AFI17-101.pdf_safe.pdf

DEPARTMENT OF THE AIR FORCE

WASHINGTON, DC

AFI17-101_DAFGM2022-01

10 JUNE 2022

REISSUE DATE: 15 JUNE 2023

MEMORANDUM FOR DISTRIBUTION C

MAJCOMs/FOAs/DRUs

FROM: SAF/CN

1800 Air Force Pentagon Washington DC 20330-1800

SUBJECT: Department of the Air Force Guidance Memorandum (DAFGM) to Air Force Instruction (AFI) 17-101, RISK MANAGEMENT FRAMEWORK (RMF) FOR DEPARTMENT

OF THE AIR FORCE INFORMATION TECHNOLOGY (IT)

By Order of the Secretary of the Air Force, this DAFGM immediately changes AFI 17-

101, RISK MANAGEMENT FRAMEWORK (RMF) FOR AIR FORCE INFORMATION

TECHNOLOGY (IT), 6 February 2020. Compliance with this Memorandum is mandatory. To the extent its directions are inconsistent with other Air Force publications, the information herein prevails, in accordance with DAFI 90-160, Publications and Forms Management. Ensure all records generated as a result of processes prescribed in this publication adhere to Department of the Air Force Instruction 33-322, Records Management and Information Governance Program, and are disposed in accordance with the Air Force Records Disposition Schedule, which is located in the Air Force Records Information Management System.

AFI 17-101 is hereby updated to reflect the multiple changes contained within the “Summary of Changes” section of the attached DAFGM.

This Memorandum becomes void after one year has elapsed from the date of this Memorandum, or upon incorporation by interim change to, or rewrite of AFI 17-101, whichever is earlier.

Lauren Barrett Knausenberger, SES, DAF Chief Information Officer

Attachment:

Interim Guidance to AFI 17-101, RISK MANAGEMENT FRAMEWORK (RMF) FOR

DEPARTMENT OF THE AIR FORCE INFORMATION TECHNOLOGY (IT)

AFI17-101_DAFGM2022-01 10 JUNE 2022

SUMMARY OF CHANGES

This guidance provides interim modifications to policy concerning the Department of the Air Force (DAF) implementation of the Department of Defense (DoD) Risk Management Framework. This guidance applies to Chapter 1, Program Overview, by introducing the Fast Track Authorization to Operate (ATO) methodology and documenting policies specific to the Special Access Program (SAP) community; Chapter 3, RMF Roles and Responsibilities, by updating Authorization Official (AO) responsibilities and grade requirements, Information System Owner (ISO), Program Manager (PM), and Information System Security Manager (ISSM) responsibilities, and privacy information identification requirements; and Chapter 4, RMF Methodology, by introducing the DAF Organizational Risk Tolerance Baseline (ORTB), documenting policies specific to the SAP community; updating references to multiple documents; modifying references, abbreviations and acronyms, and terms; incorporating changes in leadership with update to Signature block and an organizational name change from Deputy Chief, Information Officer to Chief Information Officer; and revising purpose paragraph records management statement. The rewrite of AFI 17-101 will change the product number and title to a Department of Air Force (DAF) Instructions to incorporate this DAFGM information.

PURPOSE

* References to AF changed to read DAF for some publications that have been rewritten as DAFs.

* References to “Deputy Chief Information Officer” changed to read “Chief Information Officer” throughout.

(DELETE) Ensure all records created as a result of processes prescribed in this publication are maintained in accordance with Air Force Manual 33-363, Management of Records, and disposed of in accordance with the Air Force Records Disposition Schedule located in the Air Force Records Information Management System.

(ADD) Ensure all records generated as a result of processes prescribed in this publication adhere to Air Force Instruction 33-322, Records Management and Information Governance Program, and are disposed in accordance with the Air Force Records Disposition Schedule, which is located in the Air Force Records Information Management System.

(MODIFY) 1.1 Purpose. This AFI provides implementation instructions for the implementation of the Risk Management Framework (RMF) and Fast Track ATO methodologies for Department of the Air Force (DAF) Information Technology (IT) in accordance with AFPD 17-1, and AFI 17-130, Air Force Cybersecurity Program Management.

(ADD) 1.1.5. The Fast Track ATO methodology shifts the focus from a compliance-based to risk-based approach and is the primary method to assess risk for new IT, including Platform Information Technology (PIT) Systems, and for renewing ATOs. The three tenants of Fast Track are a Cybersecurity Baseline, Threat-based Risk Assessment, and Information Security Continuous Monitoring (ISCM) strategy. The Fast Track ATO-specific implementation can be found in the Fast Track ATO Handbook on the DAF RMF Knowledge Service (KS) website.

(ADD) 1.2.3.1. DAF IS processing both SAP and SCI will adhere to the more restrictive policies of each of the respective SAP and SCI communities.

(MODIFY) 1.2.4. Authority for space mission systems rests with the United States Space Force (USSF) as delegated by United States Strategic Command and United States Space Command.

DAF space systems follow DAF cybersecurity policy and processes; where exceptions exist, this Instruction is annotated accordingly. NOTE: Space systems supporting more than one DoD Component will follow cybersecurity policy and guidance in DoDI 8581.01, Information Assurance (IA) Policy for Space Systems Used by the Department of Defense.

(DELETE) 3.1.6. Serves as the final approval authority for National Security System designations.

(ADD) 3.2.6. Serves as the final validation authority for National Security System designations.

(MODIFY) 3.3.1. Must be a DoD official and a U.S. citizen. The DAF CIO may appoint AOs as Senior AOs (O-7 or SES at a minimum) or Subordinate AOs (O-6 or GS-15 at a minimum) when a Senior AO exists within a boundary. This AO hierarchy will allow Senior AOs to efficiently and effectively manage all IT within their boundaries. (T-1)

(ADD) 3.3.1.1. Subordinate AOs may only sign authorization decision documents for residual risk of moderate to very low. (T-1)

(ADD) 3.3.1.2. Senior AOs must approve all plans of actions and milestones mitigating high/very high risk in accordance with AFI 17-101, 4.7, Authorize System. (T-1)

(ADD) 3.3.1.3. Senior AOs must oversee any escalation to high/very high risk of previously approved moderate or low risk determinations. (T-1)

(MODIFY) 3.3.7. Must ensure verification through the DAF Ports, Protocols, and Services Office (af.pps@us.af.mil) that associated ports (internal and external), internet protocols, and data services of the system/enclave, with the exception of those identified by other policy (i.e., special access program), comply with the requirements outlined in DoDI 8551.01, Ports, Protocols, and Services Management (PPSM). (T-0)

(MODIFY) 3.3.11 Will ensure a DD Form 2930, Privacy Impact Assessment (PIA) is completed for all DAF IT IAW AFI 33-332, Air Force Privacy and Civil Liberties Program. (T-1)

(ADD) 3.9.13. Will ensure, with coordination of the PM staff, periodic reviews, testing, or assessment of assigned IT are conducted at least annually, are properly documented, and IAW the DAF ISCM strategy.

(ADD) 3.10.6. Will ensure Trusted Systems and Networks (TSN) and Supply Chain Risk Management (SCRM) requirements are addressed IAW AFI 63-101/20-101, Integrated Life Cycle Management. (T-2)

(ADD) 3.10.7. Will ensure the development of a Program Protection Plan (PPP) and evaluate key PPP measures (specifically addressing Supply Chain Risk Management, National Interest Determinations, and Defense Production Act) IAW AFI 63-101/20-101 and AFPAM 63-113, Program Protection Planning for Life Cycle Management. (T-2)

(MODIFY) Renumber 3.10.7. to 3.10.8. Will ensure the development and implementation of a cybersecurity strategy for IT IAW AFMAN 17-1402, Air Force Clinger-Cohen Act (CCA) Compliance Guide, and AFI 63-101/20-101, Integrated Life Cycle Management. (T-3)

(ADD) 3.10.9. Will assert Trusted Systems and Network designations via the Information Technology Categorization & Selection Checklist (ITCSC) for DAF IT. (T-3)

(MODIFY) Adjust numbering of remaining 3.10.X paragraphs due to additions above.

Renumber 3.10.6 through 3.10.14 to 3.10.10 through 3.10.20.

(MODIFY) 3.10.20. Review all the data flows and data types associated with their system to determine if PII/PHI data is stored, processed, or transmitted, or if a change is being proposed to the system that would add PII/PHI to a system.

(ADD) 3.10.20.1. In cases where no PII/PHI is present, the DAF ITCSC will serve as a conclusive determination that privacy requirements do not apply to the system. (T-1).

(ADD) 3.10.20.2. In cases where PII/PHI is present, a Privacy Impact Assessment (PIA) (DD Form 2930) must be completed in accordance with AFI 33-332, Air Force Privacy and Civil Liberties Program. (T-0).

(ADD) 3.10.21. Will ensure that once categorization of PII/PHI data is complete, the system will follow existing guidance on completing system security categorization. (T-0).

(MODIFY) 3.12.2. Completes and maintains required cybersecurity certification IAW AFMAN 17-1303. Individuals in this position must be U.S. citizens. (T-0).

(MODIFY)

Table 3.1. DAF RMF Appointment Matrix.

Role Appointed/ Identified By Rank Minimum

Reference(s)

DAF CIO+ SecAF (established) O-9/SES HAF MD1-26, Chief Information Officer

DAF CISO DAF CIO O-7 / SES Title 40 United States Code Section 3554;

DoDI 8510.01

Mission Area Owner

Identified O-7 / SES AFPD 16-14, Security Enterprise Governance;

DoDI 8510.01

Senior AO*+ DAF CIO O-7 / SES 40 USC §3506;

DoDI 8510.01

Subordinate

AO*+

DAF CIO O-6/GS-15 40 USC §3506;

DoDI 8510.01

AODR AO O-5 / GS-14 DoDI 8510.01

SCA*+ DAF CISO O-4 / GS-13 40 USC §3554;

DoDI 8510.01 SCAR SCA Any AFI 17-101 PM+ For programs of record, Service

Acquisition Executive (SAE) (as applicable); otherwise, ISO performs duties.

Any government official

DoDI 5000.02

ISO*+ For programs of record, Service Acquisition Executive (SAE) (as applicable); otherwise, HAF/SAF 3-letter or MAJCOM 2-letter (as applicable)

Any CNSSI No. 4009

IO/Steward Identified by the ISSM Any DoDI 8500.01, NIST SP 800-

37r2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy

ISSE+ PM Any DoDI 8510.01 ISSM*+ PM or ISO Any DoDI 8510.01 ISSO+ ISSM Any DoDI 8510.01 UR ISO Any DoDI 8510.01

1. * Denotes minimum system-level RMF positions

2. + Denotes additional responsibilities and authorities assigned in Attachments

MODIFY) 3.18.1. Department of the Air Force Cybersecurity Technical Advisory Group (DAFCTAG). The DAFCTAG provides technical cybersecurity subject matter experts from across the MAJCOMs and functional communities a forum to facilitate the management, oversight, and execution of the DAF Cybersecurity Program. The DAFCTAG examines cybersecurity-related issues common across DAF entities and provides recommendations to the CISO and Defense Information Assurance Security Accreditation Working Group.

(MODIFY) 3.18.2. Department of the Air Force Risk Management Council (DAFRMC). The DAFRMC provides a forum for the senior cybersecurity professionals to discuss issues concerning cybersecurity risk from a mission and business perspective. The council reviews proposed Mission Area or DAF RMF control overlays, and RMF guidance. The council standardizes the cybersecurity implementation processes for both the acquisition and lifecycle operations for IT. The DAFRMC advises and makes recommendations to existing governance bodies. Finally, the DAFRMC recommends assignment of IT to the appropriate AO for systems that fall outside of all defined authorization boundaries.

(MODIFY) 4.1. Overview. The 7-Step RMF process is based on the process outlined in NIST SP 800-37r2 and DoDI 8510.01 and is illustrated in Figure 4.1. Where possible, this Instruction also identifies steps required for the “Assess Only” (see Chapter 5) process. This process is iterative throughout the entire lifecycle for IT IAW DoDI 5000.02, the DoD Program Manager’s Guidebook for Integrating the Cybersecurity Risk Management Framework (RMF) into the System Acquisition Lifecycle (DoD PM Guidebook), and the DoD Cybersecurity Test and Evaluation Guidebook (DoD Cybersecurity T&E Guidebook).

(ADD) 4.1.3 Fast Track ATO-specific implementation can be found in the Fast Track ATO Handbook. The Fast Track ATO Handbook can be found on the DAF RMF KS at https://rmfks.osd.mil/rmf/Collaboration/Component%20Workspaces/AirForce/Pages/Docu ments.aspx?RootFolder=/rmf/Collaboration/Component%20Workspaces/AirForce/Air%2 0Force%20Shared%20Document%20Library/Base

(MODIFY) 4.3.1 Begin this step by completing the RMF ITCSC and DD Form 2930. During this process, the impact of confidentiality, integrity, and availability is categorized into one of three designations (low, moderate, or high) to address the impact of a potential loss of data.

(MODIFY) 4.3.2 If the program’s primary mission is not represented on the form’s authorization boundary list, the PM or ISO will check “Other” on the ITCSC and submit the document to the DAFRMC for disposition; send to SAF/CNZR Cybersecurity Division, SAF.CNZR.CNZR.Workflow@us.af.mil.

(MODIFY) 4.3.3. IAW AFI 17-110, the Program Manager/ Project Manager must register the IT in DAF IT Investment Portfolio Suite (ITIPS), as the governance tool for the DAF CIO, with the exception of those identified by other policy (i.e., special access programs, space, nuclear command, control, and communication, Joint) to be registered in another repository. (T-2).

(MODIFY) 4.3.5. The dual-signed ITCSC will be posted to ITIPS as an artifact upon initial registration or when a substantial modification or update is planned or completed. The dual-signed ITCSC documents PM and AO concurrence on RMF CATEGORIZE and SELECT elements. (T-1s).

(MODIFY) 4.4. SELECT Security Controls. References DoDI 8510.01, CNSSI No.1253, NIST SP 800-30, NIST SP 800-53r5, and the DoD and DAF RMF KS (OPR: PM/ISO).

(MODIFY) 4.4.1. The process for selection of security controls is documented at DoDI 8510.01, Enclosure 6 Paragraph 2.b. (Users are advised to consult the DoD and DAF RMF KS, and or the DAF SAP Cybersecurity Office milSuite website located at https://www.milsuite.mil/book/groups/usaf-cybersecurity-for-sap/overview until static references are updated).

(MODIFY) 4.4.2.2. Air Combat Command, the DAF Enterprise AO and common control provider, provides Tier 2 Common Controls (Inheritance) available in eMASS for DAF IT use.

(MODIFY) 4.4.5. Tailor controls as required. Every selected control must be accounted for either by the organization or the ISO. If a control is added or de-selected from the baseline (i.e., tagged as not applicable), then a risk-based rationale must be documented in the security plan and POA&M. Note: Special Access Programs must consult the Joint Special Access Program (SAP) Implementation Guide (JSIG) located in the RMF Policy and Guidance section at https://www.dcsa.mil/mc/ctp/tools/ to determine and manage non-tailorable controls.

(MODIFY) 4.5. IMPLEMENT Security Controls. References DoDI 8510.01, NIST SP 800- 53r5, applicable security technical implementation guides, security requirements guides, the DAF Organizational Risk Tolerance Baseline (ORTB), and the DoD and DAF RMF KS. (OPR:

PM/ISO).

(ADD) 4.5.1. The DAF ORTB is a Tier 1 (see Note), organizational tool that provides scoping considerations such as prioritization and importance, and introduces the order in which security controls or control enhancements are to be implemented. Areas of consideration for the DAF ORTB include policy/regulatory, technology, physical infrastructure, system component allocation, operational/environmental, public access, scalability, common control, and security objective.

(ADD) 4.5.2. Control implementation focuses on identifying and managing the most critical IT risks as early in the process as possible. The ORTB leverages the Control Criticality Rating schemes in eMASS to facilitate and provide visibility of this requirement and establish an implementation order.

(ADD) 4.5.3. Except as otherwise noted, all controls are tailorable, but will be added or removed only as a function of specified, risk-based determination. (T-1).

NOTE: Implementation priorities are comprehensive, in that identification and management of High, Moderate, or Low risks includes all determined risks at that level spanning all 3 risk Tiers consistent with the three-tiered approach to RMF governance.

For information on the three-tiered approach to cybersecurity risk management see DoDI 8510.01, Enclosure 4, Figure 2.

(ADD) 4.5.4. Every selected control must be accounted for either by the organization or the ISO or PM/SM. If a selected control is not implemented, then the rationale for not implementing the controls must be documented in the security plan and POA&M. (Tier 0)

(ADD) 4.5.5. An expanded view of ORTB components is provided via the ORTB spreadsheet on the DAF RMF KS (Search: ORTB).

(ADD) 4.6.1 For Fast Track, conduct cyber risk assessment IAW Fast Track Handbook.

(MODIFY) 4.7. AUTHORIZE System. After reviewing the security authorization documentation, the AO or subordinate AO formally accepts or rejects risk by authorizing the IT through an interim authority to test (IATT), authorization to operate (ATO), authorization to operate with conditions (ATOc), or a denial of authorization to operate (DATO). References DoDI 8510.01, enclosure 6 (OPR: AO/AODR).

(ADD) 4.7.2.5. For SAP systems, AOs ensure ISSMs, ISOs, and PMs follow amplifying guidance contained in the most current Risk Posture Guidance for DAF SAP Information Technology (IT) letter located at https://www.milsuite.mil/book/docs/DOC-662288.

(MODIFY) 4.8. Denial of Authorization to Operate (DATO).

(MODIFY) 4.8.1. If risk is determined to be unacceptable when compared to the mission assurance requirement, the AO or subordinate AO, in collaboration with all program stakeholders, will issue a DATO. If the system is already operational, the responsible AO will issue a DATO and operation of the system will cease immediately. Network connections will be immediately terminated for any system that is issued a DATO. (T-0).

(MODIFY) 4.8.2. Upon issuing the DATO, the AO will provide a copy of the issued document to SAF/CN via SAF.CNZR.CNZR.Workflow@us.af.mil. (T-1).

(DELETE) 4.10.2. Air Force Information Assurance Platform Information Technology (PIT) Guidebook. The PIT Guidebook provides clarity on the information cybersecurity activities required for all PIT. This includes weapon systems, medical systems, industrial control systems, armament systems, test systems, etc., that qualify as PIT. The Guidebook should be used to develop local procedures, as enhancement to RMF for PIT that correspond with the product being developed or procured. The Guidebook suggests best practices to be followed in ensuring cybersecurity is “built-in” to the product, but allows local variations. The primary use of the Guidebook is for acquisition of new PIT and to provide guidance on applicability of the RMF to legacy PIT.

(ADD) 4.10.10. Cybersecurity professionals will use the Joint Special Program Implementation Guide (JSIG), located at in the RMF Policy and Guidance section at https://www.dcsa.mil/mc/ctp/tools/ for enhanced cybersecurity configurations and processes.

(ADD) 4.10.11. Fast Track ATO Handbook. The Fast Track ATO Handbook identifies the methods used for conducting agile and effective assessments on all DAF IT (IS and PIT Systems) pursuing this RMF ATO process consistent with DoD and DAF guidance. It describes the process for presenting results, including pertinent documentation needed for review by the SCA and AO, to make risk-informed decisions, streamline the authorization process, and maintain visibility of cybersecurity risk posture. The Fast Track ATO Handbook can be found on the DAF RMF KS at https://rmfks.osd.mil/rmf/Collaboration/Component%20Workspaces/AirForce/Pages/Docu ments.aspx?RootFolder=/rmf/Collaboration/Component%20Workspaces/AirForce/Air%2 0Force%20Shared%20Document%20Library/Base

(ADD) 4.10.12. DoD Cybersecurity Test and Evaluation Guidebook. The purpose of this updated guidebook is to promote data-driven mission-impact-based analysis and assessment methods for cybersecurity test and evaluation (T&E) and to support assessment of cybersecurity, system cyber survivability, and operational resilience within a mission context by encouraging planning for tighter integration with traditional system T&E. The guidebook can be found on the DAF RMF KS at https://rmfks.osd.mil/rmf/Collaboration/Component%20Workspaces/AirForce/Air%20For ce%20Shared%20Document%20Library/Base/Fast%20Track%20ATO/DoD%20Cyberse curity%20T&E%20Guidebook,%2010%20Feb%202020.pdf

References

(ADD) Department of Defense (DoD) Joint Special Access Program (SAP) Implementation Guide (JSIG), 11 April 2016

(ADD) SAF/AA and SAF/CN Dual Signed Memorandum, “Risk Posture Guidance for DAF Special Access Program (SAP) Information Technology (IT),” 25 Aug 2021

(ADD) DoD Senior Information Security Officer Memorandum, “Authorizations to Operate Extensions and Cybersecurity Function Prioritization Guidance,” 3 April 2020

(ADD) Department of the Air Force, Cybersecurity Risk Authorization Guidance, 8 April 2020

(ADD) Current FY 2021 CIO Federal Information Security Modernization Act (FISMA) Metrics

Abbreviations and Acronyms

(ADD) DATO—Denial of Authorization to Operate

Terms

(MODIFY) Chief Information Security Officer (CISO)—Official responsible for carrying out the chief information officer responsibilities under the Federal Information Security Modernization Act (FISMA) and serving as the CIO's primary liaison to the agency's authorizing officials (AO), information system owners (ISO), and information systems security officers (ISSO). NOTE: Also known as senior information security officer (SISO) or senior agency information security officer (SAISO).

(ADD) DAF Organizational Risk Tolerance Baseline (ORTB) - The DAF ORTB is a “Control Baseline,” the set of controls that are applicable to information or an information system to meet legal, regulatory, or policy requirements as well as address protection needs for the purpose of managing risk.

Additional information about the DAF ORTB can be found in the DAF ORTB Implementation Guide located on the DAF RMF KS at https://rmfks.osd.mil/rmf/Collaboration/Component%20Workspaces/AirForce/Pages/Docu ments.aspx?RootFolder=%2Frmf%2FCollaboration%2FComponent%20Workspaces%2F AirForce%2FAir%20Force%20Shared%20Document%20Library%2FBase%2FDAF%20 ORTB&FolderCTID=0x0120008CEFE2A54FED0C4D8435348C1B283FC5&View=%7BE 0F6B4EF%2D0419%2D466B%2DBsEBC%2DB499D12939F3%7D.

BY ORDER OF THE SECRETARY

OF THE AIR FORCE

AIR FORCE INSTRUCTION 17-101

6 FEBRUARY 2020

Cyberspace

RISK MANAGEMENT FRAMEWORK

(RMF) FOR AIR FORCE

INFORMATION TECHNOLOGY (IT)

COMPLIANCE WITH THIS PUBLICATION IS MANDATORY

ACCESSIBILITY: Publications and forms are available for downloading or ordering on the e-Publishing website at www.e-Publishing.af.mil

RELEASABILITY: There are no releasability restrictions on this publication

OPR: SAF/CNZ

Supersedes: AFI17-101, 23 January 2020

Certified by: SAF/CNZ (Ms. Wanda E. Jones-Heath)

Pages: 41

This Air Force Instruction (AFI) implements Air Force Policy Directive (AFPD) 17-1, Information Dominance Governance and Management, AFPD 33-3, Information Management, and associated processes outlined on the AF RMF Knowledge Service (KS), for managing the life-cycle cybersecurity risk to Air Force Information Technology (IT). This instruction is consistent with Chairman Joint Chiefs of Staff Instruction 6510.01F, Information Assurance (IA) and Support to Computer Network Defense (CND). This publication applies to all military (active, reserve, guard), civilians, and contractors. Ensure all records created as a result of processes prescribed in this publication are maintained in accordance with Air Force Manual 33-363, Management of Records, and disposed of in accordance with the Air Force Records Disposition Schedule located in the Air Force Records Information Management System. Refer recommended changes and questions about this publication to the Office of Primary Responsibility listed above using the Air Force Form 847, Recommendation for Change of Publication; route AF Forms 847 from the field through the appropriate chain of command. This publication may be supplemented at any level, but all supplements must be routed to the Office of Primary Responsibility listed above for coordination prior to certification and approval. The authorities to waive wing/unit level requirements in this publication are identified with a Tier (“T-0, T-1, T-2, T-3”) number following the compliance statement. See Air Force Instruction (AFI) 33-360, Publications and Forms Management, Table

1.1 for a description of the authorities associated with the Tier numbers. Submit requests for waivers through the chain of command to the appropriate Tier waiver approval authority, or alternately, to the Publication Office of Primary Responsibility (OPR) for non-tiered compliance items.

2 AFI17-101 6 FEBRUARY 2020

SUMMARY OF CHANGES

This document has been substantially revised and needs to be completely reviewed. Major changes include integration of Special Access Programs into the 17-series, updates to the IT Categorization and Selection Checklist (ITCSC) processes, and the incorporation of Air Force Guidance Memorandum 2018-01 in its entirety.

Chapter 1—PROGRAM OVERVIEW 5

1.1. Purpose

Figure 1.1. Air Force IT Categories

1.2. Applicability

1.3. Objectives

Chapter 2—COORDINATING ROLES AND RESPONSIBILITIES 7

2.1. Under Secretary of the Air Force (USecAF)

2.2. Administrative Assistant to the Secretary of the Air Force (SAF/AA)

2.3. Secretary of the Air Force for Acquisition (SAF/AQ)

2.4. Deputy Chief of Staff, Intelligence, Surveillance, and Reconnaissance (AF/A2/6). 7

Chapter 3—RMF ROLES AND RESPONSIBILITIES 8

3.1. Secretary of the Air Force (SAF), Office of the Deputy Chief Information Officer

(SAF/CN)

3.2. Chief Information Security Officer (CISO), SAF/CNZ

3.3. Authorizing Official (AO)

3.4. Air Force Enterprise Authorizing Official (AF Enterprise AO)

3.5. AO Designated Representative (AODR)

3.6. Security Control Assessor (SCA)

3.7. Security Controls Assessor Representative (SCAR)

3.8. Agent of the Security Controls Assessor (ASCA)

3.9. Information System Owners (ISO)

3.10. Program Manager (PM)

3.11. Unit Communications Squadron Commander (CS/CC)

3.12. Information System Security Manager (ISSM)

AFI17-101 6 FEBRUARY 2020 3

3.13. Information System Security Officer (ISSO)

3.14. Information Systems Security Engineer (ISSE)

3.15. Information Owner/Steward

3.16. User Representative

3.17. Additional Responsibilities

Table 3.1. AF RMF Appointment Matrix

3.18. Cybersecurity Forums

Chapter 4—RMF METHODOLOGY 19

4.1. Overview

Figure 4.1. RMF for AF IT

4.2. PREPARE

4.3. CATEGORIZE System

4.4. SELECT Security Controls

4.5. IMPLEMENT Security Controls

4.6. ASSESS Security Controls

4.7. AUTHORIZE System

4.8. Denial of Authorization to Operate

4.9. MONITOR Security Controls

4.10. Resources and Tools

Chapter 5—AF IT ASSESS ONLY REQUIREMENTS 25

5.1. PIT Subsystems, PIT Products, IT Services, and IT Products

5.2. Reciprocity

5.3. Evaluated Products

5.4. Contingencies

5.5. Software Products Excluded from AF SACA

Chapter 6—APPROVAL TO CONNECT (ATC) PROCESS 28

6.1. Overview

6.2. Duration and Expiration

6.3. Note:

4 AFI17-101 6 FEBRUARY 2020

6.4. Connection to the DoD Information Network

6.5. Connection to the Air Force Information Networks (AFIN)

6.6. Guest System Registration

6.7. ATC Process for Air Force Functional/Mission Systems

6.8. Continuous Monitoring

6.9. Denial of Approval to Connect

Chapter 7—SECURITY CONTROL OVERLAYS 31

7.1. Overview

7.2. Policy

7.3. Development and Approval Process

7.4. Review and Coordinate Finalized Overlay

7.5. Coordinate with Defense Information Systems Agency to Implement Overlay in eMASS

Chapter 8—TRANSFER OF IT BETWEEN AUTHORIZING OFFICIALS 33

8.1. Overview

8.2. Transition Process

8.3. IT With No AO Assigned

Chapter 9—FINANCIAL IMPROVEMENT AND AUDIT READINESS (FIAR)

INFORMATION TECHNOLOGY (IT) 35

9.1. Overview

9.2. Definition

9.3. Responsibilities

9.4. FM Security control Implementation Guidance

Attachment 1—GLOSSARY OF REFERENCES AND SUPPORTING INFORMATION 37

AFI17-101 6 FEBRUARY 2020 5

Chapter 1

PROGRAM OVERVIEW

1.1. Purpose. This AFI provides implementation instructions for the implementation of the Risk Management Framework (RMF) methodology for Air Force (AF) Information Technology (IT) in accordance with AFPD 17-1, and AFI 17-130, Air Force Cybersecurity Program Management.

1.1.1. The RMF incorporates strategy, policy, awareness/training, assessment, continuous monitoring, authorization, implementation, and remediation.

1.1.2. The RMF aligns with Secretary of the Air Force/ Deputy Chief Information Officer (SAF/CN) strategic goals and objectives key concept of cybersecurity that works which requires robust risk assessment and management.

1.1.3. The RMF process encompasses life cycle risk management to determine and manage the residual cybersecurity risk to the AF created by the vulnerabilities and threats associated with objectives in military, intelligence, and business operations.

1.1.4. Privacy and security controls are implemented based on the assessed and mitigated residual risk. The controls align with Department of Defense Instruction (DoDI) 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT) and are documented in the RMF security authorization package for AF IT.

Figure 1.1. Air Force IT Categories.

6 AFI17-101 6 FEBRUARY 2020

1.2. Applicability.

1.2.1. This includes IT supporting research, development, test and evaluation (T&E), and DoD-controlled IT operated by a contractor or other entity on behalf of the DoD. AF IT (see Figure 1.1) includes but is not limited to: information systems (major applications and enclaves), platform information technology (PIT) (PIT systems, PIT subsystems, and PIT products), IT services (internal & external), IT products (software, hardware, and applications) and boundary requirements for assess and authorize and assess only (see Chapter 5).

1.2.2. Risk management authorities for special access programs rest with SAF/CN and are executed via this instruction unless higher level guidance exists, in which case compliance will default to the more restrictive policies and directives. The responsible office in support of special access programs IT risk management is the Administrative Assistant to the Secretary of the Air Force and Air Force Senior Security Official (SAF/AA).

1.2.3. This AFI does not apply to the protection of sensitive compartmented information systems (IS) or intelligence, surveillance, reconnaissance mission and mission support systems.

1.2.4. Authority for AF space systems rests with AF Space Command as delegated by United States Strategic Command. AF space systems follow AF cybersecurity policy and processes;

where exceptions exist, this Instruction is annotated accordingly. NOTE: Space systems supporting more than one DoD Component will follow cybersecurity policy and guidance in DoDI 8581.01, Information Assurance (IA) Policy for Space Systems Used by the Department of Defense.

1.2.5. For IT not centrally managed or that has yet to be assigned an authorizing official (AO), the unit responsible for ownership or operation of the IT shall assign duties for the minimum RMF relevant roles (see Table 3.1) required to comply with RMF. The duties shall include the roles and responsibilities for reporting, oversight, and risk management to the AF.

1.3. Objectives.

1.3.1. The RMF provides a disciplined and structured process to perform AF IT security and risk management activities and to integrate those activities into the system development life cycle. The RMF is a dynamic approach to risk management that effectively manages mission and cybersecurity risks in a diverse environment of complex, evolving, and sophisticated cyber threats and vulnerabilities.

1.3.2. The RMF ensures AF IT assets are assessed for cybersecurity risk. Discovered weaknesses are documented in a plan of action and milestones (POA&M) to mitigate residual risk. An AO, identified at Table 3.1, who is supported by an RMF team, accepts the risk for his/her area of responsibility, in accordance with DoDI 8510.01, and the Air Force RMF Knowledge Service (See Resources and Tools).

AFI17-101 6 FEBRUARY 2020 7

Chapter 2

COORDINATING ROLES AND RESPONSIBILITIES

2.1. Under Secretary of the Air Force (USecAF). The Under Secretary of the Air Force serves as the Department of the Air Force’s Chief Information Officer (CIO) and serves as SecAF’s agent in assigned policy and program domains.

2.2. Administrative Assistant to the Secretary of the Air Force (SAF/AA).

2.2.1. Works with the Air Force Chief Information Security Officer (CISO/ SAF CNZ) to oversee the establishment of risk tolerance and security controls for IT owned by Air Force organizations.

2.2.2. Provides cybersecurity implementation guidance to the CISO in support of Air Force operational requirements.

2.2.3. Supports identification and oversight of tools to maintain visibility of the security posture of IT throughout the Air Force.

2.3. Secretary of the Air Force for Acquisition (SAF/AQ).

2.3.1. Acquires AF electronic systems including: commercial-off-the-shelf systems, or non-developmental item programs.

2.3.2. Works with the CISO to oversee the establishment of risk tolerance and security controls for AF IT. Provides guidance to organizations on how to implement cybersecurity solutions for operational requirements.

2.3.3. Ensures all security controls are translated into security requirements via systems security engineering and are written into the system requirement document (SRD) on all new and upgrade capability developments.

2.4. Deputy Chief of Staff, Intelligence, Surveillance, and Reconnaissance (AF/A2/6).

2.4.1. Maintains visibility of the cybersecurity posture of AF sensitive compartmented information and the DoD portion of the intelligence mission area IT through automated assessment and authorization tools.

2.4.2. Oversees the establishment of risk tolerance and baseline security controls for AF sensitive compartmented information and DoD portion of the Intelligence Mission Area IT.

2.4.3. Consults with SAF/CNZ as appropriate.

2.4.4. Provides RMF implementation guidance to AF intelligence surveillance and reconnaissance systems and network organizations.

8 AFI17-101 6 FEBRUARY 2020

Chapter 3

RMF ROLES AND RESPONSIBILITIES

3.1. Secretary of the Air Force (SAF), Office of the Deputy Chief Information Officer

(SAF/CN). SAF/CN:

3.1.1. Reports directly to USecAF for accomplishment of SAF/CN responsibilities.

3.1.2. Provides direction, policy, guidance and oversight for all matters pertaining to the formulation, review, and execution of plans, policies, programs, and budgets in support Air Force Cybersecurity program and Risk Management Framework (RMF) implementation.

3.1.3. Appoints the Chief Information Security Officer (CISO) who develops, implements, maintains, and enforces the AF Cybersecurity Program.

3.1.4. Appoints AOs in coordination with the appropriate mission area owner.

3.1.5. Provides guidance to organizations on how to implement cybersecurity solutions for operational requirements in support of established national, DoD, Joint Chiefs of Staff, or AF security controls for IT and remain within established risk tolerance levels.

3.1.6. Serves as the final approval authority for National Security System designations.

3.1.7. Maintains visibility of the cybersecurity posture for AF IT through automated tools or designated repositories in support of Air Force CIO and appointed AOs.

3.1.8. Ensures an IS owner (ISO) is appointed for all AF IT.

3.1.9. Appoints the AF Chief Architect with responsibility for the AF Cybersecurity Architecture IAW AFI 17-140, Architecting.

3.1.10. Is responsible for common control identification and implementation across the Air Force Information Networks.

3.2. Chief Information Security Officer (CISO), SAF/CNZ. Will develop, implement, maintain, and enforce the AF Cybersecurity Program and the RMF process, roles, and responsibilities. The CISO will advocate for any budgets associated with duties below and advocate for AF-wide cybersecurity solutions through the planning, programming, budget and execution process on behalf of the SAF/CN. The CISO is required to be a DoD official (O-7 or SES at a minimum) and a United States citizen. (T-1) The CISO:

3.2.1. Completes training and maintains cybersecurity certifications IAW AFMAN 17-1303, Cybersecurity Workforce Improvement Program.

3.2.2. Monitors, evaluates, and provides advice to the SAF/CN regarding AF cybersecurity posture.

3.2.3. Coordinates with the SAF/CN and AOs, ensure the cybersecurity risk posture, risk tolerance levels, and risk acceptance decisions for AF IT meet mission and business needs.

3.2.4. Serves as the security control assessor (SCA) or appoints SCAs.

3.2.5. Provides guidance and direction for the agent of the security control assessor (ASCA) establishment and licensing in support of RMF requirements.

AFI17-101 6 FEBRUARY 2020 9

3.2.6. Oversees the establishment and enforcement of the AF RMF, roles, and responsibilities;

review approval thresholds and milestones within the RMF.

3.2.7. Serves as the chair of the Air Force Risk Management Council.

3.2.8. Participates in Federal, joint, DoD, and AF cybersecurity and RMF technical working groups and forums (e.g., Defense Information Assurance Security Accreditation Working Group).

3.2.9. Adjudicates IT determinations, when a conflict in the IT determination process is identified, in coordination with the Air Force Risk Management Council.

3.2.10. Appoints AF members to the DoD RMF Technical Advisory Group.

3.2.11. Reviews and approves Privacy Impact Assessments (PIAs) submitted IAW AFI 33- 332, The Air Force Privacy and Civil Liberties Program. The approval of the privacy impact assessment cannot be delegated.

3.2.12. Ensures AF RMF guidance is posted to the AF Component Workspace portion of the DoD Knowledge Service and is consistent with DoD policy and guidance.

3.3. Authorizing Official (AO). The AO is the official with the authority and responsibility for accepting risk for an IT system. With the exception of unmitigated “Very High” and “High” risk, (see Terms) the AO balances the level of risk for a system with mission requirements. The AO is the only person with authority to grant authorization decisions within their area of responsibility.

All AOs have the flexibility in augmenting, executing, and implementing RMF for systems in their AOR. For example, an AO can create a community-specific guidebook to better clarify guidance.

AOs:

3.3.1. Must be a DoD official (O-7 or SES at a minimum) and a U.S. citizen. (T-1).

3.3.2. Will complete training and certification requirements IAW AFMAN 17-1303. (T-1).

3.3.3. Are appointed by SAF/CN, in coordination with the appropriate Mission Area Owner.

The appointment grants authority to authorize IT as defined in the AO appointment memo.

3.3.4. Advocate for cybersecurity-related positions in accordance with DoDI 8500.01, (T-0) AFI 17-130, and AFMAN 17-1303. (T-2)

3.3.5. Must ensure an IS owner is appointed prior to issuing an authorization decision. (T-1)

3.3.6. Ensure ISOs participate throughout the RMF process and understand the risk imposed on the mission due to operating the IT.

3.3.7. Must ensure verification through the AF Ports, Protocols, and Services Office (af.pps@us.af.mil) that internet protocols, data services, and associated ports (internal and external) of the system/enclave comply with the requirements outlined in DoDI 8551.01 Ports, Protocols, and Services Management (PPSM). (T-0)

3.3.8. Assist the SAF/CN in providing guidance to organizations on how to implement solutions for operational requirements exceeding the established National, DoD, Joint Chiefs of Staff, or AF baseline controls for IT.

10 AFI17-101 6 FEBRUARY 2020

3.3.9. Will approve initial National Security System designations via the Information Technology Categorization & Selection Checklist for AF IT. (T-1) NOTE: The IT Categorization and Selection Checklist (ITCSC) is available on the Air Force RMF Knowledge Service (See Resources and Tools).

3.3.10. Must render authorization decisions that balance mission needs with security concerns for IT within the AO’s area of responsibility. The authorization decision documentation will be digitally signed and generated via Enterprise Mission Assurance Support Service (eMASS).

Any exceptions to, or conditions of, the authorization decision must be articulated within the authorization decision document. (T-1)

3.3.11. Will ensure a Privacy Impact Assessment (DD Form 2930) is completed for all IS. (T- 3)

3.3.12. Will review the security assessment report, risk assessment report, and plan of actions and milestones to ensure there is a clearly defined course of action (see also National Institute of Standards (NIST) Special Publication (SP) 800-30, Guide for Conducting Risk Assessments). An AO may downgrade or revoke an authorization decision at any time. (T-3)

3.3.13. Will review and approve the security assessment plan, the security plan, and system-level Information Security Continuous Monitoring (ISCM) strategy. (T-3)

3.3.14. Must ensure all AF IT comply with DoD and AF connection approval processes. See Chapter 5, Approval to Connect (ATC) Process. (T-1)

3.3.15. Will not delegate authorization decision authority (i.e., to formally accept risk for a system) in accordance with DoDI 8510.01. (T-0)

3.3.16. Note: Appointment letters and AO boundaries are located on the AF RMF Knowledge Service.

3.4. Air Force Enterprise Authorizing Official (AF Enterprise AO). The AF Enterprise AO is the only authority permitted to grant an approval to connect (ATC) to Air Force Information Networks. ATC authorities for other AF appointed AO’s may be approved by SAF/CN in coordination with the Enterprise AO. In addition to the AO responsibilities in paragraph 3.3 above, the Enterprise AO:

3.4.1. Will establish acceptable security controls and risk tolerance for connecting to the Air Force Information Network and provide guidance to implementing organizations to mitigate risk commensurate with established risk tolerance. (T-1)

3.4.2. Must, at a minimum, review the security authorization package for all requests to connect to the Air Force Information Network and assess the impact to enterprise community risk. (T-2)

3.4.3. Will render Air Force Information Network connection decisions in the form of an approval to connect (see Chapter 6) for non-AF systems and for AF systems falling under another AO. (T-2)

3.4.4. Expediently respond to urgent/emergency requests to connect to the Air Force Information Network. This may be delegated to an Enterprise AO designee.

AFI17-101 6 FEBRUARY 2020 11

3.5. AO Designated Representative (AODR). The AODR:

3.5.1. Will be appointed by the AO, and at a minimum, be an O-5 or GS-14. Appointments will be in writing (to include all duties and responsibilities) to support the RMF. Digital signatures are authorized for appointment letters. (T-1)

3.5.2. Note: This role can be supplemented with contractor support; however contractors are not permitted to make decisions on behalf of the government and may only provide advice and guidance.

3.5.3. Must complete AO training and any other training or certification requirements consistent with assigned duties and responsibilities. (T-1)

3.5.4. Will provide recommendations to the AO to render authorization decisions based on input from the SCA, ISO, Program Manager (PM), and other AOs and AO Designated Representative (AODR). (T-3)

3.5.5. Will perform any and all duties of an AO except for accepting risk by issuing an authorization decision IAW DoDI 8510.01. (T-0)

3.6. Security Control Assessor (SCA). The SCA:

3.6.1. Will be appointed by the CISO and will be at least an O-4 or GS-13 with the authority and responsibility for the assessment determination within their assigned area of responsibility.

(T-1)

3.6.2. Must complete training and maintain appropriate cybersecurity certification IAW AFMAN 17-1303. (T-1) Note: It is highly recommended SCAs complete both the AO training module and attain the Committee on National Security Systems Instruction (CNSSI) No. 4016, National Information Assurance Training Standard for Risk Analysts, certificate for supplemental training (See Resources and Tools).

3.6.3. Will ensure the development of the security assessment plan and ensure its integration into the program office’s Test and Evaluation Master Plan IAW DoDI 5000.02, Operation of the Defense Acquisition System. (T-0)

3.6.4. Must prepare the security assessment report documenting the issues, findings, and recommendations from the security control assessment, and reassess remediated controls, as required. (T-3)

3.6.5. Will periodically assess security controls employed within, and inherited by the IT IAW the Information Security Continuous Monitoring strategy. (T-3)

3.7. Security Controls Assessor Representative (SCAR). This position may be an organic or contracted resource. Should the security controls assessor representative be a contractor, they are not permitted to make decisions on behalf of the government but can only provide advice and guidance. The security controls assessor representative works with the Program Manager (PM), IS security manager (ISSM), IS security officer (ISSO), and RMF team to assess security controls for the security controls assessor. The security controls assessor representative:

3.7.1. Will complete training and maintain appropriate cybersecurity certification IAW AFMAN 17-1303. (T-2) Note: It is recommended that Security Controls Assessor Representatives (SCAR) also complete the AO training module and attain the CNSSI No. 4016 certificate for supplemental training.

12 AFI17-101 6 FEBRUARY 2020

3.7.2. Ensures security controls are implemented IAW the security plan and are assessed IAW the Security Authorization Package in accordance with DoDI 8510.01. (T-0)

3.7.3. Validates assessment results from others' (e.g., Agent of the Security Controls Assessor or ISSM) hands-on, comprehensive evaluations of the technical and non-technical security controls for the IT to determine the degree to which the IT satisfies the applicable security controls.

3.8. Agent of the Security Controls Assessor (ASCA). The Agent of the Security Controls Assessor (ASCA) is a licensed 3rd-party agent that assists in assessment activities and provides an independent report for the SCA. This position cannot make decisions on behalf of the government;

the ASCA can only provide advice and guidance. The ASCA:

3.8.1. Must achieve and maintain an ASCA license per the AF and Space ASCA Licensing Guide. (T-1)

3.8.2. Responds to PM, ISO, SCA SCAR, and AO requests for information regarding their respective systems.

3.8.3. Performs comprehensive evaluation of the technical and non-technical security controls for the IT to determine the degree to which the IT satisfies the applicable security controls, and provide mitigation recommendations.

3.8.4. Will perform assessment procedures for each applicable security control as outlined in the DoDI 8510.01. (T-0)

3.8.5. Will meet the intent of RMF independence between the PM or ISO and the individuals performing security control assessments; the ASCA reports only to the SCA. (T-2)

3.8.6. Will not be part of the development team or program office. The PM or ISO provides funding for organizations or contractors to perform ASCA responsibilities. The PM or ISO may not provide direction or oversight to organizations or contractors in support of ASCA responsibilities. (T-1)

3.8.7. Will document agreements that include safeguards to prevent a conflict of interests with the development team. (T-2)

3.9. Information System Owners (ISO). Official responsible for the overall procurement, development, integration, modification, and operation and maintenance of AF IT. (T-2) An ISO is appointed and performs all PM roles and responsibilities when a PM is not assigned. For AF-wide systems (e.g., Air Force Networks (AFNET) Headquarters Air Force (HAF) and Logistics Model), the ISO will be appointed by the HAF/SAF 3-letter responsible for the capability. For Major Command (MAJCOM)-level or base-level IT, to include base enclaves, and PIT, the appropriate MAJCOM 2-letter appoints the ISO. (T-3) No further appointment is required The ISO:

3.9.1. Will identify the requirement for the IT and request funds to operate and maintain the IT in order to assure mission effectiveness. (T-2)

3.9.2. Will ensure, with coordination of the PM staff, the development, maintenance, and tracking of the system security plan for the assigned IT. (T-2)

3.9.3. Must ensure, with coordination of the PM staff, the development of an ISCM strategy consistent with DoDI 8510.01. (T-0)

AFI17-101 6 FEBRUARY 2020 13

3.9.4. Reports the security status of the IT including the effectiveness of all implemented security controls in accordance with the ISCM strategy.

3.9.5. Will manage access control requirements, including privileged users, and ensure all personnel receive the requisite security training. (T-3)

3.9.6. Conducts the initial remediation actions on security controls based on the findings and recommendations of the security assessment report and work with the SCA to reassess remediated controls.

3.9.7. Ensures the plan of action and milestones is developed for all identified weaknesses and the appropriate steps to mitigate those weaknesses are identified.

3.9.8. Ensures appropriate steps are taken to reduce or eliminate identified weaknesses, then generates the security authorization package and submits the package to the SCA for assessment.

3.9.9. Must Ensure open plan of action and milestones items are updated and closed in a timely manner. (T-2)

3.9.10. Ensures consolidated RMF documentation is maintained for systems with instances at multiple…