Att_J-2_AITS.pdf

DEPARTMENT OF THE NAVY

HEADQUARTERS UNITED STATES MARINE CORPS

HQMC C4 DEPARTMENT

3000 MARINE CORPS PENTAGON, ROOM 1D247

WASHINGTON, DC 20350-3000

IN REPLY REFER TO:

FOR OFFICIAL USE ONLY

C4/CY

10 Aug 17

From: Deputy, Department of the Navy (DON) Chief Information Officer (CIO), Marine Corps

To: Program Manager, MCRC Advertising Information Technology System

Subj: AUTHORIZATION TO OPERATE (ATO) THE MARINE CORPS RECRUITING COMMAND

ADVERTISING INFORMATION TECHNOLOGY SYSTEM (MCRC AITS): 2017-0852

Ref: (a) DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), 24 May 16, as amended

(b) Marine Corps Operational Security Control Assessor (SCA) Recommendation ATO MCRC

AITS HQMC 5230, 4 Aug 2017

(c) MCEN-N Marine Corps Certification and Acceditation Support Tool (MCCAST) Security

Authorization Package (SAP) for MCRC Advertising Information Technology System , DoD

RMF-161, 1 Aug 2017

(d) MCRC Advertising Information Technology System Plan of Action and Milestone

(POA&M), 01 Aug 2017

(e) CJCSI 6211.02D, Defense Information System Network (DISN) Responsibilities, 24 Jan 12

(f) CJCSI 6510.01F, Information Assurance (IA) and Support to Computer Network Defense

(CND), 9 Feb 11

(g) DoDI 8500.01, Cybersecurity, 14 Mar 14

(h) Federal Information Security Modernization Act (FISMA) of 2014, [Title 44, Chapter 35], 3

Jan 14

(i) SECNAVINST 5211.5E, Department of the Navy (DoN) Privacy Program, 28 Dec 05

(j) ECSM 018, Marine Corps Assessment and Authorization Process, 8 Aug 17

(k) ECSM 021, Ports, Protocols and Services Management, 15 May 12

(l) MARADMIN 371-13, Requirement for Registration of Ports, Protocols and Services

Operating on the MCEN, DTG 240043Z Jul13

1. In accordance with reference (a), the Marine Corps Authorizing Offical (AO) hereby grants an ATO for the operation of MCRC AITS. This authorization is granted based on the information provided in reference (b), based on the review of the information contained in references (c) and (d), and in compliance with references (e) through (l).

2. This ATO expires on 31 August 2020, or when significant modifications are implemented to the

MCRC AITS which alter or impact the accredited security or architectural design. Changes must be submitted in writing through the Marine Corps Operational SCA for review and approval by the Marine

Corps AO prior to implementation. Change proposal packages must, at a minimum, include updated topology diagrams, communications information and hardware and software listings that differ from those submitted in the baseline configuration in reference (c). If the PM does not complete reauthorization then effective 31 August 2020 (ATD), a Denial of Authorization to Operate (DATO) commences and on 1 September 2020, MARFORCYBER will initiate the disconnection process.

3. The system provides digital marketing, database marketing, leads management, and fulfillment services using a leased data center environment procured on behald of the USMC Recruiting

Command. Rackspace provides hardware and OS level support for all systems while management and operation of all applications is outsourced in support of USMC Recruiting Command marketing efforts.

4. MCRC AITS security categorization is Confidentiality - Moderate, Integrity – Low, and Availability -

Moderate. While in operation, the hardware is authorized process up and including Public information in the System High mode of operations. Per reference (b), the overall risk was identified as Medium.

MCRC AITS was reviewed and applicable overlays will be used, per guidance provided by the AO.

5. In order to retain this ATO, the system owner is required to comply with all DoD and Marine Corps

Cybersecurity policy requirements and ensure the items listed below are accomplished. Non-compliance with any of the following will result in a DATO.

a. During the first year of this ATO, the following must be accomplished:

Address all AU controls findings - The AU controls were mapped to your 7 points that needed to be addressed. Once the assessment was done, the vendor started to implement a better auditing system. The ISSM will be updating the POA&M as work progresses, and my team will be monitoring progress.

Remove the DOB data element - The ISSM has stated that they can remove this information from the DB, and stop collecting it.

The ISSM will provide monthly POA&M updates within MCCAST.

b. During the second year of this ATO, the following must be accomplished:

The ISSM will solicit C4 CY assistance in the review of the new contract RFP to verify the proper language is in place to meet DoD Cybersecurity requirements.

c. During the third year of this ATO, the following must be accomplished:

The FedRAMP migration will be completed 6 months prior to the ATO expiration.

A full assessment will be performed on any components that do not fall under the

FedRAMP assessment.

d. Ports, protocols, and services (PPS) were verified by the C&A Branch, confirming all MCRC

AITS PPS have been registered in the Categories Assurance List (CAL), per reference (k) and (l).

e. DADMS/DITPR-DON registration number: 23011

f. POA&M timelines as indicated in reference (d) must be followed. Failure to meet POA&M requirements can result in the ATO and ATC being withdrawn.

g. Program Manager must confirm and provide program budget, funding and support per reference (e).

h. Implementation and maintenance of personnel and technical security controls described in references (c) and (j).

i. Implementation and maintenance of the Information Assurance Vulnerability Management program required patches/fixes per reference (f).

j. Compliance with requirements for proper protection of data and systems as defined by reference (f).

k. Compliance with information security evaluation and reporting requirements established by the Federal Government per reference (h).

6. Per reference (e), all System Administrators (SA), including part-time or collateral duty SAs, will be certified and cleared to the level of information classification of a given information system. Contractor

SAs will also meet certification and access control requirements to include personnel clearances and physical controls.

7. Upon fielding of MCRC AITS all end user administrators will have access to conduct security compliance as well as audit functions in preparation for future DoD cybersecurity assessments (e.g., both pre- and official Command Cyber Readiness Inspections, monthly ICE DEMon/White Team cybersecurity compliance reviews). In accordance with reference (e), we acknowledge the Defense

Information Systems Agency (DISA) and the Joint Task Force-Department of Defense Information

Network (JTF-DODIN) will conduct periodic monitoring of our MCEN-N and MCEN-S. We acknowledge and consent to initial vulnerability assessment and periodic unannounced vulnerability assessments on our existing connected host systems to determine the security features in place to protect unauthorized access or attack and enhance cybersecurity posture.

8. Questions may be directed to the Marine Corps Operational SCA at DSN 278-6795 or (703) 784-

6795.

R. A. LETTEER

By direction

Copy to:

MARFORCYBERCOM

MCCOG