16-R-0001_Att_8_AF_AO_Approval_SW_Cert_Res.pdf

14 September 2015

AF AO Approval SW Certification Resources for Reciprocity In accordance with the Software Applications Approval Process memo, SW products approved through the following sources are considered approved for use on the AF portion of the DODIN, and reciprocity is exercised for SW resources listed below that are outside of the AF’s purview, unless specifically noted below.

NOTE: PMOs purchasing software need to be conscientious of support IAW AFMAN 33-153, Chapter 3.

DISCLAIMER: The below list is intended as a resource and guide to PMO and Wing ISSMs and in no way represents automatic approval of any SW, HW, or other IT product. As stated in the Software Applications Approval Process memo, ISSMs are responsible for performing due diligence when incorporating any new IT product into their accreditation baseline/boundary. For example, the existence of a specific COTS product STIG does NOT indicate automatic compliance. The PMO/Wing ISSM must securely implement the STIG and mitigate or resolve identified vulnerabilities.

1. AF Evaluated/Approved Products List Description: The AF E/APL is the definitive source for standard desktop, web, and mobile applications formally approved to operate on the AF DODiN NIPR and SIPR environments. The AFNIC/NTS office at Scott AFB manages the process and the SCA for the EPL is at HQ AFPSC/A2/3/6 at Peterson AFB.

Link to AF E/APL: https://cs3.eis.af.mil/sites/afao/Lists/COTSGOTS%20Software/EPL.aspx Link to Approval Request worksheet/org box: https://cs1.eis.af.mil/sites/afnic/sc/SitePages/Home.aspx

2. NSA NIAP/Common Criteria Evaluated Products Lists Description: NSA manages the National Information Assurance Partnership (NIAP), a US government program originated to meet the security testing needs of both consumers and producers of information technology. Through the NIAP's Common Criteria Evaluation and Validation Scheme (CCEVS), approved Common Criteria Testing Laboratories (CCTLs) evaluate Commercial Off-The-Shelf Products. The CCEVS Validation Body: provides technical guidance to CCTLs, validates the results of IT security evaluations for conformance to the International Common Criteria for IT Security Evaluation, and serves as an interface to other nations for the recognition of such evaluations.

Link to NIAP validated products: https://www.niap-ccevs.org/CCEVS_Products/pcl.cfm Link to the CC certified products list: http://www.commoncriteriaportal.org/products/ https://cs3.eis.af.mil/sites/afao/Lists/COTSGOTS%20Software/EPL.aspx https://www.niap-ccevs.org/CCEVS_Products/pcl.cfm http://www.commoncriteriaportal.org/products/ https://cs1.eis.af.mil/sites/afnic/sc/SitePages/Home.aspx

Link: https://aplits.disa.mil/processAPList.action

4. DISA STIG site Description: The Security Technical Implementation Guides (STIGs) and the NSA Guides are the configuration standards for DOD IA and IA-enabled devices/systems. Since 1998, DISA Field Security Operations (FSO) has played a critical role enhancing the security posture of DoD's security systems by providing the Security Technical Implementation Guides (STIGs). The STIGs contain technical guidance to "lock down" information systems/software that might otherwise be vulnerable to a malicious computer attack. If a product has an available and applicable STIG to run against, the PMO may run the product against the STIG and place the results in the system host package with other required actions and artifacts per the Software Application Approval Process memo.

NOTE: The existence of a specific COTS product STIG does NOT indicate automatic compliance. The PMO/Wing ISSM must securely implement the STIG and mitigate or resolve identified vulnerabilities.

Link: http://iase.disa.mil/stigs/Pages/index.aspx

5. AFWay Description: AFWay is a Web-based Air Force system for purchasing IT. The system combines eBusiness and eCommerce processes that guide users through requirement identification, approval and purchase by combining these into one simplified process. AFWay is part of the overall IT Management program that is also supported by other organizations and applications. AFWay provides to the customer the following: Pre-negotiated contracts with leading IT manufacturers and resellers, pricing below manufacturers’ retail prices and GSA pricing, access to thousands of hardware/software products, as well as IT services, ability to accomplish requirements research at one site, and ability to obtain vendor quotes for single or bulk buys through the system.

Link: https://www.afway.af.mil/

6. DISA DoD Mobile Application Store Description: The Mobile Application Store (MAS) capability is an online digital electronic software distribution system that is part of the Mobile Device Management (MDM)-MAS system. Working in conjunction with the MDM, the MAS can deliver, update, and delete applications on the mobile device without the mobile device user having to return the device for service. The objective of an enterprise MAS is to optimize the functionality and distribution of mobile applications to mobile devices while minimizing replication, cost, and downtime.

Links: http://www.disa.mil/Enterprise-Services/Mobility/Apps https://disa.deps.mil/ext/cop/dod_mobility/SitePages/UserCornerHome.aspx

3. DoD Unified Capabilities Approval Products List Description: The DoD Unified Capabilities (UC) APL is established in accordance with the UC Requirements (UCR 2013) document and mandated by the DoD Instruction (DoDI) 8100.04. Its purpose is to maintain a single consolidated list of products that have completed Interoperability (IO) and Information Assurance (IA) certification. Use of the DoD UC APL allows DoD Components to purchase and operate UC systems over all DoD network infrastructures. The APLITS site incorporates JITC testing.

https://aplits.disa.mil/processAPList.action http://iase.disa.mil/stigs/Pages/index.aspx https://www.afway.af.mil/ https://disa.deps.mil/ext/cop/dod_mobility/SitePages/UserCornerHome.aspx http://www.disa.mil/Enterprise-Services/Mobility/Apps

7. AF Enterprise Mobile Application Store(s) Description: AFLINK is free and available now for download. It is presented in several languages on the Apple App Store and the Google Play Store for Android. It is accessible worldwide via those online stores so that Airmen stationed overseas can also stay connected.

Link: http://www.af.mil/News/ArticleDisplay/tabid/223/Article/110442/aflink-mobile-app-keeps-people-connected-to-everything-air-force.aspx

8. DoD Enterprise Software Initiative (ESI) Description: The DoD Enterprise Software Initiative (ESI) is a joint effort in coordination with the federal-wide SmartBUY program to maximize DoD buying power for commercially available information technology and selected services on a DoD-wide basis.

NOTE: Please note that ESI is primarily an acquisition source and should be used as a resource rather than an approval/certification source. ESI also lists resellers – PMOs should be cognizant that resellers could sell products from developers who could be on other excluded products lists or have known security issues. As with any other SW resource site, the IAM must perform security due diligence before incorporating available SW products into their operational environment, and should also be aware that additional/further testing may be required.

Link: http://www.esi.mil/

9. DATA.GOV

Description: Open government data powers software applications that help people make informed decisions – from choosing financial aid options for college to finding the safest consumer products and vehicles. Below are just a few examples of government, community, and business tools that: use open government data from the United States; are accessible, vetted, and available; and are, for the majority, free and do not require registration to use.

Link: http://www.data.gov/applications?q=&currentpage=1

10. Forge.mil Description: Forge.mil is a family of services provided to support the DoD's technology development community. The system enables the collaborative development and use of open source and DoD community source software. For programs and projects that require greater access control, the system supports private collaborative development with an on demand, fee for service offering. These initial software development capabilities are growing to support the full system life-cycle and enable continuous collaboration among all stakeholders including Project Managers, developers, testers, certifiers, operators, and users.

Link: http://www.forge.mil/ http://www.af.mil/News/ArticleDisplay/tabid/223/Article/110442/aflink-mobile-app-keeps-people-connected-to-everything-air-force.aspx http://www.af.mil/News/ArticleDisplay/tabid/223/Article/110442/aflink-mobile-app-keeps-people-connected-to-everything-air-force.aspx http://www.forge.mil/ http://www.esi.mil/ http://www.data.gov/applications?q=&currentpage=1

11. AF Intelligence Community Approved Products List (APL) Description: The 25 AF/A6S Agency Software Evaluation site is the software evaluation site for the 25th AF/A6S, which is the the Authorizing Official (AO) for all AF Sensitive Compartmented Information systems and Collateral (Top Secret and below) Intelligence Surveillance and Reconnaissance (ISR) mission systems. Evaluated products that the AO has permitted to be used by the ISR community are placed on the AF Intelligence Community (IC) APL. Software on the AF Intelligence Community (IC) APL can be implemented so long as the ISSM/PMO adheres to any noted restrictions and mitigates vulnerabilities.

Link to IC APL: https://intelshare.intelink.gov/sites/afisra-a6s/a6sc/Lists/APL Software Analysis Request link: https://intelshare.intelink.gov/sites/afisra-a6s/a6sc/Pages/afisraepl.aspx

12. Army Networthiness SharePoint Portal Description: The Army Networthiness (NW) program was created out of an Army need to address compliance and mitigate risks. Its purpose is to ensure that all applications, systems, devices, Web services, and hardware purchases support Federal, Department of Defense (DoD), and Army guidelines, regulations, and requirements. In effect, the program is to determine whether an application or system is worthy to go on the Army's Enterprise network (LandWarNet). The NW program assesses interoperability and supports the Army's goal for a standard baseline, utilizing Enterprise License Agreements to maximize the reach of our IT dollars. NW was developed in a proactive way to preclude drive-by fielding of systems, serve as a safety-net prior to anything connecting to the LandWarNet (LWN), prevent products from causing damage or interoperability issues, and to mitigate the risks posed to the LWN from numerous threat vectors.

Link: https://army.deps.mil/NETCOM/sites/nw/CoNApproval/Lists/Networthiness%20Data/ https://intelshare.intelink.gov/sites/afisra-a6s/a6sc/Lists/APL https://intelshare.intelink.gov/sites/afisra-a6s/a6sc/Pages/afisraepl.aspx https://army.deps.mil/NETCOM/sites/nw/CoNApproval/Lists/Networthiness%20Data