ID08200023 Appendix I - Draft Visitors Group Security Agreement.pdf

THIS

CONTRACTOR

VISITOR GROUP SECURITY AGREEMENT (VGSA)

IS FOR

PERFORMANCE ON CONTRACT

XXXX-XXXX

BY

COMPANY NAME

AT PETERSON AIR FORCE BASE, COLORADO

I. Contractual Agreement: This agreement, promulgated by DoD Instruction 5220.22, Volume 2, National Industrial Security Program: Industrial Security Procedures for

Government Activities and DoD Manual 5220.22-M, National Industrial Security Program

Operating Manual (NISPOM), Chapter 1, Section 2, Paragraph 1-200, DoDM 5200.01,Vol 1-4, DoD Information Security Program, Air Force Instruction 16-1406, Air Force Industrial

Security Program, AFI 16-1404, Air Force Information Security Program and Air Force

Guidance Memorandum, AFI16-1406, Air Force Industrial Security Program, as updated and amended, is entered into by the Installation Commander, Peterson Air Force Base, and

COMPANY NAME and prescribes the specific actions to be taken by the contractor's personnel and the Department of Defense to properly protect classified defense information involved in contractor performance for contract number XXXXXX-XX-XX, being performed at the contractor's operating locations on Peterson Air Force Base. The responsibilities of each are delineated in this agreement.

*Note: This contract is administered by SPONSORING ORGANIZATION (IE. HQ

AFSPC/A3), hereinafter referred to as the Sponsoring Organization. As used in this agreement, the terminology Visitor Group, contractor, company, and home office facility (HOF) are synonymous.

Responsibilities are delineated as follows:

A. Visitor Group Security Supervision. Under the terms of this agreement, the Visitor

Group shall be integrated into the Sponsoring Organization’s Information Security Program and will operate in accordance with DoDM 5200.01, DoD Information Security Program, Air Force

Instruction 16-1406, Air Force Industrial Security Program, and supplements thereto, and the

Sponsoring Organization’s security program operating instructions (OIs), plans and/or procedures. The Visitor Group will operate on Peterson AFB at ENTER ON BASE ADDRESS.

The installation servicing security activity (21 SW/IPO) is responsible for providing security program oversight. The Sponsoring Organization is responsible for implementing and managing the contractor’s security program per DoDM 5200.01 and AFI 16-1406.

1. The Visitor Group’s Home Office Facility (HOF) will provide the 21 SW/IPO through the Sponsoring Organization the name of the HOF’s Facility Security Officer (FSO).

2. All parties, the Sponsoring Organization, the Contracting Office, Visitor Group, and

21 SW/IP will perform duties specified by this agreement in a timely manner.

3. The Visitor Group will provide an on-site Security Point of Contact to the 21 SW/IPO.

B. Standard Practice Procedures (SPP). Compliance with this agreement eliminates SPP publication requirement. The Visitor Group will use and comply with applicable DoD or AF directives and the Sponsoring Organization’s security program operating instructions, procedures, and/or requirements per this agreement. This provision of the agreement is not intended nor does it interfere with the Visitor Group’s internal management policies, procedures, or requirements unless stated otherwise.

C. Access to and Accountability of Classified Material.

1. The United States Government owns all classified information. All access to and/or possession of classified material by on-base Visitor Group personnel, including oral and/or visual, at Peterson Air Force Base, will be in accordance with AFI 16-1406 and local guidance provided by the Program Manager and 21 SW/IPO. The Visitor Group’s access to classified information will be controlled by the Sponsoring Organization and limited to “contract-specific, need-to-know” information only. The government Sponsoring Organization is accountable for and controls all classified information.

2. The contractor shall follow the Sponsoring Organization’s policy regarding information management, and in the maintenance of records for classified material received or generated internally. The Sponsoring Organization will use an AF Form 310, Document Record and Receipt, or similar form, for control of classified material, to include transfer between the contractor and DoD activities, and destruction.

3. The contractor shall follow the NISPOM in regards to information management and in the maintenance of records for classified material received or generated internally in the contractor’s off base facility.

4. Contractor access to government security containers and government access to contractor security containers is permitted as long as the contractor’s access to classified information is limited to a strict “need-to-know” as prescribed by contract.

5. The contractor, when located in the same office with the Sponsoring Organization personnel, may receive and use classified material from the Sponsoring Organization under the same procedures as used within the duty section. Material must be returned to the Sponsoring

Organization custodian prior to the end of the duty day, and cannot be removed from the duty section without the Program Manager’s authorization.

6. As required, COMSEC materials will be accounted for in accordance with AFMAN

17-1302-O. Suspected COMSEC violations will be reported either in person or through secure communications Channels to the custodian for the COMSEC account.

7. Except as noted in paragraph c-6 above, contractor personnel discovering unattended classified material or an unsecure and unattended classified container will secure the material and immediately notify the Sponsoring Organization’s Security Assistant or Program Manager.

The Visitor Group receives, releases, and disseminates classified material through the

Sponsoring Organization.

8. Visitor Groups are prohibited from establishing their own Information Technology (IT) systems/networks (Local Area Networks [LAN], Wide Area Network [WAN], Cellular phone/USB Modem as WAN, Wi-Fi as WAN, etc.) without the direct permission of governing communications and responsible information systems office.

9. The Program/Project Manager or unit Security Assistant will ensure contractor employees who need access to government IT are determined to be trustworthy via favorable personnel security investigation commensurate with assigned duties and by a designated government official prior to being granted access to government IT.

10. Contractor employees will abide by AFI 16-1404 para 2.7.7.2., which prohibits government and personal cellular/PCS and/or radio frequency (RF), infrared (IR) wireless devices, and other devices such as cell phones and tablets, and devices that have photographic or audio recording capabilities in areas where classified is processed or discussed.

D. Storage of Classified Material.

1. The contractor shall follow the Sponsoring Organizations security procedures for the storage of classified material. As required, COMSEC materials will be accounted for in accordance with AFMAN 17-1302-O.

2. If storage containers are provided to the contractor as government furnished equipment

(by contract), the responsibility for setting the storage container combination rests with the contractor, and shall be performed IAW DoDM 5200.01 Volume 3 Enclosure 3 Section 11. SF

700, Security Container Information, or equivalent contractor forms, will be used to identify persons having knowledge of the combination(s). This form will be posted inside the locking drawer of each security container.

E. Transmission of Classified Material.

1. The Visitor Group is not authorized for direct receipt or dispatch of classified material at Peterson Air Force Base through U.S. postal channels.

2. Classified material transmitted via U.S. postal channels directly from Peterson AFB must be processed through the Sponsoring Organization and packaged in accordance with

DoDM 5200.01 for transmission through the base classified mail system. The Visitor Group is authorized to hand-carry classified material, to include computer equipment, between Peterson

AFB and their Colorado Springs office location using an appropriately cleared employee as a courier. The individual must be briefed on courier responsibilities and designated in writing as a courier of classified material by the contractor authenticated by the Sponsoring Organization’s

Security Assistant. Equipment and materials will always be packaged and safeguarded for carrying in accordance with DoDM 5200.01 Volume 3 Enclosure 4 and AFI 16-1404 5.3. The contractor will maintain an accountability system for the equipment/materials hand-carried on and off the installation in accordance with paragraph 5-401 of the NISPOM. The Visitor Group may use AF Form 310, Document Receipt and Destruction Certificate, or similar form for this purpose.

F. Disposition of Classified Material. The Visitor Group will return all classified information jointly developed or shared under the terms of this agreement to the Sponsoring

Organization when no longer required for performance of work under the contract unless otherwise instructed by the Contracting Officer. The Visitor Group will return any remaining classified information held to the Sponsoring Organization at the end of contract performance.

The United States Air Force claims all rights as owner of all classified material and products developed, designed, and/or utilized within the scope of this contract.

G. Reproduction of Classified Material. The Visitor Group may not reproduce classified material without permission of the Sponsoring Organization. When so authorized, the Visitor

Group will use only DoD approved and controlled reproduction equipment, in accordance with

DoDM 5200.01 and AFI 16-1404.

H. Security Education. The contractor shall and the government Security Assistant will be responsible for:

1. Prior to granting access, and at least once annually thereafter, train on-site activity personnel whose duty performance requires access to classified information of their individual responsibilities for safeguarding classified information. The training should be tailored to those responsibilities associated with assigned duties, the provisions of this agreement, any associated

DD Form 254, and security discrepancies identified in recent reviews. The government Security

Assistant will maintain records of this training.

2. Conduct briefings and debriefings IAW AFI 16-1404 Ch 6, to include OPSEC and

COMSEC if necessary. The SF 312, Non-Disclosure Agreement, and/or corporate training records for contractor personnel assigned to the on-site activity may be retained at the contractor off installation facility.

3. Ensure participation, whenever possible, of all appropriate on-site activity personnel in any security education or orientation programs conducted by the Program Manager to convey security classification guidance.

4. Training personnel issued restricted area badges annually concerning physical security of restricted areas. The government Security Assistant will maintain records of this training, and provide copies to the contractor as required.

5. Unless specified otherwise, provide special purpose training for classified couriers, destruction officials, escort officials, and other briefings required for special access programs such as CNWDI and NATO. The government Security Assistant will maintain records of this training, and provide copies to the contractor as required.

I. Personnel Security Clearances. The Visitor Group’s home office (local FSO is acceptable) will submit visit requests using JPAS. A visit request will be sent to the Sponsoring

Organization Security Assistant at the start of contract performance that specifies employee security clearances. The Visitor Group will furnish an updated visit request thereafter at least annually, and every time a change occurs in employees or clearance levels. The updated visit requests are sent directly to the Security Assistant of the Sponsoring Organization via JPAS. The

Sponsoring Organization shall keep current visit requests on file for the duration of the contract.

1. The Visitor Group will send a JPAS visit request and will put the contract number in the POC field along with the phone number as well as in the Additional Information field.

Subcontractors submit independent Visit Requests to the serviced organization via JPAS on their employees.

2. When the Visitor Group sends a visit request to a third party (DoD entity) they shall put the contract number and the phone number of the government entity that will verify the contractors need-to-know in the POC field as well as the Additional Information field.

3. If the third party being visited is not a DoD entity and the third party does not have

JPAS access, a visit authorization letter IAW DoD 5220.22-M Ch 6 Section 6-104 and AFI

16-1406 Ch 7 is required along with the sponsoring government organization’s need-to-know endorsement.

J. Security Incidents. The Visitor Group must immediately report to the Sponsoring

Organization any suspected violation of security procedures outlined in DoDM 5200.01. The

Visitor Group must also keep the Sponsoring Organization advised of any reports submitted per

AFI 71-101 Volume 4, Counterintelligence. The Sponsoring Organization shall notify 21

SW/IPO of reported incidents.

1. The Sponsoring Organization appoints Inquiry Officials (IO) to research and investigate possible security violations or infractions committed by the Visitor Group. The IO will prepare a Preliminary Inquiry report in accordance with DoDM 5200.01 and AFI 16-1404.

2. The Sponsoring Organization’s Security Assistant will provide a written report of security incidents involving the Visitor Group to the Visitor Group’s FSO. A copy of that report will be provided to 21 SW/IPO. As appropriate, 21 SW/IPO shall notify other AF activities.

K. Contractor Restricted Area Badges. When required for contract performance, the

Automated Entry Control Card (AECC) will be issued to Visitor Group personnel for entry into restricted and/or controlled areas on Peterson AFB.

1. Visitor Group personnel will request authorization to obtain an AECC to the

Sponsoring Organization’s Security Assistant by a letter signed by the (Local or Corporate) FSO.

The letter shall state the contract number, individual’s name, SSN, DOB, company name, destination (Sponsoring Organization office symbol), work cycle (DAYS/HOURS), and the expiration date of the contract.

2. The 21 SFS Pass and Registration section will issue AECCs upon the request of the

Sponsoring Organization’s Security Assistant with a completed AF Form 2586.

3. Visitor Group employees must display their AECC when inside restricted or controlled areas/buildings. Employees will not wear and display their AECC outside restricted or controlled areas/buildings, nor will the AECC be used as a means to gain access to the installation.

4. The Visitor Group will surrender an employee’s AECC when directed by the

Sponsoring Organization or 21 SFS, when the employee no longer requires it for performance of duties, or when the employee has terminated employment with the contractor at Peterson AFB.

Any forms and/or passes used to gain access to Peterson AFB will be confiscated by the

Sponsoring Organization and relinquished to the 21 SFS Pass and Registration. Refer AECC or installation entry procedures to 21 SFS Pass and Registration Office, Bldg. 1334, 556-6660.

L. Contractor Local Area Badges. When required for contract performance, locally developed installation badges will be issued to Visitor Group personnel for entry onto Peterson

AFB. Only unit Security Assistants with properly authenticated Signature Cards will be authorized to submit EALs. The EAL should identify the contract organization, contract number, names of contract personnel requiring access to the installation, and the duration of the contract.

The Government Sponsor will notify 21 SW/IPO any time derogatory information is revealed on contractor personnel. The Visitor Group will surrender an employee’s local area badge(s) when directed by the Sponsoring Organization, when the employee no longer requires it to perform duties, or when the employee has terminated employment with the contractor at Peterson AFB.

M. Contractor Badges Obtained at Third-Party Contractor Locations. When required for contract performance, the Contractor will be permitted to obtain badges at third-party contractor locations. Visitor Group personnel will request authorization to obtain such badges from the Sponsoring Organization’s Authorized Government Representative. The Visitor Group will surrender such badges when directed by the Sponsoring Organization, when the employee no longer requires it for performance of duties, or when the employee has terminated employment with the contractor at Peterson AFB.

N. Release of Material Obtained Through or Generated by Performance on the

Contract. The Visitor Group will provide any such material to the Sponsoring Organization for review for the presence of classified or sensitive information, and approval to release the material in advance of the actual release.

O. Security Checks. Visitor Group personnel may perform end of day security checks within their assigned work areas in accordance with DoDM 5200.01, AFI 16-1404, and the Sponsoring

Organization security program operating instructions. The Visitor Group will use Standard Form

701, Activity Security Checklist, or generate an equivalent self-designed checklist which meets approved requirements.

P. Emergency Protection. The Visitor Group will make every effort to secure all classified material with the Sponsoring Organization in the event of a natural disaster, major accident, or civil disturbance per DoDM 5200.01, AFI 16-1404, and the Sponsoring Organization security program operating instruction. If the work area is evacuated or abandoned before classified materials can be secured with the Sponsoring Organization, the Visitor Group, upon termination of the emergency condition, will examine classified holdings with the Sponsoring Organization’s

Security Assistant to ensure there has not been a compromise or loss of exposed information.

Q. Protection of Government Resources. The Visitor Group will comply with AFI 31-101, the Air Force Installation Security Program, and other security and safety operating instructions of the Sponsoring Organization and installation.

R. Clarification of Security Requirements. The Visitor Group will address inquiries or questions pertaining to the provisions of DoDM 5200.01 and AFI 16-1404, and any other security related issue, to the Sponsoring Organization’s Security Assistant or Authorized

Government Representative.

S. Foreign Involvement. Under the terms of this agreement, the Visitor Group is required to notify the Sponsoring Organization Contract Program Manager and Contracting Officer, prior to any foreign involvement, regardless of access requirements or the sensitivity of information to be disclosed (classified or unclassified).

II. Security Reviews.

A. Staff Assistance Visits (SAVs), Security Reviews, and Self-Inspections. Inspections will not be conducted by the 21 SW/IPO on the Visitor Group independent of the Sponsoring

Organization. The presence of the Sponsoring Organization’s Security Assistant is required during a Security Review.

B. 21 SW/IPO Security Reviews.

1. The 21 SW/IPP will notify and schedule all Security Reviews through the Sponsoring

Organization’s Security Assistant. The Security Review is conducted per DoDM 5200.01, AFI

16-1404, and AFI 16-1406, supplements thereto, and this agreement. A copy of the Security

Review report will be provided to the Visitor Group by 21 SW/IPP. The Visitor Group is not required to acknowledge receipt, nor respond, unless directed to do so in the report.

2. The Sponsoring Organization’s Security Review or self-inspection will include the

Visitor Group’s operation. The Visitor Group will also be included in the Sponsoring

Organization’s semiannual security self-inspection program. The Sponsoring Organization will use the Visitor Group Security Agreement and their own self-inspection criteria to monitor the

Visitor Group’s performance and compliance. Document and maintain the Security Review report as required by DoDM 5200.01 and AFI 16-1404.

III. Expenditure of Funds for Security. This agreement is not an authorization for a commitment of funds. Nothing in this agreement shall be construed to impose any liability on the part of the U.S. government for injury to the agents, employees of the Visitor Group, its subcontractors, assignees, or other individuals acting for or on behalf of the Visitor Group, to the property of the same, nor shall anything in this agreement be construed to modify the provisions of existing contracts.

IV. Other:

A. Forms. The Sponsoring Organization furnishes all government forms, all required DoD and Air Force instructions/regulations, operating instructions, and unit security plans required in support of this agreement.

B. Sub-contracts. A separate or independent VGSA is developed for subcontractors when prime and subcontractors are not working at the same AF installation. If at the same location, a separate VGSA is not required. The prime contractor will ensure that all subcontractors performing work on classified contracts on Peterson AFB comply with this agreement, DoD

5220.22-M, and applicable local Air Force directives. The prime contractor shall place a statement to this effect in Item 13 of the subcontract DD Form 254 that will perform work on

Peterson AFB. A copy of the DD Form 254 for subcontracts will be provided to 21 SW/IPO.

Under no circumstances does a separate VGSA for subcontractors relieve the prime contractor of overall security responsibility for the subcontractor (See Attachment 1).

C. Notification. The program office, requiring Air Force activity or Contracting officer will notify the 21 SW/IPO in writing within 30 days to contract completion or terminated on Peterson

AFB in order to schedule a close-out inspection per DoD 5220.22-R, AFI 16-1406, 6.4, and this agreement.

D. Government Liability. Nothing in this agreement shall be construed to impose any liability on the part of the U.S. Government for injury to the agents, employees of the contractor, its subcontractors, assignees, or other individuals acting for or on behalf of the contractor, to the property of the same, nor shall anything in this agreement be construed to modify the provisions of existing contracts.

E. AIS access. Sponsoring Organization encloses AIS access requirements for their organization, directorate, and command (See Attachment 2).

V. Security Points of Contact:

COMPLETE SPONSORING ORGANIZATIONS

SECURITY ASSISTANT CONTACT INFORMATION

21 SFS Law Enforcement Desk (Manned 24 hours)

(719) 556-4000/4805

21 Space Wing

21 SW/IP

Julie Boyatt, DAFC

Industrial Security Program Manager

135 Dover Street, Ste 1055

Peterson AFB CO 80914-3400

(719) 556-8235

GLOSSARY OF SECURITY TERMS/ACRONYMS/FORMS

21 SW/IPO The 21st Space Wing Information Protection Contract Security Office. The office that provides security supervision of classified contract performance on Peterson

Air Force Base (PAFB).

ACO Administrative Contracting Officer. The contracting official responsible for the administration of the contract.

AFI Air Force Instruction. Designed to supplement Air Force Policy Directives.

AFOSI Air Force Office of Special Investigations. The agency charged with conducting special investigations for the USAF. AFOSI agents conduct investigations of sabotage, espionage, subversion, terrorism, fraud, etc.

AIS Automated Information Systems

Classified A contract that requires, or will require, access to classified

Contract information by contractor personnel in the performance of the contract. (A contract may be a classified contract even though the contract document is not classified).

CNWDI Critical Nuclear Weapon Design Information

COMSEC Communications Security

CSSO Contractor Special Security Officer. The contractor official responsible for security management of the SCI program.

DAA Designated Approval Authority

DSS Defense Security Service. The DoD agency responsible for ensuring contractor security practices conform with the NISPOM and conducting other investigations as required by the DoD.

EMSEC Emissions Security. Previously known as TEMPEST.

HOF Home Office Facility. For the purpose of this agreement, the HOF is the cleared facility responsible for management of the Visitor Group. Generally, it is the facility identified on the DD Form 254 as the prime contractor.

ISR Industrial Security Program Regulation (DoD 5220.20 Volume 2)

VG Visitor Group. For the purpose of this agreement, a VG is a contractor activity requiring access to classified information and continuous manning by contractor personnel on Peterson Air Force Base. It is not a requirement for the contractor to maintain classified material. It is sufficient for the contractor to be authorized access to classified material if needed to perform their job. When a subcontract is involved, the subcontractor activity is part of the prime contractor's VG, unless special procedures have been adapted (Contractors working on Peterson AFB are considered integrated Visitor Groups).

NATO North Atlantic Treaty Organization

NISPOM National Industrial Security Program Operating Manual (DoD 5220.22-M)

ON-SITE This term refers to contractor operations on Peterson Air Force Base.

ACTIVITY

OPSEC Operations Security

PROGRAM The USAF, or other DoD official, usually assigned to Peterson Air

MANAGER Force Base, who is monitoring or supervising contractor performance.

SCG Security Classification Guidance

SCI Sensitive Compartmented Information. A special access program involving compartmented intelligence information.

SPP Standard Practice Procedures. Written security procedures prepared when the

FSO believes them necessary for the effective implementation of the NISPOM.

SSO Special Security Officer. The official responsible for monitoring safeguarding procedures for SCI information.

UA User Agency. The federal agency for which a contract is performed. In most cases this will be the USAF, but it can be another federal agency.

AF Form 310 Document Receipt and Destruction Certificate

AF Form 2586 Unescorted Entry Authorization Certificate. Used to request controlled and restricted area badges and authorize escort authority

DD Form 254 Contract Security Classification Specifications. A form used to summarize the security requirements in a contract. It is prepared by the Program Manager in conjunction with the contracting office and is usually an attachment to the contract document.

SF 312 Classified Information Nondisclosure Agreement (NdA)

SF 700 Security Container Information

SF 701 Activity Security Checklist

SF 702 Security Container Check Sheet

Prime Contract #: ___________________________

AGREEMENT CERTIFICATION

In a joint security effort with a common purpose to protect classified defense information, authorized officials have agreed to the contents of this document as evidenced by their signatures below.

ROBERT C. LARSEN

21 SW/IP

Chief, Information Protection

Date: ________________

Security Assistant Name Company Official Name

Organization Name of Company

Security Assistant Title (ex: Facility Security Officer)

DATE DATE

Program Manager Name JULIE K. BOYATT

Program Manager 21 SW/IP

Industrial Security Program Manager

________ ________ DATE

DATE

Prime Contract #: ________________________

ATTACHMENT 1

SUBCONTRACTOR AGREEMENT CERTIFICATION

In a joint security effort with a common purpose to protect classified defense information, subcontractor authorized officials have agreed to the contents of this document as evidenced by their signature below and further certify receipt of a copy of this document.

SUBCONTRACTOR: Name of Company

Signature Block Facility Security Officer of

Sub-Contractor

DATE: __________________

ATTACHMENT 2

INFORMATION SYSTEM ACCESS CONTROL

The government Sponsoring Organization’s Security Assistant and Cyber Security Liaison

(CSL) will ensure the contractor, at a minimum, adheres to the following:

AFMAN 17-1301

4.1. Introduction. AF ISs connect to the DoD Information Network (DoDIN) subnetworks

(e.g., SIPRNet, Non-classified Internet Protocol Router Network [NIPRNet], GVS, etc.) IAW

Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 6211.02, Defense Information Systems

Network (DISN) Responsibilities. Every individual who has access to standalone systems, specialized/functional ISs, enterprise ISs, and/or mission systems is an IS user.

4.1.1. Access to AF ISs is a revocable privilege and is granted to individuals based on need to know and IAW National Security Telecommunications and Information Systems Security

Policy (NSTISSP) No. 200, National Policy on Controlled Access Protection; DoD 5200.2-

R, Personnel Security Program; and CJCSI 6510.01, Information Assurance (IA) and

Support to Computer Network Defense (CND). Follow procedural guidance in MPTO 00-

33B-5004.

4.2. Authorized Users. An authorized user is any appropriately cleared individual required to access a DoD IS to carry out or assist in a lawful and authorized governmental function.

Configure authorized user account creation and administration using role-based access sChemes;

see AFMAN 17-1201, User Responsibilities and Guidance for Information Systems. Consult

AFI 31-501, Personnel Security Program Management, for investigation requirements for access to an Automated Information System (AIS) position, as outlined in DoD 5200.2-R, Appendix 10.

4.2.1. All authorized users (e.g., military, civilian, contractor, temporary employees, volunteers, interns, key spouses, and American Red Cross personnel) will complete

CyberAwareness Challenge training prior to being granted access to an IS. (T-0). Users annually re-accomplish CyberAwareness Challenge training; organizations maintain compliance IAW DoD 8570.01-M. Authorized user access to unclassified and classified ISs based on the assigned duties and the Automated Data Processing (ADP) position categories identified in DoD 5200.2-R, Appendix 10: Category ADP-III (also referred to as IT-III) are nonsensitive positions.

4.2.1.1. CyberAwareness Challenge training is located on the Advanced Distributed

Learning Service (ADLS) accessible via the AF Portal.

4.2.1.2. A publically accessible version of the CyberAwareness Challenge training is located on the DISA website (http://iase.disa.mil). Users without an ADLS account may substitute this training for initial network access.

4.2.1.3. When a user requires a new/modification to his/her account (due to Change of station or assignment, Temporary Duty [TDY], etc.), the gaining CSS verifies the user meets access requirements before granting access to the IS. Users are not required to retake the CyberAwareness Challenge training provided the user has a valid and current

(within a year) course completion record. Verification of completion may be accomplished using the printed or electronic copy of CyberAwareness Challenge training certificate from DISA or ADLS or confirmation by the CSS.

http://iase.disa.mil/

4.2.1.4. System access by authorized users requires PKI access methods as specified in

DoDI 8520.03, Identity Authentication for Information Systems, and CJCSI 6510.01.

4.2.2. Privileged User. Grant privileged access to unclassified and classified ISs based on the assigned duties and the ADP position categories identified in DoD 5200.2-R, Appendix

10: Category ADP-I (also referred to as IT-I) are Privileged positions and Category ADP-II

(also referred to as IT-II) are Limited Privileged positions.

4.2.2.1. Administrative and privileged accounts require PKI user authentication IAW

United States Cyber Command (USCYBERCOM) Tasking Order (TASKORD) 2015-

0102, Implementation and Reporting of DoD Public Key Infrastructure (PKI) System

Administrator and Privileged User Authentication.

4.2.2.2. Privileged users should meet all the requirements of an authorized user as specified in AFMAN 17-1303 and paragraph 4.2.1.

4.2.2.3. Privileged users are established and administered with a role-based access sCheme IAW the system policy and Chapter 3 of DoD 5200.2-R and AFMAN 17-

1303.

4.2.2.4. System access requires PKI access methods as specified in DoDI 8520.03 and

CJCSI 6510.01.

4.2.2.5. Privileged users access only data, control information, software, hardware, and firmware that they are authorized access and fulfills the “need to know” requirement.

4.2.2.6. To maintain separation of duties and least privilege, users maintain separate accounts, a user account for day-to-day or “non-privileged” functions, and a privileged account for administrative functions IAW DoD 8570.01-M.

4.2.2.7. Prohibit sharing of privileged user accounts and credentials between users.

4.2.2.8. Configure privileged user remote access IAW the applicable DISA STIGs (i.e., Enclave, Operating System, Remote Access, Directory Services Domain, etc.) and the selected security controls within the RMF package.

4.2.2.9. Privileged users are position-certified IAW DoD 8570.01-M and qualified IAW

AFMAN 17-1303.

4.2.2.10. Privileged users complete an Information System Privileged Access Agreement and Acknowledgement of Responsibilities IAW DoD 8570.01-M (Appendix 4).

4.3. Required Account Access Documentation.

4.3.1. When required by the ISO for IS access, the CSS or ISSO ensures the DD Form 2875, System Authorization Access Request (SAAR), is completed and signed. Document access requests, Annual Information Awareness (CyberAwareness Challenge) training completion, and justification for access and clearance/background investigation verification as referenced by DoD 5200.2-R and AFI 31-501. DD Form 2875 signatures can be “wet” or digitally signed. Do not combine multiple system access requests on the same DD Form 2875.

4.3.1.1. CSSs/ISSOs, in coordination with the organizational Security Assistant, verify user background investigation requirements IAW DoD 5200.2-R.

4.3.1.2. The ISSO/ISSM (referred to as the “Information Assurance Officer” on the DD

Form 2875) retains the DD Form 2875 IAW instructions outlined on the form for non-

AFNet ISs. The CSS retains the DD Form 2875 according to the instructions on the form for AFNet ISs.

4.3.1.2.1. Original DD Form 2875s for unprivileged AFNet accounts may be transferred when duty assignments Change; the gaining unit’s CSS may use local methods to update duty information in the “IAO Express” tool and shared drive access requirements. The losing unit’s CSS ensures termination of shared drive access prior to users out-processing. Changes to privileged account access requirements require a new DD Form 2875.

4.3.1.2.2. Re-accomplish DD Form 2875s for AFNet-SIPRNet (AFNet-S) accounts when access requirements Change.

4.3.2. In accordance with AFMAN 17-1201, users of all authorized IS devices (to include

Mobile Computing Devices) sign the standardized AF Form 4394, Air Force User

Agreement Statement-Notice and Consent Provision, prior to initial IS access. For wireless devices, users complete the standardized AF Form 4433, US Air Force Unclassified

Wireless Mobile Device User Agreement. Maintain copies of signed AF Forms 4433 within the CSS.

4.3.3. Access to classified ISs also requires a Standard Form (SF) 312, Nondisclosure

Agreement, IAW AFI 16-1404, Air Force Information Security Program.

4.4. Token Access. IAW DoDI 8520.02 and DoDI 8520.03, users authenticating to DoD networks require the use of a hardware token. Follow guidance in Chapter 8 to obtain a hardware token prior to being granted access to AFNet and AFNet-S Directory Services

Domains and authenticating to NIPRNet or SIPRNet PK-Enabled websites.

4.5. Loss of Access. Access to an AF IS is a privilege and continued access is contingent on personnel actions, Changes in need to know, or operational necessity; see AFMAN 17-1201.

The ISO has the authority to re-instate users who have lost access.

4.5.1. Specific procedural information for account disabling is located in MPTO 00-33B-

5004.

4.5.2. Failure to complete annual CyberAwareness Challenge training results in immediate suspension of access to unclassified and classified ISs.

4.5.3. Actions that threaten or damage AF ISs may result in immediate suspension of access to unclassified and classified ISs IAW CJCSI 6510.01 and DoD 5200.2-R. Deliberate inappropriate use of user accounts or systems may result in administrative disciplinary action IAW AFMAN 17-1201.

4.5.3.1. If an individual’s clearance is suspended, denied, or revoked, immediately suspend access to classified ISs. Commanders should review circumstances surrounding the suspension, denial, or revocation to determine if continued access to unclassified systems is warranted and if revocation of the hardware token is required. Commanders may provide recommendations regarding user access to the ISO.

4.5.3.2. If an individual violates the IS terms of use, commanders should consider suspending access pending re-accomplishment of CyberAwareness Challenge training.

Additional restrictions on reinstatements for classified ISs are determined locally and should follow the guidelines of DoD 5200.2-R.

4.6 Account Management. AF direction is to use PKI-based identification and authentication

IAW DoDI 8520.02, DoDI 8520.03 and the USCYBERCOM Communications Tasking Order

(CTO) 07-015, Public Key Infrastructure (PKI) Implementation,Phase 2

(https://www.cybercom.mil/J3/orders/Pages/CTOs.aspx). Manage all user accounts using https://www.cybercom.mil/J3/orders/Pages/CTOs.aspx applicable system configuration guidance; follow TOs published by AFSPC (e.g., MPTO 00-

33B-5004, MPTO 00-33A-1202 [for AFNet accounts], and the applicable DISA STIGs

[enclave, application security, operating system, database, etc.]).

4.6.1 ISSM/ISSOs implement automated IS controls to Check and disable IS user accounts that have been dormant more than 30 days IAW CJCSI 6510.01.

4.6.1.1. AF CIO Exception: Disable National Guard and Reserve member IS user accounts only after 90 days of inactivity.

4.6.1.2. Document system specific IS user account disabling requirements after periods of inactivity in the IS security authorization package.

4.6.1.3. ISSMs provide a monthly list of disabled SIPRNet accounts to the base Local

Registration Authority (LRA) for SIPRNet hardware token recovery actions; see

Chapter 8.

4.6.2. Delete unnecessary (to include service accounts) and/or default accounts and Change all factory default or user-generated passwords included in a newly acquired system(software or hardware) IAW the configuration information in the IS security authorization package before allowing any user access to the system.

4.6.2.1. Rename default accounts that cannot be deleted, IAW applicable DISA STIGs.

4.6.2.2. Do not execute root-level access in IS applications.

4.6.2.3. Disable/deactivate user accounts (do not delete/deprovision) when users are unable to remotely access their accounts due to an extended absence or when a user is suspended from work, IS access is revoked for any reason, or the security clearance is suspended as specified in paragraph 4.5.3.