6211_02.pdf

CHAIRMAN OF THE JOINT

CHIEFS OF STAFF

INSTRUCTION

J-6 CJCSI 6211.02C

DISTRIBUTION: A, B, C, J, S 9 July 2008

DEFENSE INFORMATION SYSTEM NETWORK (DISN): POLICY AND

RESPONSIBILITIES

References: See Enclosure E.

1. Purpose. This instruction establishes policy and responsibilities for the connection of information systems (ISs) (e.g., applications, enclaves, or outsourced processes) to the Defense Information System Network

(DISN).

a. Additional policies governing other subnetworks of the DISN networks are covered in the following instructions:

(1) Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 6250.01, “Satellite Communications” (reference a).

(2) CJCSI 6215.01, “Policy for Department of Defense Voice Networks” (reference b).

b. Policy on sensitive compartmented information (SCI) is covered in Director of Central Intelligence Directive (DCID) 6/3, “Protecting Sensitive Compartmented Information within Information Systems” (reference c).

c. This instruction does not cover connection policy to research, development, test, and evaluation networks such as the Defense Research and Engineering Network or Advanced Concept Technology Demonstration networks.1

1 These networks must follow DISN connection and DOD cross domain processes and procedures if connecting to the DISN.

CJCSI 6211.02C

9 July 2008

2. Cancellation. CJCSI 6211.02B, 31 July 2003, “Defense Information System Network (DISN): Policy, Responsibilities and Processes,” is canceled.

3. Applicability. This instruction applies to the Joint Staff; combatant commands, Services, and Defense agencies (CC/S/As); and DOD field and joint activities, including DOD and Service Nonappropriated Fund Instrumentalities. This instruction also applies to non-DOD governmental DISN users and contractors in facilities that interconnect with the DISN.

4. Policy. See Enclosure A.

5. Responsibilities. See Enclosure B.

6. Summary of Changes. This revision updates CJCSI 6211.01B. It further:

a. Moves to the concept of baseline CD services and solutions (i.e., enterprise CD services, centralized CD solutions, and baseline point solutions) providing the primary capabilities for information sharing between different security domains.

b. Replaces DISN Designated Approving Authorities (DISN DAAs) with the new DOD Principal Accrediting Authorities (PAAs). Additionally, replaces the DISN Flag Panel with the DISN/Global Information Grid (GIG) Flag Panel.

c. Updates certification and accreditation (C&A) guidance based on the DOD Information Assurance Certification and Accreditation Process (DIACAP) implementation in accordance with (IAW) DOD Instruction (DODI) 8510.01 (see reference d).

d. Focuses on policy and responsibilities. Specific process steps will be maintained and updated as required by the Defense Information Systems Agency (DISA).

e. Transfers Cross Domain Solutions Assessment Panel responsibilities to Cross Domain Resolution Board (CDRB) chaired by the Director, Unified Cross Domain Management Office (UCDMO).

f. Makes CC/S/A headquarters responsible for endorsing and validating requirements for CC/S/A organization CD information transfer and non-DOD connection requests.

g. Adds DOD requirement to register ISs connected to the DISN in the DOD Information Technology (IT) Portfolio Repository (DITPR) or the SECRET Internet Protocol Router Network (SIPRNET) IT Registry.

h. Adds UCDMO responsibilities and roles.

i. Provides updated guidance on official and authorized use of DISN IAW DOD Regulation 5500.7-R (reference e). Additionally, updates guidance covering violations of standards of conduct prescribed in the regulation IAW DODD 5500.7 (reference f).

j. Provides reciprocity guidance for connection of ISs to facilitate the establishment of joint bases, combatant command operational requirements, and the migration to net-centric warfare.

7. Definitions. See Glossary. Major source documents for definitions in this instruction are Joint Publication (JP) 1-02, “DOD Dictionary of Military and Associated Terms,” (reference g) and Committee on National Security Systems (CNSS) Instruction (CNSSI) 4009, “National Information Assurance Glossary” (reference h).

8. Releasability. This instruction is approved for public release;

distribution is unlimited. DOD components (including combatant commands), other federal agencies, and the public may obtain copies of this instruction through the Internet from the CJCS Directives Home Page -- http://www.dtic.mil/doctrine.

9. Effective Date. This instruction is effective immediately.

For the Chairman of the Joint Chiefs of Staff:

STEPHEN M. GOLDFEIN

Major General, USAF Vice Director, Joint Staff

Enclosures:

A -- Policy B -- Responsibilities C -- Connection Process D -- DISN Security Information Assurance Program E -- References

GL -- Glossary

(INTENTIONALLY BLANK)

i

DISTRIBUTION

Distributions A, B, C, and J plus the following:

Copies

Assistant Secretary of Defense for Networks and Information Integration/Chief Information Officer ii iii

LIST OF EFFECTIVE PAGES

The following is a list of effective pages. Use this list to verify the currency and completeness of the document. An “O” indicates a page in the original document.

PAGE CHANGE PAGE CHANGE

1 through 4 O C-A-1 through C-A-8 O i through viii O C-B-1 through C-B-6 O A-1 through A-8 O D-1 through D-8 O B-1 through B-22 O E-1 through E-4 O C-1 through C-4 O GL-1 through GL-8 O iv v

RECORD OF CHANGES

Change No.

Date of Change

Date Entered

Name of Person Entering Change vi vii

TABLE OF CONTENTS

Page

ENCLOSURE A -- POLICY

Defense Information System Network (DISN) Background A-1 Policy .............................................................................. A-2 Official and Authorized Use of DISN ................................ A-5

ENCLOSURE B -- RESPONSIBILITIES

Chairman of the Joint Staff Chiefs of Staff (CJCS) ........... B-1 Combatant Commanders................................................. B-2 Commander, U.S. Strategic Command

(CDRUSSTRATCOM)................................................... B-2

Service Chiefs.................................................................. B-3 Director, Defense Information Systems Agency (DISA) ..... B-4 Director, Defense Intelligence Agency (DIA)...................... B-8

Director, National Security Agency (NSA)/Central Security Service (CSS)................................................. B-9

Director, Defense Security Service (DSS)........................ B-10 CC/S/As, DOD Field Activities, and Joint Activities....... B-10 Director, Unified Cross Domain Management Office

(UCDMO).................................................................. B-14

Principal Accrediting Authorities (PAAs)......................... B-16 DISN/GIG Flag Panel .................................................... B-16

Defense IA/Security Accreditation Working Group

(DSAWG) .................................................................. B-17

CC/S/A, DOD Field Activities, and Joint Activities Designated Accrediting Authorities (DAAs) ............... B-18 Reciprocity -- Connection to Joint/Combined Networks. B-20 Resolution of Accreditation Decision and Information System Operation Disputes...................................... B-21 Relationship Between the GIG Waiver Board, DSAWG, and Information Assurance Panel (IAP)..................... B-22

ENCLOSURE C -- CONNECTION PROCESS

Connection Process ......................................................... C-1 Approval for Non-DOD Connections to DISN.................... C-1 Backside Connection....................................................... C-1 Tunneling Classified Information..................................... C-2 JWICS Connection Process Requests............................... C-2 Interim Certification to Operate (ICTO) Requests.............. C-2

APPENDIX A -- DISN CONNECTION

Classified Connections .................................................C-A-1

Unclassified Connections .............................................C-A-1 viii

Page Defense Switched Network (DSN) Connection ...............C-A-1

DISN Video Services (DVS)............................................C-A-2 Connection Documentation Requirements....................C-A-2 Connection Approval Scan............................................C-A-3 Enclave Changes Requiring Notification and/or Approval..................................................................C-A-3 Non-DOD Connection Requirements.............................C-A-4 Exercise Connection.....................................................C-A-5 Contingency Connection...............................................C-A-5 Disconnection ..............................................................C-A-5 Alternate Connections ..................................................C-A-6

APPENDIX B -- CROSS DOMAIN (CD) INFORMATION TRANSFER

REQUIREMENTS

CD Information Transfer Requirements ........................C-B-1 CC/S/A and Field Activity Headquarters ......................C-B-1 Defense Information Systems Agency (DISA).................C-B-3 Unified Cross Domain Management Office (UCDMO).....C-B-4 DISN/GIG Flag Panel ...................................................C-B-5 Defense IA/Security Accreditation Working Group

(DSAWG) .................................................................C-B-5

ENCLOSURE D -- DISN SECURITY INFORMATION ASSURANCE PROGRAM

Background .................................................................... D-1 Inspections and Visits ..................................................... D-1 Coordination and Frequency of Inspections and Visits..... D-2 Remote Monitoring and Vulnerability Assessments.......... D-3 Joint Vulnerability Assessment Methodology ................... D-3 Inspection Criteria........................................................... D-3 Reporting ........................................................................ D-4 Enclave Categorization .................................................... D-4 Enclave Inspection Categories ......................................... D-4 Inspection Responsibility and Frequency Table ............... D-6 Joint Vulnerability Assessment Process (JVAP)................ D-6

ENCLOSURE E -- REFERENCES........................................................ E-1 List of Web Addresses...................................................... E-4

GLOSSARY

Part I -- Abbreviations and Acronyms...................................... GL-1 Part II -- Definitions................................................................ GL-5

TABLE

D-1 DISN Networks Security Inspection Table............................. D-6

A-1 Enclosure A

ENCLOSURE A

POLICY

1. Defense Information System Network (DISN) Background

a. The DISN is a composite of DOD-owned and leased telecommunications subsystems and networks. It is DOD’s worldwide enterprise-level telecommunications infrastructure providing end-to-end information transfer in support of military operations. The DISN facilitates information resource management and supports national security as well as DOD needs. As a critical portion of the GIG, the DISN furnishes network services to DOD installations and deployed forces.

Those services include voice, data, video, messaging, and other unified capabilities along with ancillary enterprise services such as directories.

The DISN has three segments: sustaining base, long-haul, and deployed.

(1) The sustaining base infrastructure (i.e., base, post, camp or station, and Service enterprise enclaves) interfaces with the long-haul infrastructure to support strategic/fixed environment user telecommunications requirements. The sustaining base segment is primarily the responsibility of the CC/S/A.

(2) The long-haul telecommunications infrastructure and its associated services are the responsibility of the DISA.

(3) The deployed warfighter and associated combatant commander telecommunications infrastructures support the Joint Task Force and/or Combined Task Force. The combatant command and subordinate Service components have primary responsibility for the deployed warfighter and associated combatant command telecommunications infrastructure within the theater.

b. The DISN provides the GIG transfer infrastructure by connecting separate CC/S/A and field activity ISs into a DOD enterprise-wide network to meet common-user and special purpose information transfer requirements.

c. DISN information transfer facilities support secure transport requirements for subnetworks such as the Defense Switched Network (DSN), Defense Red Switch Network (DRSN), Non-Secure Internet Protocol Router Network (NIPRNET),2 SIPRNET, DISN Video Services

2 Based on DOD dictionary and JP 1-02 (reference g). Other uses of the acronym include Unclassified But Sensitive Internet Protocol Router Network (DOD IT Portfolio Registry) and Non- Classified Internet Protocol Router Network (DODI 8500.2 (reference k)).

A-2

(DVS) Network, Enhanced Mobile Satellite Services (EMSSs), and other government agency networks.

d. The DISN's long-haul telecommunications infrastructure is designated as a mission critical3 and mission assurance category (MAC) I national security system (NSS). The DISN and its subnetworks must be operated and protected IAW DODD 8500.01E (reference i) and other 8500 series issuances.

(1) The DISN SIPRNET, NIPRNET, DRSN, and EMSS subnetworks are designated as mission critical IAW DODI 5000.2 (reference j).

(2) The DISN SIPRNET, DRSN, and EMSS subnetworks are designated as MAC I ISs handling information vital to the operational readiness or mission effectiveness of deployed and contingency forces in terms of content and timeliness. These subnetworks must implement designated MAC I information assurance (IA) controls IAW DODI 8500.2 (reference k) and DODI 8510.01 (reference d).

2. Policy

a. DOD will use DISN services to satisfy DOD long-haul and wide area network transfer communications requirements IAW DODI 4640.14 (reference l).

b. The DISN will use secure configurations of approved IA and IA-enabled IT products (i.e., National Information Assurance Partnership/Federal Information Processing Standards evaluated/approved products), certified IA personnel, and strict configuration control.

c. DOD ISs4 connected to DISN must be certified and accredited IAW applicable guidance and processes (i.e., DODI 8510.01 (reference d), DODI 8100.3 (reference m), or DCID 6/3 (reference c)).

3 A system that meets the definitions of “information system” and “national security system” in the Clinger Cohen Act, the loss of which would cause the stoppage of warfighter operations or direct mission support of warfighter operations. See DODI 5000.2 (reference j).

4 Includes DOD-owned ISs and DOD-controlled ISs operated on behalf of the Department for Defense that receive process, store, display, or transmit DOD information, regardless of classification or sensitivity.

A-3

d. Non-DOD (see Glossary) ISs operating on behalf of the Department of Defense must be certified and accredited IAW applicable DOD guidance and processes (i.e., DODI 8510.01 (reference d) or DOD 5220.22-M, “National Industrial Security Program Operating Manual” (NISPOM) (reference n)).

e. DOD ISs must be registered in the DITPR or the SIPRNET IT registry by the responsible CC/S/As or field activities IAW DOD Chief Information Officer (CIO) memorandum (reference o).

f. Non-DOD ISs operating on behalf of the Department of Defense must be registered in the DITPR or the SIPRNET IT registry by the sponsoring CC/S/As or field activities IAW DOD CIO memorandum (reference o).

g. Unclassified IS applications connected to the DISN must be registered in the systems/networks approval process (SNAP) system Web-based application, the systems approval process (SysAP).

h. DOD ISs connected to the DISN must be covered by accredited Computer Network Defense Service (CNDS) providers IAW DODD O-8530.1 (reference p).

i. Non-DOD ISs connected to the DISN must be covered by accredited CNDS providers IAW DODD O-8530.1 (reference p).5

j. Direct or indirect DISN connections must follow the connection policies and responsibilities established in this instruction. They must also follow DISA connection request procedures, requirements, and processes. Connections for SCI ISs will be IAW DCID 6/3 (reference c).

k. Tunneling of classified Secret information over transport other than SIPRNET must use National Security Agency (NSA)/Central Security Service (CSS) approved cryptography. Data must be encrypted by NSA/CSS approved Type-1 cryptography when transported over a network not cleared at or above the highest level of classification of the data.

5 The sponsoring CC/S/A or field activity must ensure that the CNDS provider requirement is defined in a contract, MOA, or MOU with the non-DOD organization or entity.

A-4

l. Connections among ISs of different security domains will be IAW this instruction, DODD 8500.01E (reference i), DODD O-8530.1 (reference p), and other applicable DOD issuances and instructions.

Connections to SCI ISs must be IAW DCID 6/3 (reference c).6

(1) Connections of non-DOD ISs to the DISN must be sponsored, endorsed, and validated by the CC/S/A or field activity headquarters and approved by the Office of the Assistant Secretary of Defense for Networks and Information Integration (OASD(NII)/DOD CIO).

(2) All non-DOD connections to DISN require a DOD sponsor, separate connection request, and filtered access.

(3) Contractor ISs connected to the DISN must comply with this instruction, guidelines issued by DISA as the operating entity, and DOD 5220.22-M, NISPOM (reference n).7

m. Cross Domain Information Transfer Requirements and

Capabilities

(1) CD information transfers must be used only to meet CC/S/A and field activity compelling mission requirements and must be validated by CC/S/A or field activity headquarters.

(2) CD information transfer requirements will be prioritized based on the National Military Strategic Plan for the War on Terrorism (reference q) priorities and the military objectives in the National Military Strategy (reference r).

(3) CD information transfer requirements will employ baseline capabilities and technologies8 in the following order:

(a) Enterprise CD services, which are used to connect ISs of different security domains, will be established to fulfill operational requirements across the DOD enterprise.

(b) Centralized CD solutions, which are centrally managed and owned by a single DOD component, will be established to fulfill operational requirements across multiple organizations.

6 SCI CD connections to a collateral DISN system will be documented in the system’s DOD accreditation package.

7 Defense Security Service has been assigned as the Cognizant Security Office for DOD implementation of the NISPOM.

8 The Cross Domain Baseline can be found at https://www.intelink.gov/mypage/ucdmo.

A-5

(c) Baseline point CD solutions approved for operational use will be used only when an enterprise CD service or centralized CD solution is not available.

(4) When existing CD baseline services or capabilities cannot meet operational requirements, the development of new solutions must be approved IAW this instruction.

n. A DOD inspection, site visit, and assessment program9 will support connected ISs.

(1) All ISs connected to the DISN are subject to electronic monitoring for communications management and network security. This includes site visits, compliance inspections, and remote vulnerability assessments to check system compliance with configuration standards.

(2) Scanning and monitoring by organizations external to a CC/S/A or field activity must be pre-coordinated at least 24 hours prior to the event.10

o. Survivability enhancements in transmission paths, routing, equipment, and associated facilities must be implemented in ISs supporting critical CC/S/A mission requirements based on the commander’s or director’s formal risk management process IAW DODI

8510.01 (reference d).

p. Personnel with access or privileged access to the DISN will meet the personnel security requirements IAW DOD 5200.2-R (reference s).

q. The DISN is the DOD’s worldwide enterprise-level telecommunications infrastructure. It is critical to planning, mobilizing, deploying, executing, and sustaining U.S. military operations (DODD

3020.40 (reference t)).

3. Official and Authorized Use of DISN. The DISN must be used only for official and authorized purposes IAW DOD 5500.7-R (reference e).11 Use of the DISN for non-official purposes must be authorized in writing by the CC/S/A Component head.

9 See Enclosure D, DISN Security Information Assurance Program.

10 This will occur with at least 24 hours notification and coordination with the CC/S/A or field activity DAA or appointed representative and U.S. Strategic Command (USSTRATCOM).

11Federal government communication systems and equipment (including government-owned telephones, facsimile machines, electronic mail, Internet systems, and commercial systems when use is paid for by the federal government) shall be for official use and authorized purposes only.

A-6

a. CC/S/As may authorize categories of non-official communication after determining that such communications:

(1) Do not adversely affect the performance of official duties by the DOD employee or CC/S/A or field activity.

(2) Are of reasonable duration and frequency and, whenever possible, are made during the DOD employee’s or military member’s personal time (such as after normal duty hours or during lunch periods).

(3) Serve a legitimate public interest such as enabling DOD employees or military members to stay at their desks rather than leave the work area to use commercial communication systems.

(4) Do not overburden the communication system and create no significant additional cost to DOD, CC/S/A, or field activity.

b. DOD 5500.7-R (reference e) states that authorized purposes might include brief communications made by military members and DOD employees during official travel to notify family members of transportation or schedule changes. They may also include reasonable personal communications from the military member or DOD employee at his or her workplace (such as checking with spouses or minor children;

scheduling doctor, automobile, or home repair appointments; brief Internet searches; or e-mailing directions to a visiting relative).

c. CC/S/A directors or military commanders may prohibit use of government communications systems and equipment, or filter access to commercial Web sites or services, to defend DOD’s IT resources and ensure sufficient bandwidth is available for DOD operations. Examples of situations where access may be prohibited or filtered include the following:

(1) Accessing streaming video or radio Web sites.

(2) Accessing personal commercial e-mail accounts (e.g., Hotmail, Yahoo, AOL, etc.) from government computers.

d. Unauthorized DISN uses include the following:

(1) Use, loading, or importing of unauthorized software (e.g., applications, games, peer-to-peer software, movies, music videos or files, etc.).

A-7

(2) Accessing pornography.

(3) Unofficial advertising, selling, or soliciting (e.g., gambling, auctions, stock trading, etc.).

(4) Improperly handling classified information.

(5) Using the DISN to gain unauthorized access to other systems and/or networks.

(6) Endorsing any product or service, participating in any lobbying activity, or engaging in any prohibited partisan political activity.

(7) Posting DOD information to external newsgroups, bulletin boards, or other public forums without authorization.

(8) Other uses incompatible with public service.

e. DODD 5500.7 (reference f) states penalties for violation of the standards of conduct prescribed in DOD 5500.7-R (reference e) that include statutory and regulatory sanctions such as judicial (criminal and civil) and administrative actions for DOD civilian employees and members of the Military Departments.

(1) The provisions concerning the official and authorized use of the DISN (federal communications) in DOD 5500.7-R (reference e) constitute lawful general orders or regulations within the meaning of Article 92 (section 892 of reference u) of the Uniform Code of Military Justice (UCMJ), are punitive, and apply without further implementation. In addition to prosecution by court-martial under the UCMJ, a violation may serve as a basis for adverse administrative action and other adverse action authorized by United States Code (USC) or federal regulations. In addition, violation of any provision in DOD 5500.7-R (reference e) may constitute the UCMJ offense of dereliction of duty or other applicable punitive articles.

(2) Violation of any provision in DOD 5500.7-R (reference e) by DOD civilian employees may result in appropriate criminal prosecution, civil judicial action, disciplinary or adverse administrative action, or other administrative action authorized by USC or federal regulations.

A-8

B-1 Enclosure B

ENCLOSURE B

RESPONSIBILITIES

1. Chairman of the Joint Chiefs of Staff (CJCS). The Chairman is responsible for developing DISN joint policy IAW DODD 8500.01E (reference i), DODI 8510.01 (reference d), and DODD 8115.01 (reference v).

a. The Chairman, Joint Chiefs of Staff, delegates to the Director for Command, Control, Communications, and Computer Systems (J-6) authority for developing joint DISN policy in support of the Warfighting Mission Area (WMA) in coordination with OASD(NII)/DOD CIO, CC/S/A, and field activities.

b. The Director for Command, Control, Communications, and Computer Systems (J-6) will:

(1) Serve as PAA for WMA IAW DODI 8510.01 (reference d).12

(2) Issue DOD PAA and DISN/GIG Flag Panel decisions for connection of ISs for enterprise deployment and acceptance of risk as required.

(3) Appoint a flag-level WMA PAA representative to serve as chair on the DISN/GIG Flag Panel.

(4) Appoint a flag-level representative to the UCDMO Oversight Panel IAW UCDMO charter (reference w).

(5) Appoint an O-6 or civilian equivalent as primary representative to the Defense IA/Security Accreditation Working Group (DSAWG) and alternate representatives with Joint Staff DSAWG voting authority.

Provide a copy of the appointment letter to the DISN/GIG Flag Panel and the DSAWG chairperson.

(6) Appoint an O-6 or civilian equivalent representative to the

CDRB.

(7) Prioritize combatant command operational CD information transfer requirements based on the CJCS priorities, the National Military Strategic Plan for the War on Terrorism (reference q), and the military objectives in the National Military Strategy (reference r).

12 DOD PAAs are appointed for the four GIG MAs consisting of the WMA, the Enterprise Information Environment MA (EIEMA), the Defense Intelligence MA (DIMA), and the Business Mission Area (BMA).

B-2

(8) Monitor and report significant DISN network operations (e.g., major mission degradation) to the Chairman.

2. Combatant Commanders. In addition to responsibilities outlined in paragraph 9 ( CC/S/As, DOD Field Activities, and Joint Activities), the combatant commanders will:

a. Approve the connection of deployed ISs to theater networks and their subsequent operation.

b. Endorse and validate combatant command CD and non-DOD connection requests in support of mission requirements.

c. Review and submit service restoration priority requests IAW with DISA Circular 310-130-4 (reference x).

d. Submit DISN requirements through designated Service Executive Agent channels to DISA IAW DODD 5100.3 (reference y). Commander, U.S. Special Operations Command (CDRUSSOCOM) may submit requirements directly to DISA from USSOCOM headquarters.

e. Act to prevent or mitigate the loss or degradation of Defense Critical Infrastructure supporting the DISN and retain risk decision authority for Unified Command Plan (UCP) (reference z) assigned missions and responsibilities.

3. Commander, U.S. Strategic Command (CDRUSSTRATCOM). In addition to the responsibilities outlined in paragraph 2 (above) and paragraph 9 (CC/S/As, DOD Field Activities, and Joint Activities), CDRUSSTRATCOM will:

a. Appoint a flag-level representative to the DISN/GIG Flag Panel.

b. Appoint an O-6 or government civilian equivalent as combatant command primary representative to the DSAWG and appoint alternates with USSTRATCOM DSAWG voting authority. Provide a copy of the appointment letter to the DISN/GIG Flag Panel and the DSAWG chairperson.

c. Plan, integrate, and coordinate with CC/S/As on DOD global operations by directing GIG operations and defense IAW the UCP and responsibilities in CJCSI 6510 (reference aa).

B-3

d. Assist DISA (Defense Critical Infrastructure Program (DCIP) Sector Lead for GIG) in identifying, analyzing, and assessing the DISN and its subnetwork assets and related mission impacts in coordination with other CC/S/As.

e. Issue disconnection warning orders and orders IAW with Appendix A of Enclosure C.

f. Direct joint vulnerability assessment process (JVAP) visits to assess cross domain solutions, as required.

4. Service Chiefs. In addition to responsibilities outlined in paragraph 9 (CC/S/As, DOD Field Activities, and Joint Activities), the Service Chiefs will:

a. Provide local data distribution capability to meet combatant command validated connectivity requirements. ISs must be focused on supporting operational requirements of the combatant command or parent Service and be capable of supporting contingency operations.

b. Appoint an O-6 or government civilian equivalent as primary representative to the DSAWG and alternates with Service DSAWG voting authority. Provide a copy of the appointment letter to the DISN/GIG Panel and the DSAWG chairperson.

c. In addition to the responsibilities outlined in paragraph 9.h., Services will perform the following tasks in support of Service CD information transfer requirements:

(1) Appoint an O-6 or civilian equivalent representative to the

CDRB.

(2) Designate an office to work on CD activities and issues with the

UCDMO.

(3) Conduct certification testing of CD technologies IAW DOD and Intelligence Community (IC) guidance and security controls as required.13

d. Validate operational requirements, endorse sponsoring Service organization requests, and prioritize Service CD and non-DOD connection requests.

13 UCDMO, in coordination with DOD and IC organizations, is developing a security controls catalog for certification testing of CD technologies.

B-4

e. Provide requisite site support for DISN equipment located on bases, posts, camps, and stations. This includes providing power, physical security, floor space, and onsite coordination for the DISN network points of presence on these bases, posts, camps, and stations.

Site support must be specified by DISA in procedural documentation and coordinated with the Service.

f. Identify, assess, and document the DISN assets and associated dependencies needed to implement required CC/S/A and field activity mission-essential tasks and required capabilities in coordination with

DISA.

5. Director, Defense Information Systems Agency (DISA). In addition to responsibilities outlined in paragraph 9 (CC/S/As, DOD Field Activities and Joint Activities), Director, DISA will:

a. Provide transport services used for voice, data, and video services through a combination of terrestrial and satellite assets and services IAW DODD 5105.19 (reference bb).

b. Direct operation and management of DOD-owned and leased telecommunications DISN subsystems and networks.

c. Provide DISN services to satisfy CC/S/A and field activity long-haul and wide area network information transfer requirements.

d. Appoint a flag-level representative to the DISN/GIG Flag Panel.

e. Appoint an O-6 or government civilian equivalent as chairperson of the DSAWG. Provide a copy of the appointment letter to the DISN/GIG Flag Panel and DSAWG chairperson

f. Appoint an O-6 or government civilian equivalent as a primary DSAWG representative as well as alternates with DISA DSAWG voting authority. Provide a copy of the appointment letter to the DISN/GIG Flag

g. Appoint an O-6 or civilian equivalent representative to the CDRB.

h. Assess the technical, programmatic, and operational feasibility of adding new services and capabilities to the DISN.

(1) Add new DISN services and capabilities in response to validated and prioritized user requirements and planned technology insertion.

B-5

(2) Analyze and satisfy requests for new DISN services in coordination with the CC/S/As.

(3) Identify capability gaps to OASD(NII)/DOD CIO when the CC/S/A requirements cannot be met feasibly by new DISN services.

i. Approve DISN connections based on validated requirements.

Ensure that the connection meets technical and interoperability requirements IAW DODI 4630.8 (reference cc), CJCSI 6212.01 (reference dd), and CJCSI 6215.01 (reference b). Additionally, ensure the IS is accredited IAW DODI 8510.01 (reference d) or DCID 6/3 (reference c).14

j. Accredit the DISN SIPRNET to process SECRET information, including North Atlantic Treaty Organization (NATO) information, IAW DODI 8510.01 (reference d).15

k. Conduct network management and meet CC/S/A and field activity requirements to acquire DOD long-haul telecommunications infrastructure and services.

l. Maintain configuration management of the DISN. For example, this includes maintaining an accurate, appropriately classified, and physically and electronically protected database of existing DISN user activities (including non-DOD agencies and contractor activities). It also includes monitoring system service restoration.

m. Monitor the effectiveness of the DISN-provided services in satisfying user requirements and respond to combatant command requests for reports on system performance.

n. Plan and coordinate with the CC/S/A and field activities to identify, analyze, and assess DISN assets and mission impacts IAW DODD 3020.40 (reference t).

o. Perform required system engineering and modeling to achieve the optimal network design and implementation approach. Identify performance standards for DISN services (e.g., availability and response time) and mission survivability requirements.

14 DISA will also ensure ISs provide adequate security, usually through remote compliance monitoring and vulnerability assessments.

15 NATO information must be handled IAW United States Security Authority for NATO Affairs Instruction 1-07 (reference ee).

B-6

p. Advise the Chairman, CDRUSSTRATCOM, and other combatant commanders on DISN resource allocation or events that significantly degrade the network.

q. Conduct onsite and remote compliance assessments of DISN enclaves and connections.

r. Support the combatant commands in creating a User-Defined Operational Picture for their areas of responsibility (AORs).

s. Serve as the primary coordinator for processing, reviewing, and implementing all DISN connection requests.

(1) Track and approve all single-level connections, employing standard equipment configuration conforming to published security configuration guidelines.

(2) Identify vulnerabilities and configuration or operational changes that affect individual or classes of accredited CD information transfer requirement implementations. Notify the DSAWG, affected CC/S/A, field activity designated accrediting authorities (DAAs), and UCDMO of such changes.

(3) Monitor connected enclave (e.g., base, camp, post, or station) accreditation and security status IAW DOD 8510.01 (reference d).

Assess enclave compliance with DOD vulnerability management

(4) Provide quarterly status reports on operational DISN CD services and solutions to the OASD(NII)/DOD CIO, the DISN/GIG Flag Panel, the DSAWG, the UCDMO, and the CC/S/As.

(5) In coordination with DSAWG, review commercial Internet waiver requests to DOD ISs (network and standalone) and make recommendations to the GIG Waiver Board.

(6) Develop, maintain, and promulgate a customer connection process guide describing steps that must be followed to request and implement a DISN connection (including but not limited to NIPRNET, SIPRNET, DSN, or DVS connections). The guide will also include processes for requesting non-DOD connections to DISN and for DISN CD services and solutions.

B-7

(7) Develop and maintain databases and Web sites16 that include the following:

(a) The SIPRNET GIG Interconnection Approval Process (GIAP) System (SGS) used to record the technical and operational characteristics of active connections. This database must also record pending and operational CC/S/A and field activity CD information transfer requirements. Access to data will be provided to the UCDMO for incorporation into a combined DOD and IC CD database.

(b) The SNAP unclassified systems database and Web site to record technical and operational characteristics of active connections and systems.

t. Conduct SIPRNET and NIPRNET compliance validation visits to high-risk connection locations. Compliance validation visits will, at a minimum, consist of traditional security checks, scanning of the connected network, enhanced compliance visits (ECVs), and a JVAP if a CD solution is operational. This includes the following tasks:

(1) Maintain reports of the visits on the DOD database.

(2) Provide report access to the OASD(NII)/DOD CIO; the Joint Staff; USSTRATCOM; the Director, Operational Test and Evaluation (DOT&E); and selective CC/S/As for review.

(3) Establish processes and procedures for the documentation of site response to compliance visit open findings.

(4) Assess security implementation on connected environments from the cryptographic device to the workstation for classified connections (i.e., SIPRNET) and from the point of presence of the connection to the workstations for unclassified connections (i.e., NIPRNET).

u. In addition to responsibilities outlined paragraph 9.h., DISA will perform the following tasks in support of DOD and IC CD information transfer connection requirements:

(1) Appoint a representative to the CDRB.

(2) Coordinate, manage, and maintain the implementation of DISA-provided enterprise CD services, centralized CD solutions, and

16 Ensure databases and Web sites are appropriately classified and have appropriate physical and electronic security.

B-8 baseline point CD solutions. Ensure feedback between DISA, the supported CC/S/A and field activities, and the UCDMO on CD services and solutions.

(3) Operate enterprise CD services on behalf of the DOD components.

(4) Designate an office to work CD activities and issues with the

(5) Develop the JVAP to ensure that CD information transfer requirements are assessed annually in coordination with NSA/CSS and the UCDMO.

v. Execute responsibilities IAW DODD 3020.40 (reference t) as the DCIP Defense Sector Lead Agent for the GIG.

w. Develop and maintain a central Ports, Protocols, and Services (PPS) registry IAW DODI 8551.1 (reference ff) of DOD ISs with PPS that are visible to DOD-managed network components.

6. Director, Defense Intelligence Agency (DIA). In addition to responsibilities outlined in paragraph 9 (CC/S/As, DOD Field Activities, and Joint Activities), the Director, DIA, will:

a. Implement, operate, manage, and secure Joint Worldwide Intelligence Communications System (JWICS) components and facilities on the DISN IAW established agreements with DISA.

b. Provide threat assessments to support CC/S/A and field activity ISs and network risk assessments and decisions.

c. Appoint a flag-level representative to the DISN/GIG Flag Panel.

d. Appoint an O-6 or government civilian equivalent as primary representative to the DSAWG and alternates with DIA DSAWG voting authority. Provide a copy of the appointment letter to the DISN/GIG Flag

e. In support of IC CD information transfer connection requirements, DIA will perform the following in addition to the responsibilities outlined in paragraph 9.h.:

(1) Appoint a representative to the CDRB.

B-9

(2) Coordinate, manage, and maintain the implementation of DIA-provided enterprise CD services, centralized CD solutions, and baseline point CD solutions. Ensure there is feedback among DIA and supported CC/S/A and field activities and the UCDMO on CD services and solutions.

(3) Designate an office to work on CD activities and issues with the

(4) Conduct certification testing of CD technologies IAW DOD and IC guidance and security controls as required.17

7. Director, National Security Agency (NSA)/Central Security Service (CSS). The Director, NSA/CSS (in addition to responsibilities outlined in paragraph 9 (CC/S/As, DOD Field Activities, and Joint Activities) will:

a. Appoint a flag-level representative to the DISN/GIG Flag Panel.

b. Appoint an O-6 or government civilian equivalent primary representative to the DSAWG and alternates with NSA/CSS DSAWG voting authority. Provide a copy of the appointment letter to the DISN/GIG Flag Panel and the DSAWG chairperson.

c. Appoint a representative to the CDRB.

d. Recommend techniques and procedures to minimize DISN information security vulnerabilities IAW DODD 8500.01E (reference i) and CJCSI 6510.01 (reference aa).

e. Develop and/or certify Communications Security (COMSEC) solutions. Produce keying material for all COMSEC.

f. Establish and maintain methods for performing, analyzing, and evaluating security countermeasures and attacks in support of the community evaluation of the global risk for CD solutions.

g. In support of DOD and IC CD information transfer requirements, and in addition to responsibilities outlined in paragraph 9.h., NSA/CSS

(1) Identify vulnerabilities that affect individual or classes of accredited implementations. Coordinate with DISA, DISN/GIG Flag Panel, DSAWG, UCDMO, and USSTRATCOM on notification of CC/S/As

17 UCDMO, in coordination with DOD and IC organizations, is developing a security controls

B-10 appointed CIOs, senior information assurance officers (SIAOs), and DAAs for affected ISs.

(2) Provide technical support to DISA for development and conduct of a CD JVAP.

(3) Designate an office to work on CD activities and issues with the

(4) Conduct certification testing of CD technologies IAW DOD and IC guidance and security controls as required.18

8. Director, Defense Security Service (DSS). The Director, in addition to responsibilities outlined in paragraph 9 (CC/S/As, DOD Field Activities, and Joint Activities), will:

a. Administer the National Industrial Security Program on behalf of DOD and non-DOD federal agencies that have entered into an agreement with the Secretary of Defense for the purpose of rendering industrial security services.

b. Serve as the DAA for all classified contractor connections to the DISN IAW DOD 5220.22-M, NISPOM (reference n).

9. CC/S/As, DOD Field Activities, and Joint Activities. The CC/S/As, DOD Field Activities, and Joint Activities will:

a. Submit long-haul, common-user transmission requirements to DISA, IAW DODI 4640.14 (reference l).

(1) Identify to DISA each DOD IS requiring long-haul, common-user information transfer services for DISN planning purposes. ISs and requirements must be identified to DISA as soon as requirements for these services are validated.

(2) Coordinate long-haul requirements for DISN access within a combatant commander’s geographic AOR, combatant commander/Service/post/camp/station or agency operated facility, and DISA prior to submission.

(3) Coordinate with DISA the customer provisioning of Web services such as data interfaces for alarm, configuration, and trouble ticketing.

18 UCDMO, in coordination with DOD and IC organizations, is developing a security controls

B-11

(4) Process sustaining base and deployable segment requirements IAW DODI 4640.14 (reference l) and the supporting components’ procedures.

b. Implement DOD PAA and DISN/GIG Flag Panel decisions on the enterprise deployment, operation, and connection of ISs.

c. Appoint DAA(s) for CC/S/A and field activity ISs IAW DODD 8500.01E (reference i), DODI 8500.2 (reference k), and DODI 8510.01 (reference d).

(1) The DAA must be a U.S. citizen, an employee of the U.S.

government (USG) (minimum grade of O-6 or civilian equivalent), and hold USG security clearance commensurate with ISs under the DAA’s jurisdiction.

(2) The DAA may delegate accreditation approval authority if necessary. The individual delegated must be at least an O-6 or civilian equivalent and meet the requirements specified in DODD 8500.01E (reference i), DODI 8500.2 (reference k), and paragraph c. (1) above. The delegation of authority must be in writing.

d. Ensure that ISs connected to the DISN are certified and accredited IAW DOD19 or IC C&A guidance.

e. Ensure the CC/S/A sponsoring organization provides for or aligns with an accredited CNDS provider to acquire computer network defense (CND) support for each IS or network.

f. Ensure that SIPRNET enclaves with the requirement to process NATO classified information meet NATO and U.S. security requirements to handle NATO classified information IAW United States Security Authority for NATO Affairs Instruction 1-07 (reference ee). Additionally, ensure the enclaves are accredited IAW DODI 8510.01 (reference d).20

g. Endorse connection requirements and maintain oversight for component connections and requests.

(1) Document and endorse the requirements for connections including alternate connections.

19 DODI 8510.01 (reference d).

20 The Central United States Registry (CUSR) Web site lists registered enclaves at https://secureweb.hqda.pentagon.mil/cusr/index.asp.

B-12

(2) Endorse requests, validate operational requirements, and prioritize CC/S/A non-DOD connection requests.

(3) Ensure all sponsored non-DOD unclassified connections are accredited IAW DODI 8510.01 (reference d) or DCID 6/3 (reference c).

(4) Ensure that foreign entity connection requests are endorsed by a combatant command headquarters.

(5) Assign and identify to DISA a primary (O-6 or civilian equivalent) and alternate to validate and endorse CC/S/A non-DOD DISN connection requirements for CC/S/A or field activity headquarters.

h. Program, budget, fund, and provide support for assigned portions of the DISN (including procurement, training, operation, maintenance, usage fees, CD service, solution development, and physical and electronic security survivability measures).

i. Manage the DISN connected ISs in conformance with DOD NetOps and GIG policies and procedures.

j. Provide guidance in writing on authorized and prohibited uses of DISN IAW DOD 5500.7-R (reference e). Ensure user agreement and IA awareness training includes CC/S/A authorized and prohibited uses of DISN and potential penalties IAW DODD 5500.7 (reference f). See Enclosure A (Policy).

k. In support of DOD and Director of National Intelligence (DNI) CD information transfer requirements, CC/S/As will:

(1) Identify an office or point of contact (POC) to work CD activities and issues with the UCDMO.

(2) Use the CD products and solutions listed in the UCDMO CD baseline.

(3) Employ enterprise or centralized CD services whenever possible as the preferred solution for an information transfer requirement.

(4) Provide the UCDMO with information on any CC/S/A CD solution or program improvement and research and development activities.

B-13

(5) Provide the UCDMO with CD information transfer

(6) Endorse, validate, and prioritize CC/S/A or field activity operational CD information transfer requirements.

(7) Obtain combatant command validation, endorsement, and prioritization of information transfer requirements submitted in support of combatant command operations.

(8) Support development of CD strategy, roadmap, and process as

(9) Coordinate with UCDMO to determine availability and suitability of a CD service or solutions to meet CC/S/A CD information transfer requirement(s) prior to initiating any CD development.

(10) If required, support implementation of CC/S/A baseline CD solutions for which they are a proponent in coordination with other CC/S/A CD support offices, the UCDMO and DISA, support site personnel, and system developers.

(11) Conduct life cycle management21 and support of a CC/S/A CD service and solution through a program management office or specified CC/S/A organization IAW DODI 5000.2 (reference j) and DODI

8580.1 (reference gg).

l. Ensure ISs are compliant with DOD IA requirements IAW DODD 8500.01E (reference i), CJCSI 6510.01 (reference aa), and DISN policy and procedures.

m. Maintain direct management responsibility to coordinate, install, test, and accept their users’ host and terminal access circuits according to DOD and DISA-established criteria.

n. Provide information, as requested, to DISA for DISN billing, management, and inventory purposes.

o. Conduct compliance inspections, assistance visits, technical engineering inspections, remote monitoring, and vulnerability assessments of DISN connections and connected enclaves in support of the DISN Information Assurance Program (Enclosure D).

21 Life-cycle activities include capabilities, resources, acquisition, security, operations, deactivation, and retirement/reutilization or demilitarization of a service or solution.

B-14

p. Establish procedures to ensure prompt management action is taken as a result of classified information compromise or determination that classified information is at risk of compromise IAW DOD 5200.1-R (reference hh).

q. Identify and assess critical assets and supporting infrastructures required to operate CC/S/A and field activity ISs.

(1) Identify physical infrastructure assets critical to the operation of ISs and networks connected to DISN and GIG.

(2) Identify dependencies on supporting infrastructure (e.g., electrical power) or supporting networks (e.g., commercial telecommunications).

(3) Assess the susceptibility of ISs to natural or manmade damage to identify remediation or mitigation measures. Implement formal risk assessment, management, and remediation processes to ensure remediation or mitigation actions are implemented IAW risk management decisions.

(4) Ensure IS DCIP requirements are included in contingency, continuity of operations, and/or disaster preparedness plans IAW DODD

3020.40 (reference t).

r. Ensure DOD and non-DOD personnel (including supporting contractor personnel) are held personally and individually responsible and accountable for providing proper protection of classified information, controlled unclassified information, ISs, and/or networks under their custody and control IAW CJCSI 6510.01 (reference aa).