DOD_policy_memo_ Encryption of SUData.pdf

DON CIO Message: DTG: 091256Z OCT 07

UNCLASSIFIED//

SUBJ: DON ENCRYPTION OF SENSITIVE UNCLASSIFIED DATA AT REST GUIDANCE

REF/A/DOC/OMB MEMO/23JUN2007//

REF/B/DOC/DOD MEMO/03JUL2007//

REF/C/DOC/GSA/18JUN2007//

REF/D/MSG/DON CIO WASHINGTON DC/171952ZAPR2007//

NARR/REF A IS OMB POLICY MEMO 06-16, PROTECTION OF SENSITIVE

UNCLASSIFIED AGENCY INFORMATION. REF B IS DEPARTMENT OF DEFENSE (DOD)

POLICY MEMO, ENCRYPTION OF SENSITIVE UNCLASSIFIED DATA AT REST (DAR) ON

MOBILE COMPUTING DEVICES AND REMOVABLE STORAGE MEDIA USED WITHIN THE

DOD. REF C IS GSA ANNOUNCEMENT DOD ENTERPRISE SOFTWARE INITIATIVE

(ESI) AND SMART BUY DAR BASIC PURCHASE AGREEMENT AWARDS. REF D IS THE

DEPARTMENT OF NAVY (DON) CIO MESSAGE, SAFEGUARDING PERSONALLY

IDENTIFIABLE INFORMATION (PII). REFS CAN BE FOUND AT

HTTP://PRIVACY.NAVY.MIL.

POC/DARIN DROPINSKI/CIVPERS/DON CIO/LOC: WASHINGTON DC/TEL:703-604-

7059/EMAIL: DARIN.DROPINSKI@NAVY.MIL/ POC/JAMES MAUCK/CTR/DON CIO/LOC:

WASHINGTON DC//TEL: 703-601-0579/EMAIL: JAMES.MAUCK.CTR@NAVY.MIL

PASSING INSTRUCTIONS:

CNO: PLEASE PASS TO N6

NAVY ECHELON II COMMANDS: PLEASE PASS TO COMMAND INFORMATION OFFICER

(IO)

USMC MAJOR SUBORDINATE COMMANDS: PLEASE PASS TO COMMAND INFORMATION

OFFICER (IO)

RMKS/1. POLICY. PER REF A, ALL UNCLASSIFIED DATA AT REST (DAR) THAT

HAS NOT BEEN APPROVED FOR PUBLIC RELEASE AND IS STORED ON MOBILE

COMPUTING DEVICES SHALL BE TREATED AS SENSITIVE DATA AND ENCRYPTED

USING COMMERCIALLY AVAILABLE ENCRYPTION TECHNOLOGY. FURTHERMORE, REF B

MANDATES: TRUSTED PLATFORM MODULE TECHNOLOGY BE PURCHASED ON ALL

COMPUTING DEVICES WHERE AVAILABLE; IMPLEMENTATION OF DAR PROTECTION FOR

MOBILE AND REMOVABLE MEDIA; AND STIPULATES THAT DAR REQUIREMENTS ARE IN

ADDITION TO ALL OTHER PREVIOUSLY SPECIFIED REQUIREMENTS. PER REF B,

ALL DAR ENCRYPTION PRODUCTS MUST BE PURCHASED FROM THE DEPARTMENT OF

DEFENSE (DOD) ENTERPRISE SOFTWARE INITIATIVE (ESI). INFORMATION AND

DETAILS ON REF C AND RECOMMENDED SOLUTIONS ARE AVAILABLE AT

HTTP://WWW.ESI.MIL AND AT HTTP://IASE.DISA.MIL. REF D IDENTIFIES DON

POLICY REQUIREMENTS FOR SAFEGUARDING PERSONALLY IDENTIFIABLE

INFORMATION (PII).

2. BACKGROUND. THE DEPARTMENT OF THE NAVY (DON), INCLUDING

REPRESENTATION FROM THE INFORMATION ASSURANCE STAFFS OF THE DON CHIEF

INFORMATION OFFICER (CIO), DON DEPUTY CIO (NAVY), DON DEPUTY CIO

(MARINE CORPS), NAVY PMW 161, AND PROGRAM MANAGER NAVY MARINE CORPS

INTRANET (PM NMCI) PARTICIPATED IN A DOD-LEVEL DAR TIGER TEAM TASKED TO

DEVELOP REQUIREMENTS FOR, AND EVALUATE RESPONSES TO, AN RFP FOR DAR

ENCRYPTION PRODUCTS. REF C IS THE RESULT OF THAT EFFORT.

http://privacy.navy.mil/ http://www.esi.mil/ http://iase.disa.mil/

3. THE DON INFORMATION EXECUTIVE COMMITTEE (DON IEC) WILL SELECT THE

DON ENTERPRISE DAR ENCRYPTION SOLUTION BY EARLY NOVEMBER 2007. THE DON

WILL IMPLEMENT THE DAR ENCRYPTION SOLUTION ENTERPRISE WIDE. THIS

POLICY WILL IMPACT ALL DON MOBILE COMPUTERS AND REMOVABLE MEDIA. THE

DON ENTERPRISE SOLUTION WILL BE A SINGLE PRODUCT; HOWEVER, IF A SINGLE

PRODUCT DOES NOT MEET THE NEEDS OF THE DIFFERING MISSIONS THROUGHOUT

THE DON, THE NAVY AND MARINE CORPS CAN RECOMMEND TO THE IEC NEED FOR

THE APPROVAL OF ADDITIONAL PRODUCTS FROM REF C. STILL, TO MAXIMIZE

BUYING POWER, ENSURE INTEROPERABILITY, REDUCE COMPLEXITY, AND MINIMIZE

CERTIFICATION AND ACCREDITATION COSTS AND TIMELINES, THE DON MUST

MAINTAIN A SOLUTION WITH THE LEAST NUMBER OF PRODUCTS. TO DETERMINE

THE RECOMMENDED DON DAR SOLUTION, NMCI HAS FACILITATED ENTERPRISE

TESTING OF THE DOD RECOMMENDED PRODUCTS IN COLLABORATION WITH

REPRESENTATIVES FROM NON-NMCI DON NETWORKS. UPON SELECTION OF THE DON

ENTERPRISE DAR ENCRYPTION SOLUTION, THE DON CIO WILL PROMULGATE UNDER

SEPCOR IMPLEMENTATION AND ACQUISITION INSTRUCTIONS.

4. ACTION.

A. HOLD ALL PURCHASES OF DAR PRODUCTS AND SERVICES IN ABEYANCE UNTIL

THE DON CIO ANNOUNCES THE DON ENTERPRISE DAR ENCRYPTION SOLUTION.

B. ALL PURCHASES OF THE DON ENTERPRISE DAR ENCRYPTION SOLUTION MUST BE

COORDINATED AT THE ENTERPRISE LEVEL THROUGH THE OPNAV N6 FOR THE NAVY

AND HQMC C4 FOR THE MARINE CORPS.

C. THE NAVY AND THE MARINE CORPS SHALL REPORT TO DON CIO PROSPECTIVE

QUANTITIES REQUIRED AS THE DON CAN REALIZE SUBSTANTIAL SOFTWARE LICENSE

PRICE REDUCTIONS WITH SUFFICIENT QUANTITIES. ADDITIONALLY, THE NAVY

AND MARINE CORPS SHALL PROVIDE THEIR RESPECTIVE PLANS OF ACTION AND

MILESTONES (POA&M) FOR PROSPECTIVE QUANTITIES REQUIRED, FUNDING,

ACQUISITION, AND IMPLEMENTATION OF THE DON ENTERPRISE DAR ENCRYPTION

SOLUTION TO THE DON CIO BY 21 NOV 2007. DON CIO MUST REPORT STATUS OF

DAR IMPLEMENTATION TO OSD (DOD CIO) NLT 31 DEC 2007.

D. THE DON ENTERPRISE DAR ENCRYPTION SOLUTION SHALL BE APPLIED TO ALL

DON MOBILE COMPUTERS AND REMOVABLE MEDIA AS DEFINED IN REF B.

E. ALL COMMANDS MUST COMPLY WITH REF D, WHICH IDENTIFIES THE DON

REQUIREMENTS FOR SAFEGUARDING PII.

5. REQUEST WIDEST DISSEMINATION OF THIS MESSAGE.

6. RELEASED BY ROBERT J. CAREY, DEPARTMENT OF THE NAVY CHIEF

INFORMATION OFFICER.//