

22, 2008

(l) DoD 5200.2-R, “Personnel Security Program,” January 1, 1987

(m) DoD Instruction 5400.04, “Provision of Information to Congress,” March 17, 2009 (n)

Department of Defense/Government Printing Office Security Agreement, 1981

(o) DoD Instruction 7650.01, “Government Accountability Office (GAO) and

Comptroller General Requests for Access to Records,” January 27, 2009

(p) DoD Directive 5405.2, “Release of Official Information in Litigation and Testimony by

DoD Personnel as Witnesses,” July 23, 1985

(q) DoD Directive 5230.20, “Visits and Assignments of Foreign Nationals,” June 22, 2005 (r)

Committee on National Security Systems Instruction 4004, “Destruction and

Emergency Protection Procedures for COMSEC and Classified Material,” August

(s) DoD Instruction 8510.01, “DoD Information Assurance Certification and

Accreditation Process (DIACAP),” November 28, 2007

(t) Chapters 22 and 33 of title 44, United States Code

(u) DoD Directive 5015.2, “DoD Records Management Program,” March 6, 2000

1 Contact Security Directorate, Office of the Deputy Under Secretary of Defense for Intelligence 2 Documents issued by the Committee on National Security Systems (CNSS) are available at www.cnss.gov/full-index.html

(v) DoD Directive 8500.01E, “Information Assurance (IA),” October 24, 2002 http://www.cnss.gov/full-

Change 2, 03/19/2013 12 ENCLOSURE 1

(w) DoD Directive C-5200.19, “Control of Compromising Emanations (U),” May 16, 1995

(x) DoD 5220.22-M, “National Industrial Security Program Operating Manual,” February

28, 2006

(y) Parts 120 through 130 of title 22, Code of Federal Regulations (also known as

“The International Traffic in Arms Regulations”)

(z) DoD Directive 5230.11, “Disclosure of Classified Military Information to

Foreign Governments and International Organizations,” June 16, 1992

(aa) DoD Instruction 2000.16, “DoD Antiterrorism (AT) Standards,” October 2, 2006

(ab) DoD Instruction 5240.05, “Technical Surveillance Countermeasures (TSCM) Program,”

February 22, 2006

(ac) United States Security Authority for NATO Affairs Instruction 1-07, “Implementation of

NATO Security Requirements,” April 5, 2007

(ad) Department of Defense and United Kingdom Ministry of Defense, “Security Implementing

Arrangement,” January 27, 2003

(ae) Chairman of the Joint Chiefs of Staff Manual 3150.29C, “Code Word, Nickname, and

Exercise Terms Report (NICKA) System,” December 7, 2007

(af) DoD Directive 5000.01, “The Defense Acquisition System,” May 12, 2003

(ag) Chairman of the Joint Chiefs of Staff Manual 5720.01B, “Joint Staff Message Management and Preparation,” February 15, 2005

(ah) DoD Directive 5205.07, “Special Access Program (SAP) Policy,” July 1, 2010

(ai) DoD Directive 5210.56, “Carrying of Firearms and the Use of Force by DoD Personnel

Engaged in Security, Law and Order, or Counterintelligence Activities,” April 1, 2011

(aj) DoD Instruction 3224.03, “Physical Security Equipment (PSE) Research, Development, Test, and Evaluation (RDT&E),” October 1, 2007

(ak) Federal Specification FF-L-2740, “Locks, Combination,” current edition

(al) Federal Standard 832, “Construction Methods and Materials for Vaults,” September 1,

(am) Federal Specification FF-L-2937, “Combination Lock, Mechanical,” January 31, 2005, as amended

(an) Federal Specification AA-F-358, “Filing Cabinet, Legal and Letter Size, Uninsulated, Security,” current edition

(ao) Federal Specification AA-V-2737, “Modular Vault Systems,” April 25, 1990, with

Amendment 2, October 30, 2006

(ap) Federal Specification FF-P-110, “Padlock, Changeable Combination (Resistant To Opening

By Manipulation and Surreptitious Attack),” current edition, as amended

(aq) Section 1386 of title 18, United States Code

(ar) Federal Standard 809, “Neutralization and Repair of GSA Approved Containers and Vault

Doors,” current edition

3 Available to authorized recipients from the Central U.S. Registry 4 Contact the Director, International Security Programs, Defense Technology Security Administration, Office of the

Under Secretary of Defense for Policy 5 Restricted distribution. Contact J-3, Office of the Joint Chiefs of Staff 6 This document is For Official Use Only. It is available to authorized recipients at https://ca.dtic.mil/cjcs_directives/index.htm 7 Available through DoD Lock Program at https://locks.navfac.navy.mil at the Documents, Federal Specifications tab for Federal Specifications or Documents, Directives and Guidance tab for Federal Standards and Military

Handbooks.

(as) National Security Agency/Central Security Service Evaluated Product List 02-01, Change 2, 03/19/2013 13 ENCLOSURE 1

“NSA/CSS Evaluated Products List for High Security Crosscut Paper Shredders” (also

Annex A to NSA/CSS Specification 02-01, “High Security Crosscut Paper Shredders”), current edition

(at) National Security Agency/Central Security Service Evaluated Product List 02-02, “NSA/CSS Evaluated Products List for High Security Disintegrators” (also Annex A to

NSA/CSS Specification 02-02, “High Security Disintegrators”), current edition

(au) Military Handbook 1013/1A, “Design Guidelines for Physical Security of Facilities,”

December 15, 1993

(av) Underwriters Laboratories Inc., Standard 634, “Standard for Connectors and Switches for

Use with Burglar-Alarm Systems,” October 12, 2007

(aw) National Security Agency/Central Security Service Policy Manual 3-16, “Control of

Communications Security (COMSEC) Material,” August 2005

(ax) Executive Order 13549, “Classified National Security Information Program for State, Local, Tribal, and Private Sector Entities,” August 18, 2010

(ay) Committee on National Security Systems, National Security Telecommunications and

Information Systems Security Instruction (NSTISSI) No. 7003, “Protective Distribution

Systems (PDS),” December 13, 1996

(az) DoD Instruction 5200.33, “Defense Courier Operations,” June 30, 2011

(ba) DoD 5220.22-R, “Industrial Security Regulation,” December 4, 1985

(bb) Chapter I of title 39, Code of Federal Regulations

(bc) DoD Instruction 8523.01, Communications Security (COMSEC), April 22, 2008

(bd) Intelligence Community Directive 503, “Intelligence Community Information Technology

Systems Security Risk Management, Certification and Accreditation,” September 15,

(be) Department of Defense Foreign Clearance Manual, September 5, 2011

(bf) DoD Instruction 8500.2, “Information Assurance (IA) Implementation,” February 6, 2003

(bg) DoD 5105.38-M, “Security Assistance Management Manual (SAMM),” October 3, 2003

(bh) DoD Directive 8570.01, “Information Assurance Training, Certification, and Workforce

Management,” August 15, 2004

(bi) DoD Instruction 3305.13, “DoD Security Training,” December 18, 2007

(bj) DoD Instruction O-5205.11, “Management, Administration, Oversight of DoD Special

Access Programs (SAPs),” July 1, 1997

(bk) Section 2723 of title 10, United States Code

(bl) Intelligence Community Directive 701, “Security Policy Directive for Unauthorized

Disclosures of Classified Information,” March 14, 2007

(bm) Sections 102, 105, 552 and 552a of title 5, United States Code

(bn) DoD Directive 5230.24, “Distribution Statements on Technical Documents,” March 18, 8 Available through GSA at http://www.gsa.gov/portal/content/103856#Federal Specifications 9 Available from Underwriters laboratories Inc. at http://www.ul.com/global/eng/pages/solutions/standards 10 Available to authorized recipients at www.iad.nsa.smil.mil/resources/library/nsa_office_of_policy_section/index.cfm 11 Available at http://www.dni.gov/electronic_reading_room/ICD_503.pdf 12 Available at https://www.fcg.pentagon.mil 13 Available on JWICS at http://www.intelink.ic.gov/sites/ppr/policyHome/default.aspx 14 Also known and referred to in this volume as “The Freedom of Information Act (FOIA),” as amended 15 Also known and referred to in this volume as “The Privacy Act of 1974, as amended”

(bo) DoD Directive 5240.06, “Counterintelligence Awareness and Reporting (CIAR),” May 17, http://www.gsa.gov/portal/content/103856#Federal http://www.ul.com/global/eng/pages/solutions/standards http://www.iad.nsa.smil.mil/resources/library/nsa_office_of_policy_section/index.cfm http://www.dni.gov/electronic_reading_room/ICD_503.pdf http://www.fcg.pentagon.mil/ http://www.intelink.ic.gov/sites/ppr/policyHome/default.aspx

Change 2, 03/19/2013 14 ENCLOSURE 1

(bp) Committee on National Security Systems, National Security Telecommunications and

Information Systems Security Instruction (NSTISSI) No. 4003, “Reporting and Evaluating

COMSEC Incidents,” December 2, 1991

(bq) Section 3161 of Public Law 105-261, “National Defense Authorization Act for Fiscal Year

1999,” as amended

(br) DoD Directive O-5240.02, “Counterintelligence,” December 20, 2007

(bs) DoD Directive 8000.01, “Management of the Department of Defense Information

Enterprise,” February 10, 2009

(bt) Committee on National Security Systems Policy 18, “National Policy on Classified

Information Spillage,” June 2006

(bu) Committee on National Security Systems Instruction 1001, “National Instruction on

Classified Information Spillage,” February 2008

(bv) Assistant Secretary of Defense for Command, Control, Communications and Intelligence

Memorandum, “Disposition of Unclassified DoD Computer Hard Drives,” June 4, 2001

(bw) Assistant Secretary of Defense for Networks and Information Integration Memorandum, “Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and

Removable Storage Media,” July 3, 2007

(bx) Assistant Secretary of Defense for Networks and Information Integration Memorandum, “Department of Defense (DoD) Guidance on Protecting Personally Identifiable Information

(PII),” August 18, 2006

(by) Director, Administration and Management Memorandum, “Safeguarding Against and

Responding to the Breach of Personally Identifying Information,” September 25, 2008

(bz) Directive-Type Memorandum 09-026, “Responsible and Effective Use of Internet-based

Capabilities,” February 25, 2010

(ca) DoD Directive 8320.02, “Data Sharing in a Net-Centric Department of Defense,”

December 2, 2004

(cb) DoD Instruction 5210.02, “Access to and Dissemination of Restricted Data and Formerly

Restricted Data,” June 3, 2011

(cc) Deputy Secretary of Defense Memorandum, “Protection of NATO Classified Information

Stored, Processed or Transmitted in U.S. Communication and Information (CIS) Systems and Networks,” September 8, 2000

(cd) Deputy Secretary of Defense Memorandum, “Web Site Administration,”

December 7, 1998

(ce) DoD Instruction 5200.39, “Critical Program Information (CPI) Protection Within the

Department of Defense,” July 16, 2008

(cf) DoD 5400.7-R, “DoD Freedom of Information Act Program,” September 4, 1998

(cg) Section 403 of title 50, United States Code (also known as “The National Security Act of

1947,” as amended )

(ch) Executive Order 12333, “United States Intelligence Activities,” December 4, 1981, as amended

(ci) DoD 5220.22-C, “Carrier Supplement to Industrial Security Manual for Safeguarding

Classified Information,” October 1, 1986

16 NTISSI and documents issued by the Committee on National Security Systems (CNSS) are available at www.cnss.gov/full-index.html

(cj) Section 2162 of title 42, United States Code (also known as “The Atomic Energy Act of

1954,” as amended ) http://www.cnss.gov/full-index.html

Change 2, 03/19/2013 15 ENCLOSURE 1

(ck) DoD Instruction 5025.01, “DoD Directives Program,” September 26, 2012

(cl) (Added)(AF) AFI 35-102, “Security and Policy Review Process,” May 4, 2016, as amended

(cm) (Added)(AF) AFMAN 17-1302-O, “Communications Security (COMSEC) Operations,”

April 9, 2020

(cn) (Added)(AF) AFMAN 16-101, “Security Cooperation (SC) and Security Assistance (SA)

Management”, August 2, 2018

(co) (Added)(AF) AFI 16-201, “Air Force Foreign Disclosure and Technology Transfer

Program,” June 2, 2015

(cp) (Added)(AF) AFI 31-101, “Integrated Defense,” March 25, 2020

(cq) (Added)(AF) AFI 16-701, “Management, Administration and Oversight of Special Access

Programs,” February 18, 2014

(cr) (Added)(AF) DAFI 33-360, “Publications and Forms Management,” December 1, 2015

(cs) (Added)(AF) AFI 71-101, Volume 1, “Criminal Investigations Program,” July 1, 2019

(ct) (Added)(AF) AFI 71-101, Volume 4, “Counterintelligence,” July 2, 2019

(cu) (Added)\(AF) DoD Manual 5200.02_AFMAN 16-1405, “Air Force Personnel Security

Program,” August 1, 2018

(cv) (Added)(AF) DoDM 5205.07, Volume 1, “DoD Special Access Program (SAP) Security

Manual: General Procedures,” June 18, 2015

(cw) (Added)(AF) DoDM5220.22V2_AFMAN 16-1406V2, “National Industrial Security

Program: Industrial Security Procedures for Government Activities,” May 8, 2020

(cx) (Added)(AF) AFI 33-322, Records Management and Information Governance

Program, March 23, 2020

(cy) (Added)(AF) AFI 16-1402, “Counter-Insider Threat Program Management” June

17, 2020

(cz) (Added)(AF) FED STD FF-P-110J, “Padlock, Changeable, Combination (Resistant to Opening by Manipulation and Surreptitious Attack,” February 11, 1997

(da) (Added)(AF) DoDD 8100.02, “Use of Commercial Wireless Devices, Services, and

Technologies in the Department of Defense (DoD) Global Information Grid (GIG),”

April 14, 2004

(db) (Added)(AF) DoDD 5205.16, “The DoD Insider Threat Program,” September 30,

(dc) (Added)(AF) USD(I) Memorandum, “Derivative Classification Training,” January

31, 2019

(dd) (Added)(AF) DAFPD 16-14, Security Enterprise Governance, December 31, 2019

(de) (Added)(AF) DAFMAN 16-1404, Volume 1 (title and issuance date TBD)

(df) (Added)(AF) AFMAN 17-1301, “Computer Security (COMPUSEC),” February 12,

(dg) (Added)(AF) AFI 17-130, “Cybersecurity Program Management,” February 13,

(dh) (Added)(AF) USD(I) Memorandum, Clarification of Automated Entry Control

System Minimum Requirements,” October 23, 2013

(Added)(AF) ADOPTED FORMS

(Added)(AF) SF 702, Security Container Check Sheet

Change 2, 03/19/2013 16 ENCLOSURE 1

(Added)(AF) DD Form 254, Department of Defense Contract Security Classification

Specification

(Added)(AF) DD Form 2501, Courier Authorization

(Added)(AF) AF Form 310, Document Receipt and Destruction Certificate

(Added)(AF) AF Form 847, Recommendation for Change of Publication

(Added)(AF) AF Form 1297, Temporary Issue Receipt

(Added)(AF) AF Form 2427, Lock and Key Control Register

(Added)(AF) AF Form 2587, Security Termination Statement

(Added)(AF) AF Form 2583, Request for Personnel Security Action

(Added)(AF) OF 89, Maintenance Record for Security Containers/Vault Doors

Change 2, 03/19/2013 17 ENCLOSURE 2

ENCLOSURE 2

SAFEGUARDING

1. CONTROL MEASURES. DoD Components shall have a system of control measures that ensure access to classified information is limited to authorized persons. The control measures shall be appropriate to the environment in which access occurs and to the nature and volume of the information. The system shall include technical, physical, and personnel control measures.

Administrative control measures, which may include records of internal distribution, access, generation, inventory, reproduction, and disposition, shall be required when technical, physical, and personnel control measures are insufficient to deter and detect access by unauthorized persons. Except as otherwise specified, requests for waivers to the provisions of this Volume shall be submitted in accordance with section 16 of Enclosure 3 of Volume 1.

a. (Added)(AF) Waiver requests for access to collateral classified information shall be submitted through information protection channels to the Director, Security, Special

Program Oversight and Information Protection (SAF/AAZ) in accordance with DoDM

5200.01, Volume 1_AFMAN 16-1404 Volume 1, Information Security Program: Overview, Classification and Declassification (T-1). Waiver requests involving access to Sensitive

Compartmented Information (SCI) shall be submitted to the Air Force Cognizant

Security Authority, AF/A2/6 (T-1). Waiver requests involving Special Access Program

(SAP) information shall be submitted through the SAP security officer to the Air Force

Special Access Program Central Office (SAPCO) (T-1).

b. (Added)(AF) Control measures shall also be considered for international transfer of classified information conducted via security cooperation efforts (T-0). Consistent with

AFMAN 16-101, Security Cooperation and Security Cooperation Management, paragraph

2.7.3.8, U.S. Air Force system planning teams are responsible for surveying security protection of classified information and material and CUI. In addition, U.S. Air Force programs will validate foreign partner’s safeguarding capabilities to provide a commensurate level of protection which is substantially the same degree of security as provided by the U.S. Government (T-1).

c. (Added)(AF) The Chief of Information Protection at each installation hosting extended visits of foreign nationals in accordance with AFI 16-201, Air Force Foreign

Disclosure and Technology Transfer Program, must review and sign the security plan referenced in attachment 11 of AFI 16-201 (T-1).

2. PERSONAL RESPONSIBILITY FOR SAFEGUARDING. Everyone who works with classified information is personally responsible for taking proper precautions to ensure that unauthorized persons do not gain access to classified information. Everyone granted access to classified information is personally responsible for protecting the classified information they know, possess, or control and for complying with the pre-publication security review processes specified in DoDD 5230.09 (Reference (k)). Classified information shall be protected at all

Change 2, 03/19/2013 18 ENCLOSURE 2 times either by storing it as this Volume prescribes or by having it under the personal observation and control of an authorized individual.

3. ACCESS TO CLASSIFIED INFORMATION. Except as provided in sections 5 and 6 of this enclosure and in accordance with section 11 of Enclosure 3 of Volume 1, no person may have access to classified information unless that person has a security clearance in accordance with

DoD 5200.2-R (Reference (l)) and has signed a Standard Form (SF) 312, “Classified Information

Non-Disclosure Agreement” (NDA), and access is essential to the accomplishment of a lawful and authorized Government function (i.e., has a need to know).

a. (Added)(AF) Commanders and Directors grant and suspend an individual’s access to classified information, in accordance with DoDM 5200.01_AFMAN16-14-5. (T-0) This action may not be delegated.

b. (Added)(AF) Activity security managers or security assistants provide administrative support to process approved accesses and terminate accesses (T-3). Once access is granted, the activity security manager or security assistant shall update the Joint

Personnel Adjudication System (JPAS), or its successor system, to reflect access level and

NDA execution (T-3).

c. (Added)(AF) Commanders and Directors will terminate access to classified information when:

(1) (Added)(AF) A person’s honesty, reliability, and trustworthiness become questionable (T-1). Document the termination on AF Form 2587, Security Termination

Statement, and ensure JPAS, or its successor system, is updated (T-3).

(2) (Added)(AF) The DoD Central Adjudication Facility terminates/revokes clearance eligibility, in accordance with DoDM 5200.02_AFMAN 16-1405. Refer to

Enclosure 5, paragraph 9 of this Volume for additional information regarding termination briefings. Document the termination on AF Form 2587, Security Termination

Statement, and ensure JPAS, or its successor system, is updated (T-1).

d. (Added)(AF) Commanders and Directors shall terminate access to classified information when the individual separates or retires from the organization (T-0).

Document the termination on AF Form 2587, and ensure JPAS, or its successor system, is updated (T-1). Individuals shall be debriefed with the following topics covered:

(1) (Added)(AF) Remind individuals of their responsibility to continue to protect classified information and controlled unclassified information to which they had access (T-

0).

(2) (Added)(AF) Discuss procedures for reporting any unauthorized attempt to gain access to such information (T-0).

Change 2, 03/19/2013 19 ENCLOSURE 2

(3) (Added)(AF) Remind individuals of the prohibition for retaining classified information and CUI when leaving the organization (T-0).

(4) (Added)(AF) Include requirements for submitting material intended for public release, as specified in AFI 35-102, Security and Policy Review Process (T-0).

(5) (Added)(AF) Potential civil and criminal penalties as noted on AF Form 2587 for failure to fulfill their continuing security responsibilities (T-0).

e. (Added)(AF) Prior to granting contractors access to classified information, in addition to verifying security clearance eligibility, need-to-know and a signed SF312, information owners will verify the information/accesses are authorized via the DD Form

254 (T-0).

f. (Added)(AF) Commanders and Directors shall only grant U.S. personnel access to

NATO information based on verification of security eligibility and a need-to-know (T-0).

This action may be delegated in writing when the Commander/Director is absent and at geographically separated units. Commanders/Directors, or designee, will:

(1) (Added)(AF) Verify the individual has the proper security access and eligibility for the level of NATO information required (T-0). Ensure JPAS, or its successor system is updated to reflect NATO access (T-1). For access to:

(a) (Added)(AF) COSMIC Top Secret (CTS), the individual must possess a final U.S. Top Secret security clearance (T-0).

(b) (Added)(AF) NATO Secret (NS) and NATO Confidential, the individual must possess a final U.S. Secret security clearance (T-0).

(c) (Added)(AF) CTS Atomic Information (ATOMAL) and NS ATOMAL, the individual must possess a final U.S. Top Secret security clearance and be read in to

Restricted Data (T-0).

(d) (Added)(AF) NATO Confidential ATOMAL, the individual must possess a final U.S. Secret security clearance and read in to Restricted Data (T-0).

(e) (Added)(AF) NATO Restricted (NR), no security clearance is required.

(2) (Added)(AF) Use of the AF Form 2583, Request for Personnel Security Action, is optional.

(3) (Added)(AF) Ensure the individual is briefed that their access has been terminated (T-1).

4. DETERMINING NEED FOR ACCESS. The individual with authorized possession, knowledge, or control of the information has the final responsibility for determining whether a prospective recipient’s official duties requires them to possess or have access to any element or item of classified information, and whether that prospective recipient has been granted the appropriate security clearance by proper authority.

Change 2, 03/19/2013 20 ENCLOSURE 2

5. EMERGENCY AUTHORITY. In emergencies in which there is an imminent threat to life or in defense of the homeland, the Heads of the DoD Components may authorize the disclosure of classified information, including information normally requiring the originator’s prior authorization, to an individual or individuals who are otherwise not routinely eligible for access.

The disclosing authority shall:

5. (Added)(AF) The on-scene Air Force commander may authorize the disclosure of classified information in emergencies where there is an imminent threat to life (e.g. fire, major accident response, natural disaster). Emergencies where there is an imminent threat to the defense of the homeland, the Security Program Executive (SPE), as defined in

DoDM 5200.01, Volume 1_AFMAN 16-1404 Volume 1, Information Security Program:

Overview, Classification and Declassification or Wing Commander may authorize the disclosure of classified information. The disclosing authority shall complete all requirements listed below (T-0).

a. Limit the amount of classified information disclosed to the absolute minimum to achieve the purpose.

b. Limit the number of individuals who receive classified information.

c. Transmit the classified information through approved Federal government channels by the most secure and expeditious method consistent with this Volume, or by other means deemed necessary when time is of the essence.

d. Provide instructions about what specific information is classified and how it should be safeguarded. Information disclosed shall not be deemed declassified as of result of such disclosure or subsequent use by a recipient. Physical custody of classified information must remain with an authorized Federal government entity in all but the most extraordinary circumstances.

e. Provide appropriate briefings to the recipients on their responsibilities not to disclose the information to unauthorized individuals and obtain a signed SF 312.

f. Notify the agency or DoD Component originating of the information and the Deputy

Under Secretary of Defense for Intelligence, and Security (DUSD(I&S)) within 72 hours of the disclosure of classified information, or at the earliest opportunity that the emergency permits but no later than 30 days after the release, by providing:

f. (Added)(AF) Report the disclosure through information protection channels in the chain of command (T-0).

(1) A description of the disclosed information.

(2) Identification of individuals to whom the information was disclosed.

(3) How the information was disclosed and transmitted.

Change 2, 03/19/2013 21 ENCLOSURE 2

(4) Reason for the emergency release.

(5) How the information is being safeguarded.

(6) A description of the briefings provided.

(7) A copy of the signed SF(s) 312.

6. ACCESS BY INDIVIDUALS OUTSIDE THE EXECUTIVE BRANCH. Classified information may be made available to individuals or agencies outside the Executive Branch, as provided in this section, if such information is necessary for performance of a lawful and authorized function, and such release is not prohibited by the originating department or agency.

The Heads of DoD Components shall designate officials to ensure the recipient’s eligibility for access, prior to the release of classified information. (See Volume 1, Enclosure 3, section 11 for requirements for access by individuals inside the Executive Branch.)

a. Congress. DoDI 5400.04 (Reference (m)) provides rules for access to classified information or material by Congress, its committees, members, and staff representatives.

Members of Congress, by virtue of their elected position, are not investigated or cleared by the

Department of Defense.

b. Government Printing Office (GPO). Collateral documents and material of all classifications may be processed by the GPO, which protects the information according to a

DoD/GPO Security Agreement (Reference (n)).

c. Representatives of the Government Accountability Office (GAO). DoDI 7650.01

(Reference (o)) sets forth rules for granting GAO representatives access to classified information that the Department of Defense originates and possesses when such information is relevant to the performance of the statutory responsibilities of that organization. Certifications of security clearances and the basis therefore, shall be accomplished under arrangements between the GAO and the relevant DoD Component. Personal recognition or presentation of official GAO credential cards are acceptable for identification purposes, but not for access to classified

d. Historical Researchers. Persons outside the Executive Branch who are engaged in historical research projects may be authorized access to classified information provided that the

DoD Component Head or senior agency official with classification jurisdiction over the information:

(1) Determines, in writing, that such access is clearly consistent with the interests of national security in view of the intended use of the material to which access is granted by certifying that the requester has been found to be eligible for access pursuant to Reference (l) and section 3 of this enclosure.

(2) Limits access to specific categories of information over which the DoD Component has classification jurisdiction or for which the researcher has the written consent of the DoD

Component or non-DoD agency with classification jurisdiction. The information contained within or revealed by the specified categories must be within the scope of the research.

Change 2, 03/19/2013 22 ENCLOSURE 2

(3) Maintains custody of the classified material at a DoD installation or activity or authorizes access to documents held by the National Archives and Records Administration

(NARA).

(4) Obtains the requester’s agreement to safeguard the information and to submit any notes and manuscripts intended for public release for review by all DoD Components or non-

DoD departments or agencies with classification jurisdiction to determine whether classified information is contained therein. The agreement shall be documented by execution of a statement substantially similar to that in Figure 1.

Change 2, 03/19/2013 23 ENCLOSURE 2

Figure 1. Conditions Governing Access to Official Records by Historical Researchers

To Whom It May Concern:

I understand that the classified information to which I have requested access for historical research purposes is concerned with the national defense or foreign relations of the United States. Unauthorized disclosure could reasonably be expected to cause damage, serious damage, or exceptionally grave damage to the national security depending on whether the information is classified Confidential, Secret, or Top Secret, respectively. If granted access, I therefore agree to the following conditions governing access to the [insert Component or activity] files:

1. I will abide by any rules and restrictions issued in your letter of authorization, including those of other Agencies whose information is interfiled with that of the [insert Component or activity].

2. I agree to safeguard the classified information to which I gain possession or knowledge in a manner consistent with Part 4 of Executive Order 13526, “Classified National Security Information,” and the applicable provisions of the DoD regulations concerning safeguarding classified information, including Volumes 1, 2, and 3 of DoD Manual

5200.01, “DoD Information Security Program.”

3. I agree not to reveal to any person or Agency any classified information obtained because of this access except as authorized in the terms of your authorization letter or a follow-on letter. I further agree that I shall not use the information for purposes other than those set forth in my request for access.

4. I agree to submit my research notes for review to determine if classified information is contained in them before their removal from the specific area assigned to me for research. I further agree to submit my manuscript(s) for a security review before its publication or presentation. In each of these reviews, I agree to comply with any decision of the reviewing official in the interests of the security of the United States, including the retention or deletion of any classified parts of such notes and manuscript whenever the Federal Agency concerned deems such retention or deletion necessary.

5. I understand that failure to abide by the conditions in this statement shall constitute sufficient cause for canceling my access to classified information and for denying me any future access and may subject me to criminal provisions of Federal Law as referred to in Item 6.

6. I have been informed that provisions of title 18 of the United States Code impose criminal penalties, under certain circumstances, for the unauthorized disclosure, loss, copying, or destruction of defense information.

THIS STATEMENT IS MADE TO THE UNITED STATES GOVERNMENT TO ENABLE IT TO EXERCISE

ITS RESPONSIBILITY FOR THE PROTECTION OF INFORMATION AFFECTING THE NATIONAL

SECURITY. I UNDERSTAND THAT ANY MATERIAL FALSE STATEMENT THAT I MAKE KNOWINGLY

AND WILLFULLY SHALL SUBJECT ME TO THE PENALTIES OF TITLE 18, U.S. CODE, SECTION 1001.

Signature:

Witness's Signature:

Date:

Change 2, 03/19/2013 24 ENCLOSURE 2

(5) Authorizes access, in writing, for no more than 2 years from the date of issuance.

The DoD Component may renew access for 2-year periods in accordance with DoD Component-issued regulations.

e. Presidential or Vice Presidential Appointees and Designees. Persons who previously occupied senior policy-making positions to which they were appointed or designated by the

President or Vice President may not remove classified information upon departure from office, as all such material shall remain under the U.S. Government’s security control. Such persons may be authorized access to classified information they originated, reviewed, signed, received, or that was addressed to them while serving as an appointee or designee, provided that the DoD

Component Head or senior agency official with classification jurisdiction for such information:

(1) Determines, in writing, that such access is clearly consistent with the interests of national security in view of the intended use of the material to which access is granted and by certifying that the requester has been found to be eligible for access pursuant to section 3 of this enclosure.

(2) Limits access to items that the person originated, reviewed, signed, or received while serving as a Presidential or Vice Presidential appointee or designee.

(3) Retains custody of the classified material at a DoD installation or activity or authorizes access to documents in the custody of the NARA.

(4) Obtains the requestor’s agreement (SF 312) to safeguard the information and to submit any notes and manuscript for pre-publication review by all DoD Components and non-

DoD departments or agencies with classification jurisdiction to determine that no classified information is contained therein.

f. Use of Classified Information in Litigation. DoDD 5405.2 (Reference (p)) governs the use of classified information in litigation.

g. Special Cases. When necessary in the interests of national security, the Heads of the DoD

Components or their senior agency official may authorize access to classified information by persons outside the Federal government, other than those enumerated in section 5 of this enclosure and paragraphs 6.a through 6.f of this section. Prior to authorizing access, such official must determine that the recipient is reliable, loyal, and trustworthy for the purpose of accomplishing a national security objective; meets the requirements of section 3 of this enclosure; and can and will safeguard the information from unauthorized disclosure. The national security objective shall be stated in the authorization, which shall be in writing. This authority may not be further delegated.

7. VISITS. The Heads of the DoD Components shall establish procedures to…