Attachment 2b_20200713 CISO Privileged Access Guidelines for NAVWAR FINAL Signed.pdf

13 July 20

MEMORANDUM

From: NAVWAR Command Information Security Officer (CISO)

To: NAVWAR Command Information System Security Managers (C-ISSM)

NAVWAR Information System Security Managers (ISSM)

NAVWAR Cyberspace Information Technology and Cybersecuity Workforce (Cyber IT/CSWF)

Program Managers (PM)

NAVWAR Cyber Planning and Response Center (Leadership Team)

Subj: PRIVILEGED ACCESS AGREEMENT (PAA) AND ENHANCED USER (EU) GUIDELINES

FOR NAVWAR

Ref: (A) SECNAVINST 5510.30C, Department of the Navy Personnel Security Program, 24 Jan 2020

(B) SECNAVINST 5239.20A, DoN Cyberspace IT and CSWF Management and Qualifications, 10 Feb 2016

(C) SECNAV Manual M-5239.2, Cyberspace Information Technology and Cybersecurity

Workforce Management and Qualification Manual, June 2016

Encl: (1) Privileged Access Agreement (PAA) and Enhanced User (EU) Guidelines for NAVWAR

1. Background: Reference (A) requires that a favorable Tier 5 (T5) background investigation or T5 reinvestigation (T5R – every 5 years) be conducted on military, civilian and contractor personnel for

“privileged access IT.” Reference (B) outlines the requirements for personnel needing privileged access.

Reference (C) defines enhanced user requirements. There have been numerous questions about privileged and enhanced user access relative to background investigation requirements. NAVWAR Director of

Security, Cyber IT/Cyber Security Program Manager, and Command ISSM, in consultation with the offices of the Department of the Navy Chief Information Officer (Cybersecurity and Privacy), and Deputy

Under Secretary of the Navy (Security and Intelligence Directorate) developed guidelines in Enclosure

(1) to assist NAVWAR personnel in determining user access requirements and meeting corresponding security background investigation requirements.

2. Action: NAVWAR C-ISSMs, ISSMs and Cyber IT/CSWF Program Managers will use the guidelines in Enclosure (1) to help ensure the requirements outlined in Reference (A) through (C) are met.

4. Point of Contact: NAVWAR Command ISSM, Rob Nordengreen, robert.nordengreen@navy.mil.

M. A. COMPTON

PRIVILEGED ACCESS AGREEMENT (PAA) AND ENHANCED USER (EU) GUIDELINES FOR NAVWAR

1 Enclosure (1)

Privileged Access and Enhanced User Guidelines for NAVWAR

0.0 Purpose

The purpose of this NAVWAR Command Information Security Officer (CISO) Memorandum is to provide Privileged Access and Enhanced User guidance to the NAVWAR Enterprise.

1.0 Definitions

Authorized User: As defined in SECNAVINST 5239.20A is, “Any appropriately cleared individual with a requirement to access a DoD Information Systems (IS) for performing or assisting in a lawful and authorized governmental function.”

Enhanced User: As defined in SECNAV M-5239.2, dated June 2016, is, “An Authorized

User (military, civilian or contractor) who requires detailed knowledge of Cyber IT and/or cybersecurity to support work in the development, maintenance, or operation of

DoN systems, including weapons, tactical, electronic and electrical services, navigation, and engineering. Enhanced Users possess advanced Cyber IT/CS knowledge and abilities centered on particular professional areas.”

Privileged Access: As defined in SECNAVINST 5239.20A is, “Access to system control, monitoring, administration, criminal investigation, or compliance functions...each person with Privileged Access will be required to acknowledge special responsibilities with a

Privileged Access Agreement (PAA).”

Privileged User: As defined in SECNAVINST 5239.20A is, “A user that is authorized, and therefore trusted, to perform security-relevant functions that ordinary users are not authorized to perform.”

2.0 Enhanced User and Privileged Access Determination

Before submitting an Access Request, it is important that the requesting individual and the system ISSM carefully review the below requirements for Privileged Access and Enhanced User to determine which applies. The cost to the government in both time and money for the security investigation and determination for Privileged Access is significantly greater than for an

Enhanced User. Therefore, clear justification for Privileged Access must be provided in the PAA request.

2.1 Privileged Access Requirements

The Privileged Access determination checklist is provided in SECNAV M-5239.2, June 2016, Appendix 1, and the PAA form SECNAV 5239/1 is provided in Appendix 2. All users determined to require Privileged Access must have an approved PAA and SAAR-N before gaining Privileged Access to the network, system or application. The PAA process can be found on the NAVWAR WIKI at: https://wiki.spawar.navy.mil/confluence/display/HQ/8.2.5+-

+Privileged+Access+%28PA%29+for+NAVWAR+HQ+and+PEOs.

2.2 Enhanced User Requirements

Enhanced users require limited privileged access to Operating System or Computing

Environment (OS/CE) to perform limited tasks on a system. Once identified, authorization

2 Enclosure (1) agreement will be developed with limited training requirement related to specific task or tasks.

The ISSM of the system determines the training requirement and provides authorization to access utilizing EUA form.

Enhanced User functions, training, and restrictions assessments will be defined in the EUA using the following guidelines as a reference:

May require an elevated set of permissions in order to complete a series of functions that cannot otherwise be performed at a lower permission level;

Do not include managing the overall configuration (i.e., hardware, software, or peripheral device installation or removal);

Do not include vulnerability scanning or patching actions;

Do not include auditing, protecting, or defending the network, system or application;

Are not performed on servers or other hardware providing central management of other devices, but only on workstations or other endpoint devices; and

Do not include network access to the DoDIN or the Internet – i.e., are stand-alone, on isolated networks, or are restricted via Virtual Local Area Network or router/firewall

Access Control Lists to only local/internal infrastructure – per the requirements of DISA

STIG Group ID V-36451.

Enhanced User Agreements:

The purpose of the Enhanced User Agreement is to document the specific actions an Enhanced

User is permitted to perform on an IS, to identify any restrictions the EU is subject to, and to identify the controls the EU is required to comply with.

Performing any action not documented on the EUA is a violation of the agreement and shall result in the restriction of the user from performing any EU functions. It may additionally result in loss of Authorized User status and administrative or disciplinary action as applicable.

EUAs shall include (at a minimum):

1. Employee Name

2. IS/CS/PIT Name/Identifier

3. Permitted actions/functions

4. Restrictions

5. Controls

6. Acknowledgement of Responsibilities

7. Employee Signature

8. ISSM Signature

3 Enclosure (1)

4 Enclosure (1)

3.0 Roles and Responsibilities Relative to Privileged and Enhanced Users

Information System Security Manager (ISSM): ISSMs within the NAVWAR Enterprise are individuals with overall responsibility for the network, system or application (less

NMCI). They will ensure the following:

o The ISSM shall determine whether an Authorized User requires Enhanced User or

Privileged Access User access to the network, system or application in order to perform their responsibilities. It is important that the level of access required is not over-assessed, since this requires considerably more time and money to conduct the required security investigation.

o Each Authorized User must meet the background investigation requirement that corresponds to the position sensitivity level; have current user access agreements

(System Authorization Access Request-Navy (SAAR-N), and either a PAA or an

Enhanced User Agreement (EUA) as appropriate); and complete appropriate system training and approved cybersecurity awareness training prior to accessing the network, system or application.

o PAAs and EUAs must be reviewed, updated, and signed annually and must identify the specific network, system, or application to which an individual has

Privileged or Enhanced User Access.

o A signed copy of the PAA or EUA shall be maintained by the network, system or application administrator as part of the official record.

o Personnel no longer requiring Privileged Access or Enhanced User Access shall have their records modified to reflect a change in the access granted.

Command Information System Security Manager (C-ISSM): Note that there are three C-

ISSMs in the NAVWAR Enterprise: one at Echelon II covering NAVWAR Headquarters and the PEOs, and one for each NIWC. Each C-ISSM will facilitate the processing of

SAAR-N, PAA and EUA package submissions after they have been validated by the respective CSWF-PM. The C-ISSM will ensure the following:

o Packages are routed to the Security Manager for processing. Once packages have been processed they will be provided to the submitter for recording and filing.

o Monitor SAAR-N and PAA submissions for compliance with cybersecurity policy.

Cyber Workforce Program Manager (CWF PM): Note that there are three CSWF PMs, one at Echelon II covering NAVWAR Headquarters and the PEOs, and one for each

NIWC. Each Cyber Workforce PM is responsible for overseeing Privileged User procedures implementation.

o Privileged User Access: The CWF PM is responsible for final review of the PAA and will:

Ensure all blocks correctly filled.

Validate C-ISSM signature block.

Ensure Cyber Security Credentials and Operating System/Operating

Environment Credentials are valid, up to date and training sufficient based on DoD 8570.1M requirements.

Ensure T5/R clearance is in place or T5/R clearance is initiated

Track Privileged Users in TWMS per SECNAV M-5239.2 M June 2016.

Note that as of this Memorandum, TWMS functionality is not working

5 Enclosure (1) properly and that CWF PMs need to track PAAs in a separate repository until TWMS functionality for tracking PAAs is implemented.

o Enhanced User Access: Oversee Enhanced Users implementation and tracking.

Security Manager: Note that there are three Security Managers in the NAVWAR

Enterprise: one at Echelon II covering NAVWAR Headquarters and the PEOs, and one for each NIWC. They are responsible for submitting adequate background investigations for government and military personnel based on individuals’ user requirements. The

Security Manager will collaborate with Contracting Officer Representatives (COR) for contractors whose Authorized User needs exceeds their security access requirement. In these cases, the Security Manager will submit adequate background investigation based on individuals user requirements.

Command Information Security Manager (CISO): The NAVWAR CISO is responsible for overseeing the management of the Authorized User process across the NAVWAR

Enterprise.

Contractor Officer Representative (COR): Will ensure the PWS/SOW includes language defining privileged and/or enhanced user requirements.

4.0 Security Determination Requirements

Enhanced User: All enhanced users are required to have a favorably adjudicated T3/R (or equivalent) investigation.

Privileged Access User: SECNAVINST 5510.30C, 24 January 2020, requires all personnel with

Privileged Access to have at a minimum a T5/R (or equivalent) investigation.

5.0 Privileged Access Security Determination Transition Guidance

5.1 Initial PAA Requirements:

Privileged users must have at a minimum, an open T5/R investigation (or be enrolled in

Continuous Evaluation by Reinvestigation Deferment, if applicable) as initiated by the Security

Manager.

5.2 Annual PAA Requirements

Privileged Users who hold a current PAA with a security determination less than a favorable

T5/R, are not required to submit a new PAA and SAAR-N until the time of their annual PAA review by their ISSM. During the annual review, if the Privileged User is determined to still require Privileged Access, and the individual does not hold a favorably adjudicated T5/R security determination, then a new SAAR-N will be submitted and the Security Manager will request a

T5/R on the individual. Privileged Users are encouraged to submit their new PAA and SAAR-N at least one month before their annual review is due in order to allow time for processing their request. If the Privileged User fails to receive a signed SAAR-N and PAA, then they must cease

Privileged Access work until signed forms are received.

5.3 Contractor Personnel

Privileged Access and Enhanced User requirements are determined by the terms of the contract.

It is the responsibility of the government to ensure that the contract Performance Work

6 Enclosure (1)

Statements and Task Orders reflect these requirements. It is the responsibility of the contractor to ensure that their employees who require Privileged Access or Enhanced User Access in accordance with the contract, meet all requirements stated above before performing Privileged

Access or Enhanced User functions. To support network, system and application ISSMs, Procuring Contracting Officers (PCO) and CORs are responsible to include the T5/R requirement for Cyber Workforce Privileged Users in the contract and ensure a T5/R investigation is initiated.