MSC_N6_N62-5239-3-Q_Rev2.pdf

N6.62.5239.3-Q Rev 2 22 Sept 2022

Military sealift command

Cybersecurity Manual

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx i

RECORD OF CHANGES

The latest version of this document is 9/22/2022. Revisions since the initial version are listed below.

Version Author Description of Changes Date

1.0 Beverly A. Hawkins Input information for CUI

and PAA. Added CSWF update.

3/24/2021

1.1 Beverly A. Hawkins - Updated references

- Updated contact e-mail addresses for Incident Reporting Table.

- Added info for CPCON

- Removed INFOCON

8/4/2022

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx ii

This page intentionally blank

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx iii

Foreword

This manual will implement the directives set forth in Command, Military Sealift Command (COMSC) Instruction 5239.3C Military Sealift Command Cybersecurity Policy. It prescribes uniform standards and practices to implement and comply with governing Cybersecurity (CS) directives.

CS is a readiness issue. Our failure to address successfully can have significant negative impacts on MSC operations and critical Department of Defense (DoD) missions. Failure to develop and promote a command climate of responsible CS behavior is a preventable vulnerability that we must not ignore. CS is everyone’s responsibility and requires the personal attention/action of every mariner, military member, government civilian, and contractor as we execute our daily duties.

This manual does not pertain to, alter, or supersede existing authorities and policies of the Director of National Intelligence (DNI) and Deputy Chief of Naval Operations, Information Dominance (CNO (N2N6)) regarding the protection of Sensitive Compartmented Information (SCI) and special access programs for intelligence as directed by Executive Order 12333.

This is an enterprise-level manual governing all Military Sealift Command (MSC), personnel, and sites, to include afloat units. This manual is effective immediately and is applicable to controlled Information Systems (IS) that are operated on behalf of MSC and receive, process, store, display, or transmit DoD, Department of Navy (DON), and MSC information, regardless of classification or sensitivity. This also includes all contractor owned systems or networks that are operated on behalf of MSC including those that are for the exclusive use of contractors.

This manual may be accessed through the MSC SharePoint portal at:

https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx. Any comments or questions regarding this manual should be sent to msc_n62_command_issm@us.navy.mil for resolution.

Military Sealift Command Managers’ Internal Control-

Quality Management System Procedure

COMSC P N6.62.5239.3-Q

Rev 2

Issued By: Date:

Christopher D. Thayer Director, Maritime Operations

THAYER.CHRISTO

PHER.DAVID.1041

702296

Digitally signed by

THAYER.CHRISTOPHER.DAVID

.1041702296 Date: 2022.09.23 13:35:55 -04'00'

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx iv

MSC Cybersecurity Manual Table of Contents

Foreword ........................................................................................................................................................... iii Table of Contents ................................................................................................................................................iv References ......................................................................................................................................................... vi Part 1 Introduction

1. Purpose

2. Background

3. Overview

4. Applicability and Scope

5. Definitions Part 2 Responsibilities

6. Overview

7. Information System Security Managers (ISSM)

8. Information System Security Officers (ISSO)

9. Information System Developers

10. Program Managers (PM)

11. Privileged Users/System Administrators/Ship Communications Officer (SCO)/Radio Electronic Technician (RET)

12. Authorized Users

13. Cybersecurity Workforce Program Manager (CSWF-PM)

14. Cybersecurity Workforce Personnel

15. Cybersecurity Workforce Contractor Part 3 Procedures

16. Acquisitions and Authorization

17. Access Control

18. Change Management

19. Communications Security (COMSEC)

20. Compliance Assessment, Reporting, and Remediation

21. Contingency of Operations Planning (COOP)

22. Classified/Unclassified Material Destruction

23. Classified Meetings

24. CS Training

25. Electronic Mail (E-Mail)

26. Emergency Destruction

27. Disposition of Computer Hard Drives

28. Foreign Nationals

29. High to Low File Transfers

30. Information Assurance Vulnerability (IAV) and Event Management

31. Incident and Intrusion Reporting

32. Cyberspace Protection Conditions (CPCONs)

33. CPCON Levels

34. Infrastructure

35. Insider Threat

36. Internet Usage

37. Passwords

38. Personal Electronic Devices (PEDs)

39. Personally Identifiable Information (PII)

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx v

40. Personnel Security Standards

41. Privileged User Roles

42. Physical Access

43. Printing, Reproduction, and Photography

44. Risk Management Framework and A&A

45. Secure Remote Computing

46. Security Containers

47. Security Violations

48. Software Controls

49. Soft Certs

50. USB

51. Wireless

52. Working Papers APPENDIX A: Definitions .............................................................................................................................A-1 APPENDIX B: Acronyms............................................................................................................................... B-1 APPENDIX C: Contract Language ................................................................................................................. C-1 APPENDIX D: USB Request Form ................................................................................................................D-1 APPENDIX E: Incident/Event Reporting Template ....................................................................................... E-1 APPENDIX F: Incident Response Worksheet ................................................................................................ F-1

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx vi

References

(a) COMSCINST 5239.3C, MSC Cybersecurity Policy, 18 Mar 19

(b) Federal Information Security Management Act of 2002, Title III of

E-Government Act of 2002, Public Law 107-347

(c) SECNAVINST 5239.3C, Department of the Navy Cybersecurity Policy, 2 May 2016

(d) OPNAVINST 5239.1D, U.S. Navy Cybersecurity Program, 18 Jul 2018

(e) CJCSI 6510.01F, Information Assurance (IA) and Support to Computer

Network Defense (CND), 9 Feb 2011

(f) DoDI 8500.01, Cybersecurity, 14 Mar 2014, (CH-1, 7 Oct 2019)

(g) DoDD 8140.01, Cyberspace Workforce Management, 5 Oct 2020

(h) DoDI 8510.01, Risk Management Framework for DoD Systems, 19 Jul 2022

(i) SECNAVINST 5239.19A, Department of the Navy Computer Network Incident

(j) DoDD 5230.20, Visits and Assignments of Foreign Nationals, 22 Jun 2005

(k) SECNAVINST 5239.19A, Department of the Navy Computer Network Incident

Response and Reporting Requirements, 10 Sep 2019

(l) NIST Special Publication (SP) 800-61 Rev 2, Computer Security Incident

Handling Guide, 6 Aug 2012

(m) USTRANSCOM Memorandum TCJ6, Update of Cyber Security Contract Language for Information Technology (IT) and Non-IT Contracts, 8 May 2015

(n) DoDI 8551.01, Ports, Protocols, and Services Management (PPSM), 28 May 2014, (CH-1, 27 Jul 2017)

(o) DoDD 8521.01E, DoD Biometrics, 13 Jan 2016, (CH-2, 15 Oct 2018)

(p) National Security Telecommunications and Information Systems

Security Policy (NSTISSP) No. 11, Jul 2003

(q) Development Process for US Government Protection Profiles (PP)

(r) DoDI 8523.01, Communications Security (COMSEC), 6 Jan 2021

(s) COMSCINST 2280.3G, Policy and Procedures for Handling, Distribution, and

Control of Communications Security Material within Military Sealift Command, 30 Nov 2021

(t) COMSCINT 3030.5A, Military Sealift Command Continuity of Operations Program, 1 Mar 2022

(u) DoDI 5015.02, DoD Records Management Program, 24 Feb 2015,

(v) DON CIO Memorandum, Acceptable Use of DON IT, 12 Feb 2016

(w) DON CIO Message DTG 2916522, Loss of Personally Identifiable Information

(PII) Reporting Process, Feb 2008

(x) USCYBERCOM Computer Tasking Order (CTO) 12-0863 231402Z, Jul 12, DoD

SIPRNET Public Key Infrastructure Implementation

(y) NETWARCOM CTO 08-07, Public Key Infrastructure (PKI)

(z) DoDM 5200.02, Procedures for the DoD Personnel Security Program (PSP), 3 Apr 2017, (CH-1, 29 Oct 2020)

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx

N6.62.5239.3-Q vii

(aa) Navy Cyber Defense Operations Command (NCDOC) Directive 11- 0010, Scanning and Patching

(ab) MSC Host Based Security System (HBSS) Exception Policy, 25 Aug 2011

(ac) SECNAV M 5210.1, Department of the Navy Records Management Program, January 2012

(ad) SECNAVINST 5000.37, Provision of Department of the Navy Documentary

Material, 21 Sep 09

(ae) COMSCINST 3121.9C, Standard Operating Manual (SOM), 12 Sep 2012

(af) NIST SP 800-53 Rev 4, Apr 2013 (rev. 4/30), Security and Privacy Controls for Federal Information Systems and Organizations

(ag) OPNAVINST 2100.2A, Navy Policy and Procedures on the Issuance, Use and

Management of Government-Owned Cellular Phones, Personal Digital Assistants and Calling Cards, 4 Sep 2008

(ah) FIPS 140–2, effective, 15 Nov 2001, Changes Notices (12-03-2002)

(ai) COMSCINST 5522.2B, Policy for use of Portable Electronic Devices in MSC

Spaces, 14 Jul 2020

(aj) SECNAVINST 5211.5F, Department of the Navy Privacy Program, 20 May 2019

(ak) DD FORM 2875, System Authorization Access Request (SAAR), Aug 2009 /

OPNAV 5239/14 (Rev 9/2011)

(al) USCYBERCOM CTO 10-004A Removable Flash Media Device Implementation

Within and Between Department of Defense (DoD) Networks

(am) DoDI 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, 24 May 2011

(an) DoDI 8520.03, Identity Authentication for Information Systems, 13 May 2011, (CH-1,

(ao) NIST SP 800-34, May 2010 (Rev 1)

(ap) Circular 92 Title 17, Copyright Law of the United States (Title 17), Dec 2011

(aq) NISTIR 6985, COTS Security Protection Profile - Operating Systems (CSPP-OS), Apr 2003

(ar) DON Memorandum Navy Open-Source Software Guidance, 5 Jun 2007

(as) DoDD 8100.02, Use of Commercial Wireless Devices, Services, and Technologies in the Department of Defense (DoD) Global Information Grid (GIG), 14 Apr 2004

(at) COMUSFLTFORCOM INST 2100.1, 21 May 2014, Policy and Procedures on the

Issuance, Use, and Management of Government Issued Wireless Devices

(au) DODI 5200.48, Controlled Unclassified Information (CUI), 6 March 2020

(av) DoD 8570.01-M, Information assurance Workforce Improvement Program, 19 Dec 2005, (CH-4, 10 Nov 2015)

(aw) SECNAV M-5239.2, Department of the Navy Cyberspace Information Technology and Cybersecurity Workforce Management and Qualification Manual, 27 June 2016

(ax) USCCI 5200-13, Cyberspace Protection Conditions, 13 April 2019

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx

Part 1 Introduction

1. Purpose. This manual provides the procedures to support actions directed in reference (a). It follows Information Technology (IT) Cybersecurity (CS) methodologies implemented per references (b) through (f). It articulates the responsibilities required to implement, verify, and report sufficient security safeguards within MSC. These safeguards are necessary to acquire, manage, integrate, and secure Information Systems (IS) and capabilities to support the delivery of high-quality, cost effective IT solutions across the operational continuum.

2. Background. CS is the prevention of damage to, protection of, and restoration of all automated IS applications, enclaves, outsourced IT based processes, Platform IT (PIT), and PIT interconnections.

3. Overview. This manual addresses people, processes, strategies, technologies, and other comprehensive Department of Defense (DoD)-wide approaches for protecting IT infrastructure and the information contained within IT systems. Specifically, it:

a. Guides the development of appropriate CS strategy mechanisms required for the protection of MSC’s physical and logical IT assets. These security mechanisms must be an integral part of the development, acquisition, fielding, and operational processes.

b. Provides procedures related to protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of:

(1) Information created, collected, or maintained on behalf of MSC.

(2) IS and networks operated by MSC, contractors processing MSC information, or other organizations on behalf of MSC.

c. Establishes and integrates MSC afloat and ashore approaches to protect the availability, integrity, authentication, non-repudiation, and confidentiality of Department of Navy (DON) and MSC information, IS, and networks. This includes the ability to detect and react against attacks, and intrusions, mitigate the effects of incidents, help restore services, and perform post-incident analysis.

d. Establishes standards for identifying, training, and certifying personnel performing IT security management functions. This is including military, government employees, and contractor personnel, regardless of job series or military specialty per reference (g).

e. Requires all authorized users of DON IS to complete initial CS awareness orientation and annual CS awareness refresher training.

f. Incorporates CS/Computer Network Defense (CND) as a critical component of the IT systems engineering life cycle management process.

g. Requires registration of all MSC IS and networks that meet the qualification for registration in the DoD IT Portfolio Repository (DITPR) via the DON variant of DITPR, also known as DITPR-

DON.

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx

h. Requires all IT services under MSC's authority to maintain current Assessment and Authorization (A&A) approvals (i.e., Authority to Operate (ATO) and Authority to Connect (ATC)) per references (f) and (h).

i. Evaluates MSC IT CS Management in conjunction with CS policies and procedures annually.

j. Requires MSC IT programs to document security costs.

k. Directs the use of risk management analysis to balance MSC IT data criticality in order to identify and implement practical risk mitigations.

l. Directs the establishment, implementation, and integration of a comprehensive CS incident response and reporting process throughout MSC following the specific guidance established in references (i) through (l).

m. Makes certain compliance with DoD vulnerability management and notifications include the corrective actions necessary to minimize risk.

4. Applicability and Scope. This manual is applicable to controlled IS that are operated on behalf of MSC and receive, process, store, display, or transmit DoD, DON, and MSC information, regardless of classification or sensitivity. This also includes all contractor-owned systems or networks operated on behalf of MSC, including those that are for the exclusive use of contractors.

a. In the absence of more restrictive policies in place, all MSC personnel will adhere to the policies and directives implemented by the Chairman of the Joint Chiefs of Staff (CJCSI), DoD, DON, Federal Government, and relevant contract language per reference (m).

b. This manual does not pertain to, alter, or supersede existing authorities and policies of the Director of National Intelligence (DNI) and Deputy Chief of Naval Operations, Information Warfare (CNO (N2N6)), as the Navy Senior Official of the Intelligence Community (SOIC), regarding the protection of Sensitive Compartmented Information (SCI) and special access programs for intelligence as directed by Executive Order 12333.

c. All MSC IT system owners, maintainers, and users will adhere to the requirements within this manual.

5. Definitions. There are many words and phrases associated with providing government information. The term Information Assurance (IA) has been replaced with Cybersecurity. For the sake of clarity and consistency, the terms used throughout this manual along with their definitions are included in Appendix A. Appendix B contains Acronyms used in this manual.

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx

Part 2 Responsibilities

6. Overview. Reference (a) delineates roles and responsibilities relevant to implementing CS at MSC. Part 2 provides an overview of the CS functional roles within MSC.

7. Information System Security Managers (ISSM). The ISSM is responsible for the CS program within MSC. The ISSM functions as MSC’s focal point for CS matters on behalf of, and as principal advisor to Commander, MSC (COMSC). The ISSM roles and responsibilities are as follows:

a. Implementation of CS practices per DoD, DON, MSC policies and guidance.

b. Must not be assigned any other privileged user positions (e.g., key manager, certificate manager, network administrator, System Administrator (SA), database administrator, or web administrator). The COMSC is authorized to combine the ISSM and Information System Security Officer (ISSO) CS roles when operationally necessary.

c. Distribution and maintenance of plans, manuals, guidance, and Standard Operating Procedures (SOPs) for MSC IS.

d. Creation of CS policies and procedures for site-specific components of operations and maintenance.

e. Identifying alternative CS strategies to address organizational security objectives.

f. Coordination with United States Transportation Command (USTRANSCOM) CS Program and Navy Cyber Defense Operations Command (NCDOC) to implement controls as directed, collaborate on current threats and request more advanced vulnerability analysis as needed.

g. Oversee the review of network and systems audit trails, resolve discrepancies, and report incidents to NCDOC for evaluation and reporting. ISSM obtains audit trails of additional monitoring of individuals who have been identified as posing an increased level of risk.

h. Work with operations staff to mitigate vulnerabilities or elevate findings to engineering for resolution of new issues.

i. Address Information Assurance Vulnerability Alerts (IAVAs), Information Assurance Vulnerability Bulletins (IAVBs), and Technical Advisories (TAs) in the context of the DoD Information Assurance Vulnerability Management (IAVM) Program.

j. Support the A&A process and documentation of site-specific components within their Area of Responsibility (AOR) in the determination of appropriate measures to manage network risks effectively.

k. Coordinate with the Command Security (N021) support staff to validate users have the required security investigation, clearance, authorization, and need-to-know for access to each requested IS.

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx

l. Confirm established processes and procedures are implemented per MSC standards for:

(1) Issuing, protecting, and changing systems passwords.

(2) Incident handling and reporting.

(3) Antivirus signature updates.

(4) Firewall configurations.

(5) Change requests that affect the security posture.

(6) Host-based intrusion detection system monitoring.

m. Serve as the functional experts on CS best practices. Provide direct support to Program Management, Fleet Communications, and Mission Support divisions as needed to highlight how decisions may affect the security posture of cyber and communication infrastructures, especially to identify CS program implications of new technologies or technology upgrades.

n. Promote awareness of security issues among management and provide sound security principles to reflect in the organization's vision and goals.

o. Promote awareness of security issues among user base to facilitate a culture of cyber secure behavior through training and enforcement of established policies and procedures.

8. Information System Security Officers (ISSO). ISSOs are designated in writing to assist MSC ISSMs in meeting their duties and responsibilities to include the following:

a. Implement and enforce all DoD, DON, and MSC CS policies and procedures. Ensure all users are aware of their CS responsibilities for MSC systems before they are allowed access to those systems.

b. Initiate protective or corrective measures upon discovery of a CS incident or vulnerability.

Ensure a process is in place for authorized users to report all CS-related events, potential incidents, threats, and vulnerabilities.

c. Substantiate that all CS related documentation is current and accessible to properly authorized individuals.

9. Information System Developers. Developers oversee the early and continuous involvement of functional proponents, threat and risk assessors, users, CS personnel, data owners, certification authorities, and Navy Authorization Official (NAO) to implement the security requirements of the IS.

a. Contact the Staff CMS Responsible Officer (SCMSRO) during initial design to determine COMSEC device requirements (if required) in system design.

b. Implement Risk Management Framework (RMF) and document all software used for control purposes in the A&A packages.

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx

c. Implement Naval Information Warfare Systems Command (NAVWAR) Information Assurance/Technical Authority (IA/TA) Standards as appropriate during the system design and maintenance phase.

10. Program Managers (PMs). PMs are responsible for the overall life cycle management of an IS.

With respect to maintaining a proper CS posture, their specific actions include:

a. Register their system(s) in the NAVWAR Vulnerability Remediation Asset Manager

(VRAM).

b. Designate a primary and secondary representative responsible for managing its internal IAVM program.

c. Acknowledge receipt of the IAVA, IAVB, CTO, or Technical Advisory (TA) messages.

d. Validate CS compliance within the designated compliance windows or extensions.

11. Privileged Users/System Administrators/Ship Communications Officer (SCO)/Radio Electronic Technician (RET). Responsible to maintain CS posture on the IS within their AOR. Specific duties include:

a. Escort contract vendor personnel when performing system maintenance; record visits in the MSC Maintenance/Visitor Log.

b. Monitor user account activities and establish procedures for investigating, deactivating, and deleting dormant accounts.

c. Provide CS safeguards and assurances to the data under their control as well as their personal A&A mechanisms.

d. Analyze patterns of non-compliance or unauthorized activity and take appropriate administrative or programmatic actions to minimize security risks and insider threats.

e. Make available certain hardware, software, data, facility resources, and all other applicable IT assets to support users and comply with prescribed CS requirements.

f. Recognize potential security violations, take appropriate actions to report the incident as required, and remediate or mitigate any adverse impact.

g. Implement applicable patches and security updates in a timely manner to avoid potential compromise or loss of functionality.

h. Configure, optimize, and test devices (e.g., servers, workstations, routers) to meet certain compliance with security policies, procedures, and technical requirements.

i. Verify that hardware, software, data, and other resources are archived, sanitized, or destroyed in a manner compliant with systems security plans, requirements, and regulations.

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx

j. Perform audit log reviews on networks, systems, and applications per applicable Security Technical Implementation Guides (STIGs).

12. Authorized Users. MSC authorized users have been granted access to sensitive and/or classified information that is vital to the nation’s security. Users have the responsibility to safeguard information. Users must also meet certain obligations to maintain access.

a. Report behaviors, incidents, or events to the Command Security Manager (CSM) that might affect national security and the ability to function positively and effectively in a national security environment.

b. Do not perform the following actions as it may result in the loss of access or affect clearance status:

(1) Auto-forward any e-mail from an MSC account to commercial e-mail account (i.e., Gmail, AOL, Yahoo mail, etc.).

(2) Bypass, stress, or test CS or CND mechanisms (e.g., Firewalls, Content Filters, Proxy Servers, Anti-Virus Programs).

(3) Introduce or use unauthorized software, firmware, or hardware on any MSC IT resource (e.g., wireless access points).

(4) Relocate or change equipment or the network connectivity of equipment without authorization from the ISSM.

(5) Use personally owned hardware, software, shareware, or public domain software without written authorization from the ISSM.

(6) Upload/download executable files (i.e., exe, .com, .vbs, or .bat) onto MSC IT resources without the written approval of the ISSM.

(7) Participate in or contribute to any activity resulting in a disruption or denial of service.

(8) Write, code, compile, store, transmit, transfer, or introduce malicious software, programs, or code into networks or computer equipment.

(9) Use MSC IT resources in a way that would reflect adversely on MSC or the Navy. Such uses include pornography, chain letters, unofficial advertising, soliciting or selling except on authorized bulletin boards established for such use, violation of statute or regulation, inappropriately handled classified information and Personally Identifiable Information (PII), and other uses that are incompatible with public service.

(10) Place data on MSC IT resources possessing insufficient security controls to protect that data at the required classification (i.e., Secret onto Unclassified).

c. The following are those situations that must be reported to the security office:

(1) Misuse of Computer/Automated Information Systems (AIS). Unauthorized entry into an

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx

AIS, whether government or contractor, for any reason. Modification, destruction, or manipulation of hardware or software, whether government or contractor equipment.

(2) Misuse of passwords. Do not obtain/use someone else’s password to access another’s account without permission. Do not copy/delete information from another’s account without their permission.

d. Suspicious incidents. Users may make reports to the MSC Security Officer via e-mail, facsimile, telephone, or in-person. A written report must follow a telephonic or in-person report.

Report all information about the incident as soon as possible.

13. Cybersecurity Workforce Program Manager (CSWF-PM). The CSWF-PM is responsible for communicating and tracking all Cyber IT/CSWF credentialing and development training, and certificate/certification requirements. The CSWF-PM must be designated in writing. The CSWF- PM roles and responsibilities are as follows:

a. Be trained and qualified In Accordance With (IAW) Appendix IV of reference (aw).

b. Implement CS practices per DoD, DON, and MSC policies and guidance.

c. Be responsible for the administration and overall effectiveness of the Cyber IT/CSWF Program.

d. Identify the training and certification/certificate track required for each CSWF member to support the Cyber mission.

e. Collaborate with first line supervisors and Human Resources to ensure billets and Position Descriptions (PDs) of personnel performing Cyber IT/CS functions are coded with the appropriate three-digit work role code or modify work role codes on billets that no longer have Cyber responsibilities to remove (not delete) the billet from CSWF.

f. Obtain appropriate Total Workforce Management Services (TWMS) access to manage Cyber IT/CS workforce.

g. In conjunction with first line supervisor, ensure each member has an Individual Development Plan (IDP) that leads to full qualification for assigned billet and PD.

h. Designate all CSWF members in writing.

i. Provide workforce readiness status to the ISSM for inclusion into overall Cyber readiness report.

j. Validate privileged users have a signed Privileged Access Agreement (PAA) form on file that specifies the system(s) and operating system(s) maintained and operated. These agreements must be reviewed, updated, and signed annually and must identify the specific system, network, or application to which an individual has privileged access.

14. Cybersecurity Workforce Personnel. Cyber workforce are the personnel who build, secure, operate, defend, and protect DoD and U.S. Cyberspace resources. They must:

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx

a. Be trained and qualified IAW Appendix IV of reference (aw).

b. As required, complete a PAA form signed by the ISSM and validated by the CSWF-PM.

These agreements must be reviewed, updated, and signed annually and must identify the specific system, network, or application to which an individual has privileged access.

c. As required, complete a SAAR-N form signed by the ISSM or appointee and Command Security Manager.

d. Notify the ISSM, and when appropriate, the Command Security Manager, of any changes that might affect security clearance.

e. Understand qualification requirements of assigned billet/position.

f. Routinely check with command CSWF-PM to verify the CSWF readiness accurately depicts qualification status.

g. Work with supervisor to create an IDP that captures required training path for CSWF qualification, 20 hours continuous learning, and career development.

h. Be removed from CSWF if qualification is not met or maintained.

15. Cybersecurity Workforce Contractor. Cyber workforce contractor personnel build, secure, operate, defend, and protect DoD and U.S. cyberspace resources. They must:

a. Be trained and qualified IAW references (av) and (aw) prior to workforce assignment.

b. As required, complete a PAA form signed by the ISSM and validated by the CSWF-PM.

c. As required, complete a SAAR-N form signed by the ISSM or appointee and Command Security Manager.

d. Provide documentation supporting cybersecurity certification status.

e. Meet background investigation requirements IAW references (av) and (aw).

f. Not be assigned duties as ISSM or PM or be in charge of government personnel.

g. Participate in a continuous learning program as described in references (av) and (aw).

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx

Part 3 Procedures

16. Acquisitions and Authorization. CS Requirements:

a. N6 will identify CS requirements to comply with applicable DoD/DON guidance and/or industry best practices. Appendix C includes specific examples of contract language MSC will use.

N6 will evaluate any procurement of operational IT systems before release. Implementing authorities are to identify potential conflicting policies to the MSC Command ISSM for resolution.

b. Incorporation of CS requirements will take place in the early stages of program design activities to confirm the appropriate levels of confidentiality, integrity, availability, non-repudiation, and authenticity of the systems and information contained.

c. Identify CS safeguards early in the acquisition and implementation strategy to address key elements associated with execution (i.e., technical, scheduling, maintenance, funding). This ensures CS is built-in vice bolted-on.

d. Acquisition, procurement specifications, and contracts for MSC IS assets, products, and services will include statements of CS requirements.

e. Purchases will take place per Navy and MSC contracting, acquisition policies and procedures, Blanket Purchase Agreements (BPAs), and CS approval. For specifications, tasks and clauses used in writing contracts refer to reference (m).

f. All MSC contracts for MSC IT assets and services must contain language requiring the participation in the IAVM program.

g. Statements will reflect initial risk assessments and specify the required protection level per reference (l).

h. All new acquisitions or upgrades of electronic biometric collection systems will conform to references (n) and (o).

i. MSC commands, directorates, organizations, direct reporting PMs, and/or functional component’s commanders will not field or accept systems with the following deficiencies:

(1) Not meeting minimum-security standards stated in the acquisition and procurement specifications.

(2) Not having an A&A granted by the appropriate Navy Authorizing Official.

j. MSC will utilize the National Information Assurance Partnership (NIAP) Common Criteria program and references (p) and (q) to determine the approval of specific hardware for use on the network.

17. Access Control. The Access Control Policy includes:

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx

a. Defining user or group rules and rights are ensuring these are clearly stated. Consider logical and physical access controls for assets together. This policy takes into account:

(1) The security requirements of each network, system, and application.

(2) The identification of all data related to the application or system and risks associated with access to the information.

(3) The implementation of “Least Privilege” concepts for access to systems and applications.

(4) Standard user profiles for common job roles.

(5) The segregation of access control roles, such as access requests, access authorizations, and access administration.

(6) Formal procedures for access requests and approvals.

(7) Remove the access rights of individuals who transfer, their roles or access authorizations change, or they are terminated. Include requirements for notifying administrators.

b. Due to the sensitive nature of the MSC missions, access to the Network Operations Centers (NOC), afloat units, and Headquarters (HQ) are restricted to permanently assigned personnel for official purposes only and visitors conducting officially sanctioned business. For security purposes, the term visitor applies to any person not attached to or employed by the specific Unit Identification Code (UIC) being visited. Visitors may be sponsored for entry into controlled spaces only when such access is required in connection with official government business.

(1) Security Access Badges. MSC facilities utilize security badges to ensure positive identification of personnel and to limit access to exclusion and restricted areas based upon the employee or visitor’s clearance type and need to know. Visitors shall be cleared in writing by MSC Command Security personnel prior to being granted access. All visitors are required to sign the visitor log.

(2) All persons in MSC spaces must prominently display a valid security badge on their person, above the waist, at all times. All security badges issued will bear the MSC Command seal as appropriate, and will serve as a visual indicator of affiliation and authorized clearance level.

(3) Security identification badges will be used for access only. They are not to be used as personal identification for credit, check cashing at banking institutions, verification of government employment, or other similar purposes. Security access badges issued by MSC remain U.S.

Government property. Surrender badges to security before resignation or reassignment.

c. Visitor Policy and Procedures. As the DoD personnel security system of record, Defense Information Security System (DISS) shall be used to verify clearance and/or access information for DON civilian, military, and contractor personnel. Prior to granting access to controlled areas and/or classified information, clearances will be certified.

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx

(1) Visitors representing agencies that do not participate in DoD DISS clearance policy efforts must continue to forward visit notifications and clearance certifications by record message traffic or facsimile.

(2) This policy does not negate the Need-to-Know (NTK) requirement, which must be established by the employee sponsoring the visit. In order to validate NTK and ensure the DISS record is sufficient to base the issuance of a security access badge, technical representatives are encouraged to provide the MSC security office with advance notification of the visit.

(3) Visitors who arrive without prior notification will be denied access to MSC facilities, operational spaces, or afloat units until Security approval is obtained.

(4) Visitors who are sponsored for access to MSC facilities and afloat unit-controlled areas shall be issued a badge per affiliation and clearance levels. MSC Security will verify clearance eligibility of sponsored command visitors using DISS and will issue access authorization via e-mail.

MSC personnel will ensure that positive identification of all visitors is obtained by presenting a valid government issued form of identification (i.e., Common Access Card (CAC), state issued driver’s license, passport) and will ensure the visitors access is annotated in the visitor’s log. When visitors arrive at the MSC facilities, on site personnel will check either the posted access list or the visitor’s log binder for access authorization. Visitors that have a clearance, based on confirmation from the Security Office or the access list, will be given a “No Escort (NE) Required” badge.

Visitors that do not have a security clearance will be given an “Escort Required (ER)” badge.

Visitor badges issued by MSC remain U.S. government property and must be surrendered at the main entrance upon departure.

d. Uncleared Visitors (Including Foreign Nationals). All visit requests for uncleared visitors will be forwarded to MSC's Security Office for approval. Once the security office has vetted the individuals through local agency checks, the security office will advise the MSC facility and afloat units via e-mail of visitor names and dates of visit. MSC personnel will ensure classified spaces are sanitized prior to and during entire visit and escort the visitors entire time they are in the space.

Sanitizing spaces include turning off classified monitors, stowing all classified material, and ensuring visitors do not have access to or can view classified material in print or on monitors.

Visitors must have in their possession personal identification containing a picture and an identification number, date of birth, and nationality. They also must know the applicable visit authorization number.

e. Access by Emergency Personnel. In the event of an emergency, fire fighters and medical personnel will be allowed immediate access. Normal visitor control procedures performed by the escort are not required. If circumstances permit, escorts may be assigned to emergency response personnel; however, access will not be delayed. MSC personnel will notify the MSC security office as soon as possible whenever Emergency Response Team access is necessary. Command personnel will make every attempt possible to keep classified material from the view of emergency personnel;

however, under no circumstances will personal safety be sacrificed to protect classified information.

(1) If an inadvertent disclosure of classified material occurs during an emergency, the names of emergency personnel involved will be reported to the security office for appropriate action.

f. Reporting a Lost or Stolen Badge. It is the responsibility of the badge holder to notify the security office immediately upon realization that the security access badge has been lost or stolen.

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx

Lost and/or stolen badges will be immediately disabled to prevent unauthorized use, and a replacement badge will be issued. Individuals who forget their security access badge shall report to their supervisor and be issued a "No Escort Required" badge for the duration of the watch. This action will be annotated in the Watch Supervisor Log and the Supervisor and individual will ensure that the badge is returned and logged in at the end of the watch.

g. Replacement Badges. Replacement badges will be issued for: lost or stolen badges, if a person's clearance level changes, if a person's appearance changes significantly, or when events necessitate a name change (i.e., marriage or divorce).

(1) To request a replacement badge, the employee must complete the Lost Badge Form, obtain their supervisor's signature, and forward to the MSC security office for processing.

h. Escort Procedures. When it is necessary to allow access to the MSC facilities or afloat units for persons that do not hold a Secret clearance, the technical representative responsible for the specific equipment or function must assign an escort. The assigned escort must escort all uncleared visitors entering the MSC facilities beyond the main entrance. The purpose of escorting is threefold: to prevent the unintentional disclosure of classified information, materials, or equipment to uncleared persons; to detect and deter covert attempts to obtain classified information, material, and equipment; and to ensure that security procedures and regulations are enforced. Prior to assuming escort duty, CSM personnel shall indoctrinate all escorts in their responsibilities. Prior to performing escort duty indoctrination must be accomplished.

(1) Escorts will maintain an unobstructed view of uncleared visitors at all times.

(2) The escort will clearly announce to all personnel in the area that uncleared personnel will be in the spaces. The escort will ensure all personnel have sanitized their workspaces of classified information to include locking/logging off workstations for the entire timeframe uncleared personnel are in the spaces.

(3) If uncleared personnel will be working above the false ceiling, the escort must maintain observation of all work being done. The escort must also visually observe the work being done above the false ceiling.

(4) Escort personnel will be responsible for no more than two uncleared personnel at a time, unless all of the uncleared personnel are going into the same area (conference or meeting). When there are more than two uncleared personnel to be escorted, additional personnel cleared for the area will be assigned escort duty.

i. Outgoing Clearance Validations. DISS records for all MSC employees are updated regularly to reflect the members’ affiliation and access/clearance levels authorized; therefore, visit notifications and/or clearance certifications will not be forwarded to DON or Marine Corp facilities.

Personnel are encouraged, however, to provide a minimum 48-hour advance notification of their visit requirement to MSC Security. MSC members visiting an agency that does not participate in DoD DISS clearance policy efforts must provide the MSC security office with a minimum of 72-hour advance notification of their visit to ensure the clearances are received in time to accommodate the visit.

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx

18. Change Management. MSC personnel will adhere to Change Management (CM) and Integration processes. CM applies to an alteration as defined by any change in hull, machinery, equipment, arrangement, or allowance that involves a change in design, material, quantity, or location of equipment and components in a ship or at the MSC Network Operations Centers (MNOC EAST or MNOC WEST). It includes but is not limited to new installations and upgrades to IS and non-IT electronics, embedded control systems, and internal communications systems (including site televisions, monitors, CCTV, commercial radio) and any interface antennas/receivers/converters or short-range own-ship radio systems. This requirement includes the release of new or updated STIGs. Prior to implementation, STIGs will be tested and submitted through CM for approval. This requirement generally does not include substitution of existing equipment or machinery hardware components available through off the shelf stock procurement when substitution of such components will not alter the operation of the supported equipment and will not affect the provisioning of spare parts or technical documentation.

a. The CM process functions through a Configuration Control Board (CCB) and provides a mechanism to:

(1) Integrate changes to Configuration Items (CIs). All afloat units are included in this process.

(2) Validate changes are compliant with the enterprise's technical architecture.

(3) Validate changes are compliant with the MSC Enterprise Architecture.

(4) Test and provide verification against system interoperability and integrity with utilized technologies.

(5) Maintain STIG checklists for each technology (i.e., routers, switches, Operating Systems) to provide artifact evidence in A&A packages.

(6) Maintain baseline configurations for all technologies (i.e., Virtual Servers, Operating Systems, Routers, and Peripherals) and documentation for all Ports, Protocols, and Services per reference (p) in use on MSC networks. Host Based Security System (HBSS) unique MSC settings will be determined by the CCB and applied to all MSC afloat units.

b. Changes to the enterprise begin initiation via a Change Request (CRQ), in which the Configuration Advisory Board (CAB) manages, approves, disapproves, and disseminates all information related to the CRQ.

c. The CAB is the authorizing body for changes to MSC C4 assets, systems, and applications.

d. Proposed changes will be evaluated for technical sufficiency, economy, cross program and class wide applicability, logistics and maintenance support requirements, and compliance with all external guidance and policy. Once approved, changes to configuration will be tracked by the cognizant PM(s).

e. Ships and shore-based activities are not to use their operating funds for the purchase of IT and related electronics assets without express authorization from their PM. In addition, use of the government purchase card for the purchase of designated IT assets is not authorized unless

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx specifically approved in writing.

f. A formal testing and acquisition process will be followed by the organization. Contracts should address the identified security requirements. Additional functionality built into the product that may cause a security risk should be disabled or removed.

19. Communications Security (COMSEC). MSC personnel involved in the handling, processing, and use of COMSEC material will follow current DoD directives and procedures within references

(r) and (s).

a. In addition to DoD directives and instructions, Local Element managers will follow the MSC local element procedures located on the MSC intranet site.

20. Compliance Assessment, Reporting, and Remediation. CS is a readiness issue that affects MSC's operations across the spectrum of services provided to the MSC fleet. Failure to develop and promote a command climate of responsible cyber security behavior among users is a preventable vulnerability.

a. To maintain secure systems, MSC relies on both shore-based personnel (government and contractors), who provide patch testing and update system baselines, and afloat personnel (government and contractors) that ensure networks are maintained to baseline. These personnel will ensure the entire compliance process is executed per governing directives.

b. MSC employs a patch, scan, analyze, and remediate process to ensure systems are fully patched and baselines are maintained. Administrators attempt remediation when analysis of scans indicates vulnerabilities still exist. Remediation that cannot be resolved at the local level is escalated to shore based Subject Matter Experts (SMEs) to resolve.

c. CS Vulnerability Assessment: ISSM and ISSO will ensure each IS within their AOR has a current vulnerability assessment conducted at all times. Current is defined as no older than 30 days.

(1) ISSM and ISSO will adhere to policies established in references (a) through (c).

(2) For those IS employing an Assured Compliance Assessment Solution (ACAS) scanner, scans will be set to take place weekly. ISSM and ISSO are to validate weekly scans occur.

(3) Scans will be conducted as needed to ensure a current scan is always on file.

(4) Personnel performing scans will upload results to the MSC portal per SOPs provided by the MSC CS team.

(5) Personnel experiencing issues with performing network scans will first need to document the issues by opening a trouble ticket with the MSC Global Support Desk (MSCGSD).

(6) Conduct vulnerability assessments (automated or manual) on all systems prior to implementing on the production network.

(7) Ships with networks in extended lay-up due to a ship availability period, or other circumstances, may request an exemption from this requirement in writing (e-mail will suffice) to

UNCONTROLLED QMS DOCUMENT IF PRINTED. Verify current version at: https://navy.deps.mil/sites/msc/policies/Pages/Directives.aspx the MSC N6 Afloat CS team.