Attachment_(9)_SAAR-N_Guidance.docx

Completion Instructions for the SAAR-N (OPNAV 5239/14 (Rev 9/2011))

Once the SAAR-N is complete, send it and your IA Training Certificate to the NAVAIR Help Desk via:

- e-mail: navair_SAAR@navy.mil

- or Fax: (301)995-0285

- or HelpDesk online: https://nhd.navair.navy.mil

Please see “Common Reasons the SAAR-N form is Rejected:” on page 5 before completing SAAR-N.

Completed by the Requestor Type of Request:

(*if an account already exists- but needs some kind of change/update)

· IF you have previously had an NMCI account please include your User ID

· If you select Modification, the entire form should be updated from your previous copy on file

Date: DDMMMYYYY Format (*REQUIRED) – No future dates System Name (Platform or Application): This has to be specific – “all IT systems” by itself is not acceptable. List the systems the individual will have access to, such as: NMCI NIPRNet, SIPRNet, SDREN, DREN, RDT&E Lab Name, Navy ERP, AIM, COLTS, etc. If more space is needed, continue in Block 11 for systems.

Location: Your physical location. i.e, NAS Patuxent River, Bldg 1490, Room 54, Cube 1A (If requesting multiple systems access – use the location of the primary system being used. For example, where you will be accessing your computer.)

Part 1-

1. Name: Last, First MI (if no middle name, use “NMN”)

2. Organization: Command – NAWCAD or NAVAIR

a. **For contractors: Command/Program Supported (No Company Name should be listed)

3. Office Symbol/Department: Program Office/Competency Being Supported – PMA-### or Code

4. Phone: Work Number ONLY – Requestor’s work phone number or Supervisor’s work phone number if requestor does not have one.

5. Official E-Mail Address: .mil work e-mail address only. (No personal or EDU e-mail address should be included)

a. If an @navy.mil account doesn’t exist yet - leave blank

b. **If you’re an external customer requiring access to government systems, and will NEVER have a .mil address, please use your company’s email address.

6. Job Title and Grade/Rank: Title & Grade of your specific position

a. Job title only necessary for contractors

7. Official Mailing Address: Official COMMAND mailing address for your Bldg

8. Citizenship: Choose ONE only- US, FN, LN, Other_______

a. If you select FN- See page 5 for amplifying instructions

9. Designation of Person: Choose ONE only- Military, Civilian, or Contractor

10. IA Awareness Training: This must be completed before a SAAR-N will be approved.

a. Check the box and enter date training was taken. ***Include the certificate of completion when you submit the SAAR-N form.*** Training must be taken within the current Fiscal Year (i.e., October 1st to September 30th).

*For individuals without CAC PKI, training can be accessed from any non-DoD computer at: http://iatraining.disa.mil/eta/cyberchallenge/launchpage.htm. Select Cyber Awareness Challenge and print certificate.

Requestor- Continue on Page 3

22. Requestor must read this section and acknowledge that they understand the rules for maintaining access to Government IT systems by signing Block 24 on the next page.

23. Name: Last, First MI (if no middle name, use NMN)

24. User’s Signature: either manual or digital CAC signature (must contain users EDIPI # or contractor email in signature {small print})

25. Date Signed: DDMMYYYY (If scanned multiple times, ensure Date is legible) Part II – Endorsement of Access by Information Owner, User Supervisor, and Government Sponsor

11. Justification for Access: Write in the box “To gain access to Navy IT resources in support of duties on a need to know basis.” *Include additional systems in this block, if applicable.* - Do not reference Heat Ticket Numbers in this section

12. Type of Access Required: Check one- “Authorized” or “Privileged”. Most users will be Authorized. Privileged users will be based on Position Description (PD) or job description.

· If you require both please put a check in both “Authorized” and “Privileged” 12a. Privileged users need to include the Privileged Access Agreement (PAA) form. The date in this block should match the date the user signed the PAA. (PAA forms should not exceed 6 months of date of submission)

PAA Attached and instructions:

13. User Access Required: Check- Unclassified or Classified. If a user is requesting access to both classified and unclassified, check both boxes. If accessing classified information, please specify the category of data (e.g., Secret, TS). SIPRNET is acceptable for this as well.

14. Verification of Need-to-Know: Box must be checked. As the supervisor you are acknowledging the user’s appropriate level of need-to-know.

14a. Access Expiration Date: **Required for Contractors** Specify Company Name, Contract Number, Expiration Date

15. Supervisor’s Organization/Department: Command, Office Code. i.e, NAWCAD 7.2.3. This should correlate with Line 16 and be the Government Supervisor. If the Contractor Supervisor signs in this block, then the government supervisor must additionally sign as the Information Owner in Block 17.

15a. Supervisor’s E-mail: Official .mil account 15b. Supervisor’s Phone: Official work phone number

16. Supervisor’s Name: Last, First. Can be the government or contractor supervisor (*contractors can use the COR, direct government supervisor or TPOC). If the contractor supervisor signs the form, then the government supervisor must sign as the Information Owner in Block 17.

16a. Supervisor’s Signature: either manual or digital CAC signature.

16b. Date: DDMMYYYY (If scanned multiple times, ensure Date is legible)

17. Signature of Information Owner: The Information owner of a specific system (i.e., Navy ERP, Lab x, Website x). Refer to the system(s) being requested above. If a Contractor Supervisor signed in Block 16, then the Government Supervisor (TPOC, COR, or direct government supervisor) must sign as the Information Owner.

18. Signature of IAM or Appointee: Leave blank, unless the following exist:

a. Information Owner of the System/PMA has a government IAM or,

b. System/SAAR-N is maintained at the PMA/Lab level. This is typically the case with smaller standalone systems.

c. If you are located at another Command ****The IAM/PMA IAM will have the last signature on the OPNAV 5239/14 Rev 9/2011**** ****Also, an ISSM cannot sign as their own ISSM on a SAAR-N or PAA in any instance****

19. Organization/Department: Command – NAWCAD or NAVAIR

20. Phone Number: Official work phone number

21. Date: DDMMMYYYY If Civilian or Military- Supervisor Completes Part III, #26c 26c. IT Level Designation: Based on position Sensitivity (Critical, Non-Critical, Non-Sensitive – refer to Position Description for Government) Level I – Privileged Access (Refer to the SECNAV M-5510.30 for a complete list of roles and responsibilities that qualify as IT Level I Designation – Questions? Contact the IAM/CSM.)

Level II – Limited Privilege, Sensitive Information Access (Most users fall into this category) Level III – Does NOT exist at NAVAIR

Embedded Doc explaining IT Level Designations:

Part III - Security Manager Validates the Background Investigation or Clearance Information Civilian or Military-NAVAIR/NAWCAD users- upon completing Parts I, II & 26c in Part III, e-mail or Fax the SAAR-N & IA Training Certificate to the NAVAIR National Help Desk for 7.4 Security to complete Part III. If you are not a NAVAIR/NAWCAD employee, please have your local Security Office complete part III. Then submit to the NAVAIR National Help Desk for final processing and approval. navair_saar@navy.mil or (301)995-0285 Contractor- upon completing Parts I & II, submit the form to your company’s Facility Security Officer (FSO) or Security Manager for processing. Once they have completed Part III, then e-mail or FAX the SAAR-N & IA Training Certificate to the NAVAIR National Help Desk for final processing and approval. navair_saar@navy.mil or (301)995-0285

26. Type of Investigation: ANACI (now T3 or T3R for Secret), NACLC (now T3 or T3R for Secret), SSBI, SSBI-PR, PPR, SBPR, PPP, PRSC 26a. Date of Investigation: DDMMYYYY

· Top Secret OR IT level 1 = 5 years (NO two year extension allowed)

· Secret OR IT level 2 = 10 years (NO two year extension allowed)

· Favorable/None = 15 years (NO two year extension allowed) 26b. Clearance Level: TS, Secret, Confidential, Interim Clearance, Favorable, None (N/A not acceptable) 26c. IT Level Designation: Based on position sensitivity (Critical Sensitive, Non-Critical Sensitive, Non-Sensitive – refer to Position Description for Government) Level I – Privileged Access (Refer to the SECNAV M-5510.30 for a complete list of roles and responsibilities that qualify as IT Level I Designation – Questions? Contact the IAM/CSM.)

Level II – Limited Privilege, Sensitive Information Access (Most users fall into this category) Level III – Does not exist at NAVAIR.

*Refer to the embedded Word Doc for Designating Sensitive Positions. See below.

27. Verified by: Security Manager/FSO Name

28. Security Manager Phone Number: Official work phone number

29. Security Manager Signature: either manual or digital CAC signature. (If scanned multiple times, ensure Date is legible)

29. Date: DDMMYYYY

Submit the SAAR-N Form

At Patuxent River NAS, submit the completed SAAR-N form & IA Training Certificate, Electronically to the NAVAIR National Help Desk for processing one of two ways:

-via encrypted e-mail to NAVAIR_SAAR@navy.mil -or via Fax (301)995-0285.

-or HelpDesk online: https://nhd.navair.navy.mil

If you have questions, please contact the NAVAIR National Help Desk at 301-342-3104.

Common Reasons the SAAR-N form is Rejected:

Clearance/IT Level/Privileged Access

1. Clearance Level doesn’t meet the minimum requirement for access required.

2. Type of access required doesn’t meet the investigation and IT Designation Level.

3. IT Level Designation is not checked.

4. Requestor requires access to both unclassified and classified – check both blocks, not just Classified.

5. If the requestor requires privileged access, check the box. By policy, the user will have two accounts (one for normal use and a second account for elevated privileges).

6. If Privileged access is required, Block 12a needs to be filled out and the PAA letter should be attached to the SAAR-N form for processing. They must also meet the background investigation requirements for IT-I Privileged Access (i.e., SSBI).

Contractor Specific

7. Contractor supervisor signs Blocks #15 -16b, but the Government Supervisor doesn’t also sign as the Information Owner in Block 17.

8. Contract expiration date is expired.

Other

9. Official Mailing address isn’t for the Program/Competency supported.

10. Official e-mail entered isn’t a .mil address. It is incorrectly entered as a @gmail or @yahoo. If there is no .mil address, leave it blank.

11. Blank or missing information in any section.

a. The only exception is Block 17, Information Owner. Not all systems have an Information Owner and it is OK if this section is blank. The only exception is for contractors who have their contractor supervisor sign the form and also need their Government supervisor to sign. See #5.

12. Verification of Need-to-Know (Block 14) needs to be checked by the Government Supervisor.

Foreign National (FN) SAAR-N Requirements System Name: Required to list the specific systems the FN user will have access to. If the space is not large enough to list all of the systems, write "See attached" and include a document listing all of the systems.

Access Expiration: Expiration date of the FN visit/orders.

Supervisor: FN’s U.S. contact officer.

Security Section: Leave this section blank and send to the 7.4 Foreign Disclosures POC (Mitch Hamrick). The 7.4 Foreign Disclosures representative will complete this section with the required FN visit request information and obtain appropriate Security Manager endorsement.

NAWCAD Patuxent River MD Unclassified/FOUO 11/05/2015 v1.4 image1.emf

NAVAIR_PAA_v4r3_09January2014.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

FOR OFFICIAL USE ONLY

v4.3 09 January 2014

Subj: IA Technical (IAT) Privileged Access Agreement (PAA)

MEMORANDUM

Subj: PAA and Statement of Acceptance of Responsibilities for:

Ref: (a) DoDD 8500.01E, "Information Assurance (IA)," of 24 Oct 2002 (update 23 Apr 2007)

(b) DoDI 8500.2, "IA Implementation," of 6 Feb 2003

(c) DoDI 8510.01, "DoD IA Certification and Accreditation Process (DIACAP)," of 28 Nov 2007

(d) DoD 8570.01, "IA Training, Certification and Workforce Management," of 15 Aug 2004 (update 23

Apr 2007)

(e) DoD 8570.01-M, "IA Workforce Improvement Program," of 19 Dec 2005 (Change 3, 24 Jan 2012)

(f) OPNAVINST 5239.1C, "Navy IA Program," of 20 Aug 2008

(g) SECNAVINST 5239.3B, "Department of the Navy Information Assurance Policy," of 17 Jun 2009

(h) CJCSI 6510.01F, "Information Assurance (IA) and Support to Computer Network Defense (CND)," of

9 Feb 2011

(i) CJCSM 6510.01B, "Cyber Incident Handling Program" of 10 Jul 2012.

(j) SECNAVINST 5239.19, "Department of the Navy Computer Network Incident Response and

Reporting Requirements," of 18 Mar 2008

(k) Navy Telecommunications Directive (NTD) 11-08, “Electronic Spillage Requirements,” of Nov 2008

(l) DoD 5200.2-R, "Personnel Security Program," of 16 Jan 1987 (update 23 Feb 1996)

(m) SECNAVINST 5510.30B, "DON Personnel Security Program," of 6 Oct 2006

(n) SECNAV M-5510.30, "DON Personnel Security Program," of Jun 2006

(o) Security Director, Naval Air Systems Command (AIR 7.4), Memorandum Ser AIR 7.4/7.2 Information

Technology (IT) Position Requirements of 16 Oct 2008

(p) Committee on National Security Systems (CNSS) Instruction 4013, "National Information

Assurance Training Standard for System Administrators," of Mar 2004

Encl: (1) System Authorization Access Request Navy (SAAR-N) OPNAV 5239.14 (Rev 9/2011)

1. In accordance with references (a) through (p), you are hereby appointed to an IA Technical (IAT) position, and are authorized to have privileged access to the system(s) referenced in the subject line of this memorandum, at NAVAIR. Per reference (e), "Personnel in technical category positions must be issued and retain an appointing letter to their IA duties." The statement of responsibilities for the system(s) are listed in paragraph 4, below. Additionally, it is a best practice that the IAO and privileged user positions should be filled separately except for EXTREME operational constraints.

FROM: Information Assurance Manager

2. First and foremost, IAT personnel need to satisfy all responsibilities of an "Authorized User" as defined in paragraph 5.12 of reference (b), where applicable. In addition, a "Privileged User" is responsible for the following duties outlined in paragraph 5.11 of reference (b):

a. Configure and operate IA and IA-enabled technology according to DoD information system IA policies and procedures and notify the Information Assurance Officer (IAO) of any changes that might adversely impact IA.

b. Establish and manage authorized user accounts for DoD information systems, including configuring access controls to enable access to authorized information and removing authorizations when access is no longer needed.

3. As a privileged user, you shall access only that data, control information, software, hardware, and firmware for which you are authorized access and have a need-to-know, and assume only those roles and privileges for which you are authorized. You are required to comply with the security requirements of ref (l) and hold a U.S. Government security clearance commensurate with the level of information processed by the system(s) for which you are responsible. As of the date of this letter, I have verified that you hold a valid

U.S. Government clearance. As a privileged user, you shall maintain a working knowledge of the system or enclave functions, its technical IA safeguards, and its operational IA measures. Per references (n) and (o), privileged users hold Critical Sensitive positions, must have a Single Scope Background Investigation (SSBI), and shall be designated as IT-I Position Category users.

4. In addition to the aforementioned requirements, you shall execute the following Privileged User responsibilities as stated in Appendix 4 to reference (e):

a. Do not introduce or process data or software for the IS that you have not been specifically authorized to handle.

b. Protect all passwords and other authenticators at the highest level of data they secure. Do not share any password(s), account(s), or other authenticators with other coworkers or other personnel not authorized to access the system. As a privileged user, you must understand the need to protect the root password and/or authenticators at the highest level of data it secures. Do NOT share the root password and/or authenticators with coworkers who are not authorized system access.

c. Take responsibility for all actions taken under your account(s), root, or otherwise. Do not attempt to

“hack” the network or any connected information systems, or gain access to data to which you do not have authorized access.

d. Appropriately protect and label all output generated under your account (including printed materials, magnetic tapes, floppy disks, and downloaded hard disk files).

e. Immediately report any indication of computer network intrusion, unexplained degradation or interruption of network services, or the actual or possible compromise of data or file access controls to the appropriate system Information Assurance Officer (IAO). Do NOT install, modify, or remove any hardware or software (i.e. e.g., freeware/shareware and security tools) without written permission and approval from the system IAO.

f. Do not install any unauthorized software (e.g., games, entertainment software) or hardware (e.g., sniffers).

g. Do not add/remove any users’ names to the Domain Administrators, Local Administrator, or Power

Users group without the prior approval and direction of the system IAO.

h. Do not introduce any unauthorized code, Trojan horse programs, malicious code, or viruses into the system.

i. In the case of inadvertent disclosure, per references (i), (j) and (k), it is a requirement to report electronic spillages through the appropriate chain of command and in accordance within the published timeline(s).

j. The following prohibitions apply while using the system:

(1) Introducing Classified and/or Controlled Unclassified Information (CUI) into a NIPRNet environment.

(2) Accessing, storing, processing, displaying, distributing, transmitting, or viewing material that is abusive, harassing, defamatory, vulgar, pornographic, profane, or racist; that promotes hate crimes, or is subversive or objectionable by nature, including material encouraging criminal activity, or violation of local, state, federal, national, or international law.

(3) Storing, accessing, processing, or distributing Classified, Proprietary, CUI, For Official Use Only

(FOUO), or Privacy Act protected information in violation of established security and information release policies.

(4) Obtaining, installing, copying, pasting, transferring, or using software or other materials obtained in violation of the appropriate vendor’s patent, copyright, trade secret, or license agreement.

(5) Knowingly writing, coding, compiling, storing, transmitting, or transferring malicious software code, to include viruses, logic bombs, worms, and macro viruses.

(6) Engaging in prohibited political activity.

(7) Using the system for personal financial gain such as advertising or solicitation of services or sale of personal property (e.g., eBay), or stock trading (i.e., issuing buy, hold, and/or sell directions to an online broker).

(8) Fundraising activities, either for profit or non-profit, unless the activity is specifically approved by the organization (e.g., organization social event fund raisers and charitable fund raisers, without approval).

(9) Gambling, wagering, or placing of any bets.

(10) Writing, forwarding, or participating in chain letters.

(11) Posting personal home pages.

(12) Any other actions prohibited by DoD 5500.7-R or any other DoD issuances.

k. Personal encryption of electronic communications is strictly prohibited and can result in the immediate termination of access.

l. Do not allow any user who is not cleared access to the network or any other connected system without prior approval or specific guidance from the IAO.

m. Use the special access or privileges granted to ONLY to perform authorized tasks or mission related functions.

n. Do not use any NAVAIR owned information system to violate software copyright by making illegal copies of software.

o. ONLY use the PRIVILEGED USER account for official administrative actions. This account will NOT be used for day to day network communications.

p. Failure to comply with the above requirements will be reported and may result in the following actions:

(1) Revocation of IS privileged access.

(2) Counseling.

(3) Adverse actions pursuant to the Uniform Code of Military Justice and/or criminal prosecution.

(4) Disciplinary action, discharge or loss of employment.

(5) Revocation of Security Clearance.

q. Obtain and maintain required certification(s), according to reference (e) and the certification provider, to retain privileged system access.

r. Respond to Information Assurance Vulnerability Alerts (IAVA), Information Assurance Vulnerability

Bulletins (IAVBs), and other vulnerability notifications by obtaining and installing system patches, making procedural changes, and reporting IAVA compliance to the IAO. To be added to the System

Administrator distribution listing for satisfying the IAVM requirements, please contact your local IA office.

s. In coordination with the Information Assurance Officer(s), administer user identification and authentication mechanism(s) of the information system or network.

t. Attend required technical (e.g., operating system, networking, or system administration) and security

(e.g., security management) training relative to assigned duties. Reference (p) establishes the minimum course content or standard for the development and implementation of IA training for system administrators.

5. The NAVAIR DCIO for Information Assurance is Darryl S. Allen. Please contact your IA Office by e-mail or phone for specific guidance and documentation on the IA program.*

IAT Acknowledgement: As the privileged user assigned to the system(s) in the subject line on the first page of this memo, I agree to the above listed responsibilities.

Copy to:

726100

* Once the Program Manager & IAT have digitally signed this form, please Save As > LastNameFirstNameInitial_PAALetter.pdf.

(Enter 10 digits without hyphens or spaces)

(Enter 10 digits without hyphens or spaces)

INFORMATION ASSURANCE WORKFORCE QUESTIONNAIRE

* If you fulfill a Computer Network Defense (CND) or Information Assurance System Architect and Engineer (IASAE) role, please contact the IA Office for assistance.

****Please scan any certificate(s) and attach with this form and e-mail to your local IA office.****

(Enter 10 digits without hyphens or spaces)

If your certification has not been obtained, please indicate month/year you expect to be compliant:

Please identify IA certification & OS/CE qualifications below based on your Information Assurance Technical (IAT) Level.*

(Enter 10 digits without hyphens or spaces)

8.0.1291.1.339988.308172

07 July 2009

NAVAIR/NAWCAD IAO Appt Letter Form

NAWCAD-7.2.6

Information Assurance Officer Appointment Letter

DateTimeField1:

TextField1: Individual's Name and Code

TextField1: (Print Name)

TextField1: (Print Name)

TextField1: (Print Name)

TextField1: (Print Name)

TextField1: (Print Name)

TextField2: PMA/NAVAIR/NAWC Competency Code

TextField2: System/Network/Program Name(s)

TextField2: eMASS# / System ID

DropDownList1:

email:

PhoneNum:

SignatureField1:

DateTimeField2:

CheckBox10: 0

CheckBox10: 0

TextField3:

DropDownList2:

DropDownList3:

image2.emf

How to complete the IA Technical (IAT) Privileged Access Agreement (PAA) Form DRAFT.docx

How to complete the IA Technical (IAT) Privileged Access Agreement (PAA) Form

PAA Requirements:

SAAR-N-

· Privileged must be marked in block 12

· Block 12a must be dated

· Block 26 must be SSBI or equivalent

· Block 26b must be Secret or Top Secret

· Block 26c must be marked IT Level 1

PAA -

· Date must be completed

· To: must be completed

· PMA or Competency must be completed

· System Name must be completed

· eMASS number must be filled in

· Clearance Level on page 2 must be completed and match block 26b on SAAR-N

· Page 4 must be signed by IAM, IAT and Competency/Team Leader or Program Manager

· IAT Level must be filled in

· Baseline IA Certification and OS/CE Certification/Qualification Achieved must be completed

· IF, there are no OS/CE Certification/Qualification Achieved, the date when the IAT will be compliant must be filled in and should be within 6 months of the date the PAA is signed. And the IAT and Competency/Team Leader or Program Manager MUST SIGN PAGE 5 image3.emf

How to Designate Sensitive Positions - SECNAV5510.30.docx

SECNAV M-5510.30

June 2006

5-3 CRITERIA FOR DESIGNATING SENSITIVE POSITIONS

1. The following criteria for designating position sensitivity for DON employees is based on OPM and DoD criteria. The criteria for designating IT position sensitivity is based on OMB criteria, DoD criteria, and DON requirements:

a. Special-Sensitive (SS): Any position which the head of the agency determines to be at a level higher than critical sensitive:

(1) Due to the greater degree of damage to the national security that an individual could effect by virtue of his/her position, or

(2) Special requirements concerning the position under authority other than EO 10450, such as designations applied under SSO cognizance pertaining to DCID 6/4.

(3) DAAs shall be designated as special-sensitive

(SS), due to the degree of damage an individual could effect by virtue of his/her position, including those IT duties in which the incumbent has:

(a) Responsibility for planning, direction and implementation of a major (DON-wide or DoD-wide) IT security program; has responsibility for direction, planning, and design of a major (DON-wide or DoD-wide) computer system, including the hardware and software; or can access a major (DON-wide or DoDwide) system during the operation or maintenance in such a way and with relatively high risk for causing inestimable damage or realizing extreme personal gain, or

(b) DAA.

b. Critical-Sensitive (CS): Any position that includes:

(1) Access to Top Secret national security information.

(2) Development or approval of plans, policies, or programs which affect the overall operations of the DON (e.g., policy making or policy determining positions).

(3) Development or approval of war plans, plans or particulars of future major or special operations of war, or critical and extremely important items of war.

(4) Investigative and certain investigative support duties, the issuance of personnel security clearances or access authorizations, or the making of personnel security determinations.

(5) Fiduciary, public contact, or other duties demanding the highest degree of public trust. (Fiduciary duties involving IT systems are also designated as IT positions as described below.)

(6) Certain IT positions will be designated as CS, and IT-I, due to the potential for grave damage to the national security. CS IT-I positions include those in which the incumbent has:

(a) Responsibility for development and administration of computer security programs, and also including direction and control of risk analysis and/or threat assessment.

(b) Been designated as IAM or IAO.

(c) Significant involvement in life-critical or mission-critical systems.

(d) Responsibility for the preparation or approval of data for input into a system which does not necessarily involve personal access to the system, but with relatively high risk for effecting grave damage or realizing significant personal gain.

(e) Relatively high risk assignments associated with or directly involving the accounting, disbursement or authorization for disbursement from systems of (1) dollar amounts of $10 million per year or greater, or (2) lesser amounts if the activities of the individual are not subject to technical review by a higher authority in the IT-I category to insure the integrity of the system.

(f) Positions involving major responsibility for the direction, planning, design, testing, maintenance, operation, monitoring and/or management of systems hardware and software.

(g) Other IT positions as designated by the agency head that involve relatively high risk for effecting grave damage or realizing significant personal gain.

(7) Any other position so designated by the SECNAV and/or his designee.

c. Noncritical-Sensitive (NCS): Any position that involves:

(1) Access to Secret or Confidential national security information.

(2) Assignment to duties involving the protection and safeguarding of DON personnel and property (e.g., security police, provost marshal, duties associated with ammunitions and explosives).

(3) Duties involving education and orientation of DoD personnel.

(4) Duties involving the design, operation, or maintenance of intrusion detection systems deployed to safeguard

DON personnel and property.

(5) Responsibility for financial operations subject to routine supervision or approval, but with no funds disbursement or transfer capabilities. (Fiduciary duties involving IT systems are also designated as IT positions as described below.)

(6) Non-management DON mission support positions with authority for independent or semi-independent action.

(7) Duties involving delivery of service to support the DON mission requiring confidence or trust.

(8) Certain IT positions will be designated as NCS, and IT-II, due to the potential for serious damage to the national security. NCS IT-II positions include those in which the incumbent has:

(a) Responsibility for systems design, operations, testing, maintenance, and/or monitoring that is carried out under technical review of higher authority in the CS

IT-I category.

(b) Access to and/or processing of proprietary data, information requiring protection under the Privacy Act of

1974, sensitive information, and Government-developed privileged information involving the award of contracts; including user level access to DON or DoD networks and information systems, system security and network defense systems, or to system resources providing visual access and/or ability to input, delete or otherwise manipulate sensitive information without controls to identify and deny sensitive information.

(c) Duties associated with or directly involving the accounting, disbursement or authorization for disbursement of funds in dollar amounts of less than $10 million per year;

and/or duties that involve the development, writing and administration of, and/or awarding, approving or modifying of contracts which total dollar amounts less than $10 million per year; or as deemed appropriate by the agency head those commensurate fiscal duties with potential for damage or personal gain.

(d) Other positions as designated by the agency head that involve a degree of access to a system that creates a potential for serious damage or personal gain less than that in

CS IT-I positions.

d. Non Sensitive (NS): Only those:

(1) Positions with limited relation to the DON mission, devoid of 5 CFR 732 security risk criteria and 5 CFR

731 public trust risk criteria will be designated as non sensitive.

(2) IT-III positions are designated as Non Sensitive

(NS), and are dependent upon very rigorous IT controls to remain non-sensitive and to:

(a) Preclude access to system security and network defense systems, or to system resources;

(b) Preclude visual access to proprietary data, information requiring protection under the Privacy Act of 1974, government-developed privileged information involving the award of contracts, and other protected sensitive information.

(c) Preclude ability to input, delete or otherwise manipulate protected sensitive information.

(d) Except in those cases where sensitive information (e.g., privacy act data but not government furnished information) is stored in contractor-owned and operated computer networks and databases with no interconnection (including data feeds) to DON IT systems or networks, may use other safeguards as authorized by applicable guidance, in lieu of these position designation requirements.

2. Commanding officers are responsible for ensuring that positions that meet the above criteria are properly designated as sensitive. The majority of DON positions are sensitive due to the DON’s national security mission.

How to Designate Sensitive Positions - SECNAV5510.30.docx

SECNAV M-5510.30

June 2006

5-3 CRITERIA FOR DESIGNATING SENSITIVE POSITIONS

1. The following criteria for designating position sensitivity for DON employees is based on OPM and DoD criteria. The criteria for designating IT position sensitivity is based on OMB criteria, DoD criteria, and DON requirements:

a. Special-Sensitive (SS): Any position which the head of the agency determines to be at a level higher than critical sensitive:

(1) Due to the greater degree of damage to the national security that an individual could effect by virtue of his/her position, or

(2) Special requirements concerning the position under authority other than EO 10450, such as designations applied under SSO cognizance pertaining to DCID 6/4.

(3) DAAs shall be designated as special-sensitive

(SS), due to the degree of damage an individual could effect by virtue of his/her position, including those IT duties in which the incumbent has:

(a) Responsibility for planning, direction and implementation of a major (DON-wide or DoD-wide) IT security program; has responsibility for direction, planning, and design of a major (DON-wide or DoD-wide) computer system, including the hardware and software; or can access a major (DON-wide or DoDwide) system during the operation or maintenance in such a way and with relatively high risk for causing inestimable damage or realizing extreme personal gain, or

(b) DAA.

b. Critical-Sensitive (CS): Any position that includes:

(1) Access to Top Secret national security information.

(2) Development or approval of plans, policies, or programs which affect the overall operations of the DON (e.g., policy making or policy determining positions).

(3) Development or approval of war plans, plans or particulars of future major or special operations of war, or critical and extremely important items of war.

(4) Investigative and certain investigative support duties, the issuance of personnel security clearances or access authorizations, or the making of personnel security determinations.

(5) Fiduciary, public contact, or other duties demanding the highest degree of public trust. (Fiduciary duties involving IT systems are also designated as IT positions as described below.)

(6) Certain IT positions will be designated as CS, and IT-I, due to the potential for grave damage to the national security. CS IT-I positions include those in which the incumbent has:

(a) Responsibility for development and administration of computer security programs, and also including direction and control of risk analysis and/or threat assessment.

(b) Been designated as IAM or IAO.

(c) Significant involvement in life-critical or mission-critical systems.

(d) Responsibility for the preparation or approval of data for input into a system which does not necessarily involve personal access to the system, but with relatively high risk for effecting grave damage or realizing significant personal gain.

(e) Relatively high risk assignments associated with or directly involving the accounting, disbursement or authorization for disbursement from systems of (1) dollar amounts of $10 million per year or greater, or (2) lesser amounts if the activities of the individual are not subject to technical review by a higher authority in the IT-I category to insure the integrity of the system.

(f) Positions involving major responsibility for the direction, planning, design, testing, maintenance, operation, monitoring and/or management of systems hardware and software.

(g) Other IT positions as designated by the agency head that involve relatively high risk for effecting grave damage or realizing significant personal gain.

(7) Any other position so designated by the SECNAV and/or his designee.

c. Noncritical-Sensitive (NCS): Any position that involves:

(1) Access to Secret or Confidential national security information.

(2) Assignment to duties involving the protection and safeguarding of DON personnel and property (e.g., security police, provost marshal, duties associated with ammunitions and explosives).

(3) Duties involving education and orientation of DoD personnel.

(4) Duties involving the design, operation, or maintenance of intrusion detection systems deployed to safeguard

DON personnel and property.

(5) Responsibility for financial operations subject to routine supervision or approval, but with no funds disbursement or transfer capabilities. (Fiduciary duties involving IT systems are also designated as IT positions as described below.)

(6) Non-management DON mission support positions with authority for independent or semi-independent action.

(7) Duties involving delivery of service to support the DON mission requiring confidence or trust.

(8) Certain IT positions will be designated as NCS, and IT-II, due to the potential for serious damage to the national security. NCS IT-II positions include those in which the incumbent has:

(a) Responsibility for systems design, operations, testing, maintenance, and/or monitoring that is carried out under technical review of higher authority in the CS

IT-I category.

(b) Access to and/or processing of proprietary data, information requiring protection under the Privacy Act of

1974, sensitive information, and Government-developed privileged information involving the award of contracts; including user level access to DON or DoD networks and information systems, system security and network defense systems, or to system resources providing visual access and/or ability to input, delete or otherwise manipulate sensitive information without controls to identify and deny sensitive information.

(c) Duties associated with or directly involving the accounting, disbursement or authorization for disbursement of funds in dollar amounts of less than $10 million per year;

and/or duties that involve the development, writing and administration of, and/or awarding, approving or modifying of contracts which total dollar amounts less than $10 million per year; or as deemed appropriate by the agency head those commensurate fiscal duties with potential for damage or personal gain.

(d) Other positions as designated by the agency head that involve a degree of access to a system that creates a potential for serious damage or personal gain less than that in

CS IT-I positions.

d. Non Sensitive (NS): Only those:

(1) Positions with limited relation to the DON mission, devoid of 5 CFR 732 security risk criteria and 5 CFR

731 public trust risk criteria will be designated as non sensitive.

(2) IT-III positions are designated as Non Sensitive

(NS), and are dependent upon very rigorous IT controls to remain non-sensitive and to:

(a) Preclude access to system security and network defense systems, or to system resources;

(b) Preclude visual access to proprietary data, information requiring protection under the Privacy Act of 1974, government-developed privileged information involving the award of contracts, and other protected sensitive information.

(c) Preclude ability to input, delete or otherwise manipulate protected sensitive information.

(d) Except in those cases where sensitive information (e.g., privacy act data but not government furnished information) is stored in contractor-owned and operated computer networks and databases with no interconnection (including data feeds) to DON IT systems or networks, may use other safeguards as authorized by applicable guidance, in lieu of these position designation requirements.

2. Commanding officers are responsible for ensuring that positions that meet the above criteria are properly designated as sensitive. The majority of DON positions are sensitive due to the DON’s national security mission.