Attachment 06_Cybersecurity Plan.pdf

Controlled Unclassified Information / FOUO

NAVAIR Patuxent River Naval Air Station

Department of the Navy

CONTRACT

ATTACHMENT (06)

Cyber Security Plan

(CSP)

Dated: 1 January 2017

Version 4.0

Approved by: _____________________________

PISSM Name

Program Information System Security Manager

NAVAIR-7.2.6

DISTRIBUTION STATEMENT D: Distribution authorized to DoD and U.S. DoD contractors only. Other requests shall be referred to Department of the Navy, NAVAIR, Program Information System Security Manager, Patuxent River, MD 20670-1547.

DESTRUCTION NOTICE

Destroy by any method that will prevent disclosure of contents or reconstruction of the document.

The content of this Cyber Security Plan (CSP) has been established for the protection of Government data. Per Department of Defense

Instruction (DoDI) 8582.01, industry partners are subject to the following requirements in order to establish a consistent and unified strategy for Government data protection. These requirements must be flowed down to any sub-contractors, suppliers and organizations that process Government data.

This CSP has further been established for the protection of all information being exchanged within this contract. The CSP also establishes the protection requirements of Government data that is processed by any “System” or “software’ that will be delivered to

Government.

Per DFARS SUBPART 204.73, Covered Defense Information (CDI) is considered unclassified information. Per Presidential

Directive Order 13556, November 2010 Controlled Unclassified Information (CUI) replaces categories and terms of unclassified information such as For Official Use Only (FOUO), Sensitive But Unclassified (SBU) and Law Enforcement Sensitive (LES) with the intent of utilizing a single term to improve uniformity across all Federal agencies. As CDI is a term for unclassified information it falls under the definition of CUI. CDI then must be treated as CUI. All unclassified information on this contract is considered

Controlled Unclassified Information (CUI) unless specifically released and labeled as “Public” information by a Government Public

Affairs Officer (PAO).

The contractor shall establish the Cyber Security (CS) Program pursuant to the requirements designated below. Furthermore the contractor shall address each of the requirements in this CS Plan within a Program Cyber Security Implementation Plan (PCSIP) utilizing Data Item Description (DID): DI-MGMT-82002 “NAVAIR Cyber security Implementation Plan” (CDRL A004, Cyber

Security Implementation Plan). The Program CSIP shall serve as basis for establishing a cybersecurity baseline between this industry partner and the NAVAIR 6.8 Corporate Business Office (CBO). Once approved by the Government the Program CSIP is intended to be utilized by other group/entities that are part of this industry partner. This is intended to not cause duplication of submitting a

Program CSIP for each and every follow-up contract or delivery order. The Program CSIP will include a “roll up” of all applicable sub-contractors, suppliers, and other organizations that process Government data under this contract.

The Government will provide all necessary reference documents or electronic links to those documents not generally available to the industry partner as required. Throughout the life of the contract, if any instruction or document is replaced or superseded, the replacement or superseding instruction or document shall be applicable to the requirements defined in this CSP.

All CS authority within a program office rests with the civilian Program Information System Security Manager (PISSM). This authority has been designated via an appointment letter by the CS competency and the Program Manager. Questions regarding the requirements set forth in this CS Plan must be directed to the PISSM.

A.

CYBER SECURITY

Cyber Security (CS) is the discipline that protects and defends information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. These measures include providing for restoration of information systems by incorporating protection, detection, and reaction capabilities. The following paragraphs contain United States Public Law as well as Department of Defense (DoD) and Department of the Navy (DON) CS requirements. These CS requirements stem from various DoD, Secretary of the Navy (SECNAV), Office of the Chief of Naval Operations (OPNAV), and Naval Air Systems Command

(NAVAIR) policies, directives, and instructions. United States Government herein described as "Government" officials have the authority to review and examine, in conjunction with contractor personnel, the CS controls on any contractor operated system containing government information for the purposes of ascertaining proper CS posture and implementation.

B.

ARCHITECTURE

The contractor’s network architecture shall maximize the use of the contractor’s existing infrastructure and that of its subcontractors, suppliers via the commercial Internet in order to maintain compatibility with the U.S. Government Wide Area Networks (WANs), such as NIPRNET, DREN, and NMCI. The contractor shall continue to utilize a network architecture which supports the mission needs of Navy/USMC Programs for the purposes of interoperability while maintaining the quality and timeliness of the technical information, data access, and delivery. The contractor shall utilize all observed network trends for the purposes of ascertaining the successful accomplishment of the preceding. The contractor shall make adjustments to its network infrastructure on an as needed basis for the purposes of meeting the mission requirements. Security measures shall be put in place in accordance with SECNAVINST

5239.3B, OPNAVINST 5239.3A, CJCSI 6211.02D, DoDI 8500.2, DoDI 8510.01, NIST 800-53 and DoDI 8520.02.

C.

CYBER SECURITY PRACTICES

The contractor shall adhere to the Department of the Navy’s (DON)’s Cyber Security Program prescribed methodologies for the protection of information to support DON missions. The contractor shall utilize existing methods and processes in order to deliver secure, interoperable and integrated information management (IM) and information technology (IT) to the DON and its contract support. The contractor shall ensure that all IT systems, software and interfaces that contain Government data meet government security certification standards and requirements appropriate to the particular classification level of operation as specified by the US

Navy, Department of Defense, or other cognizant government authority for the purposes of the above mentioned DON goals in accordance with SECNAV M-5239.1. DON CS Program policies are listed in the REFERENCES section.

D.

PUBLIC KEY INFRASTRUCTURE (PKI):

Public Key Infrastructure (PKI) encryption is the chosen compliant DoD standard for protecting Controlled Unclassified Information

(CUI) during transmission. CUI is defined as U.S. Government data that is NOT CLASSIFIED and that has NOT BEEN

PUBLICALLY RELEASED. CUI includes but is not limited to data that is labeled or considered: For Official Use Only (FOUO), Privacy data, Contract Information, Unclassified Technical Data, Accountability information, DoD Sensitive But Unclassified (SBU).

Failure to encrypt CUI during electronic transmission is considered a security weakness and must be corrected upon discovery via the contractor personnel responsible for CS. Multiple violations by individuals must be reported to the PISSM by the contractor for resolution. The contractor shall require its personnel to adhere to the required PKI policies stated herein when transmitting CUI.

The contractor shall implement DoD PKI policy per DoDI 8520.02. The contractor shall obtain and utilize PKI certificates issued by an approved External Certificate Authority (ECA) for the purposes of protecting all CUI. Approved PKI will be utilized by the contractor, its subcontractors, and suppliers when transmitting CUI via electronic means. Public Key Enablement (PKE) is the chosen

DoD standard for authentication at the application level. The contractor shall utilize PKI when interacting with DoD PKI/PKE information systems and accessing DoD CUI or sensitive information.

E.

ELECTRONIC MAIL (E-MAIL):

The contractor shall utilize digital signature and encryption via DoD PKI or ECA digital certificates on all electronic mail (e-mail) messages containing CUI or e-mail messages that discuss any matter that may serve as an Operations Security (OPSEC) indicator, per DoDI 8520.02. If contractor personnel support multiple email addresses for use under this contract then a separate PKI certificate is required for each email address. Unapproved accounts, such as AOL, HOTMAIL or YAHOO, will not be used for official business under this contract unless specifically authorized to do so by the Government per CJCSI 6510.01F.

F.

DATA AT REST

The contractor shall ensure that an approved DoD product is utilized for Data at Rest (DAR) that is stored on mobile computing devices such as laptops and personal digital assistants (PDAs), or removable storage media. The cryptography shall be National

Institute of Standards and Technology (NIST) Federal Information Processing Standard 140-2 (FIPS 140-2) compliant and a mechanism shall be established to ensure encrypted data can be recovered in the event the primary encryption system fails.

G.

ASSESSMENT AND AUTHORIZATION (A&A)

For Information Technology (IT) systems which receive process, store, display, or transmit DoD information to be delivered to the government, the contractor shall coordinate with the PISSM to determine the CS requirements for the delivered systems. The contractor shall ensure that the delivered IT system can successfully complete the Risk Management Framework (RMF) process.

Applicability of RMF and its associated controls will be determined by the Government and iterated to the contractor prior to commencement of the effort. All delivered IT systems must have the ability to obtain an Authority To Operate (ATO) as defined in

DoDI 8510.01, DoDI 8500.01, DoDI 8500.2, DoDI 8520.02, DoDI 5000.02, DoDI 8580.1, SECNAVINST 5239.3B, OPNAVINST

5239.3A and OMB A-130, Appendix III. A Cyber Security coordination kick-off meeting described in ” (CDRL A005, Sub-Title:

Cyber Security System/Software Assurance Report) will serve as the launch point for this coordination.

The contractor will assist and provide necessary documents as defined in the above policies for the purposes of completing the RMF process. The government may provide the contractor with access to the on-line RMF A&A tool.

The contractor shall employ all NIST 800-53 controls that are deemed appropriate to the delivered system. The contractor shall demonstrate the required CS design features of all systems, software and interfaces to assist the government in meeting the certification standards specified by the cognizant government agency (e.g. DONCIO, NETWARCOM, SPAWAR, PEO. The results of certification testing shall be submitted to the government in support of a recommendation to the Operational Authorizing Official

(AO) or the Functional Authorizing Official (FAO) for accreditation and/or PIT designation, using the applicable tool. The contractor will assist the government in managing applications associated with these systems via the appropriate Functional Area Manager

(FAM). The contractor will assist the government in determining the Information Assurance Vulnerability Management (IAVM) requirements for the delivered IT system where applicable.

For IT systems delivered to the government, the contractor shall provide all pertinent information to comply with Federal Information

Security Management Act of 2002 (FISMA) and Information Technology Management Reform Act (Pub L. 104-106, Division E

Clinger-Cohen Act) requirements as requested by the Government. IT systems shall be tested for CS requirements in accordance with the policies stated above.

For IT systems delivered to the government, the contractor shall provide all pertinent information to comply with Federal Information

Security Management Act of 2002 (FISMA) and Information Technology Management Reform Act (Pub L. 104-106, Division E

Clinger-Cohen Act) requirements as requested by the Government. IT systems shall be tested for CS requirements in accordance with the policies stated above.

For IT systems delivered to the government, the contractor shall ensure that any commercial CS or CS-enabled IT products that are utilized as part of that system have been evaluated and validated, as appropriate, in accordance with the National Information

Assurance Partnership (NIAP) (http://www.niap-ccevs.org/cc-scheme/vpl/) or Common Criteria (CC). If network switches are part of the architectural design of the system then the contractor shall ensure the switching devices are equipped with the means to manage ports and that have been validated and certified by NIAP (http://www.niap-ccevs.org) or CC evaluation and validation scheme.

For IT systems delivered to the government, the contractor shall ensure that the system will incorporate CS-Enabled Operating

Systems that have been validated or are under evaluation by NIAP or CC scheme and are: a) Configurable in accordance with applicable DoD Security Technical Implementation Guides (STIGs) or System and Network Attack Center (SNAC) guides, and

Security Requirements Guides (SRG’s). DoD Security Technical Implementation Guides (STIGs) and SNAC guides are available at https://iase.dis.mil b) Able to incorporate the DoD Information Assurance Vulnerability Management Program (IAVMP) in accordance with DoDI 8500.2; and c) Supportable for the expected lifecycle of the system. The contractor shall also ensure that the system shall incorporate the DoD licensed virus protection software available at the following DoD website:

https://patches.csd.disa.mil. The contractor shall ensure that the delivered IT system adheres to the DAR requirement “F” DATA AT

REST.

For IT systems delivered to the Government, the contractor shall utilize the approved DoD/DoN Assured Compliance Assessment

Solution (ACAS) vulnerability management scanner, herein after referred to as 'the approved scanning tool (AST).' The Government shall provide the AST 'license' to the contractor as Government Furnished Equipment (GFE). The contractor shall be responsible for providing the required hardware to install and host the AST. The contractor shall configure the AST in accordance with the tool's

Authorization to Operate (ATO), as provided by the Government Program ISSM. Prior to initiating any vulnerability scans, the contractor must complete an approved ACAS training curriculum as authorized by the Government Program ISSM. Prior to using the approved scanning tool, the contractor shall install the latest vulnerability definitions, signatures, and engine updates on the targeted system prior to each vulnerability scan as approved by the Government Program ISSM. The contractor shall provide the http://www.niap-ccevs.org/cc-scheme/vpl/ http://www.niap-ccevs.org/ https://iase.dis.mil/ https://patches.csd.disa.mil/ unaltered, (i.e. raw), results of the vulnerability scans to the Government as directed by the Government Program ISSM in the Contract

Data Requirements List. All category I vulnerabilities will be identified and corrected prior to any IT system acceptance by the

Government.

Per Vice Chief of Naval Operations Joint Memo Ser. N09/16U100548 (8 NOV 2016) the contractor shall implement the required and applicable Information Assurance Technical Authority (IA TA) Standards for all delivered Platform Information Technology

(PIT) Systems and/or systems deemed "Controlled Systems".

For IT systems delivered to the government, the contractor shall be familiar with and apply the following CS, IT and INFOSEC standards where applicable: Federal Information Security Management Act of 2002 (FISMA, Information Technology Management

Reform Act (Pub L. 104-106, Division E Clinger-Cohen Act), Committee on National Security Systems Policy (CNSSP) No. 22, Committee on National Security Systems Instruction (CNSSI) No. 7000, National Security Telecommunications and Information

Systems Security Instruction (NSTISSI) No. 7001, DoDD 5000.01 DoDI 8500.01, DoDI 8500.2, DoDI 8520.02, DoDI 8510.01

(DIACAP/Risk Management Framework), SECNAVINST 5239.3B, OPNAVINST 5239.3A, DoD MIL-STD-461F and MIL-STD-

464C; CJCSM 6510.01B; CJCSI 6510.01F.

Further system and/or software deliverables are addressed in (CDRL A005, Sub-Title: Cyber Security System/Software Assurance

Report) if a system is delivered under this contract effort.

H.

Cyber Security (CS) Point of Contact (POC)/Cyber Security Workforce (CSWF)

For IT systems delivered to the government, the contractor shall define its CS workforce requiring CS certification based on the requirements defined in DoDD 8140, Cyberspace Workforce Management, with level approval by the government. Personnel in the

CS workforce will be required to fulfill the certification requirements of DoDD 8140. All identified Cyber Security WorkForce

(CSWF) personnel identified by the contractor and level approved by the government are required to be certified with criteria established in DoD 8140 within 12 months of contract award. The contractor shall not be required to enter the CS personnel certification in the personnel system referenced in DoDD 8140.

The contractor shall provide a counterpart point of contact to the Program Information System Security Manager (PISSM); herein identified as the CS Point of Contact (POC). The CS POC shall ensure all CS requirements are adhered to. The CS POC will ensure that the contractor team is aware of all CS requirements. The CS POC shall coordinate with the PISSM in all matters related to CS.

The CS POC will be required to fulfill the certification requirements of DoDD 8140. The contractor is not required to flow down the requirement for a CS POC certified per DoDD 8140 to its subcontractors.

I.

WEB SITES, ELECTRONIC ROOMS (E-ROOMS), COLLOBORATION TOOLS, & CLOUD SERVICES

The contractor shall utilize DoD compliant PKI digital certificates to use as authenticators for accessing all DoD web sites and/or e-rooms and collaboration tools. The contractor shall utilize the official DoD remote conferencing collaboration tool, Defense

Collaboration Services (DCS) (https://disa.deps.mil/disa/org/ES7/DCS/SitePages/Home.aspx) for all electronic collaborative efforts that contain DoD information.

Before hosting services such as but not limited to: web sites, e-rooms and sharepoint sites that contain DoD CUI information, the contractor shall investigate existing government tools and services to meet these requirements. In the event that existing services cannot be utilized, the contractor shall obtain government approval prior to implementing or utilizing any such services. If such services are deemed necessary by the government then, these tools shall be web based applications that enhance data delivery and distribution to include electronic collaboration and management tools. These efforts shall supplement existing legacy systems, and the Navy’s goals of web enablement of new technology and applications. Any developed systems shall utilize DoD PKI and PKE digital certificates as an authenticating mechanism and utilize existing encryption methods (i.e. Secure Sockets Layer (SSL) or

Transport Layer Security (TLS) for the protection of CUI data.

The utilization of any “Cloud” services in support of this contract is unauthorized unless specifically authorized by the Government

PISSM in writing.

https://disa.deps.mil/disa/org/ES7/DCS/SitePages/Home.aspx

For secure large electronic file exchange requirements, the NAVAIR External Sharepoint Site (Team Connect) will be utilized. The

Government will provide and approve access to this site on a required basis. The industry partner shall ensure that the proper PKI credentials are utilized by individuals per section “D” of this CSP.

The U.S. Army Aviation and Missile Research Development and Engineer Center (AMRDEC) Safe Access File Exchange (SAFE)

Web Application (https://safe.amrdec.army.mil/safe/) is not authorized for NAVAIR usage as this site allows usage for NON-CAC personnel. Per section “D” of this CSP only DOD CAC/PKI enforced authentication means are authorized. Exceptions may be granted for compelling operational requirements on a case-by-case basis by the PISSM in writing via encrypted email message.

J.

COMMON ACCESS CARDS (CAC) & SAAR-N FORMS

CAC

The government may approve and issue common access cards (CAC) to personnel supporting this contract on a case by case basis.

CAC request shall be initiated using the Trusted Associate Sponsorship System Consent to Monitor (TASS)

(https://www.dmdc.osd.mil/TASS/). A Trusted Agent (TA) will be identified by the Government to the Contractor for CAC issuance.

CAC applicants shall submit an initial request for a CAC or government credential to the Trusted Agent (TA) and log in to TASS to complete and submit the online application for government credentials. The sponsoring DoD Agency will provide the Applicant

Request Form which is the necessary information and appropriate paperwork required for obtaining a government credential. The contractor shall then vet the Applicant using the DoD approved process. Once the Applicant, Contracting Agency, and Sponsoring

Agency provide the necessary information, the Applicant shall submit the required information to the TA.

The TA will verify that the contractor has vetted the Applicant and establish the affiliation of the Applicant with the service or agency.

Once the TA confirms the vetting and ensures all other requirements have been satisfied, he or she creates an application in TASS for submission.

Once the TA submits a new application for an Applicant, the TA will provide the Applicant (via secure means) the TASS weblink and his or her user ID and temporary password. The Applicant shall then log in to TASS to complete and submit the application. Once the TA submits the application, the Applicant has seven days to complete an initial log in to TASS and begin the application process, or TASS will automatically disable the Applicant's application.

Per DTM 08-003, the Next Generation CAC Implementation Guidance document, initial CAC issuance requires, at a minimum, the completion of FBI fingerprint check with favorable results and submission of a National Agency Check with Inquiries (NACI) to the Office of Personnel Management (OPM), or a DoD-determined equivalent investigation. Per DoD Manual 1000.13, Volume 1

(Enclosure 2, Section 6C) only an official government email address (e.g., .mil, .gov, .edu) may be entered into a CAC.

Contractor email addresses are NOT authorized on the CAC and it is the responsibility of the contractor company to provide a valid ECA PKI certificate associated with the contractor’s official email addresses for usage and in support under this contract.

SAAR-N Forms

All personnel in support of this contract with requirements for accessing government IT systems must provide a completed System

Authorization Access Request –Navy (SAAR-N) form (OPNAV 5239/14 (Rev 9/2011) or latest version thereof) and a completed

Cyber Awareness Challenge ver. 2.0 or latest version thereof. This training is available at the following location:

http://iase.disa.mil/eta/cyberchallenge/launchPage.htm. The contractor shall establish a CAC/SAAR-N POC to coordinate with the government in such matters. The CAC/SAAR-N POC shall deliver completed TASS Registration Request (TRR) and SAAR-N forms electronically for approval and processing by the government. SAAR-N forms shall be digitally signed by all signatories using either their DoD or ECA issued PKI certificate.

(a) Contractor personnel assigned to perform work under this contract may require access to Navy IT resources (e.g., computers, laptops, personal electronic devices/personal digital assistants (PEDs/PDAs), NMCI, RDT&E networks, websites such as

MyNAVAIR, and Navy Web servers requiring CAC PKI. Contractor personnel (prime, subcontractor, consultants, and temporary employees) requiring access to Navy IT resources (including those personnel who previously signed SAAR DD Form 2875) shall electronically submit a completed System Authorization Access Request Navy (SAAR-N), OPNAV 5239/14 (Rev 9/2011) form or https://safe.amrdec.army.mil/safe/ https://www.dmdc.osd.mil/TASS/ http://iase.disa.mil/eta/cyberchallenge/launchPage.htm latest version thereof, and have initiated the requisite background investigation (or provide proof of a current background investigation) prior to accessing any Navy IT resources.

(b) SAAR-N forms will be submitted to the PISSM via the Contracting Officer’s Representative (COR) or Alternate COR (ACOR), or to the government sponsor, if the contract does not name a COR or Alternate COR via the contractor’s Facility Security Officer

(FSO). If the contract does not have an assigned COR or ACOR, the designated SAAR-N Government Sponsor for contractor employees requiring IT access shall be responsible for signing and processing the SAAR-N forms and submission to the PISSM. For those contractors that do not have a FSO, SAAR-N forms shall be submitted to the PISSM via the COR/ACOR or designated SAAR-

N Government Sponsor. Copies of the approved SAAR-N forms may be obtained through the COR/ACOR or designated SAAR-N

Government Sponsor.

(c) In order to maintain access to Navy IT resources, the contractor shall ensure completion of initial and annual CS awareness training. The contractor shall ensure that a completed DoD Cyber Awareness Challenge ver. 2.0 or the latest version thereof , monitor expiration of requisite background investigations, and initiate re-investigations as required. If requested, the contractor shall provide to the COR/ACOR or designated SAAR-N Government Sponsor documentation sufficient to prove that it is monitoring/tracking the

SAAR-N requirements for its employees who are accessing Navy IT resources. For those contractor personnel not in compliance with the requirements of this section, access to Navy IT resources will be denied/revoked.

(d) The SAAR-N form remains valid throughout contractual performance, inclusive of performance extensions and option exercises where the contract or order number does not change. Contractor personnel are required to submit a new SAAR-N form only when they begin work on a new or different contract or order.

K.

CONTRACTOR OWNED UNCLASSIFIED NETWORK SECURITY

The contractor shall take means (defense-in-depth measures) necessary to protect the confidentiality, integrity, and availability of government-controlled unclassified information in the same manner as the contractor would protect its own unclassified company proprietary information. Access to government CUI from an external source shall use DoD ECA PKI certificates for authentication.

The contractor shall ensure that contractor-owned or operated unclassified IT network assets (including assets used for contractor

Teleworkers) used to process sensitive government information (CUI) are managed and maintained in accordance with commercial best practices, vendor-specific, or other nationally or internationally-recognized IT configuration and management standards (e.g., Contract Instruction Services (CIS), Control Objectives for Information and related Technology (COBIT®), Common Criteria (CC), National Information Assurance Program (NIAP), DoD, Defense Information Systems Agency (DISA), International Computer

Security Association (ICSA), National Industrial Security Program (NIST), National Security Agency (NSA), System Administration, Networking, and Security Institute (SANS), Sarbanes-Oxley (SOX), ISO/IEC 27002:2005.

L.

INFORMATION SECURITY REQUIREMENTS FOR PROTECTION OF UNCLASSIFIED DOD INFORMATION ON NON-DOD

SYSTEMS

The contractor shall safeguard unclassified DoD information stored on non-DoD information systems to prevent the loss, misuse, and unauthorized access to or modification of this information. The contractor shall:

a. Not process DoD information on public computers (e.g., those available for use by the general public in kiosks or hotel business centers) or computers that do not have access control.

b. Protect information by no less than one physical or electronic barrier (e.g., locked container or room, login and password) when not under direct individual control.

c. Sanitize media (e.g., overwrite) before external release or disposal.

d. Encrypt the information that has been identified as CUI when it is stored on mobile computing devices such as laptops and personal digital assistants, or removable storage media such as thumb drives and compact disks per paragraph “F” DATA AT REST.

e. Limit information transfer to subcontractors or teaming partners with a need to know and a commitment to at least the same level of protection.

f. Transmit voice and fax transmissions only when there is a reasonable assurance that access is limited to authorized recipients.

g. Not post DoD information to Web sites that are publicly available. Access control may be provided by an internal company intranet which adheres to paragraph “K” CONTRACTOR OWNED UNCLASSIFIED NETWORK SECURITY.

h. Provide protection against computer network intrusions and data exfiltration, including no less than the following:

(1) Current and regularly updated malware protection services, e.g., anti-virus, anti-spyware.

(2) Monitoring and control of inbound and outbound network traffic as appropriate (e.g., at the external boundary, sub-networks, individual hosts) including blocking unauthorized ingress, egress, and exfiltration through technologies such as firewalls and router policies, intrusion prevention or detection services, and host-based security services.

(3) Prompt application of security-relevant software patches, service packs, and hot fixes.

i. Comply with other Federal and DoD information protection and reporting requirements for specified categories of information (e.g., Critical Program Information (CPI), Personally Identifiable Information (PII), export controlled information) IAW the requirements of the contract.

M.

CLASSIFIED SYSTEMS

All classified information to be transmitted via electronic media shall use a cryptographic system authorized by the Director, National Security Agency in accordance with SECNAVINST 5510.36A Department of the Navy Information and Personnel

Security Program Regulation.

The contractor must maintain accreditation with the Defense Security System (DSS) in instances where the contractor is operating a

Special Test Equipment (STE) or Test Bench (TB) as required by NISPOM standards. Maintaining accreditation is defined as having and maintaining a valid Authority To Operate (ATO) from the Authorizing Official (AO) during the lifecycle of such a system. In order to maintain valid accreditation the contractor must ensure that all facets of accreditation standards are met.

One such standard is maintaining a valid and supportable operating system(s) for the STE or TB during the lifecycle of the system.

The contractor must alert and notify the government when an operating system is in danger to not being supported and/or not meeting accreditation standards one year prior to the lapse in accreditation. The contractor must provide sufficient resources to ensure a proper plan is maintained and executed to meet these requirements. In instances were a waiver in the form of a Risk

Acceptance Letter (RAL) is required from the Government, the contractor must provide a request for such a RAL. A RAL from the government may be issued if the following conditions are maintained:

A. A request letter with reasons and rationale that articulate the non-compliance.

B. A detailed Plan of Action & Milestones (POA&M) document for rectifying the non-compliance.

C. A Rough Order of Magnitude (ROM) that articulates the cost of rectifying the non-compliance.

D. A detailed schedule and timeline for rectifying the non-compliance.

In the event that a RAL letter is issued, the duration of the letter will be dependent on the agreed upon established timeline and on the progress being made as stated in the POA&M.

N.

CLASSIFIED SPILLAGES & INFORMATION LEAKAGE

All classified spillages either initiated or received by the contractor containing NAVAIR data shall be reported to the Program

Information System Security Manager (PISSM) and the Program Security Manager (PSM) within 24 hours of the incident.

Information leakage occurs when an adversary exploits a network or network system and begins syphoning information from those systems. In the event of an information leakage involving NAVAIR data, that incident shall be reported to the Program Information

System Security Manager (PISSM) and the Program Security Manager (PSM) within 24 hours of the incident. Furthermore, an investigation shall occur in order to develop a Plan Of Action & Milestone (POA&M). The POA&M shall be submitted to the

Government to ensure a similar incident does not occur. . The contractor shall conduct the investigation for any information leakage occurring at their site.

O.

CLASSIFIED RADIOS & TEMPEST CONTROLS

If applicable the contractor shall ensure all commercial radios that process classified information are TEMPEST certified to meet the requirements of CNSS Advisory Memorandum TEMPEST 01-02. NSA no longer determines the TEMPEST certification requirements for the entire system as part of the COMSEC certification. The certification should be supported by documentation from a government or NSA certified TEMPEST test facility. NSA-endorsed encryption does not mean that the radio is TEMPEST certified.

Proof of certification must to be provided prior to usage.

P.

PROCUREMENT OF CELLULAR TELEPHONES, PDA’S, AIR CARDS AND CALLING CARDS

Per OPNAVINST 2100.2A the contractor shall not procure cellular telephones, personal digital assistants (PDA’s), air cards and calling cards for the usage by U.S. Military and Civilian personnel.

Q.

SOFTWARE

For all software to be delivered to the Government the contractor shall adhere to the following requirements:

Further system and/or software deliverables are addressed in (CDRL A005, Sub-Title: Cyber Security System/Software Assurance

Report) if software is delivered under this contract effort.

1. INFORMATION ASSURANCE VULNERABILITY MANAGEMENT (IAVM) PLAN & STIGS

The contractor shall participate in the Program’s IAVM plan. Patch updates for avionics, weapon systems, and other embedded systems (especially safety critical items) shall be incorporated in any new software release where the appropriate regression testing has been completed. Each software release must include any appropriate patches to address vulnerabilities In instances where patches cannot be applied due to real-world operations or impact to system performance an operational risk assessment shall be performed that identifies appropriate mitigations and security controls to put in place. Mitigations must be approved by the Government.

In addition to the standalone IAVM plan document, the contractor shall provide the IAVM plan to the Government for the purposes of incorporation into the System Engineering Plan (SEP), Life Cycle Support Plan, and Test Evaluation Master

Plan (TEMP).

The IAVM plan must be integrated with the Program’s Configuration Management (CM) activities to ensure these events are synchronized. Vulnerabilities must be prioritized depending on the operating context and mitigating factors.

The contractor shall ensure system baseline documentation incorporates versioning with respect to software, system image/load, firmware.

The contractor shall ensure all applicable Security Technical Implementation Guides (STIG) have been applied and documented to the system.

All applicable STIG must be tracked using a Government provided template. The contractor shall make the completed

STIG’s template available to the Government using DISA’s SRG/STIG Applicability Guide and Collection Tool, or a contractor created matrix.

2. DATA INPUT VALIDATION

The contractor shall employ input checking and data validation on all inputs to include “trusted” messages from internal components.

The contractor shall utilize and adhere to the Application Security and Development (ASD) STIG which includes detailed requirements for input validation.

http://iase.disa.mil/stigs/Pages/index.aspx http://iase.disa.mil/stigs/agct/Pages/index.aspx

The contractor shall review and utilize the Open Web Application Security Project’s (OWASP) guides. Such guides shall be followed in any developed web applications such as for the purpose of protecting applications from such vulnerabilities as, but not limited to SQL Injections.

3. INTEGRITY CHECKING

The contractor shall utilize integrity checks to ensure data is not altered without authorization. These checks must be more than a checksum.

The contractor shall validate the Operational Flight Program (OFP)’s against a hash produced at software compilation.

All utilized hashing algorithms shall adhere to NIST SP 800-131A on all OFP’s.

The contractor shall transmit the hash via a separate channel than the OFP (out-of-band hash authentication). Automation of this authentication process shall be utilized where technically possible.

The contractor shall deliver avionics with the hash being displayed at OFP boot time where technically possible.

4. SOFTWARE QUALITY ASSURANCE

The contractor shall adhere to software development requirements. All software applications developed for the DoD, shall conform to the DISA Application Security and Development Security Technical Implementation Guide (STIG). All applicable STIGS shall be adhered to. Elements of STIG’s such as but not limited to software assurance, static code analysis and Software Configuration Management (SCM), shall be adhered to. The contractor shall coordinate with the

Government representatives to determine the applicable STIG requirements for the delivered software prior to commencement of STIG implementation and review.

5. SUPPLY CHAIN MANAGEMENT AND SOFTWARE ASSURANCE

The contractor shall demonstrate:

o Mechanisms are in place to effectively monitor the supply chain for critical components.

o An understanding of supply chain risk and the introduction of those risks through those components.

o An implementation plan for countermeasures to mitigate such risks.

To incorporate into system security engineering (SSE), systems engineering, and procurement decisions, the contractor shall use:

o Any Government-provided foreign intelligence.

o Technology exploitation threat information.

o Traditional acquisition and battlefield threat information.

The contractor shall develop a set of secure coding standards and secure design features drawing upon the “top 10 secure coding practices” https://www.securecoding.cert.org/confluence/display/seccode/Top+10+Secure+Coding+Practices), the CWE/SANS top 25 most dangerous software errors (http://cwe.mitre.org/top25/index.html), and the secure design patterns (www.cert.org/archive/pdf/09tr010.pdf - 2009-10-23) to use with all Level I Mission-Critical Function components.

For Level I Mission-Critical Functions and their Critical Components, the contractor shall establish basic protection requirements unless not establishing such requirements is justified by a cost-benefit analysis approved by the

Government. Critical function Supply Chain and Development basic protections shall include the following:

o A Supplier Management Plan that:

• Includes supplier selection criteria to reduce supply chain risks;

• Evaluates and maintains a list of suppliers and alternate suppliers with respect to the criteria established;

o An Anonymity Plan that:

• Limits the disclosure of the baseline design, test, and supply chain data;

• Uses blind buys for component procurement;

https://www.owasp.org/index.php/Guide_to_SQL_Injection http://iase.disa.mil/stigs/app-security/app-security/Pages/index.aspx https://www.securecoding.cert.org/confluence/display/seccode/Top+10+Secure+Coding+Practices o Additional access controls that:

• Further limit access to critical components and information about critical components beyond normal program control;

• Log access;

• Establish data collection for post-attack forensic analysis;

• Require inspection and approval of changes;

• Includes third-party software assurance and supply chain attack testing of development processes, system, and development environment;

• Includes material and non-material attack and compromise response process.

Q.

MISCELLANEOUS

Intentionally left blank.

REFERENCES

CJCSI 6510.01F Information Assurance (IA) and Computer Network Defense (CND), dated February 9, 2011.

CJCSI 6211.02D Defense Information System Network (DISN): Policy, responsibilities and Processes, dated January 24, 2012.

CJCSM 6510.1B Cyber Incident Handling Program, dated July 10, 2012.

CNSS TEMPEST 01-02 CNSS Advisory Memorandum, Non-stop Evaluation Standard, dated October 2002.

CNSSI 7000 TEMPEST Countermeasures for Facilities, dated May 2004.

CNSSP NO 22 (U) Policy on Information Assurance Risk Management for National Security Systems, dated January 2012.

DoDD 5000.01 The Defense Acquisition System, May 12, 2003 (certified current November 20, 2007).

DoD 5220.22-M National Industrial Security Program (NISP) Operating Manual (NISPOM), February 2006, incorporating change

1, March 28, 2013.

DoDD 8140 Cyberspace Workforce Management, (In Transition)

DODI 8582.01 Security of Unclassified DoD Information on Non-DoD Information Systems, dated June 6, 2012.

DoDD 8500.01 Cybersecurity dated March 14, 2014 (certified current May 01, 2014).

DoDI 5000.02 Operation of the Defense Acquisition System, dated December 8, 2008.

DoDI 8500.2 Information Assurance (IA) Implementation, dated February 6, 2003.

DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT), dated March 12, 2014. (In Transition)

DoDI 8510.01 DoD Information Assurance Certification and Accreditation Process (DIACAP), dated November 28, 2007. (In

Transition)

DoDI 8520.02 Public Key Infrastructure (PKI) and Public Key (PK) Enabling, dated May 24, 2011.

DoDI 8552.01 Use of Mobile Code Technologies in DoD Information Systems, dated October 23, 2006.

DoDI 8580.1 Information Assurance (IA) in the Defense Acquisition System, dated July 9, 2004.

DTM 08-003 Directive-Type Memorandum, Next Generation Common Access Card (CAC) Implementation Guidance, incorporating change 5, October 8, 2013.

DTM 09-019 Directive-Type Memorandum, Policy Guidance for Foreign Ownership, Control, or Influence (FOCI) (May be able to amplify DoD 5220.22-M in some instances), incorporating change 3, December 1, 2011.

DTM 09-027 Directive-Type Memorandum, Implementation of the Weapon Systems Acquisition Reform Act of 2009, incorporating change 4, January 11, 2013. incorporating change 4, January 11, 2013.

DTM 11-003 Directive-Type Memorandum, Reliability Analysis, Planning, Tracking, and Reporting (May be able to amplify

DoDI 5000.02, Operation of the Defense Acquisition System dated December 8, 2008, in some instances), incorporating change 2, January 16, 2013.

FIPS 140-2 FIPS PUB 140-2, Change Notices (12-03-2002) Federal Information Processing Standards Publication, Security

Requirements for Cryptographic Modules, dated December 3, 2002.

MIL-STD-461F Military Standard, Electromagnetic Emission and Susceptibility Requirements for the Control of Electromagnetic

Interference, dated December 10, 2007.

MIL-STD-464C DoD Interface Standard: Electromagnetic Environmental Effects Requirements for Systems, dated December 1, 2010.

NSTISSI No. 7001 National Security Telecommunications and Information Systems Security Instruction, NONSTOP

Countermeasures, dated June 15, 1994.

NIST SP 800-131A Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths

NIST SP 800-171 Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, dated

June 2015. Updates as of 1-14-2016

NIST SP 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems, dated February 2010.

OMB A-130, App III Security of Federal Automated Information Resources (Transmittal Memorandum No. 4)

OPNAVINST 2100.2A Navy Policy and Procedures On The Issuance, Use and Management Of Government Owned Cellular Phones, Personal Digital Assistants and Calling Cards, dated September 4, 2008.

OPNAVINST 5239.3A Navy Implementation of DoD Intelligence Information system Public Key Infrastructure (PKI), dated January 18, 2008.

OPNAVINST 5239.1C Navy Information Assurance (IA) Program, August 20, 2008.

SECNAV M-5239.1 Department of the Navy Information Assurance Program Information Assurance Manual, dated November 2005.

SECNAVINST 5239.3B Department of the Navy Information Assurance (IA) Policy, dated June 17, 2009.

SECNAVINST 5510.36A DON Information Security Program, dated October 6, 2006.

Vice Chief of Naval Operations Joint Memo Ser. N09/16U100548 (8 NOV 2016)

For Information Assurance-Related Policies and Issuances:

For OPNAV / SECNAV / Navy Documents see: http://doni.daps.dla.mil/default.aspx

For DoD Documents see: http://www.dtic.mil/whs/directives/index.html#

For MIL Documents see: https://assist.daps.dla.mil/quicksearch/

For Classified Documents formally request from NAVAIR

For links to Cyber Security-Related Policies and Issuances please go to:

http://iac.dtic.mil/csiac/ia_policychart.html http://doni.daps.dla.mil/default.aspx http://www.dtic.mil/whs/directives/index.html https://assist.daps.dla.mil/quicksearch/ http://iac.dtic.mil/csiac/ia_policychart.html

CS ACRONYMS

A&A Assessment and Authorization (Replaces C&A under RMF)

ATO Authority to Operate

C4ISR Command, Control, Communications, Computers, Intelligence, Surveillance, and

Reconnaissance

CDRL Contract Deliverable Requirement List

CA Certification Authority

CAC Common Access Card

CC Common Criteria

CIO Chief Information Officer

CIS Contract Instruction Services

CJCSI Chairman of the Joint chiefs of Staff Instruction

CJISSM Chairman of the Joint chiefs of Staff Manual

CL Confidentiality Level

CND Computer Network Defense

CNSSI Committee on National Security Systems Instruction

CNSSP Committee on National Security Systems Policy

CO Commanding Officer

COMSEC Communications Security

CPI Critical Program Information

CS Cyber Security

CTO Computer Tasking Order

CUI Controlled Unclassified Information

DAA Designated Approving Authority

DDAA Developmental Designated Approving Authority

DIACAP DoD Information Assurance Certification and Accreditation Process

DiD Defense-in-Depth

DISA Defense Information Systems Agency

DISN Defense Information Systems Network

DIACAP DoD Information Assurance Certification and Accreditation Process

DMZ Demilitarized Zone

DREN Defense Research and Engineering Network

DoD Department of Defense

DoDD DoD Directive

DoDI DoD Instruction

DON Department of the Navy

DONCIO Department of the Navy Chief Information Officer

DTM Directive-Type Memorandum

ECA External Certificate Authority

E-mail Electronic Mail

FAM Functional Area Manager

FIPS Federal Information Processing Standard

FISMA Federal Information Security Management Act of 2002

FOUO For Official Use Only

GIG Global Information Grid

IA Information Assurance

IAVA Information Assurance Vulnerability Alert

IAVB Information Assurance Vulnerability Bulletin

IAVM Information Assurance Vulnerability Management

IAVMP Information Assurance Vulnerability Management Program

IAW In accordance with

IAWF Information Assurance Workforce

ICSA International Computer Security Association

IM Information Management

INFOCON Information Operations Condition

IO Information Officer

ISP Information Security Program

ISSM/IAM Information System Security Manager/Information Assurance Manager

ISSO/IAO Information System Security Officer/Information Assurance Officer

IT Information Technology

MAC Mission Assurance Category

MCNOSC Marine Corps Network Operations Security Center

NACI National Agency Check with Inquiries

NAVCIRT Navy computer Incident Response Team

NIAP National Information Assurance Partnership

NETWARCOM Naval Network Warfare Command

NIAP National Information Assurance Program

NIPRNET Non-Classified Internet Protocol Router Network, (Unclass but Sensitive Internet Protocol

Router Network)

NISPOM National Industrial Security Program Operating Manual

NIST National Institute of Standards and Technology

NMCI Navy Marine Corps Intranet

NSA National Security Agency

NSTISSI National Security Telecommunications and Information Systems Security Instruction

OIC Officer in Charge

ODAA Operational Designated Approving Authority

OMB Office of Management and Budget

OPM Office of Personnel Management

OPNAV Office of the Chief of Naval Operations

OPSEC Operations Security

PDA Personal Digital Assistant

PEO(T) Program Executive Officer (Tactical)

PEO(X) Program Executive Officer X= (Unmanned Aviation and Strike Weapons), or (Assault &

Special Missions), or (Strike Weapons and Unmanned Aviation)

PISSM Program Information System Security Manager

PII Personally Identifiable Information

PIT Platform Information Technology

PIT-I Platform Information Technology Interconnect

PKE Public Key Enablement

PKI Public Key Infrastructure

PL Public Law

PM Program Manager

NAVAIR Naval Air Systems Command

POA&M Plan of Action and Milestones

POC Point of Contact

SANS System Administration, Networking, and Security Institute

SBU Sensitive But Unclassified

SECNAV Secretary of the Navy

SECNAVINST SECNAV Instruction

SECNAVMAN SECNAV Manual

SIPRNET Secure Internet Protocol Routing Network

SNAC System and Network Attack Center

SOX Sarbanes-Oxley

SPAWAR Space and Naval Warfare Systems Command

SSAA System Security Authorization Agreement

SSL Secure Sockets Layer

STIG Security Technical Implementation Guides

STRATCOM Strategic Command

TASS Trusted Associate Sponsorship System Consent to Monitor

TLS Transport Layer Security

USMC US Marine Corps

USN US Navy

UTN-P Unclassified Trusted Network Protection

WAN(s) Wide Area Network(s)

IA Definitions (per SECNAV M-5239.1)

Accreditation - Formal declaration by the DAA that an information system is approved to operate in a particular security mode using a prescribed set of safeguards at an acceptable level of risk.