Att_J-10_SAAR-N_Guide.docx

Unclassified/FOUO Completion Instructions for the SAAR-N (OPNAV 5239/14 (Rev 9/2011))

Once the SAAR-N is complete, send it and your IA Training Certificate to the NAVAIR Help Desk via:

- e-mail: navair_SAAR@navy.mil

- or Fax: (301)995-0285

- or HelpDesk online: https://nhd.navair.navy.mil

Type of Request:

(*if an account already exists- but needs some kind of change/update)

Date: DDMMMYYYY Format (*REQUIRED) System Name (Platform or Application): This has to be specific – “all IT systems” is not acceptable. List the systems the individual will have access to, such as: NMCI NIPRNet, SIPRNet, SDREN, DREN, RDT&E Lab Name, Navy ERP, AIM, COLTS, etc. If more space is needed, continue in Block 11 for systems.

Location: Your physical location. i.e, NAS Patuxent River, Bldg 1490, Room 54, Cube 1A (If requesting multiple systems access – use the location of the primary system being used.)

Part I - Completed by the Requestor

1. Name: Last, First MI (if no middle name, use “NMN”)

2. Organization: Command – NAWCAD or NAVAIR

a. **For contractors: Command/Program Supported

3. Office Symbol/Department: Program Office/Competency Being Supported – PMA-### or Code

4. Phone: Work Number ONLY

5. Official E-Mail Address: .mil work e-mail address only.

a. If an @navy.mil account doesn’t exist yet - leave blank

b. **If you’re an external customer requiring access to government systems, and will NEVER have a .mil address, please use your company’s email address.

6. Job Title and Grade/Rank: Title & Grade of your specific position

a. Job title only necessary for contractors

7. Official Mailing Address: Official COMMAND mailing address for your Bldg

8. Citizenship: Choose ONE only- US, FN, LN, Other_______

a. If you select FN- See page 4 for amplifying instructions

9. Designation of Person: Choose ONE only- Military, Civilian, or Contractor

10. IA Awareness Training: This must be completed before a SAAR-N will be approved.

a. Check the box and enter date training was taken. ***Include the certificate of completion when you submit the SAAR-N form.*** Training must be taken within the current Fiscal Year (i.e., October 1st to September 30th).

*For individuals without CAC PKI, training can be accessed from any non-DoD computer at: http://iase.disa.mil/eta/index.html. Select Cyber Awareness Challenge and print certificate.

Requestor- Continue on Page 3

22. Requestor must read this section and acknowledge that they understand the rules for maintaining access to Government IT systems by signing Block 24 on the next page.

23. Name: Last, First MI (if no middle name, use NMN)

24. User’s Signature: either manual or digital CAC signature

25. Date Signed: DDMMYYYY (If scanned multiple times, ensure Date is legible) Part II – Endorsement of Access by Information Owner, User Supervisor, and Government Sponsor

11. Justification for Access: Write in the box “To gain access to Navy IT resources in support of duties on a need to know basis.” *Include additional systems in this block, if applicable.

12. Type of Access Required: Check one- “Authorized” or “Privileged”. Most users will be Authorized. Privileged users will be based on Position Description (PD) or job description.

12a. Privileged users need to include the Privileged Access Agreement (PAA) form.

13. User Access Required: Check- Unclassified or Classified. If a user is requesting access to both classified and unclassified, check both boxes. If accessing classified information, please specify the category of data (e.g., Secret).

14. Verification of Need-to-Know: Box must be checked. As the supervisor you are acknowledging the user’s appropriate level of need-to-know.

14a. Access Expiration Date: **Required for Contractors** Specify Company Name, Contract Number, Expiration Date

15. Supervisor’s Organization/Department: Command, Office Code. i.e, NAWCAD 7.2.3. This should correlate with Line 16 and be the Government Supervisor. If the Contractor Supervisor signs in this block, then the government supervisor must additionally sign as the Information Owner in Block 17.

15a. Supervisor’s E-mail: Official .mil account 15b. Supervisor’s Phone: Official work phone number

16. Supervisor’s Name: Last, First. Can be the government or contractor supervisor (*contractors can use the COR, direct government supervisor or TPOC). If the contractor supervisor signs the form, then the government supervisor must sign as the Information Owner in Block 17.

16a. Supervisor’s Signature: either manual or digital CAC signature.

16b. Date: DDMMYYYY (If scanned multiple times, ensure Date is legible)

17. Signature of Information Owner: The Information owner of a specific system (i.e., Navy ERP, Lab x, Website x). Refer to the system(s) being requested above. If a Contractor Supervisor signed in Block 16, then the Government Supervisor (TPOC, COR, or direct government supervisor) must sign as the Information Owner.

18. Signature of IAM or Appointee: Leave blank, unless the following exist:

a. Information Owner of the System/PMA has a government IAM or,

b. System/SAAR-N is maintained at the PMA/Lab level. This is typically the case with smaller standalone systems.

****The IAM/PMA IAM will have the last signature on the OPNAV 5239/14 Rev 9/2011****

19. Organization/Department: Command – NAWCAD or NAVAIR

20. Phone Number: Official work phone number

21. Date: DDMMMYYYY If Civilian or Military- Supervisor Completes Part III, #26c 26c. IT Level Designation: Based on position Sensitivity (Critical, Non-Critical, Non-Sensitive – refer to Position Description for Government) Level I – Privileged Access (Refer to the SECNAV M-5510.30 for a complete list of roles and responsibilities that qualify as IT Level I Designation – Questions? Contact the IAM/CSM.)

Level II – Limited Privilege, Sensitive Information Access (Most users fall into this category) Level III – Does NOT exist at NAVAIR *Refer to the embedded Word Doc for Designating Sensitive Positions. See below.

Part III - Security Manager Validates the Background Investigation or Clearance Information Civilian or Military- upon completing Parts I, II & 26c in Part II, e-mail or Fax the SAAR-N & IA Training Certificate to the NAVAIR National Help Desk for 7.4 Security to complete Part III. navair_saar@navy.mil or (301)995-0285 Contractor- upon completing Parts I & II, submit the form to your company’s Facility Security Officer (FSO) or Security Manager for processing. Once they have completed Part III, then e-mail or FAX the SAAR-N & IA Training Certificate to the NAVAIR National Help Desk for final processing and approval. navair_saar@navy.mil or (301)995-0285

26. Type of Investigation: ANACI, NACI, NAC, NACLC, SSBI, SSBI-PR, PPR 26a. Date of Investigation: DDMMYYYY *Can be up to two years past the expiration date if no break in service 26b. Clearance Level: TS, Secret, Confidential, Interim clearance, Favorable, None 26c. IT Level Designation: Based on position sensitivity (Critical Sensitive, Non-Critical Sensitive, Non-Sensitive – refer to Position Description for Government) Level I – Privileged Access (Refer to the SECNAV M-5510.30 for a complete list of roles and responsibilities that qualify as IT Level I Designation – Questions? Contact the IAM/CSM.)

Level II – Limited Privilege, Sensitive Information Access (Most users fall into this category) Level III – Does not exist at NAVAIR.

*Refer to the embedded Word Doc for Designating Sensitive Positions. See below.

27. Verified by: Security Manager/FSO Name

28. Security Manager Phone Number: Official work phone number

29. Security Manager Signature: either manual or digital CAC signature. (If scanned multiple times, ensure Date is legible)

29. Date: DDMMYYYY

Submit the SAAR-N Form

At Patuxent River NAS, submit the completed SAAR-N form & IA Training Certificate, Electronically to the NAVAIR National Help Desk for processing one of two ways:

-via encrypted e-mail to NAVAIR_SAAR@navy.mil -or via Fax (301)995-0285.

-or HelpDesk online: https://nhd.navair.navy.mil

If you have questions, please contact the NAVAIR National Help Desk at 301-342-3104.

Embedded Doc explaining IT Level Designations:

Common Reasons the SAAR-N form is Rejected:

Clearance/IT Level/Privileged Access

1. Clearance Level doesn’t meet the minimum requirement for access required.

2. Type of access required doesn’t meet the investigation and IT Designation Level.

3. IT Level Designation is not checked.

4. Requestor requires access to both unclassified and classified – check both blocks, not just Classified.

5. If the requestor requires privileged access, check the box. By policy, the user will have two accounts (one for normal use and a second account for elevated privileges).

6. If Privileged access is required, Block 12a needs to be filled out and the PAA letter should be attached to the SAAR-N form for processing. They must also meet the background investigation requirements for IT-I Privileged Access (i.e., SSBI).

Contractor Specific

7. Contractor supervisor signs Blocks #15 -16b, but the Government Supervisor doesn’t also sign as the Information Owner in Block 17.

8. Contract expiration date is expired.

Other

9. Official Mailing address isn’t for the Program/Competency supported.

10. Official e-mail entered isn’t a .mil address. It is incorrectly entered as a @gmail or @yahoo. If there is no .mil address, leave it blank.

11. Blank or missing information in any section.

a. The only exception is Block 17, Information Owner. Not all systems have an Information Owner and it is OK if this section is blank. The only exception is for contractors who have their contractor supervisor sign the form and also need their Government supervisor to sign. See #5.

12. Verification of Need-to-Know (Block 14) needs to be checked by the Government Supervisor.

Foreign National (FN) SAAR-N Requirements System Name: Required to list the specific systems the FN user will have access to. If the space is not large enough to list all of the systems, write "See attached" and include a document listing all of the systems.

Access Expiration: Expiration date of the FN visit/orders.

Supervisor: FN’s U.S. contact officer.

Security Section: Leave this section blank and send to the 7.4 Foreign Disclosures POC (Mitch Hamrick). The 7.4 Foreign Disclosures representative will complete this section with the required FN visit request information and obtain appropriate Security Manager endorsement.

NAWCAD Patuxent River MD Unclassified/FOUO 9/15/2014 v1.1 image1.emf

How to Designate Sensitive Positions - SECNAV5510.30.docx

SECNAV M-5510.30

June 2006

5-3 CRITERIA FOR DESIGNATING SENSITIVE POSITIONS

1. The following criteria for designating position sensitivity for DON employees is based on OPM and DoD criteria. The criteria for designating IT position sensitivity is based on OMB criteria, DoD criteria, and DON requirements:

a. Special-Sensitive (SS): Any position which the head of the agency determines to be at a level higher than critical sensitive:

(1) Due to the greater degree of damage to the national security that an individual could effect by virtue of his/her position, or

(2) Special requirements concerning the position under authority other than EO 10450, such as designations applied under SSO cognizance pertaining to DCID 6/4.

(3) DAAs shall be designated as special-sensitive

(SS), due to the degree of damage an individual could effect by virtue of his/her position, including those IT duties in which the incumbent has:

(a) Responsibility for planning, direction and implementation of a major (DON-wide or DoD-wide) IT security program; has responsibility for direction, planning, and design of a major (DON-wide or DoD-wide) computer system, including the hardware and software; or can access a major (DON-wide or DoDwide) system during the operation or maintenance in such a way and with relatively high risk for causing inestimable damage or realizing extreme personal gain, or

(b) DAA.

b. Critical-Sensitive (CS): Any position that includes:

(1) Access to Top Secret national security information.

(2) Development or approval of plans, policies, or programs which affect the overall operations of the DON (e.g., policy making or policy determining positions).

(3) Development or approval of war plans, plans or particulars of future major or special operations of war, or critical and extremely important items of war.

(4) Investigative and certain investigative support duties, the issuance of personnel security clearances or access authorizations, or the making of personnel security determinations.

(5) Fiduciary, public contact, or other duties demanding the highest degree of public trust. (Fiduciary duties involving IT systems are also designated as IT positions as described below.)

(6) Certain IT positions will be designated as CS, and IT-I, due to the potential for grave damage to the national security. CS IT-I positions include those in which the incumbent has:

(a) Responsibility for development and administration of computer security programs, and also including direction and control of risk analysis and/or threat assessment.

(b) Been designated as IAM or IAO.

(c) Significant involvement in life-critical or mission-critical systems.

(d) Responsibility for the preparation or approval of data for input into a system which does not necessarily involve personal access to the system, but with relatively high risk for effecting grave damage or realizing significant personal gain.

(e) Relatively high risk assignments associated with or directly involving the accounting, disbursement or authorization for disbursement from systems of (1) dollar amounts of $10 million per year or greater, or (2) lesser amounts if the activities of the individual are not subject to technical review by a higher authority in the IT-I category to insure the integrity of the system.

(f) Positions involving major responsibility for the direction, planning, design, testing, maintenance, operation, monitoring and/or management of systems hardware and software.

(g) Other IT positions as designated by the agency head that involve relatively high risk for effecting grave damage or realizing significant personal gain.

(7) Any other position so designated by the SECNAV and/or his designee.

c. Noncritical-Sensitive (NCS): Any position that involves:

(1) Access to Secret or Confidential national security information.

(2) Assignment to duties involving the protection and safeguarding of DON personnel and property (e.g., security police, provost marshal, duties associated with ammunitions and explosives).

(3) Duties involving education and orientation of DoD personnel.

(4) Duties involving the design, operation, or maintenance of intrusion detection systems deployed to safeguard

DON personnel and property.

(5) Responsibility for financial operations subject to routine supervision or approval, but with no funds disbursement or transfer capabilities. (Fiduciary duties involving IT systems are also designated as IT positions as described below.)

(6) Non-management DON mission support positions with authority for independent or semi-independent action.

(7) Duties involving delivery of service to support the DON mission requiring confidence or trust.

(8) Certain IT positions will be designated as NCS, and IT-II, due to the potential for serious damage to the national security. NCS IT-II positions include those in which the incumbent has:

(a) Responsibility for systems design, operations, testing, maintenance, and/or monitoring that is carried out under technical review of higher authority in the CS

IT-I category.

(b) Access to and/or processing of proprietary data, information requiring protection under the Privacy Act of

1974, sensitive information, and Government-developed privileged information involving the award of contracts; including user level access to DON or DoD networks and information systems, system security and network defense systems, or to system resources providing visual access and/or ability to input, delete or otherwise manipulate sensitive information without controls to identify and deny sensitive information.

(c) Duties associated with or directly involving the accounting, disbursement or authorization for disbursement of funds in dollar amounts of less than $10 million per year;

and/or duties that involve the development, writing and administration of, and/or awarding, approving or modifying of contracts which total dollar amounts less than $10 million per year; or as deemed appropriate by the agency head those commensurate fiscal duties with potential for damage or personal gain.

(d) Other positions as designated by the agency head that involve a degree of access to a system that creates a potential for serious damage or personal gain less than that in

CS IT-I positions.

d. Non Sensitive (NS): Only those:

(1) Positions with limited relation to the DON mission, devoid of 5 CFR 732 security risk criteria and 5 CFR

731 public trust risk criteria will be designated as non sensitive.

(2) IT-III positions are designated as Non Sensitive

(NS), and are dependent upon very rigorous IT controls to remain non-sensitive and to:

(a) Preclude access to system security and network defense systems, or to system resources;

(b) Preclude visual access to proprietary data, information requiring protection under the Privacy Act of 1974, government-developed privileged information involving the award of contracts, and other protected sensitive information.

(c) Preclude ability to input, delete or otherwise manipulate protected sensitive information.

(d) Except in those cases where sensitive information (e.g., privacy act data but not government furnished information) is stored in contractor-owned and operated computer networks and databases with no interconnection (including data feeds) to DON IT systems or networks, may use other safeguards as authorized by applicable guidance, in lieu of these position designation requirements.

2. Commanding officers are responsible for ensuring that positions that meet the above criteria are properly designated as sensitive. The majority of DON positions are sensitive due to the DON’s national security mission.