DOD8510.01information assurance training cert.pdf

DoD 8570.01-M

Information Assurance Workforce Improvement

Program

December 19, 2005

Assistant Secretary of Defense for

Networks and Information Integration/Department of Defense Chief

Information Officer

DoD 8570.01-M, December 19, 2005

2 FOREWORD

This Manual is issued under the authority of DoD Directive 8570.1 “Information Assurance Training, Certification, and Workforce Management,” August 15, 2004 (Reference (a)). It provides guidance and procedures for the training, certification, and management of the DoD workforce conducting Information Assurance functions in assigned duty positions. It also provides information and guidance on reporting metrics and the implementation schedule for Reference (a).

This Manual applies to the Office of the Secretary of Defense, the Military Departments, the Chairman of the Joint Chiefs of Staff, the Combatant Commands, the Office of the Inspector General of the Department of Defense, the Defense Agencies, the DoD Field Activities, and all other organizational entities in the Department of Defense (hereafter referred to collectively as the “DoD Components”).

This Manual is effective immediately and is mandatory for use by all the DoD Components.

Send recommended changes to the Manual to the following address:

Director Information Assurance Directorate Assistant Secretary of Defense for Network and Information Integration/Department of Defense Chief Information Officer (ASD(NII)/ DoD CIO) 1155 Defense Pentagon Washington, DC 20301-1155

The DoD Components may obtain copies of this Manual through their own publications channels. Other Federal agencies and members of the public may obtain copies of this Manual from the U.S. Department of Commerce, National Technical Information Service, 5285 Port Royal Road, Springfield, VA 33261. An electronic version of this Manual can be viewed and downloaded from the following web site: http://www.dtic.mil/whs/directives.

3 TABLE OF CONTENTS

TABLE OF CONTENTS

Page

FOREWORD 2

TABLE OF CONTENTS 3

FIGURES 5

TABLES 5

REFERENCES 6

ACRONYMS 7

CHAPTER 1 – GENERAL INFORMATION 9

C1.1. PURPOSE 9

C1.2. DEFINITIONS 9

C1.3. DoD IA WORKFORCE MANAGEMENT OBJECTIVES 9

C1.4 RESPONSIBILITIES 10

CHAPTER 2 – IA WORKFORCE STRUCTURE OVERVIEW 14

C2.1. INTRODUCTION 14

C2.2. IA WORKFORCE CATEGORIES AND LEVELS 15

C2.3. TRAINING AND CERTIFICATION PROGRAMS 16

CHAPTER 3 – IA WORKFORCE TECHNICAL CATEGORY 18

C3.1. INTRODUCTION 18

C3.2. TECHNICAL CATEGORY DESCRIPTION 18

C3.3. INFORMATION ASSURANCE TECHNICAL LEVEL I 22

C3.4 INFORMATION ASSURANCE TECHNICAL LEVEL II 24

C3.5 INFORMATION ASSURANCE TECHNICAL LEVEL III 26

CHAPTER 4 – IA WORKFORCE MANAGEMENT CATEGORY 29

C4.1. INTRODUCTION 29

C4.2 MANAGEMENT CATEGORY DESCRIPTION 29

C4.3 INFORMATION ASSURANCE MANAGEMENT LEVEL I 31

C4.4 INFORMATION ASSURANCE MANAGEMENT LEVEL II 33

C4.5 INFORMATION ASSURANCE MANAGEMENT LEVEL III 35

CHAPTER 5 – DESIGNATED APPROVING AUTHORITY (DAA) REQUIREMENTS 37

C5.1. INTRODUCTION 37

C5.2. DAA FUNCTIONS AND RESPONSIBILITIES 37

C5.3. DAA TRAINING AND CERTIFICATION REQUIREMENT 38

CHAPTER 6 – AUTHORIZED USER MIMINUM IA ORIENTATION AND 40

AWARENESS REQUIREMENTS

4 TABLE OF CONTENTS

C6.1. INTRODUCTION 40

C6.2. GENERAL REQUIREMENTS 40

C6.3. SPECIFIC REQUIREMENTS 41

CHAPTER 7 – IA WORKFORCE IDENTIFICATION, TRACKING, AND 43

ASSIGNMENT

C7.1. INTRODUCTION 43

C7.2. IA WORKFORCE MANAGEMENT 43

C7.3. IA WORKFORCE IDENTIFICATION REQUIREMENTS 44

CHAPTER 8 – IA WORKFORCE MANAGEMENT REPORTING AND METRICS 47

C8.1. INTRODUCTION 47

C8.2. REPORTING REQUIREMENTS 47

CHAPTER 9 – IA WORKFORCE IMPLEMENTATION REQUIREMENTS 53

C9.1. INTRODUCTION 53

C9.2. GENERAL REQUIREMENTS 53

C9.3. SPECIFIC REQUIREMENTS 53

C9.4. IMPLEMENTATION PLAN REPORTING REQUIREMENTS 55

APPENDICES

AP1. Appendix 1, DEFINITIONS 56

AP2. Appendix 2, IA WORKFORCE LEVELS, FUNCTIONS AND 62

CERTIFICATION APPROVAL PROCESS

AP3. Appendix 3, IA WORKFORCE CERTIFICATIONS 63 AP4. Appendix 4, SAMPLE STATEMENT OF ACCEPTANCE OF

RESPONSIBILITIES 65

5 TABLE OF CONTENTS

FIGURES

Figure C2.F1. Overview of IA Workforce Structure 16 Figure C5.F1 Sample DAA Certificate of Completion 39 Figure C8.F1. IA Workforce Annual Report Format 51 Figure C9.F1. IA Workforce Milestone Budget Plan Report 55

TABLES

Table C3.T1. IA Technical Workforce Requirements 21 Table C3.T2. IA Technical Level I Position Requirements 22 Table C3.T3. IA Technical Level I Functional Requirements 22 Table C3.T4. IA Technical Level II Position Requirements 24 Table C3.T5. IA Technical Level II Functional Requirements 24 Table C3.T6. IA Technical Level III Position Requirements 26 Table C3.T7. IA Technical Level III Functional Requirements 27 Table C4.T1. IA Management Workforce Requirements 29 Table C4.T2. IA Management Level I Position Requirements 31 Table C4.T3. IA Management Level I Functional Requirements 32 Table C4.T4. IA Management Level II Position Requirements 33 Table C4.T5. IA Management Level II Functional Requirements 33 Table C4.T6. IA Management Level III Position Requirements 35 Table C4.T7. IA Management Level III Functional Requirements 35 Table C5.T1. DAA Functional Requirements 38 Table AP3.T1. DoD Approved Baseline Certifications 64 Table AP3.T2. IA Workforce Certification Organizations 64

6 REFERENCES

REFERENCES

(a) DoD Directive 8570.1, “Information Assurance Training, Certification, and Workforce Management,” August 15, 2004

(b) DoD Instruction 8500.2, “Information Assurance (IA) Implementation,” February 6, 2003

(c) DoD Directive 8500.1, “Information Assurance (IA),” October 24, 2002

(d) DoD Directive O-8530.1, "Computer Network Defense (CND)," January 8, 2001

(e) DoD 5200.2-R, “Personnel Security Program,” January 1987

(f) DoD Instruction 5200.40, “ DoD Information Technology Security Certification and

Accreditation Process (DITSCAP),” December 30, 1997

(g) Section 2224 of Title 10, US Code, “Defense Information Assurance Program”

(h) Section 278g-3 of Title 15, US Code, (as added by the Computer Security Act of 1987)

(i) Office of Management and Budget Circular A-130, “Management of Federal Information

Resources, Transmittal 4,” November 30, 2000, Appendix 3

(j) DoD Directive 1000.25, “DoD Personnel Identity Protection (PIP) Program,” July 19, 2004

(k) DoD Instruction 7730.64, “Automated Extracts of Manpower and Unit Organizational

Element Files,” December 11, 2004

(l) DoD Instruction 1336.5, “Automated Extracts of Active Duty Military Personnel Records,”

May 2, 2001

(m) DoD Instruction 7730.54, “Reserve Components Common Personnel Data System

(RCCPDS),” August 6, 2004

(n) DoD Instruction 1444.2, “Consolidation of Automated Civilian Personnel Records,”

September 16, 1987

(o) Office of Personnel Management Job Family Position Classification Standard for

Administrative Work in the Information Technology Group, GS-2200; Information Technology Management, GS-2210, May 2001, revised August 2003

(p) Section 3544 of Title 44, US Code (as added by the Federal Information Security Management Act (FISMA) of 2002)

(q) DoD 8910.1-M, “Procedures for Management of Information Requirements”, June 30,

(r) Committee on National Security Systems Instruction No. 4009, “ National Information Security System Glossary,” revised May 2003

(s) Chapter 51 of Title 5 US Code

(t) International Standards Organization/International Electronics Commission (ISO/IEC)

17024 “General Requirements for Bodies Operating Certification of Persons” April 2003

(u) Code of Federal Regulations Title 29 , Volume 4 revised as of July 1 2004 Section 1607

7 ACRONYMS

ACRONYMS

Acronym Meaning AIS Automated Information System ASD(NII)/DoD CIO Assistant Secretary of Defense for Networks and Information

Integration/DoD Chief Information Officer CBT Computer Based Training CE Computing Environment CIO Chief Information Officer CO/XO Commanding Officer/Executive Officer CMIS Corporate Management Information System COOP Continuity of Operations Plan Council ASD(NII)/ DoD CIO and USD P&R Information Assurance Training, Certification, and Workforce Management Oversight Advisory Council COTR Contracting Officer’s Technical Representative DAA Designated Approving Authority DCPDS Defense Civilian Personnel Data System DEERS Defense Eligibility Enrollment Reporting System DIMHRS Defense Integrated Military Human Resources System DISA Defense Information Systems Agency DMDC Defense Manpower Data Center DoD Department of Defense FISMA Federal Information Security Management Act FN Foreign National GIG Global Information Grid IA Information Assurance IAM Information Assurance Manager IAT Information Assurance Technical IAVA Information Assurance Vulnerability Alert INFOCON Information Operations Condition INFOSEC “Security” (The parenthetical title in DCPDS for civilian personnel performing security (IA) functions)

8 ACRONYMS

Acronym Meaning

IASE Information Assurance Support Environnent (DoD IA Portal) IS Information System ISO/IEC International Organization for Standardization

/International Electro-technical Commission IT Information Technology e-JMAPS e-Joint Manpower and Personnel System LN Local National NE Network Environment NIPRNet Non-classified Internet Protocol Router Network OMB Office of Management and Budget OJT On the Job Training OPM Office of Personnel Management PSC Position Specialty Code SIPRNet Secret Internet Protocol Router Network USD(P&R) Under Secretary of Defense for Personnel and Readiness WBT Web-Based Training WO Warrant Officer

9 CHAPTER 1

C1. CHAPTER 1

GENERAL INFORMATION

C1.1. PURPOSE

This Manual:

C1.1.1. Implements DoD Directive 8570.1 (Reference (a)).

C1.1.2. Provides guidance for the identification and categorization of positions and certification of personnel conducting Information Assurance (IA) functions within the DoD workforce supporting the DoD Global Information Grid (GIG) per DoD Instruction 8500.2 (Reference (b)). The DoD IA Workforce includes but is not limited to all individuals performing any of the IA functions described in this Manual. Additional chapters focusing on personnel performing specialized IA functions including system architecture and engineering, computer network defense, certification and accreditation, and vulnerability assessment will be published as changes to this Manual.

C1.1.3. Establishes IA workforce oversight and management reporting requirements to support Reference (a).

C1.1.4. No requirements of this Manual are intended to be inconsistent with applicable law.

C1.2. DEFINITIONS. See Appendix 1.

C1.3. DoD IA WORKFORCE MANAGEMENT OBJECTIVES:

C1.3.1. Develop a DoD IA workforce with a common understanding of the concepts, principles, and applications of IA for each category, level, and function to enhance protection and availability of DoD information, information systems, and networks.

C1.3.2. Establish baseline technical and management IA skills among personnel performing IA functions across the DoD enterprise.

C1.3.3. Provide warfighters qualified IA personnel in each category and level.

C1.3.4. Implement a formal IA workforce skill development and sustainment process, comprised of resident courses, distributive training, blended training, supervised on-the-job training, exercises, and certification/recertification.

C1.3.5. Verify IA workforce knowledge and skills through standard certification testing.

C1.3.6. Augment and expand on a continuous basis the knowledge and skills obtained through experience or formal education.

10 CHAPTER 1

C1.4. RESPONSIBILITIES

In addition to the responsibilities listed in Reference (a) and Section 3544 of Title 44 (Reference (p)), this Manual assigns the following:

C1.4.1. The Assistant Secretary of Defense for Networks and Information Integration/Department of Defense Chief Information Officer (ASD(NII)/DoD CIO) shall:

C1.4.1.1. Coordinate changes and updates to this Manual to maintain state of the art functional and certification requirements for the IA workforce.

C1.4.1.2. Develop, coordinate, and publish baseline certification requirements for personnel performing specialized IA functions.

C1.4.1.3. Coordinate the implementation and sustainment requirements of this Manual to include supporting tools and resources (e.g., conferences, website, database integration, workforce identification).

C1.4.1.4. Establish in coordination with USD(P&R) an Information Assurance Training, Certification, and Workforce Management Oversight Advisory Council (Council) to ensure that the requirements of Reference (a) and this Manual are met. The Council shall:

C1.4.1.4.1. Meet at least annually at the call of the DoD DCIO and include, at a minimum, representatives from the Chairman of the Joint Chiefs of Staff; USD(P&R); USD for Intelligence; USD for Acquisition, Technology, and Logistics (AT&L); the Military Departments and Services; Defense Information Systems Agency (DISA); and the U.S. Strategic Command.

Members must be government employees.

C.1.4.1.4.2. Establish an approval process for IA certifications to be added to or deleted from the Certification Table (AP3.T1). Certifications must have a strong correlation to the IA workforce levels and functions.

C1.4.1.4.3. Review and update the IA levels, functions, and associated certification requirements contained in this Manual.

C1.4.1.4.4. Monitor the DoD IA certification program process improvements.

C1.4.1.4.5. Conduct formal and informal reviews of Component programs and plans to validate/approve compliance with DoD baseline IA workforce management requirements.

Reviews will include the following:

C.1.4.1.4.5.1. Component implementation and sustainment plans for IA workforce identification, training, certification, management, reporting, and documentation requirements as established in this Manual and References (a) and (p).

11 CHAPTER 1

C1.4.1.4.5.2. Component plans and methodologies to track, monitor, and document completion of IA Awareness orientation and training requirements for all network users as established in this Manual and References (a) and (p).

C1.4.1.4.6. Report recommended actions to the ASD(NII) and USD(P&R) based on these reviews or other information available to it (such as FISMA Reporting Information or reports required by this Manual) to improve the program.

C1.4.1.4.7. Conduct assessments to ensure the validity of the IA workforce functions, training, and certification requirements per 29 CFR Volume 4, Section 1607 (Reference (u)).

C1.4.1.4.8. Prioritize enterprise-wide requirements for development of training content to address gaps and deficiencies

C1.4.1.5. Prepare an annual IA workforce training and certification report.

C1.4.1.6. Require the Director of the Defense Information Systems Agency (DISA) to:

C1.4.1.6.1. Provide appropriate representation to the Council.

C1.4.1.6.2. Coordinate with the DIAP, USD(AT&L), and the Components to develop and maintain an online resource correlating DoD IA training products and classes to requirements defined in law, executive order, regulation, policy, or guidelines. Additionally, provide information correlating IA functional requirements (Chapters 3, 4, and 5) to workforce categories and levels to core IA training curriculum.

C1.4.1.7. Require the Defense-wide Information Assurance Program (DIAP) to provide IA workforce management oversight and coordination for the requirements established in this Manual.

C1.4.2. The Under Secretary of Defense for Personnel and Readiness (USD(P&R)) shall support and provide appropriate representation to the Council. The Defense Activity for Non- Traditional Education Support (DANTES) will manage the certification testing process requirement for the Department.

C1.4.3. The Under Secretary of Defense for Intelligence shall provide appropriate representation to the Council to represent the Intelligence community.

C1.4.4. The Heads of the DoD Components shall:

C1.4.4.1. Comply with the responsibilities and requirements of Reference (a) and this Manual.

C1.4.4.2. Provide support for the continuous improvement of the IA workforce management processes and maintenance of requirements. Provide appropriate representation as required to the Council.

12 CHAPTER 1

C1.4.4.3. Provide for initial IA orientation and annual awareness training to all authorized users to ensure they know, understand, and can apply the IA requirements of their system(s) in accordance with Reference (a) (see Chapter 6).

C1.4.4.4. Per Reference (a), identify all positions performing information system management or privileged access IA functions by category and level as described in Chapters 3, 4, and 5 of this Manual. This applies to all positions with IA duties, whether performed as primary or additional/embedded duties (see Chapters 2-5 and 7). This requirement applies to military and civilian positions including those staffed by local nationals (LN), and to contractors if made part of the contract.

C1.4.4.5. Identify all IA function requirements to be performed by contractors in their statement of work/contract.

C1.4.4.6. Train, certify, and obtain the proper security clearance for all personnel identified as part of the IA workforce to accomplish their IA duties (see Chapters 3-5 and Appendices 2 and 3).

C1.4.4.6.1. Include requirements for IA training on all DoD Components and local policy and procedures as part of the IA program.

C1.4.4.6.2. Ensure IA personnel performing IA functions obtain/maintain a certification corresponding to the highest level function(s) required by their position.

C1.4.4.6.3. Nominate, as appropriate, other certifications that correspond to the IA functions established for a particular level. Nominations may include operating system certifications that include the appropriate IA requirements. Provide nominations to the Council.

C1.4.4.6.4. Obtain the appropriate security clearance per Reference (b) prior to granting unsupervised privileged access or management responsibilities to any DoD system.

C1.4.4.7. Identify, track, and monitor IA personnel performing IA functions (as described in Chapters 3, 4, and 5) to ensure that IA positions are staffed with trained and certified personnel (see Chapter 7).

C1.4.4.8. Collect metrics and submit reports to the ASD(NII)/DoD CIO to support planning and analysis of the IA workforce and annual FISMA reporting per Reference (p) (see Chapter 8).

C1.4.4.9. Establish, resource, and implement plans, policies, and processes to meet the requirements of Reference (a) and this Manual (see Chapter 9).

C1.4.4.10. Identify all GS-2210 positions/personnel using the Office of Personnel Management specified parenthetical titles per OPM Job Classification Standard (Reference (o)).

Enter the appropriate parenthetical title for both primary and/or additional duty responsibilities in

13 CHAPTER 1

DCPDS or equivalent civilian personnel database. This is required for all DoD personnel even if the individual performs more than two 2210 specialties.

C1.4.4.11. Enter “INFOSEC” as the “Position Specialty Code” into DCPDS per Reference (a) for all positions/personnel performing IA functions described in Chapters 3, 4, and 5 as primary, additional, or embedded duty and their category and level.

C1.4.4.12. Ensure that all DoD contracts requiring performance of IA functions (specified in Chapters 3 and 4) include the requirement to report contractor personnel’s IA certification status and compliance with this Manual. Contractors also must meet the security clearance requirements of Reference (b).

C1.4.4.13. Ensure personnel performing IA functions on national security systems meet the Committee on National Security Systems training requirements. This is in addition to the requirements of this Manual.

C1.4.4.14. Include appropriate IA content in officer accession programs; Flag, Commanding/Executive Officer (CO/XO), and Warrant Officer (WO) indoctrination; and Component professional military education. The training is intended to develop leadership understanding of the critical importance of information assurance to the successful execution of DoD’s mission at all levels of the Department of Defense.

14 CHAPTER 2

C2. CHAPTER 2

IA WORKFORCE STRUCTURE OVERVIEW

C2.1. INTRODUCTION

C2.1.1. IA functions focus on the development, operation, management, and enforcement of security capabilities for systems and networks. Personnel performing IA functions establish IA policies and implement security measures and procedures for the Department of Defense and affiliated information systems and networks.

C2.1.2. IA measures protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. This includes providing for their restoration by incorporating protection, detection, and reaction capabilities.

C2.1.3. IA duties may be performed as primary or additional/embedded duties, by a DoD employee (civilian, including LNs, or military) or by a support contractor(including LNs).

C2.1.4. As a condition of privileged access to any information system, PERSONNEL PERFORMING IA FUNCTIONS described in this Manual must satisfy both preparatory and sustaining DoD IA training and certification requirements (see Chapters 3-5). Additionally, personnel with Privileged Access must complete a “Privileged Access Agreement”, a sample of which is shown in Appendix 4, Components may expand the requirements of this agreement to meet their needs.

C2.1.5. The certification requirements of this Manual apply to DoD civilian employees, military personnel, local nationals, and support contractors performing the IA functions below and described in detail in Chapters 3-5.

C2.1.6. Personnel performing IA duties addressed by this policy include the following IA oversight responsibilities:

C2.1.6.1. Work closely with data owners, information system owners, and users to ensure secure use and operation of IS and networks.

C2.1.6.2. Ensure rigorous application of IA policies, principles, and practices in the delivery of all information technology (IT) services.

C2.1.6.3. Maintain system audit functions and periodically review audit information for detection of system abuses.

C2.1.6.4. Identify IA requirements as part of the IT acquisition development process.

C2.1.6.5. Assess and implement identified corrections (e.g., system patches and fixes) associated with technical vulnerabilities as part of the Information Assurance Vulnerability Management program, consistent with References (a) and (b), DoD Directive 8500.1 (Reference (c)), and DoD Directive O-8530.1 (Reference (d)).

15 CHAPTER 2

C2.1.6.6. Maintain configuration control of hardware, systems, and application software.

C2.1.6.7. Identify and properly react to security anomalies or integrity loopholes such as system weaknesses or vulnerabilities.

C2.1.6.8. Install and administer user identification or authentication mechanisms.

C2.1.7. The IA workforce training and certification program establishes a baseline of validated (tested) knowledge that is relevant, recognized, and accepted across the Department of Defense.

C2.2. IA WORKFORCE CATEGORIES AND LEVELS

C2.2.1. This Manual identifies two overall categories within the IA workforce: Technical and Management. These categories are subdivided into three levels each based on functional skill requirements and system environment focus (see Chapters 3, 4, and 5).

C2.2.2. The levels and functional requirements in both the technical and the management categories apply to civilian, military, and contractor personnel (including those LNs specifically authorized to perform IA functions per Reference (b).

C2.2.3. The levels and functions provide the basis to determine all IA technical and management staffing requirements. They also provide a framework for the identification of IA technical and management positions and qualified personnel (or those who can become qualified) across the Department of Defense.

C2.2.4. Each DoD position responsible for IA functional requirement(s) must be correlated with a category and level. Assigning position levels based on functions across the Department of Defense establishes a common framework for identifying the IA workforce.

C2.2.5. A position may include functional requirements spanning multiple levels. In these cases, the level, and related certification requirements will be those of the highest level functions.

Individuals performing both IAT and IAM category functions must hold certifications appropriate to the functions performed in each category.

C2.2.6. IA workforce categories and levels do not necessarily correlate to civilian grades, military ranks, or any specific occupational classification standard.

C2.2.7. Figure C2.F1., below, provides an overview of the IA workforce structure.

16 CHAPTER 2

Figure C2.F1. Overview of IA Workforce Structure

C2.3. TRAINING AND CERTIFICATION PROGRAMS

C2.3.1. IA certification programs are intended to produce IA personnel with the demonstrated ability to perform the functions of their assigned position. Each category and skill level has specific training and certification requirements. Meeting these requirements will require a combination of formal training, experiential activities such as on-the-job training, and continuing education. These training and certification requirements must be provided by the Department of Defense at no cost to government employees (military or civilian).

C2.3.2. The DoD Components must use certifications approved (and published as part of this Manual) by the office of the ASD(NII)/DoD CIO as the minimum certification requirement.

C2.3.3. Approved certifications will demonstrate close correlation to the IA categories, levels, and functions described in Chapters 3-5 and demonstrate portability throughout the Department of Defense, Federal government, and private sector.

C2.3.4. Individuals in IA positions, as defined in Chapters 3-5, not meeting certification requirements must be reassigned to other duties, consistent with applicable law. Those individuals in IA positions not meeting certification requirements may perform those duties under the direct supervision of an appropriately certified individual until certification is attained unless waived due to severe operational or personnel constraints (see paragraphs C3.2.4.2., C3.2.4.3., C.4.2.3.2.1., or C4.2.3.4.2.).

C2.3.5. Appendix 2 establishes the IA workforce certification requirement and criteria for assigned responsibilities. It also includes a requirement for the periodic review of DoD categories, functions, levels, and the approval of their associated certifications.

Network & Advanced Computer

Computing

Enclave/ Advanced Network & Computer

Enclave (Level III)

Network Level II

Computing Environment (Level I)

Network

Computing Environment

Enclave

DAA

C ertification

Functional Levels

IAT Category IAM Category

Professional IA Workforce

17 CHAPTER 2

C2.3.6. Appendix 3 provides a matrix of certifications and the categories/levels to which they apply. IA workforce members must obtain the certification corresponding to their IA functions as defined in Chapters 3, 4, and 5 and Appendix 3.

C2.3.7. Certification holders must ensure that their certificates stay active. Expired certifications must be renewed. Expired certifications are not to be considered in the workforce reports.

C2.3.8. To support IA professionals the DoD IA Portal (formerly known as the IA Support Environment (IASE)) provides DoD IA policy, training requirements, and DoD-sponsored training. The IA Portal is located at http://iase.disa.mil/.

C2.3.9. Contractor personnel supporting IA functions in Chapters 3 and 4 shall be appropriately certified prior to being engaged. The contracting officer will ensure that contracting personnel are appropriately certified and provide verification to the Defense Eligibility Enrollment System (DEERS). Additional training on local or system procedures may be provided by the DoD organization receiving services.

C2.3.10. Organizations employing LNs should coordinate in advance with appropriate offices such as the Status of Forces Agreement, the Local or Country Human Resources section of OPM, local unions, and/or training. Effective coordination will greatly enhance the capability to achieve the requirements of this Manual.

C2.3.11. Personnel IA certification status and renewal rates are management review items per Reference (b).

18 CHAPTER 3

C3. CHAPTER 3

IA WORKFORCE TECHNICAL CATEGORY

C3.1. INTRODUCTION

C3.1.1. This chapter provides detailed position guidelines and IA functions for each level within the Technical category.

C3.1.2. The functions associated with each of these levels are intended to be baseline DoD requirements. The DoD Components are expected to have additional requirements reflecting their operating policy and information system technical environment. The requirements of this Manual do not exempt individuals from meeting their own organization’s standards and requirements.

C3.2. TECHNICAL CATEGORY DESCRIPTION

C3.2.1. This category comprises IA Technical (IAT) Levels I, II, and III.

C3.2.2. Personnel required to perform any technical category IA functions (one or more functions) at any level must be certified to the highest level function(s) performed. An IAT position’s functional requirement(s) for a particular level establish the basis for the individual’s certification requirement.

C3.2.2.1. The IAT category’s functional requirements are cumulative. Thus, an IAT Level II or III position requires mastery of the functional requirements of the preceding levels.

C3.2.3. IAT Category Training Requirements:

C3.2.3.1. Participation in initial training (classroom, distributive, or blended) before, or immediately on, assignment of IA responsibilities. Training need not result in award of a military specialty code (e.g., Military Occupational Specialty, Navy Enlisted Classification Code, and/or Air Force Specialty Code), but must be sufficient to meet minimum certification standards outlined here and in Appendices 2 and 3.

C3.2.3.2. Completion of an on-the-job skills practical evaluation to meet functional requirements listed in this chapter.

C3.2.3.3. Completion of sustainment training/continuing education as required to maintain certification status. For planning purposes the standard is normally a minimum of 20 to 40 hours annually, or 120 hours over three years.

C3.2.4. IAT Category Certification Requirements:

19 CHAPTER 3

C3.2.4.1. The certification program for IAT category positions must include the functions identified for that level. All IAT category personnel, whether they perform IA functions as primary or additional/embedded duty, must be certified based on the IA functions of the position.

C3.2.4.1.1. Within six months of assignment of IA duties, all IAT personnel must achieve the appropriate IA certification unless a waiver is granted per paragraphs C3.2.4.2 or C3.2.4.3. below.

C3.2.4.1.1.1. Individuals performing IA functions and who are DoD employees or contractors on the effective date of this Manual have up to four years to comply with the certification requirements, based on Component plans to meet the implementation milestones established in Chapter 9.

C3.2.4.1.1.2. New hires’ qualification periods begin the date they start in the position (i.e., they must obtain the appropriate certification within six months of being assigned IA functions).

C3.2.4.1.2. IAT Level I certification is mandatory prior to IA Managers authorizing unsupervised privileged access for personnel performing IAT Levels I through III functions described in this Chapter.

C3.2.4.2. Designated Approving Authorities (DAAs) may waive the certification requirement under severe operational or personnel constraints. The waiver will be documented by the DAA using a memorandum for the record stating the reason for the waiver and the plan to rectify the constraint. Waivers will not extend beyond six months, must include an expiration date, and be documented in the individual IA training record. Consecutive waivers for personnel are not authorized except as noted in paragraph C3.2.4.3. Waivers must be a management review item per Reference (b). Uncertified IAT Level Is are not authorized to have unsupervised privileged access.

C3.2.4.3. IAT category personnel must be fully trained and certified prior to deployment to a combat environment. The DAA may approve a waiver for certified IAT-Is to fill level IAT- II or IAT-III billets without attaining the appropriate certification while deployed to a combat environment. The DAA may grant an interim waiver limited to the period of the deployment.

The interim waiver places an individual in a suspense status and must be time limited and include an expiration date not to exceed six months following date of return from combat status.

C3.2.4.4. Personnel in technical category positions must be issued and retain an appointing letter to their IA duties including a statement of responsibilities for the system.

Appendix 4 provides a sample statement of acceptance of responsibilities. Components will appropriately edit this form and maintain a completed copy in the individual’s personnel record or with the COTR for contractors.

C3.2.4.5. Personnel in technical category positions must maintain certifications, as required by the certifying provider, to retain privileged system access. Level 1 certification is required prior to being authorized unsupervised privileged access.

20 CHAPTER 3

C3.2.4.6. Personnel who are not appropriately certified within six months of assignment to a position or who fail to maintain their certification status must not be permitted privileged access. The DoD Components will develop programs to address remedial training and conditions for individuals to attain or return to certified status.

C3.2.4.7. The DoD Components must document and maintain the certification status of their IAT category personnel as long as they are assigned to those duties. Identification and tracking requirements are addressed in Chapter 7.

C3.2.4.8. To support the GIG infrastructure security requirements, certification standards apply equally to DoD civilian, military, and contractor personnel including those staffed by LN (with conditional privileged access per Reference (b)).

C3.2.4.8.1. New contract language must specify certification requirements. Existing contracts must be modified, at an appropriate time during the phased implementation, to specify certification requirements

C3.2.4.8.2. Per References (b) and (d) and DoD 5200.2-R (Reference (e)), LNs and FNs must comply with background investigation requirements and cannot be assigned to IAT Level III positions.

C3.2.4.8.3. In addition to the baseline IA certification requirement for their level, IATs with privileged access MUST OBTAIN APPROPRIATE COMPUTING ENVIRONMENT (CE) CERTIFICATIONS for the operating system(s) they support as required by their employing organization. This requirement ensures they can effectively apply IA requirements to their hardware and software systems.

C3.2.4.8.4. New hire civilians and contractor personnel must agree as a “condition of employment” that they will obtain the appropriate certification for the position to be filled.

C3.2.4.8.5. All personnel must agree to release their certification qualification(s) to the Department of Defense.

C3.2.4.9. Technical category training requirements are summarized in Table C3.T1.

21 CHAPTER 3

Table C3.T1. IAT Workforce Requirements

Civilian, Military, Contractor* (Including Civilian or Contractor LNs)

IAT Level

I - III

(FN and LN Levels I & II only)

Initial Training ** Yes

IA Certification (from approved list)

Yes (within six months)

Initial On the Job Practical Evaluation

Yes (for initial position)

Computing Environment (CE) Certification Yes

Maintain Certification Status Yes

(as required by certification)

Continuous Education or Sustainment Training

Yes (as required by certification

(e.g., ISC 2 requires 120 hours within 3 years))

Background Investigation As required by IA level and Reference (b)

Sign Privileged Access Statement Yes

*Contractor category, level, and certification requirements to be specified in the contract **Classroom, distributive, blended, government, or commercial provider

22 CHAPTER 3

C3.3. IAT LEVEL I

C3.3.1. IAT Level I personnel make the CE less vulnerable by correcting flaws and implementing IAT controls in the hardware or software installed within their operational systems. IAT Level I position requirements are listed in Table C3.T2.

Table C3.T2. IAT Level I Position Requirements

IAT Level I Attribute Level

Experience Normally has zero to four years of experience in IA technology or a related field.

System Environment CE.

Knowledge Applies basic knowledge of IA concepts, practices, and procedures within the CE.

Supervision Works under supervision and typically reports to a CE manager.

Other Actions are usually authorized and controlled by policies and established procedures.

IA Certification & Operating System Certification

Within six months of assignment to position and mandatory for unsupervised privileged access.

C3.3.2. Table C3.T3. lists the specific functional requirements associated with the IAT Level I position. Personnel performing these functions, regardless of their occupational title (e.g., system administrator, help desk technician, information system technician, mechanic, infantry, logistics, aviation mechanic, etc,) shall be identified as part of the IA workforce and must comply with the requirements in the table above and C3.T1.

Table C3.T3. IAT Level I Functional Requirements

T-I.1. Recognize a potential security violation, take appropriate action to report the incident as required by regulation, and mitigate any adverse impact.

T-I.2. Apply instructions and pre-established guidelines to perform IA tasks within CE.

T-I.3. Provide end user IA support for all CE operating systems, peripherals, and applications.

T-I.4. Support, monitor, test, and troubleshoot hardware and software IA problems pertaining to their CE.

T-I.5. Apply CE specific IA program requirements to identify areas of weakness.

T-I.6. Apply appropriate CE access controls.

23 CHAPTER 3

T-I.7. Install and operate the IT systems in a test configuration manner that does not alter the program code or compromise security safeguards.

T-I.8. Conduct tests of IA safeguards in accordance with established test plans and procedures.

T-I.9. Implement and monitor IA safeguards for CE system(s) in accordance with implementation plans and standard operating procedures.

T-I.10. Apply established IA security procedures and safeguards and comply with responsibilities of assignment.

T-I.11. Comply with system termination procedures and incident reporting requirements related to potential CE security incidents or actual breaches.

T-I.12. Implement online warnings to inform users of access rules for CE systems.

T-I.13. Implement applicable patches including information assurance vulnerability alerts (IAVA), information assurance vulnerability bulletins, and technical advisories for the CE operating system(s).

T-I.14. Understand and implement technical vulnerability corrections.

T-I.15. Enter assets in a vulnerability management system.

T-I.16. Apply system security laws and regulations relevant to the CE being supported.

T-I.17. Implement DoD and component password policy.

T-I.18. Implement specific IA security countermeasures.

T-I.19. Obtain and maintain IA certification appropriate to position.

24 CHAPTER 3

C3.4. IAT LEVEL II

C3.4.1. IAT Level II personnel provide network environment (NE) and advanced level CE support. They pay special attention to intrusion detection, finding and fixing unprotected vulnerabilities, and ensuring that remote access points are well secured. These positions focus on threats and vulnerabilities and improve the security of systems. IAT Level II personnel have mastery of the functional requirements of the IAT Level I position. IAT Level II position requirements are listed in Table C3.T4.

Table C3.T4. IAT Level II Position Requirements

IAT Level II Attribute Level

Experience Normally has three to seven years in IA technology or a related area.

System Environment NE and advanced CE.

Knowledge • Mastery of the functional requirements of the

IAT Level I position.

• Applies knowledge and experience with standard IA concepts, practices and procedures within the network environment.

Supervision Works under general supervision and typically reports to network manager.

Other Relies on experience and judgment to plan and accomplish goals within the NE.

IA Certification & Operating System Certification

Within six months of assignment to position.

C3.4.2. Table C3.T5. lists the specific functional requirements associated with the IAT Level II position. Personnel performing these functions, regardless of their occupational title (e.g., system administrator, help desk technician, information system technician, mechanic, infantry, logistics coordinator) shall be identified as part of the IA workforce and must comply with the requirements in the table above and C3.T1.

Table C3.T5. IAT Level II Functional Requirements

T-II.1. Demonstrate expertise in IAT Level I CE knowledge and skills.

T-II.2. Examine potential security violations to determine if the NE policy has been breached, assess the impact, and preserve evidence.

25 CHAPTER 3

T-II.3. Support, monitor, test, and troubleshoot hardware and software IA problems pertaining to the NE.

T-II.4. Recommend and schedule IA related repairs in the NE.

T-II.5. Perform IA related customer support functions including installation, configuration, troubleshooting, customer assistance, and/or training, in response to customer requirements for the NE.

T-II.6. Provide end user support for all IA-related applications for the NE.

T-II.7. Analyze patterns of noncompliance and take appropriate administrative or programmatic actions to minimize security risks and insider threats.

T-II.8. Manage accounts, network rights, and access to NE systems and equipment.

T-II.9. Analyze system performance for potential security problems.

T-II.10. Assess the performance of IA security controls within the NE.

T-II.11. Identify IA vulnerabilities resulting from a departure from the implementation plan or that were not apparent during testing.

T-II.12. Provide leadership and direction to IA operations personnel.

T-II.13. Configure, optimize, and test network servers, hubs, routers, and switches to ensure they comply with security policy, procedures, and technical requirements.

T-II.14. Install, test, maintain, and upgrade network operating systems software and hardware to comply with IA requirements.

T-II.15. Evaluate potential IA security risks and take appropriate corrective and recovery action.

T-II.16. Ensure that hardware, software, data, and facility resources are archived, sanitized, or disposed of in a manner consistent with system security plans and requirements.

T-II.17. Diagnose and resolve IA problems in response to customer reported incidents.

T-II.18. Research, evaluate, and provide feedback on problematic IA trends and patterns in customer support requirements.

T-II.19. Ensure IAT Level I personnel are properly trained and have met OJT program requirements.

T-II.20. Perform system audits to assess security related factors within the NE.

T-II.21. Develop and implement access control lists on routers, firewalls, and other network devices.

T-II.22. Install perimeter defense systems including intrusion detection systems, firewalls, grid sensors, etc., and enhance rule sets to block sources of malicious traffic.

T-II.23. Work with other privileged users to jointly solve IA problems.

T-II.24. Write and maintain scripts for the NE.

T-II.25. Demonstrate proficiency in applying security requirements to an operating system for the NE or CE used in their current position.

T-II.26. Implement applicable patches including IAVAs, IAVBs, and TAs for their NE.

26 CHAPTER 3

T-II.27. Adhere to IS security laws and regulations to support functional operations for the NE.

T-II.28. Implement response actions in reaction to security incidents.

T-II.29. Support the design and execution of exercise scenarios.

T-II.30. Support Security Test & Evaluations (Part of Certification and Accreditation Process).

T-II.31. Obtain and maintain IA certification appropriate to position.

C3.5. IAT LEVEL III

C3.5.1. IAT Level III personnel focus on the enclave environment and support, monitor, test, and troubleshoot hardware and software IA problems pertaining to the CE, NE, and enclave environments. IAT Level III personnel have mastery of the functional requirements of both the IAT Level I and Level II positions. IAT Level III position requirements are listed in Table C3.T6.

Table C3.T6. IAT Level III Position Requirements

IAT Level III Attribute Level

Experience Normally has at least seven years in IA technology or a related area.

System Environment Enclave Environment, advanced NE, and advanced CE.

Knowledge • Expert in all functional requirements of both IAT Level I and IAT Level II positions.

• Applies extensive knowledge of a variety of the IA field’s concepts, practices, and procedures to ensure the secure integration and operation of all enclave systems.

Supervision • Works independently to solve problems quickly and completely.

• May lead and direct the work of others.

• Typically reports to an enclave manager.

Other • Relies on extensive experience and judgment to plan and accomplish goals for the enclave environment.

• Supports, monitors, tests, and trouble shoots hardware and software IA problems pertaining to the enclave environment.

• Must be a U.S. Citizen.

IA Certification & Operating System Certification

Within six months of assignment to position.

27 CHAPTER 3

C3.5.2. Table C3.T7. lists the specific functional requirements associated with the IAT Level III position. Personnel performing these functions, regardless of their occupational title (e.g., system administrator, help desk technician, information system technician, aviation mechanic, infantry, logistics coordinator) shall be identified as part of the IA workforce and must comply with the requirements in the table above and C3.T1.

Table C3.T7. IAT Level III Functional Requirements

T-III.1. Mastery of IAT Level I and IAT Level II CE/NE knowledge and skills.

T-III.2. Recommend and schedule IA related repairs within the enclave environment.

T-III.3. Coordinate and ensure end user support for all enclave applications and operations.

T-III.4. Lead teams to quickly and completely solve IA problems for the enclave environment.

T-III.5. Formulate or provide input to the enclave's IA/IT budget.

T-III.6. Plan and schedule the installation of new or modified hardware, operating systems, and software applications ensuring integration with IA security requirements for the enclave.

T-III.7. Determine whether a security incident is indicative of a violation of law that requires specific legal action.

T-III.8. Direct the implementation of appropriate operational structures and processes to ensure an effective enclave IA security program including boundary defense, incident detection and response, and key management.

T-III.9. Provide direction to system developers regarding correction of security problems identified during testing.

T-III.10. Evaluate functional operation and performance in light of test results and make recommendations regarding certification and accreditation.

T-III.11. Examine enclave vulnerabilities and determine actions to mitigate them.

T-III.12. Monitor and evaluate the effectiveness of enclave IA security procedures and safeguards.

T-III.13. Analyze IA security incidents and patterns to determine remedial actions to correct vulnerabilities.

T-III.14. Develop the enclave termination plan to ensure that IA security incidents are avoided during shutdown and long-term protection of archived resources is achieved.

T-III.15. Develop and apply effective vulnerability countermeasures for the enclave.

T-III.16. Develop and manage IA customer service performance requirements.

T-III.17. Develop IA-related customer support policies, procedures, and standards.

T-III.18. Write and maintain scripts required to ensure security of the enclave environment.

28 CHAPTER 3

T-III.19. Design perimeter defense systems including intrusion detection systems, firewalls, grid sensors, etc.; enhance rule sets to block sources of malicious traffic; and establish a protective net of layered filters to prevent, detect, and eradicate viruses.

T-III.20. Schedule and perform regular and special backups on all enclave systems.

T-III.21. Establish enclave logging procedures to include important enclave events,, services and proxies,, log archiving facility.

T-III.22. Provide OJT for IAT Level I & II DoD personnel.

T-III.23. Analyze IAVAs and Information Assurance Vulnerability Bulletins for enclave impact and take or recommend appropriate action.

T-III.24. Obtain and maintain IA certification appropriate to position.

29 CHAPTER 4

C4. CHAPTER 4

IA WORKFORCE MANAGEMENT CATEGORY

C4.1. INTRODUCTION

C4.1.1. This chapter provides detailed position guidelines and IA functions for each level within the Management category.

C4.1.2. The functions associated with each of these levels are intended to be baseline DoD requirements. The DoD Components are expected to have additional requirements reflecting their operating policy and information system technical environment. The requirements of this Manual do not exempt individuals from meeting their own organization’s standards and requirements.

C4.2. MANAGEMENT CATEGORY DESCRIPTION

C4.2.1. This Category comprises IA Management (IAM) Levels I, II, and III, as well as the DAA function covered in Chapter 5.

C4.2.2. The levels and functional requirements in the management category are not necessarily cumulative. Table C4.T1. provides IAM category requirements.

Table C4.T1. IAM Workforce Requirements

Civilian, Military, or Contractor* (Including LNs )

IAM Level I - III (FN/LN Levels I & II** only)

Initial Training *** Yes IA Certification (from approved list)

Yes (within six months)

OJT Evaluation No

CE Certification No

Maintain Certification Status Yes (as required by certification)

Sustainment Training

Yes (as required by certification

(e.g., ISC 2 requires 120 hours within three years))

Background Investigation As required by IA level and Reference (b)

* Requirements to be stated in contract.

** FN/LN IAM Level II must meet conditions of References (b), (d), and (e).

***…