Appendix_F.pdf

FOR OFFICIAL USE ONLY

FOR OFFICAL USE ONLY

COMPUTER NETWORK DEFENSE SERVICE PROVIDER (CNDSP)

MEMORANDUM OF AGREEMENT (MOA)

between

ARMY RESEARCH LABORATORY (ARL) CNDSP

and

(enter sponsor organization)

SUBSCRIBER NAME: (enter organization receiving services)

CCSD NUMBER: (enter CCSD or DISA approval number)

PHYSICAL ADDRESS: (location of circuit)

NETWORK: (enter NIPRNet or SIPRNet)

SUMMARY: This ARL CNDSP MOA provides the formal documented agreement between the

CNDSP and the subscriber, or the sponsor of the subscriber when the subscriber is a commercial entity, as required to be in compliance with DoDD O-8530.1 and DODI O-8530.2 which state

“The Heads of DoD Components shall require that all component information systems and computer networks are assigned to a certified CNDS” and all information systems and computer networks must enter into a service with a CNDS provider”.

ARL Office of Primary Responsibility: The ARL Computer Network Defense Service

Provider (CNDSP) shall be the Primary Tier 2 CNDSP and will coordinate any proposed changes with all affected parties. Tier 2 CNDSP Designated Accrediting Authority

Representative is Mr. John Miller. POC for this MOA action is the ARL CNDSP Director, Mr.

Curtis Arnold, curtis.b.arnold.civ@mail.mil.

Sponsor Responsibility: In the case of a commercial entity being the subscriber, the sponsor organization is required to task the subscriber through a separate contract with the required activities assigned to the subscriber and provide oversight to ensure compliance with tasked activities for duration of MOA agreement. Further, the sponsor shall authorize direct mailto:curtis.b.arnold.civ@mail.mil communications between ARL and the subscriber for purposes of satisfying the requirements of this MOA. The Sponsor shall provide a copy of this MOA to the Subscriber.

TERMINATION DATE: This MOA is valid for three years from the date of the latest signature, or an earlier date as specified: ________________.

COMPUTER NETWORK DEFENSE SERVICE PROVIDER (CNDSP)

MEMORANDUM OF AGREEMENT (MOA)

between

ARMY RESEARCH LABORATORY (ARL) CNDSP

and

(enter sponsor organization)

1. Purpose:

This Memorandum of Agreement (MOA) is between Army Research Laboratory (ARL)

Computer Network Defense Service Provider (CNDSP) hereinafter the CNDSP, and (enter sponsor organization) to identify the Computer Network Defense (CND) Services to be provided to (enter Subscriber organization), hereinafter the Subscriber, for their identified enclave.

Specific CND Services covered by this MOA are set out below, in accordance with DoD

Instruction O-8530.2.

2. Scope:

This MOA includes each of the CND services selected for inclusion below. Those services selected for inclusion are so indicated by an “X” in the box before each service.

1. Protect

1. Vulnerability Scanning (VS) Support

Vulnerability Scanning of the Subscriber networks will be performed monthly per

US Cyber Command Communications Tasking Orders (CTOs) 08-005 and 05-19.

The Subscriber will perform the required monthly VS and forward, via an automated submittal process, the monthly results to the CNDSP for review; or alternately the Subscriber can upload the VS results to the DoD Vulnerability

Management System (VMS) if they have facilitated an “organizational browse” view into their VMS instance for ARL CND staff.

a) CNDSP Responsibilities

1) The CNDSP will ensure vulnerability data obtained from VS activities is analyzed on a timely basis to determine potential impacts to Subscriber network operations.

2) The CNDSP will set a scheduled date and time for the monthly vulnerability scan to be performed.

3) The CNDSP will furnish results of VS to the Subscriber.

4) The CNDSP will supply technical assistance to Subscriber for VS activities as requested.

5) The CNDSP will monitor Subscriber corrective action(s) and provide confirmation of mitigation through follow-up VS reports and/or email notification.

6) The CNDSP will maintain a database of vulnerability information that includes VS data used to support trend analysis.

b) Sponsor Responsibilities

1) The Sponsor will provide funding for scanning hardware, as identified by the

CNDSP to support to VS activities, and provide an IP address to be assigned to the scanner to the CNDSP Vulnerability Assessment Team (VAT).

c) Subscriber Responsibilities

1) The Subscriber will provide a network diagram, showing scanner placement, to ensure proper scanning coverage throughout enclave.

2) The Subscriber will ensure VS results are provided to Tier I reporting database (i.e. VMS).

2. Computer Network Defense External Assessments

External assessments are generally conducted in support of local accreditation needs;

the CNDSP has responsibility to assist Subscribers with the coordination of these activities. The CNDSP additionally coordinates Site Assistant Visits (SAV) prior to

Cyber Command Readiness Inspections (CCRI) for Subscribers scheduled for

CCRIs in the current fiscal year.

1) The CNDSP will assist Subscriber with identifying the need for an External

Assessment upon request.

2) If funded by the Sponsor, the CNDSP may perform an External Assessment to validate the Subscriber’s security posture and reporting compliance.

3) In the event an external assessment is performed, the CNDSP will analyze the results and incorporate lessons learned into CND services, as applicable.

4) The CNDSP will provide copies of an External Assessment Report with findings/Lessons Learned to the Subscriber, and, if applicable, Sponsor, for any External Assessments performed by the CNDSP, and verifies corrective actions.

b) Subscriber Responsibilities

1) The Subscriber will provide copies of Lessons Learned to ARL for any

External Assessments performed at the Subscriber Site by other accredited

CNDSPs.

2) In the event an external assessment is performed, the Subscriber will provide access to the facility and provide system accounts for the CNDSP External

Assessment team.

3) In the event an external assessment is performed, the subscriber will provide the CNDSP with updates to the corrective actions taken, including access to

POA&Ms.

3. Malware Protection Support

The CNDSP has an Anti-Malware Program which includes documented procedures for passing alerts to Subscribers and responding to Subscriber reports of malware activity.

1) The CNDSP will daily review advisories from Anti-Malware organizations or similar sources detailing emerging malware.

2) The CNDSP will pass warnings of malware to Subscriber as appropriate.

3) CNDSP will maintain a 24x7 malware response capability.

4) The CNDSP will report previously unknown malware to the Tier 1 provider.

1) Subscriber will provide centralized Anti-Virus/Malware services for workstations and servers at each local and remote Subscriber site.

4. Subscriber Protection Support and Training

1) The CNDSP maintains up-to-date (less than 6 months old) configuration documentation to include Subscriber network diagrams, software and hardware inventories, and network services.

2) The CNDSP will review diagrams/network configurations upon critical network changes, provide technical solutions/assistance, and advise

Subscriber of potential vulnerabilities.

3) The CNDSP will furnish general guidelines (Security Technical

Implementation Guides (STIGS), Industry Best Practices for hardening subscriber’s networks, and provide guidance on hardening configurations for specific Subscriber network components as requested.

4) The CNDSP will assist Subscriber with identifying CND training requirements to strengthen areas of Subscriber weakness.

5) The CNDSP will annually provide presentations or training on CND services.

6) The CNDSP will provide course development technical support for

Evaluation Training and Awareness (ETA) curricula and courseware on CND services, to include Network Protection, Malicious Code, Information

Operations Condition (INFOCON), and Information Assurance Vulnerability

Management (IAVM).

1) The Subscriber will provide copies of network diagrams to the CNDSP such that diagrams are always less than six months old.

2) The Subscriber will provide up-to-date information on software and hardware inventories, and network services to the CNDSP when requested.

3) The Subscriber will provide updates to the CNDSP within 30 days of any major change to a network configuration.

4) The Subscriber will ensure their personnel are adequately trained.

5) The Subscriber will maintain copies of training information provided by the

CNDSP.

5. Information Operations Condition (INFOCON) / Cyber Condition

(CYBERCON) Implementation

1) The CNDSP will maintain the latest DoD guidance and procedures for the

INFOCON/CYBERCON reporting process, formats, directive actions, and security.

2) The CNDSP will monitor INFOCON/CYBERCON change compliance, and advise US Cyber Command of Subscriber’s status. CNDSP maintains files of such status advisories/reports.

3) The CNDSP will provide guidance to subscribers on directed measures to protect their networks in response to INFOCON/CYBERCON Levels 5 through Level 1.

1) Subscriber will provide INFOCON/CYBERCON compliance status to

CNDSP IAW Strategic Directive (SD) 527-1.

2) Subscriber will maintain copies of the latest DoD/IC INFOCON/CYBERCON procedures, and provide copies of local procedures to CNDSP, upon request.

6. Information Assurance Vulnerability Management (IAVM)

1) The CNDSP will monitor Information Assurance Vulnerability Alert(s)

(IAVA), and receive and disseminate IAVM notifications to Subscribers.

2) The CNDSP will maintain a current list of Subscriber points of contact

(POCs), with primaries and alternates.

3) The CNDSP will monitor IAVA implementation by the subscribers and validate IAVM compliance through the review of vulnerability scan results.

1. Subscriber will establish VMS accounts; identify Subscriber assets in the

VMS account and request Defense Information Security Agency (DISA) to provide an organizational “browse” view for ARL CND staff to facilitate

ARL compliance monitoring.

2. Subscriber will acknowledge receipt of IAVAs and report compliance within

DoD Vulnerability Management database.

2. Monitor, Analyze and Detect

1. Network Security Monitoring/Intrusion Detection

1) The CNDSP will maintain documented network security monitoring policies and procedures that include the proper use of Intrusion Detection System

(IDS) & Intrusion Prevention System (IPS) tools.

2) The CNDSP will perform intrusion detection monitoring 24/7 on all

Subscriber networks at the port of presence (PoP) to the wide area network.

3) The CNDSP will review and analyze logs on a timely basis, and in accordance with documented procedures, in order to detect possible intruders.

4) The CNDSP will follow documented procedures for characterizing anomalous events detected by IDSs and other network monitoring systems.

5) The CNDSP will review logs within 30 minutes of detection in order to begin preliminary analysis of the event.

6) The CNDSP will search for and analyze low-level events, to identify possible unauthorized activity utilizing exploratory problem-solving or self-learning techniques. Suspicious/significant activity will be shared among the CND and

Information Assurance (IA) community. Searching and reporting are to be in accordance with local procedures.

7) The CNDSP will follow documented procedures to request copies of audit/system logs to supplement the analysis process.

1) The Subscriber will maintain, and provide to the CNDSP, a list of subscriber organization POC’s to forward applicable CNDSP requests for local audit/system logs needed to supplement the intrusion detection analysis process.

2) The Subscriber will provide copies of audit/system logs to the CNDSP to supplement analysis of a detected event upon request.

2. Attack Sensing and Warning

1) The CNDSP will search for and report distributed, long-term, coordinated, low-visibility network-based attacks across multiple networks to identify possible unauthorized activity.

2) The CNDSP has a formal process for creating and distributing warnings and notifications to the Subscriber. (These are warnings generated by the CNDSP or warnings passed on from other sources that do not broadcast to the

Subscriber.)

3) The CNDSP will review and recommend updates, configurations and/or rule sets in response to changes in the threat environment, and notify Subscriber, when appropriate.

4) The CNDSP will distribute guidance to Subscriber on best practices that support an overall DoD Defense in-depth policy for security configuration.

1) Subscriber will acknowledge and keep on file security configuration guidance from the CNDSP.

3. Indications and Warning/Situational Awareness

1) The CNDSP will develop tactics, techniques and procedures for a threat warning and notification process based on information from DoD and

Intelligence Community (IC) organizations.

2) The CNDSP will disseminate official threat reports from DoD/IC organizations to Subscriber on a need-to-know basis.

1) Subscriber will retain copies or have readily available access to threat reports distributed by the CNDSP.

3. Respond

1. Incident Reporting

1) The CNDSP will follow documented procedures for incident reporting to and from the Subscriber in accordance with Director of Central Intelligence (DCI) or DoD guidance.

2) The CNDSP will follow documented procedures for Tier2/Subscriber incident reporting to and from the Subscriber.

3) The CNDSP will follow documented policies and procedures for handling incidents reported to law enforcement and counterintelligence agencies.

4) The CNDSP will have a communications system(s) and follow documented procedures to quickly disseminate incident information/data to appropriate organizations.

1) Subscriber maintains documented procedures and instructions for incident reporting in accordance with DOD guidance.

2) Subscriber maintains or has readily available access to soft and/or hard copies of incident data which is securely stored.

2. Incident Response

1) The CNDSP follows formal incident handling and response procedures.

2) The CNDSP’s documented procedures will specify when and how to escalate the incident/event.

3) The CNDSP utilizes automated tools to track incidents, support the response process, and generate managerial reports.

4) The CNDSP will review and update incident response guidelines, checklists and recommended procedures at least annually.

5) The CNDSP will collect and retain specified information on all incidents, in support of law enforcement/counter intelligence investigations, and/or situational awareness.

6) The CNDSP will maintain a 24x7 incident/event handling capability.

7) The CNDSP will provide onsite support to Subscriber networks within 2 days for critical incidents.

1) Subscriber organizations will maintain capabilities to support incident response activities at their local and remote Subscriber sites. Upon request, the Subscriber will provide supplemental logs, malware, or physical hard drives from local systems (firewall, workstation, etc.) to the CNDSP for further analysis.

3. Incident Response Analysis

1) The CNDSP will conduct incident analysis in accordance with documented policy and procedures.

2) The CNDSP’s documented analytical processes will incorporate methods to determine the threat, risk or damage an incident may impose on subscriber networks.

3) The CNDSP will provide analyzed results from incidents that adversely affect

Subscriber’s network operations to the Subscriber. The CNDSP will also maintain copies of these reports.

4) The CNDSP will perform analysis of incident data, indentify problems, and provide Subscriber with recommended solutions for increased security.

5) The CNDSP will conduct retrospective analyses of incident data for a thorough evaluation of malicious activity.

1) Subscriber will maintain or have readily available access to post-incident analysis reports, trend reports, and recommendations from lessons learned.

4. CND Sustainment Functions

1. Notifications

1) The CNDSP will maintain certification and accreditation status as a certified

Tier 2 CNDSP in accordance with DoD O-8530.1-M.

2) The CNDSP will maintain CNDSP MOA(s) and Point of Contact (POC) listings with the Subscriber.

3) The CNDSP will develop and maintain standard operating processes needed for providing the required CND services.

4) The CNDSP will maintain a staff of qualified personnel for CND services.

5) The CNDSP will notify the subscriber of any changes to network security configurations.

6) The CNDSP will notify the Subscriber of any Provider activities that may affect network operations.

1) The Subscriber will retain a copy of the CNDSP MOA.

2) The Subscriber will notify the CNDSP of changes to network security configurations.

3) The Subscriber will provide advance notification to the CNDSP of scheduled power outages and activities that may affect CNDSP operations (e.g.

maintenance on critical network assets).

4) The Subscriber will comply with requests from the CNDSP for biannual updates to POCs and Network Diagrams.

5) Network Hardware/Equipment.

a. Network hardware and equipment procured through or provided by the

ARL remains the property of ARL. Local receipt of hardware and equipment will be established by completion of DD Form 1149, Requisition and Invoice/Shipping Document.

b. Subscriber sites are responsible for the physical security of the above hardware and equipment. The site Designated Accrediting Authority

(DAA) will accredit the physical security measures as part of the overall site accreditation.

c. The Subscriber will promptly return any sensor and scanner equipment which has been permanently disconnected from the network.

I. Alternate CNDSP Provider

For those CND services not selected above, i.e. those without an "x" in the box preceding each

CND service, the Sponsor has stated that the Subscriber is receiving these services from an alternate certified Tier 2 Computer Network Service Provider (CNDSP).

II. Optional Service Provided by CNDSP

A. Host Based Security System (HBSS)

1. HBSS services to be provided by the ARL CNDSP to Subscriber will include the following activities:

a) HBSS agents will be deployed to all Subscriber systems with supportable platforms per JTF-GNO Communications Tasking Order (CTO) 07-12, Fragmentary Order (FRAGO) 13, and CTO 10-133 (SIPRnet only), as applicable.

b) The CNDSP will provide for maintenance, updates, and configurations of a master ePolicy Orchestrator (ePO) server, to allow Subscriber the option to deploy agents or roll-up data from their local ePO server.

c) The CNDSP will maintain a strategy and resources in place for ensuring continued

HBSS support to Subscriber systems.

d) The CNDSP will provide HBSS training via computer based training (CBT) with e-mail and telephone assistance as needed to Subscriber POCs. Subscriber on-site training is not provided as part of this MOA.

2. Subscriber Obligations include the following:

a) Subscriber, as a Tier III organization, will maintain responsibility for compliance with USCYBERCOM requirements.

b) Subscriber will ensure maximum scope of HBSS deployment and implementation.

III. References:

1. Evaluator’s Scoring Metrics v. 8.0: Certification and Accreditation of

Computer Network Defense Service Providers, 01 Jun 2011.

2. CJCSM 6510.01, dated 10 August 2004

3. CJCSI 6510.01D, dated 15 June 2004

4. DoD 5200.1-R, dated 24 Nov 2003

5. DoD Directive 5230.29, dated 21 Nov 2003

6. Privacy act of 1974 (5 U.S.C. 552a), Updated May 2002

7. DoD Directive O-8530.1, dated 8 January 2001

8. DoD Instruction O-8530.2, dated 9 March 2001

9. DoD O-8530.1-M Department of Defense Computer Network Defense (CND)

Service Provider Certification and Accreditation Process

5. MOA Administration:

5.1 Term and Termination - This MOA is valid for three years from the date of the latest signature (the Effective Date), and is reviewed annually by both parties for agreement.

ARL shall be the Office of Primary Responsibility for this MOA, and will coordinate any proposed changes with all affected parties. This MOA may be amended by written agreement of both parties, and it may be terminated by either party 180 days after written notification is given to the other party, or sooner if mutually acceptable.

5.2 Dispute Resolution - The Sponsor and Army Research Laboratory (ARL) management

POCs will resolve any conflicts that arise after the Effective Date. If the Sponsor and

ARL management Points of Contact (POCs’) cannot resolve the conflict, such conflict will be elevated to the management POCs’ supervisors, and Sponsor, if applicable, for resolution. If conflict remains unresolved, such conflict will be elevated to the signatories of this MOA. The signatories will resolve the conflict by either reaching an informal agreement, or by formally amending this MOA.

5.3 Modification - This MOA will be reviewed at the request of either of the management

POCs to determine if any changes or amendments will be made and incorporated. Any such changes or amendments will be formally incorporated into the MOA within 90 days after such review. Such changes or amendments shall be signed by the original signatories of this MOA or their designees.

6. Anti-Deficiency Act, 31 U.S.C 1341:

It is mutually understood and agreed that nothing herein shall be construed as obligating either Party to violate existing laws or regulations. Additionally, nothing resulting from this agreement shall constitute a violation of the Anti-Deficiency Act, 31 U.S.C. 1341

(et.seq.), i.e., authorizing or incurring obligations or expenditures in excess of amounts apportioned by the Office of Management and Budget, or in excess of amounts permitted by agency regulations.

7. Management Points of Contact:

7.1 ARL Management Point of Contact. The Director of ARL designates the following individual to serve as the ARL Management POC with regard to all matters under this

MOA:

Curtis Arnold curtis.b.arnold.civ@mail.mil

301-394-0263

ARL may change the individual designated as the management POC upon notice to the

Subscriber of such change.

7.2 The Sponsor Management POC. The Sponsor designates the following individual to serve as the Sponsor’s Management POC with regard to all matters under this MOA:

(Enter name, email, phone number)

The Sponsor may change the individual designated as the management POC for ARL upon notice to ARL of such change.

8. Reimbursement for Services:

This MOA does not require the obligation, commitment or transfer of funds, except in return for services and hardware to facilitate the establishment and sustainment of CND services for a Subscriber. To the extent that it is necessary, the Parties will provide each other mutual support in making budget justifications and in preparing for briefings or hearings with respect to programs on which the organizations collaborate.

ARL CND Services are based on Fiscal Year costs and will be prorated to the operational date of the service. Funding for annual renewal of ARL CND Services and hardware will be transferred by the Subscriber to the Provider at the beginning of each Fiscal Year.

9. General Provisions:

mailto:curtis.b.arnold.civ@mail.mil

9.1 Nothing in this MOA is intended to supersede current law or regulation. If a term of this

MOA is inconsistent with such authority, then that term shall be invalid, but the remaining terms and conditions of this MOA shall remain in full force and effect.

9.2 This MOA in no way restricts either Party from participating in similar activities or arrangements with other public or private agencies, organizations, or individuals.

9.3 This MOA describes in general terms the basis upon which the Parties intend to cooperate. This MOA does not intend to create any rights, privileges, or benefits, substantive or procedural, enforceable by any individual or organization against the

United States; its departments, agencies, or other entities; its officers or employees; or any other person.

9.4 This MOA is subject to the availability of appropriations.

9.5 Personal Identifiable Information, Sensitive but Unclassified Information. The Parties will cooperate with each other to protect Sensitive but Unclassified Information and any other information identified by the furnishing Party as in need of special security controls. If such information is either created or provided by one Party to the other, the furnishing Party will mark the data accordingly and the receiving Party will protect it from unauthorized disclosure, including release to the public. At a minimum, the Parties will protect Sensitive but Unclassified Information in accordance with (DoD) directives.

9.6 Information Releases and Non-Disclosure. Before any information pertaining to activities performed pursuant to this MOA is made available to the public, the Parties will review and concur that the information may be released.

10. Signatures:

APPROVED and AGREED by:

SPONSOR APPROVING OFFICIAL: CNDSP APPROVING OFFICIAL:

John M. Miller

Director

U.S. Army Research Laboratory

Date: __________________ Date: _______________