Bidders Library JITC Instructions - JITCI 240-110-05.pdf

DEFENSE INFORMATION SYSTEMS AGENCY

P. O. BOX 549

FORT MEADE, MARYLAND 20755-0549

UNCLASSIFIED//FOR OFFICIAL USE ONLY ENCLOSURE

DISA CIRCULAR 240-110-5

SECURITY

Cybersecurity Assessments (CSAs) in Support of Operational Test and Evaluation (OT&E)

Security Classification Guide

1. Purpose. This Circular provides security classification guidance for cybersecurity assessments (CSAs) in support of operational test and evaluation (OT&E).

2. Applicability. The Circular applies to all military, civilian, and contractor personnel assigned to or employed by the Joint Interoperability Test Command (JITC) who conduct OT&E activities.

3. Authority.

3.1 This Circular is published in accordance with (IAW) the authority contained in Executive Order (E.O.) 13526, Classified National Security Information Memorandum, 29 December 2009;

DoD Manual (DoDM) 5200.01, Volume 1, DoD Information Security Program: Overview, Classification, and Declassification, 24 February 2012; and DoD Instruction (DoDI) O-3600.02, Information Operations (IO) Security Classification Guidance, 28 November 2005. In case of conflict between E.O. 13526 and DoDM 5200.01, the E.O. takes precedence. In case of conflict between DoDM 5200.01 and DoDI O-3600.02, the DoDM takes precedence.

3.2 This Circular is also published in accordance with the authority contained in DISA Circular (DISAC) 300-110-3, Defense Information Systems Network (DISN) Security Classification Guide, 27 September 2012, and DISAC 300-115-3, Defense Information Systems Network (DISN) Secret Internet Protocol Routing Network (SIPRNet), 1 June 2013. In case of conflict between DoDI O-3600.02 and DISACs 300-110-3 and 300-115-3, the DoDI takes precedence.

3.3 DoDI O-3600.02 takes precedence if there is no classification guide for the system(s) under test.

4. Original Classification Authority (OCA). The Chief of Staff, DISA, has been formally designated, in writing, by the Deputy Secretary of Defense as an OCA and is the OCA for this Circular.

5. Point of Contact. All inquiries concerning this guide and recommended changes to this Circular with supporting rationale should be addressed to the following:

Joint Interoperability Test Command (JITC) Attn: JITC Security Manager P.O. Box 12798 Fort Huachuca, AZ 85670-2798

DISAC 240-110-5

6. Objective of this Circular. The objective of this Circular is to clarify the handling of cybersecurity test procedures, test plans, data collected, and test reports for CSAs conducted during operational test activities. This Circular includes tools used for the collection and reduction of data produced from these activities. This Circular does not supersede current guidance; rather, it amplifies JITC procedures for handling this information and is to be used by JITC if there is no security classification guide for a particular program or system under test.

This Circular supplements DoDM 5200.01 and DoDI O-3600.02 and is to be used in conjunc-tion to obtain complete guidance on a particular subject.

7. Security Classification Guidance. Security classification guidance for CSAs in support of OT&E is provided at the enclosure.

8. Classification and Handling Markings and Downgrading and Declassification.

Classification and/or handling markings and downgrading and declassification will be applied IAW the authority documents. Information identified as classified by provisions of this Circular should be marked as would be appropriate for its classification.

9. Dissemination. Classified and for official use only (FOUO) information must be protected against unauthorized disclosure IAW Presidential guidance and DoD Regulations and Instructions. Dissemination of associated classified and/or sensitive information is addressed in the authority documents.

Enclosure a/s JOEL S. LINDEMAN Colonel, USA Chief of Staff

OPR: JITC JTA - disa.huachuca.jt.list.security-office@mail.mil DISTRIBUTION: For Official Use Only (FOUO)

DISAC 240-110-5

UNCLASSIFIED//FOR OFFICIAL USE ONLY

Enclosure

SECURITY CLASSIFICATION GUIDANCE FOR

CYBERSECURITY ASSESSMENTS (CSAs) IN SUPPORT OF

OPERATIONAL TEST AND EVALUATION (OT&E)

1. Test Procedures.

1.1 (U//FOUO) Test procedures for CSAs that include attack vectors (AVs) or test cases that depict a system that resides on the Secret Internet Router Protocol Network (SIPRNet) will be classified at a minimum of secret.

1.2 (U//FOUO) Test procedures for CSAs that include AVs or test cases that depict a system that resides on the Nonclassified Internet Router Protocol Network (NIPRNet) where the system in a similar but classified form resides on any network with a higher classification level will be classified at a minimum of secret.

1.3 (U//FOUO) Test procedures for CSAs that include AVs or test cases that depict an opera-tional site that provides for system high resources will be classified at a minimum of secret.

2. (U//FOUO) Test Plans. Test plans that depict any of the test procedures specified in paragraph 1 are based on derivative classification. Test plans can be separated to provide an unclassified portion that does not depict any classified information. In this event, a classified annex should be produced to cover the classified material. If the plans are separated, the unclassified portion should be properly marked for classification no lower than unclassified// for official use only.

3. (U//FOUO) Data Collected, Analyzed, and Reported. Data collected, analyzed, and reported during the CSA will be classified no lower than secret. In the event that the system under test is unclassified or if the system is tested on the NIPRNet with no system in similar form residing on a network that provides system high resources, the data can be handled as unclassified//for official use only during collection. In this event, the data must be moved to the secret environment for analysis and reporting in order to provide for cases where an entity would send JITC data on a system or site vulnerability via unclassified or NIPRNet e-mail for analysis on a system.

4. Attack Vectors or Test Cases.

4.1 (U//FOUO) In the event that JITC personnel conduct information gathering in an unclassified environment for AV or test case development, the AV or test case must not depict any system or site. Once the data is compiled, the data will be handled as unclassified// for official use only and then transferred to the secret environment for incorporation into any test artifact.

DISAC 240-110-X

UNCLASSIFIED//FOR OFFICIAL USE ONLY

4.2 (U//FOUO) Any AV or test case used in any CSA activity will be classified at the minimum level of secret.

4.3 (U//FOUO) Any tool containing AVs or test cases that depict a site or system or have been used in any CSA activity will be classified at the minimum level of secret.

4.4 (U//FOUO) Any DoD computer network attack (CNA) capability in which particular technologies, techniques, targets, or concepts are identified will be classified at the minimum level of secret.

5. Reports.

5.1 (U//FOUO) A CSA report containing information on AV or test case results is classified at the minimum level of secret.

5.2 (U//FOUO) A CSA report containing information on vulnerabilities or risk items associated with DoD systems or networks is classified at the minimum level of secret unless the system is unclassified only, in which case the information will be marked unclassified//for official use only.

5.3 (U//FOUO) A CSA report containing information on corrective recommendations for vulnerabilities or risk items associated with DoD systems or networks is classified at the minimum level of secret unless the system is unclassified only, in which case the information will be marked unclassified//for official use only.

5.4 (U//FOUO) A CSA report containing information on exploited vulnerabilities or findings is classified at the minimum level of secret.

5.5 (U//FOUO) The total number of findings discovered and associated with any vulnerability, site, or network is unclassified//for official use only, unless the site, facility, or location is classified at a higher level.

5.6 (U//FOUO) The terms "secure," "secure with limitations," "not secure, and "undetermined" referring to the JITC security determination are unclassified//for official use only.

6. Lines of Communication. Lines of communications will be handled accordingly depending on the classification of the system, data collection, and reporting methods utilized in order to prevent spillage and over classification of information. Direction as to how communications will be handled is provided by the JITC Action Officer.