801011r5.pdf

UNCLASSIFIED

NI 8010.11R5 Approved: 25 October 2007 Subgroup: Information Systems

NGA Instruction for NGA-Controlled Computer Network Connectivity at Contractor and Other Facilities

1. References.

a. Primary. NGA PD 8000R3, Policy Directive for Information Management and the Chief Information Officer, 24 November 2003.

b. Secondary. Secondary references are listed in the appendix.

2. Purpose. Establishes the requirements and responsibilities for installation, security, and maintenance of computer equipment in non-NGA facilities that is to be connected to networks certified and accredited by the NGA Designated Accrediting Authority (DAA).

This instruction supersedes NI 8010.11R4, same title, 15 September 2005.

3. Policy. NGA will allow direct access to NGA’s computer networks from non-NGA facilities (such as contractor sites, other Government Agencies, academic institutions, and on a very limited basis, private residences) whenever the access provides improved operational efficiencies and services to NGA, and provided the connectivity can be done within NGA’s security requirements and is approved by the DAA.

4. Applicability and Scope. This instruction applies to all NGA organizations that own or operate network workstations, servers, and network equipment. It applies only to those networks controlled and accredited by NGA, for example, Sensitive But Unclassified (SBU), NGANet, and NGA production networks. This instruction does not apply to NGA personnel using NGA laptop computers away from NGA facilities; they continue to use dial-in Challenge Handshake Authentication Protocol (CHAP) accounts. This instruction does not apply to current NGA installations in other government facilities.

5. Definitions. Terms in this instruction are generally understandable in their context.

6. Responsibilities.

a. The DAA must approve all computer connectivity before any installation or operation of NGA network equipment at non-NGA facilities is begun.

b. Enterprise Operations Directorate (E).

(1) Serves as the project lead and works the requirements with the requester.

(2) Provides costs, purchasing, installation, training, system accounts, and operations and maintenance (O&M).

NI 8010.11R5

NGA-Controlled Computer Network Connectivity at Contractor and Other Facilities

(3) Coordinates mission support activities (such as security plans and facility inspections) with the overall project.

c. Security and Installations Operations Directorate, Security Office (SIS).

(1) Provides security review and approval of the proposed installation site and provides a recommendation to the DAA.

(2) Verifies security clearances of potential users, in coordination with the site information systems security officer (ISSO), and provides a recommendation to the DAA.

(3) Provides annual computer security training or verifies that the facility has provided training.

(4) Provides incident handling and investigation in coordination with the site ISSO.

d. ISSOs. Provide day-to-day monitoring of the system to ensure that NGA security policies are in place, and serve as points of contact for system security issues.

e. Program offices.

(1) Develop security plans in conjunction with the facility ISSO and Office of the Chief Information Officer (OCIO).

(2) Provide life-cycle funding and revalidation of the requirement to DAA.

f. Non-NGA facility management.

(1) Supports the program office by writing the NGA network connectivity request and the security plan and coordinates any subsequent changes to the network with OCIO.

(2) Ensures that only authorized personnel have access to NGA networks, ensures that the security plan is complied with at all times and properly protects all NGA network data and equipment, and immediately reports security incidents to the site security representative and SIS.

(3) Ensures that personnel with NGA network access are provided annual computer security training.

7. Procedures.

a. Requests and approvals. Program offices must request, via memorandum to the DAA, installation of NGA network equipment at non-NGA facilities, identifying the network and stating the date connectivity is needed, expected duration, reason, expected applications to be used, site name and address, user list, and site point of contact responsible for the system (ISSO). The DAA reviews the connectivity request and provides written approval or rejection to the program office.

Approved requests result in an infrastructure service request.

b. Annual revalidation and funding. Annual written revalidation of the need to maintain NGA network connectivity at non-NGA facilities and the availability of funding is made to the DAA by the NGA program office during the first quarter of the fiscal year. If the DAA does not approve revalidation, E will terminate the connection and retrieve the NGA equipment.

c. Security. The NGA network workstations, servers, and equipment are sensitive or classified (or both) and must be controlled accordingly. All installations of NGA network equipment must have security plans (either stand-alone or as annexes to the enterprise plan) approved by CIO, Information Security Management Division, Information Assurance and the site security officer before actual operational connectivity is made to any NGA network. Cryptographic equipment must be controlled according to communications security (COMSEC) policy. Single, simple NGA-workstation installation is encouraged; connectivity of external local area networks (LANs) is discouraged.

d. Access. User access rights to applications and data on NGA networks are limited by mandatory access controls to only those applications necessary to perform the facility’s NGA function. The table contains approved applications and data exchanges between NGA facilities and non-NGA facilities. No access to the classified networks is granted without written approval of the DAA and the DoD network accrediting authority.

Network E-mail Microsoft Attach-ments

Internet Collabor-ation Tools

Software Exchanges

Geospatial / Imagery Products

Browser Access

Database Access

SBU yes yes yes yes no yes yes yes NGANet yes yes no yes yes yes yes yes COPPER yes yes no yes yes yes yes yes

e. Costs. Actual costs for installing, connecting, licensing, operating, and supporting approved NGA network services at non-NGA sites, and for training users, are paid by the requesting NGA office. E provides estimated costs to the requester before work starts. E provides actual costs within one month of project completion.

f. Private residence connectivity. Subject to the Director of NGA’s approval, appropriated funds may be used to install, repair, and maintain telephone-line computer connectivity in private residences provided that adequate safeguards against private misuse are in place and the service is necessary for the direct support of the Agency’s mission.

g. Information assurance.

(1) Firewalls. All external NGA network connections must enter a particular computer system through a single firewall. That firewall must have intrusion detection software installed and operating according to DoD policy. Weekly reports from the intrusion detection operation must be sent to the NGA IMT for review.

(2) Screen savers. Password-protected screen savers that activate automatically no later than 15 minutes after a workstation is inactive must be installed on all NGA network workstations at non-NGA facilities.

(3) E-mail attachments. On classified networks, the ability to send e-mail with attachments from non-NGA facilities to outside the NGA network enclave must be disabled.

(4) Training. All non-NGA users must be provided NGA security and network training before an account is created and a password is issued by NGA. Subsequent annual computer security training is required for all users.

(5) Clearances. U.S. citizens with appropriate clearances are allowed access to the NGA network workstations, servers, and cryptographic and LAN equipment. Foreign nationals in NGA facilities needing access to classified networks must hold appropriate clearances and access must be approved in writing by the DAA. No foreign networks or facilities will be connected to the SBU or NGANet.

(6) Passwords. System administrator passwords for external NGA workstations or servers may only be issued to personnel who are properly trained and hold NGA badges. Passwords are not to be revealed or shared for any reason. Choice of system administrators does not require NGA approval for external contractor networks connected to an NGA network;

however, proper security practices must be followed for connectivity to remain.

(7) Virus protection. The most current virus protection must be provided to workstations and networks connected to NGA networks. The non-NGA facility supplies virus protection for their workstations and networks connected to NGA. NGA supplies virus protection for NGA equipment connected to NGA.

h. LAN connectivity. Non-NGA facility LAN connectivity to the NGA network is permitted, provided that compatibility, training, security, and need for access are approved by NGA. Non-NGA facility LAN control and maintenance remain with the facility.

i. O&M. NGA personnel generally perform O&M after calls for service are made to the NGA help desk. Properly cleared, non-NGA personnel may perform O&M after having been verified as competent by the E Technical Services Office (ES).

A service-level agreement may be used to clearly define roles and responsibilities, especially for hardware maintenance costs and reimbursements.

j. Software and hardware. Either the facility or NGA may own NGA network-connected hardware or software; however, facility-owned hardware and software must be of a type approved by E, Infrastructure Engineering Office, Engineering Division (ENE) prior to connection. NGA property must be properly marked and accounted for. No software or hardware may be added, modified, or removed from the facility’s NGA network without approval by ENE. All storage media attached to the NGA network must be properly classified, marked as classified, and controlled.

k. Denial of requests. Requests that are initially denied may be resubmitted if the reasons for denial are remedied. NGA network installation requests, especially for classified networks, may be denied for reasons such as, but not limited to, the following:

(1) The facility is not approved for classified material or it is incapable of properly storing classified magnetic media and cryptographic key material.

(2) The facility has uncontrolled access for personnel.

(3) The LAN proposed for connectivity to an NGA network is connected to high-risk networks, or the system itself presents risks unacceptable to the DAA.

(4) The system fails automated information system certification tests and the facility is unable to correct deficiencies to the satisfaction of the DAA.

(5) The facility is in close proximity to uncontrolled areas and is therefore vulnerable to transient electromagnetic pulse emanation standard (TEMPEST) attacks, and has not been reviewed for TEMPEST countermeasures.

(6) The facility has numerous prior security violations.

NI 8010.11R5 Appendix

Appendix Secondary References

1. CJCSI 6211.02A, Chairman of the Joint Chiefs of Staff Instruction for Defense Information System Network and Connected Systems, 22 May 1996.

2. DoD 5220.22-M, National Industrial Security Operating Manual (NISPOM), January 1995.

3. Director of Central Intelligence Directive 6/3, (U//FOUO), Protecting Sensitive Compartmented Information within Information Systems, 3 May 2002.

4. NI 8400.1R7, NGA Instruction for Acquiring Information Technology Products, 29 January 2007.