Attachment 3 Policy References and Guidance.docx

Section J – Attachment 3

USSOCOM SITEC – ITSMP ACQUISITION

[Draft] Updated 5 March 2010

Policy References and Guidance

United States Code / Public Laws

10 U.S.C. 167 (Unified Combatant Command for Special Operations Forces) 10 U.S.C. 2223, P.L. 105-261 (CIO Additional Responsibilities) 10 U.S.C. 2224 (Defense Information Assurance Program) 18 U.S.C. 2510 (Electronic Communications Privacy Act of 1986) 40 U.S.C. 1401 et seq., P.L. 104-106 (Clinger-Cohen Act - Division E, IT Management Reform Act (ITMRA) of 1996) 44 U.S.C. 101, Ch. 35 and 36, P.L. 107-347 (E-Government Act of 2002) 44 U.S.C. 3501 et seq., P.L. 104-13 (Paperwork Reduction Act) 44 U.S.C. 3541, et seq. P.L. 107-347 (Federal Information Security Management Act of 2002)

White House – Office of Management and Budget (OMB)

OMB Circular A-11 (Preparation, Submission and Execution of the Budget) OMB Circular A-130 (Management of Federal Information Resources)

National Security Telecommunications and Information Systems Security Committee (NSTISSC)

NSTISSI NO. 4001 (Controlled Cryptographic Items) NSTISSI NO. 4003 (Reporting and Evaluating COMSEC Incidents)

Director of Central Intelligence

DCI Directive 6/3 (Protecting Sensitive Compartmented Information within Information Systems), June 5, 1999

Chairman of the Joint Chiefs of Staff (CJCS)

CJCSI 1001.01 (Joint Manpower & Personnel Program) CJCSI 3010.02 (Joint Operations Concepts Development Process) CJCSI 3100.01 (Joint Strategic Planning System) CJCSI 3110.10 (C4 Systems Supplement to the Joint Strategic Capabilities Plan) CJCSI 3137.01 (The Functional Capabilities Board Process) CJCSI 3150.03C (Joint Structure Event and Incident Reports) CJCSI 3150.07C (Joint Reporting Structure Communication Status) CJCSI 3155.01 (Global Command and Control System – Joint (GCSS-J) Operational Framework Policy CJCSI 3170.01 (Joint Capabilities Integration and Development System) CJCSI 3500.02 (Universal Joint Task List Policy and Guidance) CJCSI 4320.01 (Equipment Authorizations for Special Operations Commands) CJCSI 4320.01 (Requirement Authorization Documents for Special Operations Command & Other Joint Organizations) CJCSI 5122.01 (Theater Joint Tactical Networks Configuration Control Board Charter) CJCSI 5261.01 (Combating Terrorism Readiness Initiatives Fund) CJCSI 5760.01A (Records Management Policy for the Joint Staff and Combatant Commands) CJCSI 6010.01 (Coordination of US C4 Systems Positions in International Forums) CJCSI 6211.02C (Defense Information System Network (DISN): Policy & Responsibilities) CJCSI 6212.01E (Interoperability and Supportability of Information Technology and National Security Systems) CJCSI 6215.01 (Policy for DOD Voice Networks) CJCSI 6250.01 (Satellite Communications) CJCSI 6245.01 (Management of Joint Net-Centric Operations (JNO) Command, Control, Communications and Computer (C4) Education and Training Programs) CJCSI 6510.01E (Information Assurance (IA) and Computer Network Defense (CND)) CJCSI 6721.02B (Global Command and Control System-Joint (GCCS-J) Training Management) CJCSI 6731.01B (Global Command and Control System-Joint Security Policy) CJCSI 6740.01B (Military Telecommunications Agreements and Arrangements between the United States and Regional Defense Organizations or Friendly Foreign Nations) CJCSI 7401.02 (Combatant Commander Command & Control Initiatives Program) CJCSI 8010.01 (Joint Community Warfighter Chief Information Officer) CJCSI 8410.01 (Warfighting Mission Area IT Portfolio Management & Net-Centric Data Sharing) CJCSI 8501.01 (CJCS, Combatant Commanders, & Joint Staff Participation in the Planning, Programming, Budgeting, & Execution System) CJCSM 3150.03 (Joint Reporting Structure Event and Incident Reports) CJCSM 3150.07C (Joint Reporting Structure Communications Status) CJCSM 6231 (Manual for Employing Joint Tactical Communications) CJCSM 6510.01A (Information Assurance (IA) and Computer Network Defense (CND) Volume I (Incident Handling Program) CJCSM 3170.01 (Operation of the Joint Capabilities Integration and Development System)

Department of Defense (DoD) Directives

DoD Directive 3020.26 (DoD Continuity Programs), January 9, 2009 DoD Directive 3020.40 (DoD Policy and Responsibilities for Critical Infrastructure), January 14, 2010 DoD Directive 4630.05 (Interoperability and Supportability of Information Technology (IT) and National Security Systems (NSS)), May 5, 2004 DoD Instruction 4630.8 (Procedures for Interoperability and Supportability of Information Technology (IT) and National Security Systems (NSS)), June 30, 2004 DoD Directive 4640.1 (Communications Security Telephone Monitoring and Recording), January 15, 1980 DoD Directive 4640.6 (Communications Security Telephone Monitoring and Recording), June 26, 1981 DoD Directive 5000.01 (Operation of the Defense Acquisition System), May 12, 2003 (Certified Current as of November 20, 2007) DoD Instruction 5000.02 (Operation of the Defense Acquisition System), 8 December 2008 DoD Directive 5010.38 (Management Control (MC) Program) DoD Instruction 5200.01 (DoD Information Security Program Protection of Sensitive Compartmented Information), October 9, 2008 DoD Instruction 5200.01 (DoD Information Security Program and Protection of Sensitive Compartmented Information), October 9, 2008 DoD Regulation 5200.08-R (Physical Security Program), April 9, 2007 DoD Regulation 5200.1-R (Information Security Program), January 14, 1997 DoD Directive 5200.2 (DoD Personnel Security Program), April 9, 1999 DoD Instruction 5205.08 (Access to Classified Cryptographic Information), November 8, 2007 DoD Regulation 5400.11-R (DoD Privacy Program) DoD Directive 8000.01 (Management of the Department of Defense Information Enterprise), February 10, 2009 DoD Directive 8100.02 (Use of Commercial Wireless Devices, Services, and Technologies in the DoD Global Information Grid (GIG)) April 14, 2004 DoD Directive 8100.1 (Global Information Grid (GIG) Overarching Policy), September 19, 2002 DoD Instruction 8110.1 (Multinational Information Sharing Networks Implementation), February 6, 2004 DoD Directive 8115.01 (Information Technology Portfolio Management), October 10, 2005 DoD Instruction 8115.02 (Information Technology Portfolio Management Implementation), October 30, 2006 DoD Directive 8320.2 (Data Sharing in a Net-Centric Department of Defense), Certified Current as of April 23, 2007 DoD Instruction 8500.01E (Information Assurance (IA)), October 24, 2002 DoD Instruction 8500.2 (Information Assurance (IA) Implementation), February 6, 2003 DoD Instruction 8510.01 (DoD Information Assurance Certification and Accreditation Process (DIACAP)), November 28, 2007 DoD Directive 8520.1 (Protection of Sensitive Compartmented Information (SCI)) DoD Instruction 8520.2 (Public Key Infrastructure (PKI) and Public Key (PK) Enabling), April 1, 2004 DoD Directive 8530.1 (Computer Network Defense (CND)), January 8, 2001 DoD Instruction 8530.2 (Support to Computer Network Defense (CND)) March 9, 2001 DoD Instruction 8551.1 (Ports, Protocols, and Services Management (PPSM)), August 13, 2004 DoD Instruction 8552.01 (Use of Mobile Code Technologies in DoD Information Systems) October 23, 2006 DoD Instruction 8560.01 (Communications Security (COMSEC) Monitoring and Information Assurance (IA) Readiness Testing) DoD Directive 8570.01 (Information Assurance Training, Certification, and Workforce Management), August 15, 2004 DoD Manual 8570.01-M (Information Assurance Workforce Improvement Program), December 19, 2005 DoD Instruction 8580.1 (Information Assurance (IA) in the Defense Acquisition System), July 9, 2004 MIL-HDBK-61A (DoD Military Handbook: Configuration Management Guidance) STRATCOM Directive 527-1 (DoD Information Operations Condition (INFOCON) System Procedures)

United States Special Operations Command (USSOCOM)

USSOCOM Directive Number 1-9 (USSOCOM Strategic Planning Process (SPP)), 3 August 2006 USSOCOM Directive Number 25-1 (Management of Information Resources for the Special Operations Forces (SOF) Information Environment (SIE)), 21 July 2008 USSOCOM Directive Number 25-2 (Enterprise Architectures), 10 March 2004 USSOCOM Directive Number 25-5 (Information Technology Change, Configuration, and Release Management), 19 April 2005 USSOCOM Directive Number 70-1 (Acquisition Management System Policy), 11 April 2001 USSOCOM Directive Number 71-4 (Special Operations Forces (SOF) Capabilities Integration and Development System (CIDS)), 24 March 2005 USSOCOM CIO Guidance Letter 09-01 (Application and Software Deployment Process for the Headquarters USSOCOM Knowledge Sharing Environment), 29 July 2009 USSOCOM CIO Guidance Letter 09-02 (Governance for Microsoft SharePoint Server), 11 May 2009 USSOCOM CIO PM 08-02 (Office Automation Support for Headquarters Contractor Personnel) USSOCOM Manual 380-1 (Information Security Program) USSOCOM Manual 380-3 (Information Assurance Program) USSOCOM R 700-9 (Automated Data Processing Equipment (ADPE) Inventory, Control, and Disposition)

United States Air Force / Air Force Special Operations Command (AFSOC)

AFI 33-100 (User Responsibilities and Guidance for Information Systems) AFI 33-101 (Commanders Guidance and Responsibilities) AFI 33-104 (Base-Level Planning and Implementation)

AFI 33-108 (Compatibility, Interoperability, & Integration of Comm And Info Systems) AFI 33-112 (Information Technology Hardware Asset Management) AFI 33-114 (Software Management) AFI 33-115v1 (Network Operations (Netops)) AFI 33-115v2 (Licensing Network Users and Network Professionals) AFI 33-115v3 (Air Force Network Operating Instructions) AFI 33-119 (Air Force Messaging) AFI 33-127 (Electronic Messaging Registration and Authority) AFI 33-129 (Web Management and Internet Use) AFI 33-138 (Enterprise Network Operations Notification And Tracking) AFI 33-141 (Air Force Information Technology Portfolio Management and IT Investment Review) AFI 33-150 (Management of Communications Activities) AFI 33-200 (Information Assurance Management) AFI 33-201v1 (Communications Security (COMSEC)) AFI 33-201v2 (Communications Security (COMSEC) User Requirements) AFI 33-201v4 (Cryptographic Access Program) AFI 33-201v5 (Controlled Cryptographic Items (CCI)) AFI 33-201v7 (Management of Manual Cryptosystems) AFI 33-201v9 (Operational Instructions for Secure Voice Devices) AFI 33-207 (Computer Security Assistance Program) AFI 33-210 (Air Force Certification And Accreditation (C&A) Program) AFI 33-215 (Controlling Authorities for COMSEC Keying Material (KEYMAT)) AFI 33-230 (Information Assurance Assessment and Assistance Program) AFI 33-321 (Authentication of Air Force Records) AFI 33-322 (Records Management Program) AFI 33-324 (The Information Collections and Reports Management Program: Controlling Internal, Public, and Interagency Air Force Information Collections) AFI 33-332 (Privacy Act Program) AFI 33-360 (Publications and Forms Management) AFI 33-364 (Records Disposition—Procedures and Responsibilities) AFI 33-401 (Implementing Air Force Architectures)

AFMAN 33-128 (Electronic Messaging Registration) AFMAN 33-363 (Management of Records) AFPD 33-4 (Enterprise Architecting)

AFI 33-104, AFSOCSUP (Base-Level Planning and Implementation) AFI 33-114, AFSOCSUP (Software Management) AFI 33-360, AFSOCSUP (Publications and Forms Management)

AFSOCI 33-201 (Controlled Access Area) AFSOCI 33-303 (AFSOC Portals)

AFSOCMAN 33-304 (AFSOC Portals Guide for Site Owners and End Users)

USZA22-02-D-0017 (Addendum to AFSOC Task Order 0818: Privacy and Security of Protected Health Information)

HURLBURTFIELDI 33-112 (Information Technology (IT) Hardware Asset Management) HURLBURTFIELDI 33-115V1 (Hurlburt Field Network Control Center) HURLBURTFIELDI 33-115V2 (Licensing and Certifying Workgroup Managers) HURLBURTFIELDI 33-129 (Base Network Web Server Management and Publishing)

United States Army / U.S. Army Special Operations Command (USASOC)

Army Pamphlet 25–1–1 (Information Management: Information Technology Support and Services) Army Pamphlet 25–1–2 (Information Management: Information Technology Contingency Planning) Army Pamphlet 25–91 (Information Management: Visual Information; Visual Information Procedures) Army Reg. 25–1 (Information Management: Army Knowledge Management and Information Technology) Army Reg. 25–2 (Information Management: Information Assurance) Army Reg. 25–52 (Information Management: Records Management – Authorized Abbreviations, Brevity Codes, and Acronyms) Army Reg. 380–5 (Security: Department of the Army Information Security Program) Army Reg. 380–13 (Security: Acquisition and Storage of Information Concerning Non-Affiliated Persons and Organizations) Army Reg. 380–53 (Security: Information Systems Security Monitoring) Army Reg. 735-5 (Policies and Procedures for Property Accountability (2005))

USASOC Memo (Information Technology (IT) Asset Acquisition Policy) USASOC Memo (Information Technology (IT) Asset Management Program) USASOC Memo 01-09 (Secure File Transfer Capability) USASOC Memo 02-08 (Desktop Collaboration Tools) USASOC Memo 03-05 (Contract Services Off-site Memorandum of Instructions) [Relevant?] USASOC Memo (Guidance on the Management of BlackBerry Devices with Internal Bluetooth Capability) USASOC Policy 04-03 (Tactical Network Software Standardization (Blue Force Tracking)) USASOC Policy 05-04 (Centralized Acquisition and Distribution of Information Technology Assets) USASOC Policy 06-04 (Appointment and Responsibilities of Information Management Officers) USASOC Policy 14-08 (Interim Policy on Processing Focal Point Information on SIPRNET) USASOC Policy 16-02 (Command Policy, Acquisition Process for Portable Electronic Devices (PEDs) and Wireless Portable Digital Assistants (PDAs)) USASOC Policy 17-08 (Procedures for Government and Privately-Owned Electronic Equipment and Devices Entering or Exiting the U.S. Army Special Operations Command Headquarters (USASOC HQ) Building (E-2929)) USASOC Policy 23-08 (FY 08/09 Information Systems Security Monitoring Program) USASOC Reg. 25-5 (Information Technology Change, Configuration, and Release Management) USASOC Reg. No. 25-70 (Information Management: Automation; Army Special Operations Command Network (ASOCNet) Security) USASOC Reg. 25-72 (Information Management Automation: USASOC Web Site Management) USASOC Supp. 1 to AR 380-5 (Information Security) USASOC SD-001 Hard Drive Degaussing Roles and Responsibilities USASOC Team EITC Roles and Responsibilities

Unites States Navy / U.S. Navy Special Warfare Command (NAVSPECWARCOM)

OPNAV Instruction 2000.31 (Mandatory Use of Military Telecommunications Standards in the MIL-STD-188 Series) OPNAV Instruction 2010.3D (Communications Operating Facilities Report (OPNAV Report 2010-2)) OPNAV Instruction 2010.4 (Naval Telecommunications System (NTS) Software Control and Management Policy) OPNAV Instruction 2060.8 (Management of Business Administration of Department of Defense (DOD) Telephone Systems and Base Telecommunications Services within the Department of the Navy) OPNAV Instruction 2070.4A (Department of the Navy Policy on Use of the Defense Data Network (DDN) OPNAV Instruction 2075.1 (Department of the Navy Use of Commercial Wireless Local Area Network (WLAN) Devices, Services, and Technologies) OPNAV Instruction 2100.2A (Navy Policy and Procedures on the Issuance, Use and Management of Government-Owned Cellular Phones, Personal Digital Assistants and Calling Cards OPNAV Instruction 2201.3A (Communication Security (COMSEC) Monitoring of Navy Telecommunication and Automated Information Systems (AIS) OPNAV Instruction 2201.3B (Communication Security Monitoring of Navy Telecommunications and Information Technology Systems) OPNAV Instruction 2221.5C (Release of Communications Security (COMSEC) Material to U.S. Industrial Firms under Contract to the U.S. Navy) OPNAV Instruction 2800.2 (Naval Telecommunication Systems (NTS) Operating Requirements) OPNAV Instruction 2800.3 (Navy Data Communications Program) OPNAV Instruction 2800.4 (Review and Revalidation of Telecommunication Services)

NETWARCOM MSG 221505ZOCT04 (Information Assurance Vulnerability Management (IAVM) Update ALCND 159-04)

FLEET FORCES COMMAND MSG 151302ZMAY03 (Internet Use)

SECNAV M-5510.36 (Department of the Navy Information Security Program)

COMNAVSPECWARCOM Instruction 2100.1 (COMNAVSPECWARCOM Video Teleconference (VTC) Request COMNAVSPECWARCOM Instruction 2280.1E (Handling Instructions and Procedures for Distribution and Control of Communications Security Material System/Electronic Key Management System (COMSEC/EKMS) Distributed Material COMNAVSPECWARCOM Instruction 2305.1B (Policies and Procedures Governing the Use of the Toll-Free Telephone Number (1-888-SPECWAR)) COMNAVSPECWARCOM Instruction 3030.1 (Naval Special Warfare (NSW) Continuity of Operations (COOP) Program) COMNAVSPECWARCOM Instruction 3030.2 (COMNAVSPECWARCOM Continuity of Operations Plan (COOP) Volumes I and II) COMNAVSPECWARCOM Instruction 3432.1A (Operations Security (OPSEC)) COMNAVSPECWARCOM Instruction 4130.1 (Naval Special Warfare Information Technology (IT) Configuration Management (CM) Plan) COMNAVSPECWARCOM Instruction 5200.2F (Naval Special Warfare Managers’ Internal Control (MIC) Program) COMNAVSPECWARCOM Instruction 5239.4 (Policy for Laptop Computers) COMNAVSPECWARCOM Instruction 5239.8 (Information Assurance Policy)