J.6 NSWCPCDINST 2280.4D .pdf

NSWCPCDINST 2280.4D

22 May 2020

NSWC PCD INSTRUCTION 2280.4D

From: Commanding Officer, Naval Surface Warfare Center, Panama City Division

Subj: POLICY AND PROCEDURES FOR COMMUNICATIONS SECURITY/KEY

MANAGEMENT INFRASTRUCTURE MATERIALS

Ref: (a) NCMS CMS-1 (series)

(b) NCMS CMS-3 (series)

(c) SECNAV M-5510.36 (series)

(d) DODM 5200.01-V3, DOD Information Security Program: Protection of Classified

Information

(e) National Policy CNSS Instruction 4003: Reporting and Evaluating Communication

Security (COMSEC) Incidents

Encl: (1) Retention Periods for COMSEC Files, Records, and Logs

1. Purpose. To establish policies for accounting, disposing of, handling, issuing, and safeguarding of Communications Security (COMSEC) material. This instruction serves as a ready-reference for supervisors and managers involved in the management, use, accounting and disposition of COMSEC material at Naval Surface Warfare Center, Panama City Division

(NSWC PCD).

2. Cancellation. NSWCPCDINST 2280.4C.

3. Discussion. The Key Management Infrastructure (KMI) system is the replacement for the

Electronic Key Management System (EKMS). The KMI is fully operational and is comprised of nodes that provide the means to deliver cryptographic products, key management products, and services to a large and diverse community of globally distributed users. The KMI makes use of additional and faster communications media to deliver the required products to the COMSEC community. KMI will support web-based ordering, benign fill techniques, and delivery of keying material to KMI-aware End Cryptographic Units (ECUs) through Over the Network Key

(OTNK) delivery. Reference (a) prescribes the minimum policies and procedures for managing

COMSEC material, and the application of cryptographic and physical security. References (b) and (c) establish policies and procedures for classifying, safeguarding, transmitting, and destroying classified information.

4. Action. CMS-1 supersedes EKMS-1E, EKMS-1E Supp-1, and EKMS-5E with AMD-1 dated Aug 2017. Military, government civilian, and contractor personnel with any aspect of responsibility for COMSEC material, are responsible for compliance with this instruction.

5. Responsibilities and Authority

a. Commanding Officer (CO). The NSWC PCD CO is ultimately responsible for the proper management and security of all COMSEC material. Active interest and involvement in the management of the COMSEC account is paramount and has proven to be the single most effective factor in the reduction and prevention of major insecurities as outlined in reference (a).

b. COMSEC Account Manager (CAM). The CO appoints the CAM, in writing. The CAM is the CO’s primary advisor on matters concerning the proper security and management of

COMSEC material and associated records and reports, and is designated in writing by the CO.

The CAM must meet the designation requirements outlined in reference (a), and must strictly enforce policies and procedures.

c. Alternate CAM. Alternate CAMs have the same duties and responsibilities as the CAM and are equally responsible to the CO for the proper management and security of COMSEC material held by the Command. Alternate CAMs must be involved in the daily operation of the account and administratively operate the account in the CAM's absence.

d. Middle Management/Chain of Command. The management and security of COMSEC materials are inherent responsibilities at all levels of command. Proper evaluation of administrative procedures can be made only if all individuals in the chain of command are knowledgeable of, and support compliance with, established procedures and requirements.

e. COMSEC User Oversight Program. Allows each branch and division head to receive and review amplified reports, which shall be used to evaluate the performance objectives within their COMSEC program. These reports allow each department to take corrective measures and to remediate reoccurring deficiencies.

f. COMSEC Clerk. The COMSEC Clerks receives training from the CAM in the physical security and administrative responsibilities associated with COMSEC material. COMSEC

Clerks perform routine administrative duties and are authorized to sign COMSEC reports as witnesses, but are not authorized access to security containers that store COMSEC keying material.

g. Local Element (LE). LE personnel are appointed, designated, and responsible to the current CO for the proper management and security of COMSEC material, related files, and records held by the command. LEs are responsible to the parent account (or the LE issuing) for the proper accountability, security, control, and disposition of COMSEC material issued to them.

(1) LE personnel shall immediately report any known or suspected insecure practice or

COMSEC incident to the CAM.

(2) LE personnel shall report any potentially significant changes in life-style, financial status, or disciplinary problems involving personnel authorized access to COMSEC material to the Activity Security Manager.

(3) The Primary and Alternate LE representatives are responsible to the CO and CAM for:

(a) Submitting updated appointment letters that identify those who are assigned to the

LE, to their Department Security Coordinator (DSC) to verify clearance eligibility for individuals identified on the appointment letter, before the CO’s review and signature.

(b) Conducting monthly training, and provide notice of completion to the supporting

CAM.

(c) Ensuring all personnel whose duties require them to use COMSEC materials are properly cleared, trained, and formally authorized access to COMSEC material; and requiring personnel who are issued or have access to keying material to complete a Secretary of Defense

(SD) Form 572 as required by CMS-1.

(d) Following written instructions issued by CAM and reference (a) for governing the handling, accountability, and disposition of COMSEC material.

(e) Responding to spot checks and COMSEC inspections official documentation, providing corrective actions taken within 30 days.

(f) Effectively managing Modern Keys issued through the use of the Modern Key

Tracking Tool or locally created tool. Destruction of modern key will be documented on a

Standard Form (SF) 153, COMSEC Material Report.

(g) Conducting monthly training to ensure that all personnel handling COMSEC material are familiar with and adhere to proper COMSEC procedures. Emphasis shall be placed on accountability, security, two-person integrity (TPI) requirements, and identification of improper practices. Fill device applications and end unit interface training is the responsibility of the LE program of record. Document training locally by command directives.

(h) Informing the CAM if there is a change of personnel within the LE, including changes to clearance eligibility.

(i) Ensuring proper and timely inventory and destruction of COMSEC material issued to the LE, using LE personnel.

(j) Receipting for issued COMSEC material. For inventory accountability, primary liaisons will be the only LE personnel authorized to obtain COMSEC material from the CAM.

(k) Participating in announced and unannounced spot-checks and inventories conducted by the CAM.

g. COMSEC Witness. The COMSEC witness may be a government employee or contractor. The witness must have a security clearance equal to or higher than the COMSEC material involved. A COMSEC witness must be authorized access to keying material in writing by the CO. An individual who witnesses an inventory, destruction, or any other COMSEC report is equally responsible for ensuring the accuracy of the information listed, the validity of the report or record used to document the transaction being witnessed, and responsible for:

(1) Sighting all material inventoried or to be destroyed when witnessing an inventory or destruction of COMSEC material and adhering to TPI requirements.

(2) Verifying the accuracy and completeness of the destruction document.

(3) Reading the short title(s), edition, register/serial number, and the segment number to the individual responsible for destruction who then verifies the accuracy and completeness of the entries on the SF 153.

6. Account Assessment

a. Spot Checks. Per reference (a) (Chapter 4, excerpt 407), the CO shall conduct a minimum of one spot check per quarter of the COMSEC Vault and work center where COMSEC material is used and stored. The CO may delegate no more than two of the four quarterly spot checks to the Executive Officer.

b. Self-Assessments. Self-assessments provide the means to self-identify COMSEC incidents, practices dangerous to security (PDS), or other areas in need of improvement. CAMs are required to conduct quarterly self-assessments using a minimum of one section from Annex

A to CMS-3. A different section will be used each quarter to ensure each section of Annex A is completed over a one year period.

c. LE Spot Checks. CAMs shall perform at least one monthly Spot Check for a selected

LE.

7. Access and Release Requirements for COMSEC Material

a. Security Clearance. Access to classified material requires a security clearance equal to or higher than the classification of the material to be accessed, as well as need-to-know. Should an individual’s security clearance be suspended or revoked, the access to COMSEC equipment must be removed.

(1) Security clearances will be verified through the LE organization, DSC, or by the

CAM.

(2) Personnel under contract must provide copies of the applicable DD Form 254, DoD

Contract Security Classification Specification, reflecting the requirement for access to COMSEC material. COMSEC material will not be entrusted to an individual until clearance and need-to-know have been verified by the CAM.

b. Requirement for Access or Need-to-Know. Access to classified and unclassified

COMSEC material must be restricted to properly cleared individuals with a valid need-to-know whose official duties require access to COMSEC material. The fact that an individual has a security clearance, and/or holds a certain rank or position, does not necessarily entitle an individual access to COMSEC material.

c. Briefing/Indoctrination. Personnel granted access to COMSEC material must be properly indoctrinated regarding the sensitivity of the COMSEC material; the requirements for safeguarding such material; the laws on espionage; the procedures for reporting COMSEC incidents; and the rules on foreign contacts, visits, and travel. The CAM shall conduct indoctrinations of LE personnel.

d. Written Access to COMSEC Keying Material. Personnel with access to cryptographic information (keying material, book packaged material marked/designated crypto, or equipment which permits extraction of key (Simple Key Loader (SKL), Tactical key loader (TKL), Advance Key Processor (AKP) must enroll in the Department of Defense Cryptographic Access

Program (CAP) and be authorized in writing by the current CO or “Acting CO”.

e. Standard Operating Procedures (SOPs). Each facility or work center shall have a written

COMSEC SOP. Ensure the SOP contains provisions for securely conducting facility operations and for safeguarding COMSEC material. Include specific procedures for handling, controlling, and protecting COMSEC assets, including receiving, inventory (both daily and semiannual), issuing, destruction, training, PDS, annual COMSEC inspections, etc. Also, include procedures for processing COMSEC material, restricting access, authorizing storage, accounting, issuing and disseminating urgent COMSEC information to user agencies, the responsibility of the DSC, security checks, two-person integrity (TPI) (if applicable), routine destruction, and emergency destruction. Additionally, each facility shall have an Emergency Protection Plan. The procedures and instructions in the SOP are unique to the COMSEC account and local element activity.

(1) LEs are responsible for producing designation or appointment letters for access to

COMSEC key material and equipment or spaces. Individuals with unescorted access to a

COMSEC space must be listed on an access list. The CO reviews, grants access, and appoints

LEs to perform their COMSEC functions.

(2) Access lists used for granting access to cryptographic information will be updated whenever there is a change (e.g., individual no longer is authorized or no longer requires access

(transfer, separation, retirement, reassignment), upon Change of Command, or annually).

8. Requirements for Obtaining COMSEC LE Status. The requirements listed below must be met before being granted access to COMSEC material. Direct questions concerning the below requirements to the CAM. Each LE will provide a written request for COMSEC support to the

CAM. Include the following in the NSWC PCD KMI Key Request Form:

a. Provide the name of your LE Group, date, and annotate the support requirement.

b. COMSEC Key Order Types: Include asymmetric key (FIREFLY/modern key), and symmetric (traditional) keying material – both locally generated or electronically received from the Central Facility (CF), Tier 1, or another COMSEC Account.

c. COMSEC equipment request must identify CCI equipment type, quantity, and serial numbers.

d. There must be three points of contact for the COMSEC LE Group, a primary and two alternate representatives.

e. There must be a thorough description of where COMSEC material will be stored and/or used. Emphasis should be placed on existing physical security safeguards in place to protect the

9. Safeguarding and Storage of COMSEC Material. The security achieved through the proper use of cryptosystems is also dependent upon the physical protection afforded the associated keying material and those facilities where this material is stored. The ultimate effectiveness of protections afforded to COMSEC material is dependent on each COMSEC user.

a. COMSEC material shall only be stored in General Service Agency (GSA)-approved security containers and spaces approved for their storage. Unless COMSEC material is under the direct control of authorized persons, the containers and spaces shall be secured.

b. COMSEC keying material shall be stored separately from other classified material (e.g., in separate containers or separate drawers within a container). During non-working hours, COMSEC storage containers shall be locked. No external modifications are authorized for GSA-approved security containers and storage vaults.

c. Classified COMSEC keying material marked or designated CRYPTO must be stored as follows:

(1) Store TOP SECRET keying material in a strongbox or special access control container within a vault or in a GSA-approved security container, with dual combination locks.

(2) Store SECRET keying material in a security container approved by GSA for storing

SECRET or TOP SECRET keying material.

(3) Store CONFIDENTIAL keying material in any GSA-approved security container or any manner approved for storing SECRET or TOP SECRET keying material.

(4) Store unclassified Controlled Cryptographic Items (CCI) in a manner to prevent pilferage, sabotage, or theft (e.g., a locked cabinet or drawer).

d. TOP SECRET COMSEC material requires TPI and must be stored in an FF-L-2740

(series). TPI handling requires that at least two persons, who are authorized access to the

COMSEC keying material, be in constant view of each other and the COMSEC material requiring TPI whenever that material is accessed and handled. TPI shall be applied to the following COMSEC material from the time of receipt through turn-in to the CAM.

(1) Common Fill Devices – A family of portal hand-held devices developed to read in, transfer, and store key (e.g., the AN/CYZ-10 Data Transfer Device (DTD), AN/CYZ-10 Simple

Key Loader and the Really Simple Key Loader, (RASKL). Collectively, these devices are known as Data Transfer Devices (DTDs).

(2) Issued fill devices and COMSEC keying material comes in two forms, unencrypted

(red) key and encrypted (black) key. The Traffic Encryption Key (TrKEK) (black) key, once loaded encrypts the fill device and keying material to prevent unauthorized extraction. This method of operation is referred to as TrKEK distribution.

e. COMSEC equipment may require special storage facilities and procedures, which are normally addressed in the handling and security doctrine for the specific system. In conjunction with any special requirements, the following guidance applies:

(1) Store unclassified unkeyed equipment in a manner sufficient to preclude any reasonable chance of pilferage, theft, sabotage, tampering or access by unauthorized personnel.

(2) Store classified unkeyed equipment in the same manner as classified material of the same classification.

(3) Protect keyed equipment based on the classification of the equipment or the keying material, whichever is higher. Ensure that procedures are in effect to prevent unauthorized use of the equipment or extraction of its key.

f. Store CCI as follows:

(1) Unkeyed CCI and/or CCI keyed with an unclassified key marked or designated

CRYPTO, must be stored in a manner that affords protection against pilferage, theft, sabotage, or tampering, and ensures that access and accounting integrity are maintained.

(2) Keyed CCI must be stored based on the classification of the key.

(3) Unclassified COMSEC material, not designated as CCI, must be stored in a manner sufficient to preclude any reasonable chance of pilferage, theft, sabotage, tampering, or access by unauthorized persons.

g. Storage containers for COMSEC material require the following forms:

(1) SF 700, Security Container Information. Part 1 of a SF 700 for each security container housing COMSEC equipment, must be sealed, in an opaque envelope, attached to the inside of the locking drawer. DoD policy considers personal addresses and telephone numbers to be Personally Identifiable Information and must be protected per the Privacy Act of 1974. If unsealed, Part 1 must be immediately resealed in an opaque envelope.

(2) The name(s) and addresses of the individual(s) authorized access to the SF 700s must be recorded on the front of Part 2 of the SF 700. Parts 2 and 2A of the SF 700 are considered classified based on the highest classification of the contents in the container, and must be marked at the appropriate level and reflect the following derivative and downgrading instructions:

“Derived from: 32 CFR 2001.80(d) (3)” “Declassify: Upon Change of Combination”.

(3) SF 700s must be inspected, inventoried, and actions must be documented monthly or sooner if a combination is changed and the SF 700 updated. The inventory will reflect the

Department and Division responsible for the container, the container number, the location of the container, the date the combination was last changed, and the signature of the person inventorying/inspecting the SF 700s. SF 700 inventory documentation will be retained for one year or until the next Central Office Record.

(4) SF 702, Security Container Check Sheet: An SF 702, the log used to record opening and closure of the security container must be maintained for each lock on a COMSEC storage container and must be annotated each time the container is opened and closed. At the end of the day, the security container must be checked, and the time and the initials of the checker recorded on SF 702.

(5) Maintenance Record for Security Containers and Vault Doors, Optional Form (OF)

89: When a container lock or vault door is put in use, and OF 89 must be prepared and maintained. An OF 89 is a permanent record and will be retained for the service life of the security container or vault door. All repairs to damaged security containers must conform to

Federal Standard 809 titled Neutralization and Repair of GSA-approved containers and Vault

Doors. A security container is considered restored to its original integrity, if damaged or altered parts are replaced and permanent records document the replaced part.

(6) Combinations to COMSEC material containers must be changed:

(a) when the lock is initially placed in use;

(b) when a person knowing the combination no longer required access (e.g., loss of clearance, transfer);

(c) when the possibility exists that the combination has been subjected to compromise. Immediately notify the CAM for further guidance.

(d) When repair work has been performed on the combination lock.

(e) When the security container has been taken out of service.

(f) At least once every two years or sooner, as dictated by the above events.

(g) Records of Combinations: To provide for emergency access, a central record of the lock combinations for all COMSEC material security containers must be maintained in another GSA-approved security container (other than the container where COMSEC material is stored) approved for storage based on the highest classification.

(7) Only individuals who have been formally granted access to keying material by the

CO shall change combinations for COMSEC containers. A certified locksmith may be used to prepare locks for new combinations, but the actual combination must be set by an individual authorized access to that combination.

(8) Accounting for COMSEC Material. COMSEC material is identified by a distinctly different short title, edition, and in most cases, an accounting number. COMSEC keying material will be issued and accounted for by its short title, edition, and serial number. COMSEC equipment will be issued and accounted for by its short title and serial number.

(a) The CAM shall generate an SF 153 for the issue, receipt, transfer, inventory, or destruction of COMSEC material. The SF 153 will be signed by the LE. The CAM shall provide copies of documentation applicable to the LE, when performing a transaction.

(b) The LE is responsible for keeping and maintaining a file of transactions. This documentation may be inspected during the LEs COMSEC inventories and CAM Spot Checks.

10. Inventorying COMSEC Material. Equipment and keying material assigned to the NSWC

PCD KMI account must be inventoried semi-annually. Material issued to the LE shall be included in the inventory. The LE shall keep and maintain a detailed inventory of COMSEC items they have been issued. The LE must present the material to the CAMs upon request. This may include escorting the CAM to the equipment or keying material if it is in use or a fixed configuration. LEs shall conduct routine inventories as required by their operating environment.

a. There is no shift/watch-to-watch inventory requirement for electronic key issued to an electronic storage device (SDS, SKL, or TKL) encrypted with a TrKEK or where the device is either stored separately from its associated CIK or both are controlled, handled, and stored under

TPI procedures. The device and CIK will be reflected on the shift inventory and properly accounted for at all times.

b. The SF 153 is a multi-purpose COMSEC accounting report used primarily but not limited to receipt for, transfer, destruction, or inventory of COMSEC-accountable material.

c. Security containers need to be opened for the sole purpose of conducting an inventory.

However, if the security container is opened for any reason and access to the material is available, an inventory must be conducted at that time, along with the destruction of superseded

11. Destruction of COMSEC Material. To reduce the risk of a potential compromise, keying material must be destroyed as soon as possible after it has been superseded or otherwise served its intended purpose. Keying material is destroyed when regularly superseded, expired, or upon

Emergency Supersession, as directed by the Controlling Authority or when emergency destruction is directed by the CO or other proper officials. Destruction of keys issued to an SKL or TKL is accomplished through deletion of the key or zeroizing the device, if no longer required. Audit trail reviews provide the required verification the key was destroyed negating the requirement for a hard copy CMS-25 destruction report unless required by local, Immediate

Superior in Command (ISIC), or Type Command (TYCOM) policy.

NOTE: A local SF 153 destruction report will be used to perform all COMSEC destructions and a copy supplied to the CAM.

a. Emergency Supersession of Keying Material: When involved in compromise, destroy superseded material as soon as possible and always within 12 hours of receipt of emergency supersession notification.

b. In the case of an extended holiday period (over 72 hours) or when special circumstances prevent compliance with the 12-hour standard (e.g., destruction facility or operational space not occupied) destruction may be extended until the next duty day. In such cases, the material must be destroyed as soon as possible after reporting for duty.

c. If material is involved in an investigation, specific instructions to retain the material beyond its supersession date will be provided by Naval Communications Security Material

System (NCMS)//N5// or DIRNSA.

d. CCI Equipment Turn-In. If CCI equipment is deemed inoperable, the equipment shall be returned to the COMSEC Office for replacement, turn-in, or destruction.

e. Unless otherwise directed by NCMS, COMSEC equipment will not be destroyed at the local level. Equipment that is inoperative or no longer required shall be returned to the CAM for disposition.

12. Transfer/Shipment of COMSEC Material

a. The CAM is responsible for performing COMSEC CCI permanent disposition (i.e., transfer to another COMSEC account to return to a distribution agency, such as Naval

Operations and the equipment division of Naval COMSEC Material System). The LE is responsible for the shipment of CCI during test events and training activities only using one of the following methods:

(1) United States Postal Service, registered mail or express mail, or

(2) GSA authorized couriers (Federal Express or United Postal Service).

b. These methods of shipping provide transport of unclassified CCI through U.S. controlled channels using a mode of transportation that provides both continuous accountability and reasonable protection against theft or loss of the material while it is in transit.

c. The LE will utilize shipping notification from the authorized courier to trace and track the advanced movement of shipment to the point of destination, for retrieval and pickup on base or off base.

13. Secure Voice and Data Communications Equipment: Secure Terminal Equipment, KSV-21

Card, OMNI Secure Terminal, Iridium secure sleeves and the Sectera vIPer Secure Phone.

a. The above products are considered CCI and are encryption devices designed to provide wired or wireless secure voice and data connectivity. Their unique serial number, not the keying material identification number, accounts for these devices. On-site management and security are inherent responsibilities of the authorized user to whom the device is issued.

b. The CAM will issue secure voice and data communications equipment using an SF 153 and enclosure (1), as applicable. User responsibilities for safeguarding, use, and storage are detailed in enclosure (1).

14. COMSEC Incident Reporting. As required by national policy, all COMSEC incidents must be reported. Reporting is not to be delayed for local or external inquiries to gather additional information or conduct root cause analysis of circumstances resulting in the incident. Types of

COMSEC Incidents:

(a) Examples of Cryptographic Incidents.

(1) Use of keying material that is compromised, expired, superseded, defective, previously used (and not authorized for reuse), or incorrect application of keying material,.

(2) Operational use of equipment without completion of the required alarm check test or after failure of required alarm check test;

(3) Any other occurrence that may jeopardize the crypto security of a COMSEC system.

(b) Examples of Personnel Incidents.

(1) Unauthorized disclosure of PINs and/or passwords used on systems, which allow access to COMSEC material/ information.

(2) Attempts by unauthorized persons to effect disclosure of information concerning

COMSEC material or unauthorized disclosure of information related to COMSEC material.

(c) Examples of Physical Incidents.

(1) Unauthorized access or access by improperly cleared personnel;

(2) COMSEC material not properly secured and left unattended where unauthorized persons could gain access;

(3) COMSEC material improperly packaged or shipped, including, the shipment of

CIKS/PINS/passwords with the associated equipment;

(4) COMSEC material discovered outside required control or accountability, (i.e., material in-stock to the account not reflected on the Product Inventory, non-use of hand receipts, no destruction, transfer or Relief from Accountability report for in-stock material not held, and discovery of a security container unsecured), not under the direct control of authorized persons.

15. Training. It is the responsibility of the CAM to ensure alternate managers and clerks are trained. The CAM shall provide monthly and refresher training to LE personnel. Each month the LE will provide COMSEC monthly training memorandums to the CAM. Failure of the LE to conduct monthly training will result in the removal of COMSEC access.

Enclosure (1)

RETENTION PERIODS FOR COMSEC FILES, RECORDS, AND LOGS

1. Purpose. To prescribe the retention periods for COMSEC related files, logs, and records

(both active and inactive) that are used by the Local Element (LE) in COMSEC account management. The destruction of inactive files, records, and logs should be accomplished as soon as practical after the retention period expires.

a. SF 153 Local Custody Documents. Retain for 90 days after the material has been destroyed or turned in to the CAM.

b. Letters of Agreement. Retain for one year after COMSEC support has been terminated.

c. Watch-to-Watch Inventory Listing. Retain for 30 days beyond the last recorded inventory date on the sheet.

d. Visitor’s Log. Retain for one year from the date the log was completed or closed out.

e. Directives and Instructions. Retain required items related to your LE until canceled or superseded.

f. Completed SF 701/SF 702 forms. Retain for 90 days beyond the last date recorded.

2. Destruction. The above documents shall be destroyed when their retention period has expired. Destruction must be by the requirements of the security classification of each document.