Bidders Library Interoperability Test and Evaluation - DoDI 8330 01.pdf

Change 2, 12/11/2019

CONTENTS

Department of Defense

INSTRUCTION

NUMBER 8330.01

May 21, 2014

Incorporating Change 2, December 11, 2019

DoD CIO

SUBJECT: Interoperability of Information Technology (IT), Including National Security

Systems (NSS)

References: See Enclosure 1

1. PURPOSE. This instruction:

a. In accordance with the authority in DoD Directive (DoDD) 5144.02 (Reference (a)) and the guidance in DoDD 8000.01 (Reference (b)):

(1) Establishes policy, assigns responsibilities, and provides direction for certifying the interoperability of IT and NSS pursuant to sections 2222, 2223, and 2224 of Title 10, United

States Code (Reference (c)).

(2) Establishes a capability-focused, architecture-based approach for interoperability analysis.

(3) Establishes the governing policy and responsibilities for interoperability requirements development, test, certification and prerequisite for connection of IT, including NSS (referred to in this instruction as “IT”).

(4) Defines a doctrine, organization, training, materiel, leadership and education, personnel, facilities, and policy (DOTMLPF-P) approach to enhance life-cycle interoperability of

IT.

(5) Establishes the requirement for enterprise services to be certified for interoperability.

b. Incorporates and cancels DoDD 4630.05, DoDI 4630.8, and DoD Chief Information

Officer (CIO) Memorandum (References (d), (e), and (f)).

DoDI 8330.01, May 21, 2014

2. APPLICABILITY

a. This instruction applies to:

(1) The OSD, the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff (CJCS) and the Joint Staff, the Combatant Commands (CCMDs), the Office of the

Inspector General of the Department of Defense, the Defense Agencies, the DoD Field

Activities, and all other organizational entities within the DoD (referred to collectively in this instruction as the “DoD Components”).

(2) The United States Coast Guard. The U.S. Coast Guard will adhere to DoD requirements, standards, and policies in this instruction in accordance with the direction in

Paragraph 4a of the Memorandum of Agreement Between the Department of Defense and the

Department of Homeland Security (Reference (ad)).

(3) All IT (systems, applications, products or IT services) that any DoD Component acquires, procures, or operates, including IT that:

(a) DoD intelligence agencies, DoD Component intelligence elements, and other

DoD intelligence activities engaged in direct support of DoD missions, acquire, procure (systems or services), sponsor, or operate.

(b) The Combatant Commanders, their Commands, and subordinate commands acquire, procure, or operate. This includes IT in development and in operation as well as certain aspects of embedded IT (e.g., in platforms that exchange information beyond the platform boundaries).

(c) Shares, exchanges, or uses information to enable units or forces to operate in joint, multinational, and interagency operations.

(d) Supports all DoD mission areas as defined in DoDI 8115.02 (Reference (g)).

(e) Provides enterprise services to enable units or forces to operate in joint, multinational, and interagency operations.

(f) Supports DoD mobility initiatives to include infrastructure, services, and management.

b. This instruction does not apply to IT:

(1) That only performs the functions of simulation or training and only stores, processes, or exchanges simulated (i.e., not real-world) data, and has no possibility of exporting data into an operational system.

(2) That is used exclusively for demonstration or simulation, imports but does not export real-world data, and does not use that data to support any operational (e.g., warfighting, business, intelligence, enterprise information environment) process or decision making.

(3) That is designated as DoD unified capabilities (UC) and is governed in accordance with DoDI 8100.04 (Reference (h)).

3. POLICY. It is DoD policy that:

a. IT that DoD Components use must interoperate, to the maximum extent practicable, with existing and planned systems (including applications) and equipment of joint, combined, and coalition forces, other U.S. Government departments and agencies, and non-governmental organizations, as required based on operational context.

b. All IT, including defense acquisition and procurement programs and enterprise services, must have either a net ready (NR) key performance parameter (KPP), key system attribute

(KSA), or additional performance attribute (APA) as part of its interoperability requirements documentation. The NR capability (KPP, KSA, APA) requirements documentation consists of measurable and testable performance or attribute measures and metrics derived from associated

DoD architectures, and is used to assess both the technical exchange of information, data, and services, and the end-to-end operational effectiveness of those exchanges.

c. IT interoperability must be evaluated early and with sufficient frequency throughout a system’s life cycle to capture and assess changes affecting interoperability in a joint, multinational, and interagency environment. Interoperability testing must be comprehensive, cost effective, and completed, and interoperability certification granted, before fielding of a new

IT capability or upgrade to existing IT.

d. IT must be certified for interoperability or possess an interim certificate to operate (ICTO) or waiver to policy in accordance with section 9 of Enclosure 3, before connection to any DoD network (other than for test purposes).

e. Special measures may be required for protection and handling of foreign intelligence or counterintelligence information, or other need-to-know information, particularly when it contains information concerning U.S. persons. Accordingly, execution of this instruction must be tailored to comply with coordinated Director of National Intelligence (DNI) directives, Intelligence

Community (IC) policies, and DoD intelligence policies.

f. This instruction does not alter or supersede existing authorities and policies of the DNI regarding the protection of Sensitive Compartmented Information and special access programs pursuant to Executive Orders 12333 and 13526 (References (i) and (j)), national security information systems pursuant to Executive Order 13231 (Reference (k)), and other laws and regulations.

g. Nothing in this instruction replaces or modifies the cybersecurity requirements of DoDI

8500.01 (Reference (l)) and DoDI 8510.01 (Reference (m)). All IT developers and operators must fully comply with those instructions as well.

4. RESPONSIBILITIES. See Enclosure 2.

5. PROCEDURES. See Enclosure 3.

6. RELEASABILITY. Cleared for public release. This instruction is available on the

Directives Division Website at https://www.esd.whs.mil/DD/.

7. SUMMARY OF CHANGE 2. This change:

a. Removes the responsibilities for the Commander, United States Strategic Command, which no longer apply.

b. Reflects changes in responsibilities driven by the reorganization of the Office of the

Under Secretary of Defense for Acquisition, Technology, and Logistics into the Office of the

Under Secretary of Defense for Research and Engineering (USD(R&E)) and the Office of the

Under Secretary of Defense for Acquisition and Sustainment (USD(A&S)), in accordance with

Section 804 of Public Law 114-328 (Reference (ae)).

c. Reflects the name change of the Deputy Chief Management Officer of the Department of

Defense to the Chief Management Officer of the Department of Defense (CMO), in accordance with Section 901 of Reference (ae).

d. Provides guidance on using a common evaluation framework and associated automation for interoperability requirements analysis, test planning, data analysis, reporting, and subsequent certification to achieve standardization and efficiencies.

e. Updates references, abbreviations, acronyms, and other administrative changes.

8. EFFECTIVE DATE. This instruction is effective May 21, 2014.

David L. De Vries

Acting Department of Defense

Chief Information Officer

Enclosures

1. References

2. Responsibilities

3. Procedures

Glossary

DoDI 8330. 01, May 21, 2014

Change 2, 12/11/2019

CONTENTS

TABLE OF CONTENTS

ENCLOSURE 1: REFERENCES

ENCLOSURE 2: RESPONSIBILITIES

DOD CHIEF INFORMATION OFFICER (DoD CIO)

DIRECTOR, DEFENSE INFORMATION SYSTEMS AGENCY (DISA)

UNDER SECRETARY OF DEFENSE FOR ACQUISITION AND SUSTAINMENT

(USD(A&S))

UNDER SECRETARY OF DEFENSE FOR RESEARCH AND ENGINEERING

(USD(R&E)

UNDER SECRETARY OF DEFENSE (COMPTROLLER)/ CHIEF FINANCIAL

OFFICER, DEPARTMENT OF DEFENSE (USD(C)/CFO)

ASSISTANT SECRETARY OF DEFENSE FOR HOMELAND DEFENSE AND

GLOBAL SECURITY (ASD(HD&GS))

CMO

DIRECTOR OF COST ASSESSMENT AND PROGRAM EVALUATION (DCAPE)

DIRECTOR, OPERATIONAL TEST AND EVALUATION (DOT&E)

DIRECTOR, DEFENSE INTELLIGENCE AGENCY (DIA)

DIRECTOR, NATIONAL SECURITY AGENCY/CHIEF, CENTRAL SECURITY

SERVICE (DIRNSA/CHCSS)

DIRECTOR, NATIONAL GEOSPATIAL-INTELLIGENCE AGENCY (NGA)

OSD AND DoD COMPONENT HEADS

CHAIRMAN OF THE JOINT CHIEFS OF STAFF (CJCS)

COMBATANT COMMANDERS

ENCLOSURE 3: PROCEDURES

GENERAL

INTEROPERABILITY REQUIREMENTS IDENTIFICATION

NR CERTIFICATION PROCESS

ISP PROCESS

Overview

Development and Submission

ISP Review and Approval

IT INTEROPERABILITY TEST AND EVALUATION

IT INTEROPERABILITY CERTIFICATION PROCESS

Overview

Procedures

Certification of Urgent and Emergent Operational Need-Based IT

Recertification

SYSTEM CONNECTION APPROVAL

INTEROPERABILITY GOVERNANCE

WAIVERS TO IT INTEROPERABILITY POLICY AND ICTO REQUESTS

CONTENTS

GLOSSARY

PART I. ABBREVIATIONS AND ACRONYMS

PART II. DEFINITIONS

FIGURE

IT Interoperability Certification and Connection Process for Systems with Joint, Multinational, or Interagency Interoperability Requirements

Change 2, 12/11/2019 ENCLOSURE 1

ENCLOSURE 1

REFERENCES

(a) DoD Directive 5144.02, “DoD Chief Information Officer (DoD CIO),” November 21, 2014, as amended

(b) DoD Directive 8000.01, “Management of the Department of Defense Information

Enterprise (DoD IE),” March 17, 2016, as amended

(c) Title 10, United States Code

(d) DoD Directive 4630.05, “Interoperability and Supportability of Information Technology

(IT) and National Security Systems (NSS),” May 5, 2004 (hereby cancelled)

(e) DoD Instruction 4630.8, “Procedures for Interoperability and Supportability of Information

Technology (IT) and National Security Systems (NSS),” June 30, 2004 (hereby cancelled)

(f) DoD Chief Information Officer Memorandum, “Interim Guidance for Interoperability of

Information Technology (IT) and National Security Systems (NSS),” March 27, 2012

(hereby cancelled)

(g) DoD Instruction 8115.02, “Information Technology Portfolio Management

Implementation,” October 30, 2006

(h) DoD Instruction 8100.04, “DoD Unified Capabilities (UC),” December 9, 2010

(i) Executive Order 12333, “United States Intelligence Activities,” December 4, 1981, as amended

(j) Executive Order 13526, “Classified National Security Information,” December 29, 2009

(k) Executive Order 13231, “Critical Infrastructure Protection in the Information Age,”

October 16, 2001, as amended

(l) DoD Instruction 8500.01, “Cybersecurity,” March 14, 2014

(m) DoD Instruction 8510.01, “Risk Management Framework (RMF) for DoD Information

Technology (IT),” March 12, 2014, as amended

(n) Deputy Secretary of Defense Memorandum, “Department of Defense (DoD) Chief

Information Officer (CIO) Executive Board Charter,” February 12, 2012

(o) DoD Directive 5000.01, “The Defense Acquisition System,” May 12, 2003, as amended

(p) DoD Instruction 5000.02, “Operation of the Defense Acquisition System,” January 7, 2015, as amended

(q) Committee on National Security Systems (CNSS) Policy No. 15, “National Information

Assurance Policy on the Use of Public Standards for the Secure Sharing of Information

Among National Security Systems,” October 20, 20161

(r) DoD Instruction 8320.02, “Sharing Data, Information, and Information Technology (IT)

Services in the Department of Defense,” August 5, 2013

(s) DoD Architecture Framework, Version 2.02, August 20122

(t) DoD Information Enterprise Architecture 2.0, August 10, 20123

1 Please contact the CNSS office at cnss@nsa.gov to obtain a copy of this document.

2 Available on the Internet at http://dodcio.defense.gov/dodaf20.aspx 3 Available on the Internet at http://dodcio.defense.gov/Home/Initiatives/DIEA.aspx

Change 2, 12/11/2019 ENCLOSURE 1

(u) Chairman of the Joint Chiefs of Staff Instruction 5123.01H, “Charter of the Joint

Requirements Oversight Council (JROC) and Implementation of the Joint Capabilities

Integration and Development System (JCIDS),” August 31, 2018

(v) Global Information Grid Technical Guidance Federation Website, “DoD IT

Standards Registry Online” 4

(w) DoD Instruction 8320.07, “Implementing the Sharing of Data, Information, and

Information Technology (IT) Services in the Department of Defense,” August 3, 2015

(x) DoD Instruction 4650.01, “Policy and Procedures for Management and Use of the

Electromagnetic Spectrum,” January 9, 2009, as amended

(y) DoD Instruction 8320.05, “Electromagnetic Spectrum Data Sharing,” August 18, 2011

(z) “Manual for the Operation of the Joint Capabilities Integration and Development System

(JCIDS),” August 31, 2018

(aa) Defense Acquisition Guidebook Website5

(ab) Title 40, United States Code

(ac) Title 44, United States Code

(ad) Memorandum of Agreement Between the Department of Defense and the Department of

Homeland Security Regarding Department of Defense and U.S. Coast Guard Cooperation on Cybersecurity and Cyberspace Operations, January 19, 20176

(ae) Public Law 114-328, “National Defense Authorization Act for Fiscal Year 2017,”

December 23, 20167

4 Available on the Internet at https://gtg.csd.disa.mil/ 5 Available on the Internet at https://dag.dau.mil/ 6 Available on the Internet at https://dcms.uscg.afpims.mil/Our-Organization/Assistant-Commandant-for-C4IT-CG-

6-/The-Office-of-Information-Management-CG-61/Interagency-Agreements/ 7 Available on the Internet at https://www.congress.gov/114/plaws/publ328/PLAW-114publ328.pdf

Change 2, 12/11/2019 ENCLOSURE 2

ENCLOSURE 2

RESPONSIBILITIES

1. DOD CHIEF INFORMATION OFFICER (DoD CIO). In addition to the responsibilities in section 13 of this enclosure, the DoD CIO:

a. Maintains this instruction in coordination with the other OSD and DoD Component heads.

b. Provides oversight of IT interoperability, in coordination with the DoD Components and other mission partners.

c. Establishes policy and provides oversight for:

(1) Developing a capability-focused, architecture-based approach to achieve IT interoperability.

(2) Interoperability testing, certification, connection, and operation of IT.

(3) Adjudicating waivers to this instruction and requests for ICTOs for IT with joint, multinational, and interagency interoperability requirements as found in section 9 of Enclosure 3 of this instruction.

d. Maintains the DoD Enterprise Architecture (EA) in accordance with Reference (b).

e. Requires and verifies, in coordination with the USD(R&E), the USD(A&S), the CJCS, the

CMO, and the other DoD Component heads, that DoD architectures (enterprise, reference and solution) are defined, developed, integrated, coordinated, validated, synchronized, and used.

f. Requires that IT architecture (enterprise, reference and solution) data is sufficient to assess interoperability.

g. Establishes responsibilities and procedures, in coordination with the USD(R&E), the

USD(A&S), the Director of Operational Test and Evaluation (DOT&E), the CJCS, the CMO, and the other DoD Component heads, to require appropriate interoperability assessment and reassessment throughout a system’s life cycle. In coordination with the DoD Components, oversees the establishment of measurable and testable certification criteria for interoperability assessment.

h. Maintains liaison with the CIO of the Intelligence Community within the Office of the

DNI to identify and resolve DoD and IC interoperability issues.

i. Designates the authoritative IT registry (or registries) for the DoD, and publishes procedures for registering all DoD IT within the registry (or registries).

j. Establishes the IT Interoperability Steering Group (ISG), subordinate to the appropriate forum of the DoD CIO Executive Board (EB) as determined by the DoD CIO and described in its charter (Reference (n)). Designates a representative to serve as ISG tri-chair along with

USD(A&S), and CJCS representatives (for details on ISG structure and functions, see section 8 of Enclosure 3 of this instruction). Publishes and maintains the ISG charter.

k. Establishes and oversees the DoD-wide process for review of information support plans

(ISPs).

(1) Establishes, in coordination with the USD(R&E), the USD(A&S), the DOT&E, the

CJCS, and the other DoD Mission Area Owners (CMO and the Office of the Under Secretary of

Defense for Intelligence (OUSD(I))) process, procedures, format, and content guidance for developing and submitting ISPs on acquisition category (ACAT), non-ACAT, and fielded IT.

(2) Coordinates with DoD Components in establishing ISP review processes to support joint reviews of DoD Component systems.

(3) Adjudicates critical comments in joint ISP reviews that cannot be resolved at the

DoD Component level.

l. Addresses specific recommendations for critical IT interoperability issues within the DoD

CIO annual Defense Planning Guidance to the DoD Components that support the future planning, programming, budgeting, and execution cycle.

m. Provides policy and oversight for requiring and achieving the interoperability of enterprise services.

n. Designates certain ISPs affecting DoD enterprise strategic initiatives for DoD special interest oversight, and participates in the ISP reviews of those systems.

2. DIRECTOR, DEFENSE INFORMATION SYSTEMS AGENCY (DISA). Under the authority, direction, and control of the DoD CIO, and in addition to the responsibilities in section

13 of this enclosure, the Director, DISA:

a. Conducts the joint, multinational, and interagency IT interoperability assessment, test, and evaluation program, in collaboration with the other DoD Components.

b. Operates and maintains the Global Information Grid Technical Guidance Federation

(GTG-F) online portal at https://gtg.csd.disa.mil and associated processes supporting the preparation, submission, verification, assessment review, and approval of ISPs.

c. Participates in all joint reviews of ISPs and nominates, for the DoD CIO, special interest oversight of ISPs affecting DoD enterprise strategic initiatives.

https://gtg.csd.disa.mil/

d. Provides systems engineering, planning, and program guidance, in coordination with the

USD(R&E) and the USD(A&S). Aids the DoD Components with developmental IT interoperability testing to deliver solutions, reduce duplication of effort, and enhance IT interoperability.

e. Maintains the Operating At Risk List (OARL), listing all IT systems that were denied an

ICTO, are operating on a DoD network without interoperability certification or ICTO, and have not received an appropriate waiver to this instruction.

f. Defines the strategy and process for the interoperability test and certification of enterprise services within DoD.

g. Enforces the requirement for interoperability certification or granting of an ICTO before connection to the Defense Information Systems Network (DISN) through the DISN connection approval process.

h. Builds and delivers the Mobility EA to provide interoperable, secure (classified and unclassified) mobile communications capabilities to the DoD on a global basis.

i. Defines and executes the strategy, processes, and reference architectures to enhance the interoperability of enterprise services within the DoD.

j. Establishes a standard approach for evaluation of critical exchange points between enterprise services, infrastructures, and environments using measures of performance (MOPs) and measures of effectiveness (MOEs). Confirms interoperability from end-to-end in a multi-vendor, multi-networked, and multi-service environment.

k. Reviews and comments on interoperability test criteria for and leads execution of interoperability assessments across the DoD mobility program.

l. Reviews and comments on interoperability test criteria for and execution of interoperability assessments for IT supporting cyberspace operations.

m. Coordinates with Director, NGA on all geospatial intelligence (GEOINT)-related interoperability certifications.

n. Directs the DISA Joint Interoperability Test Command (JITC) to:

(1) Evaluate and certify joint, multinational, and interagency IT interoperability for the

DoD.

(2) Serve as the Interoperability Certification Authority for all DoD IT with joint, multinational, or interagency interoperability requirements, as described in Enclosure 3 of this instruction.

(3) Establish, in coordination with the DoD CIO, the USD(R&E), the USD(A&S), the

DOT&E, the CMO, and the other DoD Component heads, procedures to verify, assess, and certify, through testing, joint, multinational, and interagency IT interoperability throughout a system’s life cycle.

(4) Publish and maintain an Interoperability Process Guide (IPG) outlining all procedures required to support joint, multinational, and interagency interoperability test and certification, ICTO requests, and waiver submissions.

(5) Review and provide recommendations on requests for waiver of interoperability policy as described in section 9 of Enclosure 3 of this instruction.

(6) Coordinate with the DoD Components to resolve joint, multinational, or interagency

IT interoperability issues. If resolution cannot be achieved, provide an impact statement and recommendations for resolution to the ISG.

(7) Participate in the Joint Capabilities Integration and Development System (JCIDS) review to verify that the NR KPP, NR KSA, or NR APA are adequately defined to support interoperability testing.

(8) In coordination with program managers (PMs) of IT with joint, multinational, or interagency interoperability requirements, review Test and Evaluation Master Plans (TEMPs), and associated developmental and operational test plans for interoperability.

(9) Assess compliance with bilateral and multilateral standardization agreements (e.g., U.S.-ratified North Atlantic Treaty Organization Standardization Agreements).

(10) Provide, in support of developmental test and evaluation (DT&E) assessments and operational test readiness reviews, for all DoD IT with joint, multinational, or interagency interoperability requirements:

(a) Status of IT interoperability and standards conformance issues.

(b) Confirmation that all required developmental testing (DT) relating to IT interoperability has been successfully completed and passed.

(c) Details of any interoperability issues that must be resolved before the start of operational test and evaluation (OT&E).

(11) Define the methodology to test and certify enterprise services for interoperability within the DoD.

(12) Designate representatives to take part in applicable working groups, decision boards, or integrated process teams involved in setting or defining interoperability criteria that any enterprise service must meet before fielding.

(13) Lead the U.S. Coalition Interoperability Assurance and Validation effort in support of CCMDs to assess and resolve interoperability issues with mission partners.

3. USD(A&S). In addition to the responsibilities in section 13 of this enclosure, the

USD(A&S):

a. Incorporates the policies and requirements in this instruction into the DoD documents governing acquisition (including DoDD 5000.01 (Reference (o)) and DoDI 5000.02 (Reference

(p))), and adequately addresses this guidance during system acquisitions, as the DoD Acquisition

Executive (pursuant to section 133 of Reference (c)).

b. Approves tradeoffs among operational effectiveness, operational suitability, and interoperability, for all USD(R&E) and USD(A&S) oversight ACAT acquisition and procurement matters pertaining to IT, in coordination with the DoD CIO and the CJCS.

c. Manages acquisition of Major Defense Acquisition Program-related and Major Automated

Information System program-related IT and aids the DoD CIO, the DOT&E, the CMO, the

CJCS, and the other DoD Component heads in the evaluation of interoperability requirements in both a technical and an operational context.

d. Requires, in coordination with the DoD Business, Warfighting, Intelligence, and

Enterprise Information Environment Mission Area Owners (CMO, JCS, OUSD(I), and DoD

CIO), and the other DoD Component heads, that operationally prioritized materiel and non-materiel interoperability requirements are phased for acquisition and fielding.

e. Designates a representative to serve as a tri-chair of the ISG.

f. Assesses and considers interoperability in the Defense Acquisition Board reviews.

4. USD(R&E). In addition to the responsibilities in section 13 of this enclosure, the USD(R&E):

a. Requires in coordination with the DoD CIO and the CJCS, that IT interoperability requirements as described in the ISP, are verifiable and testable as part of the acquisition and procurement process.

b. Directs the Deputy Director, Developmental Test, Evaluation, & Prototyping

(DD(DTE&P)) to establish, and co-chair with the DOT&E, the Interoperability Test and

Evaluation Panel (ITEP).

c. Establishes the architecture for a DoD enterprise-wide interoperability test capability which must include an operationally representative joint test environment; requires and verifies that the DoD Component investments for the test are consistent with this test capability. For investments determined not to be consistent, coordinate with the responsible DoD Component on a mutually satisfactory set of corrective actions before investments may proceed.

d. Designates a representative to serve as ISG member together with DoD CIO and CJCS representatives (for details on ISG structure and functions, see section 8 of Enclosure 3 of this instruction).

e. Establishes procedures to ensure that the appropriate DT&E authority approves TEMPs, or equivalent documents, for each ACAT program, after verifying that an adequate level of

DT&E to achieve interoperability certification are planned, resourced, and can be executed in a timely manner.

5. UNDER SECRETARY OF DEFENSE (COMPTROLLER)/ CHIEF FINANCIAL OFFICER,

DEPARTMENT OF DEFENSE (USD(C)/CFO)). In addition to the responsibilities in section 13 of this enclosure, the USD(C)/CFO:

a. Addresses, in coordination with the other DoD Component heads, IT interoperability resource issues resulting from the requirements of this instruction in the budgetary process.

b. Provides the Deputy Secretary of Defense, in coordination with the USD(R&E), the

USD(A&S), the USD(I), the DoD CIO, the CJCS, and the other DoD Component heads, budget recommendations for addressing critical IT interoperability issues identified through the interoperability governance process.

6. ASSISTANT SECRETARY OF DEFENSE FOR HOMELAND DEFENSE AND GLOBAL

SECURITY (ASD(HD&GS)). Under the authority, direction, and control of the Under Secretary of Defense for Policy, the ASD(HD&GS):

a. Represents the DoD on all homeland defense-related matters with designated lead federal agencies, the Executive Office of the President, the Department of Homeland Security, other

Executive departments and federal agencies, and State and local entities to identify IT interoperability issues and communicate them to the DoD CIO.

b. Establishes procedures, in coordination with the DoD CIO, to assess and verify homeland defense-related IT interoperability requirements identified by federal, State, and local entities external to the DoD are valid.

7. CMO. In addition to the responsibilities in section 13 of this enclosure, the CMO:

a. Ensures business systems and business improvement policies and programs are efficiently and effectively designed, executed, and aligned with DoD strategy to ensure system and process integration, and interoperability across all DoD mission areas.

b. Leads end-to-end integration and improvement of business systems and business operations in support of national security.

c. Is responsible for the DoD Business Enterprise Architecture (BEA), Strategic

Management Plan, Investment Review Process, and Enterprise Transition Plan along with other

DoD products, services, and publications focused on delivering integrated and interoperable business operations that support and enable the warfighter.

8. DIRECTOR OF COST ASSESSMENT AND PROGRAM EVALUATION (DCAPE). In addition to the responsibilities in section 13 of this enclosure, the DCAPE:

a. Provides guidance to the DoD Components for conducting an analysis of alternatives

(AoA) for IT capability gaps identified through the JCIDS or Business Capability Lifecycle

(BCL) process.

b. Oversees the consideration and addressing of IT interoperability requirements as part of the AoA.

c. Provides recommendations to the Deputy Secretary of Defense for addressing, through the planning, programming, budgeting, and execution process, critical IT interoperability issues with affected DoD Components.

9. DOT&E. In addition to the responsibilities in section 13 of this enclosure, the DOT&E:

a. Requires that the NR KPP, NR KSA, or NR APA be addressed in operational tests and is an integral part of the evaluation of the system’s operational effectiveness.

b. Requires that test and evaluation of IT is conducted throughout the development, procurement, and fielded phases of a system’s life cycle with sufficient frequency to accurately assess IT interoperability.

c. Requires, with the DoD Business, Warfighting, Intelligence, and Enterprise Information

Environment Mission Area Owners (CMO, JCS, OUSD(I), and DoD CIO) and the other DoD

Component heads, that capability-focused, architecture-based measures of performance and associated metrics are developed to support evaluations of IT interoperability throughout a system’s life cycle.

d. Assists the USD(R&E) and USD(A&S) with developing and maintaining the proper tools and testing infrastructure (to include a distributed operationally representative joint test environment) to support the development and evaluation of interoperable IT.

e. Assists the DoD Components with operational test planning and assessment or evaluation of the impact of IT interoperability on operational effectiveness, suitability, and survivability.

f. Includes interoperability in the OT&E final reports’ evaluation of operational effectiveness, based primarily upon end-to-end testing within an operationally representative environment.

g. Requires that TEMPs (or equivalent documents) and operational test plans for those programs under DOT&E oversight identify IT interoperability test requirements with the

USD(R&E), the USD(A&S), and the other DoD Component heads. Emphasizes evaluation of IT interoperability as early as possible during a system’s development.

h. Sponsors and manages joint test and evaluations to identify IT interoperability shortfalls and issues, in coordination with the DoD Components.

i. Requires and verifies, in coordination with CCMDs and Military Services, that respective subordinate organizations schedule at least one major exercise every year with interoperability as a major objective of the exercise.

j. Co-chairs the ITEP with the USD(R&E), the USD(A&S), and the DD(DTE&P). For details on ITEP functions, see section 8 of Enclosure 3 of this instruction.

10. DIRECTOR, DEFENSE INTELLIGENCE AGENCY (DIA). Under the authority, direction, and control of the USD(I), and in addition to the responsibilities in section 13 of this enclosure, the Director, DIA:

a. Collaborates with the DoD Components, as appropriate, to improve IT interoperability and to identify required interfaces between DIA IT and other DoD Component systems.

b. Coordinates with the DoD Components to satisfy IT interoperability requirements for processing intelligence and counterintelligence information.

c. Coordinates with the DoD CIO on matters involving IT interoperability certification processes.

d. Coordinates with the DoD Components to resolve IT interoperability issues. If resolution cannot be achieved, provide an impact statement and recommendations for resolution to the ISG.

11. DIRECTOR, NATIONAL SECURITY AGENCY/CHIEF, CENTRAL SECURITY

SERVICE (DIRNSA/CHCSS). Under the authority, direction, and control of the USD(I), and in addition to the responsibilities in section 13 of this enclosure, the DIRNSA/CHCSS:

a. Serves as the DoD lead for approving and enforcing signals intelligence (SIGINT) architectures, in coordination with the DoD Components.

b. Provides cryptologic expertise and assistance in assessing IT requirements documentation for interoperability.

c. Requires interoperability and security of NSA/CSS IT with those systems that provide direct support to the Combatant Commanders.

d. In cooperation with the other DoD Components, satisfies NSA/CSS-required capabilities through the design and development of interoperable IT interfaces between joint, combined, coalition, or other U.S. Government or agency IT.

e. In cooperation with other appropriate DoD Components, the IC, or other U.S.

Government agencies, satisfies NSA/CSS IT interoperability requirements for processing foreign intelligence and foreign counterintelligence information by designing and developing interoperable and supportable technical, procedural, and operational interfaces.

f. Coordinates with the DoD Components to resolve IT interoperability issues. If resolution cannot be achieved, provide an impact statement and recommendations for resolution to the ISG.

g. Manages the interoperability requirements for cybersecurity-enabled IT products for NSS in accordance with Committee on National Security Systems Policy No. 15 (Reference (q)).

12. DIRECTOR, NATIONAL GEOSPATIAL-INTELLIGENCE AGENCY (NGA). Under the authority, direction, and control of the USD(I), and in addition to the responsibilities in section

13 of this enclosure, the Director, NGA:

a. Serves as the DoD Lead for GEOINT standards. Prescribes, mandates, and enforces standards and architectures related to GEOINT and confirms the integration of GEOINT standards and architectures in DoD GEOINT and GEOINT-related systems.

(1) Takes part in reviews of all GEOINT-related ISPs.

(2) Takes part in the review of all GEOINT-related requirements to verify the NR KPP, NR KSA, or NR APA are adequately defined for GEOINT.

(3) Coordinates with interoperability certification authorities to ensure that GEOINT-related interoperability test and evaluation criteria, measures, and requirements are fulfilled before those authorities grant interoperability certifications.

(4) Coordinates with PMs to review IT test strategies and developmental and operational test plans to verify that all GEOINT-related requirements are addressed.

(5) Coordinates with PMs to review test results to verify that all GEOINT-related requirements are satisfied.

b. Facilitates sharing of GEOINT by the most efficient and expeditious means, consistent with DoD Instruction 8320.02 (Reference (r)).

c. Coordinates with the DoD Components to resolve IT interoperability issues. If resolution cannot be achieved, provide an impact statement and recommendations for resolution to the ISG.

13. OSD AND DoD COMPONENT HEADS. The OSD and DoD Component heads:

a. Oversee implementation of the responsibilities and procedures in this instruction, including:

(1) Development and certification of the NR KPP, NR KSA, or NR APA for DoD

Component IT.

(2) Development, review, and approval of DoD Component IT ISPs.

(3) Interoperability test, evaluation, and certification of IT before connection to a DoD network.

b. Establish procedures consistent with this instruction for interoperability certification for

IT that does not have joint, multinational, or interagency interoperability requirements.

c. Establish procedures consistent with this instruction for reviewing DoD Component IT, determining when interoperability functionality or requirements have changed, and requiring the

PM to submit that IT for interoperability recertification in accordance with Enclosure 3 of this instruction.

d. Designate representatives to fill the critical roles specified in Enclosure 3 of this instruction, including:

(1) System sponsors to execute the roles and responsibilities specified in Enclosure 3.

(2) An NR KPP, NR KSA, or NR APA Certification Authority for all IT that are not governed by Reference (h), that the CJCS has determined have no joint, multinational, or interagency interoperability requirements, as described in Enclosure 3, and have been delegated to the DoD Component by the CJCS for NR certification.

(3) An Interoperability Certification Authority for all DoD Component IT with no joint, multinational, or interagency interoperability requirements and not governed by Reference (h), as described in Enclosure 3.

e. Provide representatives to take part in and support the ISG and the ITEP.

f. Design, develop, test, evaluate, and incorporate IT interoperability into all DoD

Component IT.

(1) Require that interoperability requirements are coordinated with the CJCS and the

Combatant Commanders, and that each IT system design identifies all external IT interfaces with required joint, multinational, interagency, and other non-DoD systems.

(2) Recommend tradeoffs among operational effectiveness, operational suitability, cybersecurity, survivability, and IT interoperability to the USD(R&E), the USD(A&S), the DoD

CIO, and the CJCS.

(3) Require IT programs be adequately funded to execute the interoperability functions specified in this instruction.

g. Require that all initial architectural views submitted either as part of an ISP, EA, reference architecture, or solution or other architecture be in accordance with the current version of the

DoD Architecture Framework (DoDAF) (Reference (s)). However, PMs may submit subsequent views (representing the same version of the system) either in accordance with the original

DoDAF version used, or the most current version. PMs will not be required to update architectural views solely to comply with changes in the DoDAF.

h. Coordinate with Director, NGA on all GEOINT-related requirements, ISPs, test strategies and plans, test and evaluation results, and interoperability certifications.

i. Require the DoD Component CIO to:

(1) Maintain a list of all DoD Component IT systems using the designated authoritative

IT registry.

(2) Oversee the development, use, and maintenance of the DoD Component architectures

(enterprise, reference, and solution) that are consistent with the latest version of the DoD

Information EA (Reference (t)), and support development of ISPs and the architecture data recommended in this instruction.

(3) Advise the DoD Component head of alternatives and solutions to identified interoperability issues.

(4) Develop guidance to require and verify that DoD Component IT is interoperable and supportable with other relevant IT internal and external to the DoD Component.

(5) Take part in ISP reviews other DoD Components conduct.

14. CJCS. In addition to the responsibilities in section 13 of this enclosure, the CJCS:

a. Provides specific guidance on preparation, format, content, timelines for submission, and review of the NR KPP, NR KSA, or NR APA.

b. Establishes policy and procedures for developing, coordinating, and certifying the NR

KPP, KSA, or APA in coordination with the USD(R&E), the USD(A&S), the DOT&E, and the other DoD Component heads.

c. Serves as the NR Certification Authority, as described in Enclosure 3 of this instruction, for all IT with joint, multinational, or interagency interoperability requirements. Determines which IT has such requirements through the JCIDS and ISP review processes, and may either certify other IT without such requirements or delegate that IT to the appropriate DoD Component for NR certification.

d. Requires and verifies, in coordination with the USD(R&E), the USD(A&S), the DoD

CIO, and the other DoD Components, that the content of joint operational concepts, and associated doctrine and operational procedures, address interoperability of IT used by Military

Services and, where required, with joint and multinational forces, and other U.S. Government departments and agencies.

e. Coordinates with, and provides advice, guidance, direction, and assistance to, the DoD

Components for IT interoperability matters.

f. Establishes processes and procedures, in coordination with the DoD CIO, the USD(R&E), the USD(A&S), the DOT&E, and the other DoD Component heads, to present insights gained from joint, multinational, and interagency operations, exercises, assessments, and experiments on

IT interoperability to the USD(R&E), the USD(A&S), the DoD CIO, the DOT&E, and the ISG.

g. Supports DoD CIO in ensuring ISP-related architectures include the necessary changes and updates determined through the JCIDS deliberate staffing process.

h. Designates a representative to serve as ISG tri-chair together with DoD CIO and

USD(A&S) representatives. For details on ISG structure and functions, see section 8 of

Enclosure 3 of this instruction.

i. Assesses interoperability in support of the ISG reviews.

j. Provides recommendations to the DoD CIO on policy waiver requests.

k. Serves as the Chief Advocate for the CCMDs on IT interoperability.

15. COMBATANT COMMANDERS. In addition to the responsibilities in section 12 and 13 of this enclosure, Combatant Commanders may establish additional interoperability criteria beyond those found in this instruction, if required to meet operational needs. Coordinate additional

CCMD interoperability criteria with OSD, CJCS, and DoD Components and integrated into DoD roadmaps in emerging and fielded systems.

Change 2, 12/11/2019 22 ENCLOSURE 3

ENCLOSURE 3

PROCEDURES

1. GENERAL. The processes and procedures described in this enclosure provide the means by which the DoD CIO accomplishes oversight to the interoperability of IT. For each IT in development, measurable interoperability requirements must be identified, formally validated through NR certification, and then formally tested through an interoperability certification process.

a. This enclosure primarily focuses on IT with joint, multinational, and interagency interoperability requirements. Such IT is within the purview of the CJCS for NR certification, and JITC commander for interoperability certification.

b. Each DoD Component will certify the NR capability for IT not having joint, multinational, or interagency interoperability requirements if authorized by the CJCS. Each DoD

Component will conduct interoperability certification for IT not having joint, multinational, or interagency interoperability requirements as determined by the CJCS. The DoD Components will establish test and certification procedures for this IT based on the procedures defined in this enclosure.

2. INTEROPERABILITY REQUIREMENTS IDENTIFICATION

a. DoD Components and PMs will identify interoperability requirements through:

(1) The JCIDS and DOTMLPF-P change recommendation processes, as outlined in

CJCS Instruction (CJCSI) 5123.01H (Reference (u)).

(2) The Defense Acquisition System, as defined in References (o) and (p), including the

BEA and the BCL for defense business systems.

(3) Compliance and alignment with requirements from the applicable portions of the

DoD EA (as defined in Reference (b)), consisting of mission area architectures (warfighting, business, intelligence, and enterprise information environment); applicable laws, regulations, policies, and guidance; DoD-wide reference and solution architectures; and DoD Component architectures. Key interoperability portions of the DoD EA include:

(a) The business rules of Reference (t).

(b) IT standards as specified in the DoD IT Standards Registry (DISR) (Reference

(v)).

(c) Cybersecurity requirements of References (l), (m), and (q).

Change 2, 12/11/2019 23 ENCLOSURE 3

(d) Data sharing requirements and use of the Data Services Environment as specified in Reference (r) and DoD Instruction 8320.07 (Reference (w)).

(e) Spectrum use and electromagnetic spectrum data sharing requirements as specified in DoDI 4650.01 (Reference (x)) and DoDI 8320.05 (Reference (y)).

(f) Network, information exchanges, and technical standard requirements described in applicable peer solution architectures and governing reference architectures. These interoperability requirements are derived from system resource flows and applicable technical standards as defined in Reference (s).

b. Interoperability requirements must be documented in a succinct, measurable, and testable manner as an NR KPP, NR KSA, or NR APA. The NR KPP, NR KSA, or NR APA must describe a set of performance measures (MOEs and MOPs). The NR KPP, NR KSA, or NR

APA must assess information requirements, information timeliness, and net-ready attributes required for both the technical exchange of information and the end-to-end operational effectiveness of that exchange.

(1) The CJCS provides specific guidance on the preparation, format, content, and timelines for submission, review, and certification of the NR capability.

(2) The NR KPP, NR KSA, or NR APA must be specified and included in either JCIDS requirements documents or an information support plan (ISP) (for those systems not covered by

JCIDS), and must be updated throughout the IT life cycle when changes affect interoperability.

(3) Any system that connects to DoD networks must meet the threshold requirements of the NR KPP, NR KSA, or NR APA before connection.

(4) The NR KPP, NR KSA, or NR APA must document specific interoperability performance measures to guide system design and development.

(5) The NR KPP, NR KSA, or NR APA must be used by the DoD Component Lead

DT&E Organization, DoD Component Operational Test Agency (OTA), or JITC as the basis to define test criteria to evaluate the interoperability of a given solution set. The NR KPP capability should be certified early so that it can be used during all test phases.

(6) DoD Components must submit the NR KPP, NR KSA, or NR APA for certification throughout a system’s life cycle as the CJCS directs.

3. NR CERTIFICATION PROCESS. NR certification ensures the NR KPP, NR KSA, or NR

APA are correct and sufficient in scope and content to describe a system’s interoperability requirements in a measurable and testable manner that meets DoD interoperability needs. NR certification for all IT, both ACAT and non-ACAT, must occur before interoperability test and evaluation, leading to interoperability certification.

Change 2, 12/11/2019 24 ENCLOSURE 3

a. PMs must document and submit NR KPPs, NR KSAs, or NR APAs for certification in accordance with Reference (u) and CJCSI 6212.01F (Reference (z)) for all ACAT, non-ACAT, and fielded IT acquisitions and procurements. DoD Components will certify NR capability for

IT without joint, multinational, or interagency interoperability requirements when authorized by

CJCS.

b. The NR Certification Authority will record the results of NR certification in the authoritative IT registry.

c. Upon significant upgrade to the system affecting interoperability or before requesting interoperability recertification (in accordance with section 6 of this enclosure), PMs will submit the NR KPP, NR KSA, or NR APA for recertification by the NR Certification Authority in accordance with References (a) and (z). This ensures that the interoperability requirements remain synchronized with current and planned operational contexts.

4. ISP PROCESS

a. Overview. The ISP is a key document in achieving interoperability certification. The ISP describes IT and information needs, dependencies, and interfaces for programs. It focuses on the efficient and effective exchange of information that, if not properly managed, could limit or restrict the operation of the program in accordance with its defined capability.

(1) The PM must use the ISP as a tool to identify and resolve risks and issues related to a program’s IT information infrastructure support and information interface requirements. The

PM uses the ISP as a key input to a system’s TEMP.

(2) The DoD CIO and the DoD Components use the ISP to verify compliance with policies and procedures that govern the exchange of information. The PM updates and submits the ISP for review at multiple milestones during the IT system’s life cycle to help decision makers determine if the system meets interoperability requirements.

(3) The PM revises the ISP with each submission, adding information as system functionality evolves and the solution architecture matures. The final ISP, known as the ISP of

Record, which describes the production or deployment representative system, must include the technical exchange of information and the operational effectiveness of that exchange of information for mission accomplishment as described in the architecture.

(4) As part of ISP, the PM must submit architectural views (listed in the IPG) to describe the interoperability requirements of the IT. The ISP review process will assist the PM to refine these views, and result in a set of detailed measurable interoperability criteria for use in interoperability test and certification.

Change 2, 12/11/2019 25 ENCLOSURE 3

b. Development and Submission

(1) PMs must develop the ISP online by entering system information through the GTG-F portal (https://gtg.csd.disa.mil). ISP formatting and content requirements are specified by the

GTG-F and described in the Defense Acquisition Guidebook (DAG) (Reference (aa)).

Deviations from these requirements require the DoD Component’s approval. Until GTG-F is available on the Secret Internet Protocol Router Network, Secret ISPs are submitted and approved using the DISA Interoperability and Supportability Legacy Data Repository. PMs submit Top Secret ISPs using a staffing notification to the appropriately classified network that includes the location of the document on the Joint Worldwide Intelligence Communications

System and the points of contact. Classified ISPs use the format and content requirements described in the DAG until the GTG-F is available on the appropriately classified network.

(2) PMs must consider the implications of compiling detailed and proprietary information in a document that receives wide distribution during review. Competition-sensitive information should be minimized in the ISP.

(3) PMs of ACAT II and below programs and non-ACAT systems may tailor the ISP to the system’s scale, complexity, and available resources with the…