Attach 1 to A0004_COMSCINST 2280.3F.pdf

COMSCINST 2280.3F

N6

2 Jun 20

COMSC INSTRUCTION 2280.3F

From: Commander, Military Sealift Command

Subj: POLICY AND PROCEDURES FOR HANDLING, DISTRIBUTION, AND CONTROL

OF COMMUNICATIONS SECURITY MATERIAL WITHIN MILITARY SEALIFT

COMMAND

Ref: (a) CMS-1 Department of the Navy COMSEC Policy and Procedures Manual 01 Jul 19

(b) CMS-3 Department of the Navy Communications Security Material System Central

Office of Record Audit Manual 01 Jul 19

(c) MSC COMSEC Website: https://msc.navy.deps.mil/SitePages/Military%20Sealift

%20Command%20EKMS.aspx

Encl: (1) COMSEC Memorandum of Agreement

(2) COMSEC Local Element Appointment Letter

(3) SD Form 572, Cryptographic Access Certification and Termination

(4) Monthly COMSEC Training Report

(5) COMSEC Clearance Memorandum

(6) Local Element Principal Authority Responsibilities

(7) Local Element COMSEC Manager and Alternate Responsibilities

(8) Local Element Training/Skillset Audit Requirements Chart

(9) Local Element Skillset Audit Checklist

1. Purpose. This instruction sets policy, establishes procedures and assigns responsibilities per references (a) through (c) using enclosures (1) through (9) for the handling, distribution and control using Communications Security (COMSEC) material held in the Military Sealift

Command (MSC) Tier 2 accounts or issued to MSC Tier 3 Local Elements (LE). References (a) through (c) shall be utilized as tools to facilitate the proper management and administration of

Tier 2 and Tier 3 account holdings.

2. Cancellation. COMSCINST 2280.3E.

3. Background. COMSEC systems and procedures are used to protect U.S. Government transmissions, communications and the processing of classified or sensitive unclassified information related to national security from unauthorized persons. COMSEC material is also used to protect communications from unauthorized persons by ensuring the authenticity of such communications. Reference (a) provides detailed regulations and guidance for issuing, receiving, accounting, handling, safeguarding and destroying COMSEC material and will be closely followed by the responsible parties described in paragraph 7.

DEPARTMENT OF THE NAVY

COMMANDER MILITARY SEALIFT COMMAND

471 EAST C STREET

NORFOLK VA 23511-2419

The enclosures provide general local guidance for COMSEC program management, but do not substitute in any way for reference (a) guidance.

4. Definitions. Definitions of terms used in this instruction are found in reference (a), article

110 and Annex A.

5. Policy. Reference (a) applies to COMSEC materials held by MSC LE accounts and its provisions apply to all who require access to, or use COMSEC material. This instruction applies to all military personnel, civil service employees, contractors and operating company personnel, ships and facilities that require COMSEC support from MSC. All personnel will be aware that non-compliance or deviation from the prescribed procedures can jeopardize the security of the

U.S. and could result in administrative or criminal penalties, including prosecution of the parties concerned under espionage laws, 18 U.S. Code (U.S.C.) §§ 793, 794 and 798.

6. Procedures

a. The COMSEC infrastructure begins with Tier 0, consisting of the National Security

Agency (NSA). Tier 1 is the layer serving as Central Offices of Record and registration authority for COMSEC accounts. The MSC COMSEC infrastructure consists of two Tier 2 parent accounts located in Norfolk, Virginia. These COMSEC accounts are administrative entities where custody and control of COMSEC material is maintained. Tier 2 accounts are the single entry and exit point for all MSC COMSEC material. They are managed per references (a) and (b).

b. MSC has Tier 3 LE accounts worldwide under MSC’s parent Tier 2 accounts. MSC Tier

3 LE accounts managed by the West Coast Vault will be assigned to parent account 170006;

MSC Tier 3 LE accounts managed by the East Coast Vault will be assigned to parent account

370006. LE accounts function and are managed similarly to the parent COMSEC accounts with the primary differences being:

(1) They do not have a Naval Communications Security Material (CMS) System assigned account number per reference (a).

(2) They draw COMSEC material from the parent Tier 2 accounts. Per reference (a), LEs are only authorized to receive COMSEC material from MSC’s Tier 2 COMSEC accounts unless otherwise authorized by MSC’s Staff Communications Material System Responsibility Officer

(SCMSRO).

c. Each LE account falls under the responsibility of the Principal Authority (PA), who can be a Ship’s Master, Commanding Officer, Officer-In-Charge, Program/Project Manager, or

Functional Director for the activity/organization.

d. LE accounts can be classified as “LE-issuing” or “LE-using.”

(1) LE-issuing. Per reference (a), commands or entities that manage Reserve-on-Board

(ROB), which is a quantity of keying material, not yet effective, held in reserve by an account to be used at a later date. It also can mean any command that issues material to other COMSEC users within their activity. Designation as an LE-issuing command shall be included as part of enclosure (1), COMSEC PA Appointment Letter/Memorandum.

(2) LE-using. As defined in reference (a), commands and activities not managing ROB and/or issuing material to other COMSEC users. Designation as a LE-using command shall be included as part of enclosure (1), COMSEC PA Appointment Letter/Memorandum.

7. Responsibilities

a. SCMSRO. Per reference (a), the SCMSRO is appointed by Commander, MSC and is responsible for the proper oversight and administration of MSC’s Tier 2 COMSEC accounts, COMSEC program, COMSEC account managers and ensuring MSC Tier 3 LE accounts comply with the applicable references.

b. Tier 2 COMSEC Manager. The COMSEC manager is appointed by MSC’s SCMSRO and is MSC’s primary representative for COMSEC material. The COMSEC manager is responsible to the SCMSRO for the proper administration of MSC’s COMSEC accounts per reference (a) and this instruction.

c. Tier 2 Alternate COMSEC Manager. The alternate COMSEC managers are appointed by and responsible to MSC’s SCMSRO and share equally with the COMSEC manager the responsibility for the proper management and administration of their COMSEC account per reference (a) and this instruction.

d. Tier 2 COMSEC Program Manager (PM). The COMSEC PMs are appointed by and responsible to MSC’s SCMSRO and are the primary point of contact for a Tier 3 LE account.

The COMSEC PM provides oversight, direction and training per reference (a) and this instruction.

e. Tier 2 COMSEC Auditor/Trainer. The COMSEC Auditor/Trainer will evaluate, per reference (b), the procedures for safeguarding, accounting and disposition of COMSEC material held by an LE. The COMSEC Auditor/Trainer is appointed by and responsible to MSC’s

SCMSRO and is tasked with identifying and analyzing those factors and offering suggestions and training for improvement.

f. Tier 3 LE PA. The PA is appointed by and responsible to MSC’s SCMSRO for properly administering his/her COMSEC LE account as defined in this instruction per enclosures (1) through (3) while ensuring compliance with established policy and procedures per reference (a), as detailed in enclosure (6).

g. Tier 3 LE COMSEC Managers. The LE COMSEC manager and alternate managers are appointed by and responsible to the Tier 3 LE PA for the proper management and security of the

LE account, to include the proper security, accountability, control and disposition of issued

COMSEC material per reference (a), Article 411 and this instruction.

h. Tier 3 COMSEC Witness. Any properly cleared individual who witnesses an inventory, destruction or other routine administrative tasks related to the handling of COMSEC material is equally responsible as the primary individual and should be familiar with applicable procedures per reference (a).

8. COMSEC Training and LE Personnel Qualifications

a. Training and qualification requirements for designation and appointment of LE responsible personnel are as follows:

(1) Enclosure (5) identifies training requirements for LE Principal Authorities, COMSEC

Managers and Users.

(2) Personnel being designated as LE managers and alternate managers must meet requirements detailed in enclosure (6) prior to assuming responsibility.

(3) LE Radio Electronic Technician Civil Service Mariners and Military Detachment personnel requiring access to COMSEC material will complete the COMSEC 301 MSC

Personnel Qualification Standard Naval Education and Training 43462-2 within 60 days of reporting on board the respective activity.

(4) In addition to requirements per enclosure (5), contracted LE managers shall demonstrate proficiency as detailed per enclosure (7) “LE Skillset Audit Checklist” during annual COMSEC audits.

b. LE COMSEC Audits

(1) The LE auditing program is designed to aid in the effective management of MSC’s

COMSEC program per reference (b).

(2) At a minimum, MSC LEs will be audited at least once each calendar year on or before

December 31. LE may request an additional audit at any time to ensure accountability and control of COMSEC holdings; for instance, when an account is transferred to a new manager.

(3) Per reference (b), Chapter 2, an audit will include:

(a) A comprehensive account review utilizing the checklist contained in reference (b), Annex B, as a guide.

(b) Identification of COMSEC deficiencies (as appropriate, deficiencies shall be corrected during audits).

(c) COMSEC physical security inspection utilizing reference (b), Annex D.

(d) Completion of enclosure (7) for contractors designated as LE managers.

9. Records Management. Records created, as a result of this instruction, regardless of media and format, shall be managed per Secretary of the Navy Manual 5210.1 of January 2012.

10. Review and Effective Date. Per OPNAVINST 5215.17A, N6 will review this instruction annually on the anniversary of its effective date to ensure applicability, currency and consistency with Federal, Department of Defense, Secretary of the Navy, Navy policy and statutory authority using OPNAV 5215/40 Review of Instruction.

M. A. WETTLAUFER

Releasability and distribution:

This instruction is cleared for public release and is available electronically only via MSC Intranet

Publications Web site, https://msc.navy.deps.mil/policies/Pages/Directives.aspx.

https://msc.navy.deps.mil/policies/Pages/Directives.aspx

Enclosure (1)

COMSEC MEMORANDUM OF AGREEMENT

Ser N642/

DD Mmm YY

From: Staff CMS Responsibility Officer, Military Sealift Command

To: Principal Authority, _________________________________

Subj: APPOINTMENT LETTER/MEMORANDUM

Ref: (a) CMS-1

(b) CMS-3

Encl: (1) SD Form 572

1. Per reference (a), you are hereby appointed as Principal Authority for Local Element

(LE) (Issuing/Using) Tier 3 Communications Security (COMSEC) LE account number:

xxxxxx-xxx under the Military Sealift Command COMSEC Tier 2 account. You are directed to familiarize yourself with and adhere to the policies and procedures within references (a) and (b).

2. Retain the original copy of the letter/memorandum of appointment in the

Correspondence/Message File for two years from the date an individual has been relieved of his/her duties.

X. X. XXXXXX D. J. WILLIAMS

Principal Authority Staff CMS Responsibility Officer

Date:_______________________

Enclosure (2)

COMSEC LOCAL ELEMENT APPOINTMENT LETTER

MEMORANDUM

From: Principal Authority

To: (Rank/Rate/Grade, Name, and DoD ID)

Subj: APPOINTMENT LETTER/MEMORANDUM

Ref: (a) CMS-1

(b) COMSCINST 2280.3

Encl: (1) SD Form 572- Cryptographic Access Certification and Termination

1. As per references (a) and (b), you are hereby appointed as Local Element (LE)

(Issuing) Manager, Alternate LE (Issuing) Manager, LE (Using) Manager, Alternate LE

(Using) Manager, as applicable) for Communications Security (COMSEC) account number: XXXXXX-XXX.

2. You must complete the COMSEC LE Course of Instruction not later than

(YYMMDD) at the prescribed location. You will provide a copy of your training certificate to your COMSEC Program Manager (PM) upon successful completion. Affix the completion certificate to the Appointment Letter when training is completed.

3. Your security clearance has been validated this date as: (Top Secret/Secret, etc., as applicable).

4. Before an extended departure from the command (i.e., permanent transfer or leave/TAD/TDY in excess of 30 days), you will report to your COMSEC PM and be relieved of responsibility for all COMSEC material for which you have signed.

J. D. DOE

Principal authority

Enclosure (3)

CRYPTOGRAPHIC ACCESS CERTIFICATION AND TERMINATION

Enclosure (4)

MONTHLY COMSEC TRAINING REPORT

Record of Attendance Date:

Command / LE Account #: COMSEC LE Manager / Alternate

Email:

Phone No:

Training Topic:

Instructor:

Training Summary:

Attendee Name (Print Legibly) Attendee Signature

Enclosure (4)

NOTES:

1. Monthly COMSEC training is available for download on MSC’s NIPR website portal under “LE COMSEC RESOURCES (COMSEC Forms)”:

https://msc.navy.deps.mil/SitePages/Military%20Sealift%20Command%20EKMS.aspx.

Monthly training topics will be announced each year in DEC via Naval Message or

Email.

2. Complete monthly training and submit this record of attendance no later than the 5th of each Month to your COMSEC PM via email, or fax to 757-443-5084 (East Vault) and

757-443-3066 (West Vault).

3. Retain original for two years. Training reports are reviewed during annual COMSEC

Audits.

Enclosure (5)

COMSEC CLEARANCE MEMORANDUM

From: Principal Authority

To: Staff CMS Responsibility Officer

Subj: COMMUNICATIONS SECURITY MATERIAL COURIER CLEARANCE

Ref: (a) COMSCINST 2280.3 (Series)

1. In accordance with reference (a), I have verified that the following personnel retain appropriate active clearance to pick up & transit COMSEC material.

Name: First, Last, MI Clearance Level Effective Date

John Doe W. (TS, S, or C) 12 NOV 2011

J. D. DOE

Principal authority

NOTE:

1. The above memorandum will be sent via email or faxed to issuing facility prior to personnel picking up COMSEC material.

2. COMSEC couriers must possess a valid DD Form 2501 (Courier Authorization Card).

Enclosure (6)

LOCAL ELEMENT (LE) PRINCIPAL AUTHORITY (PA) RESPONSIBILITIES

1. Ensure compliance with established policy and procedures governing the safeguarding and handling of Communications Security (COMSEC) material per reference (a) chapter

5, reference (b) and this instruction.

2. Establish, in writing, a list of personnel authorized access to COMSEC material per reference (a), Article 503. An individual letter or an access list may be used for this authorization. For activities in which the PA is the only COMSEC responsible person

(COMSEC responsible persons include the Tier 3 LE PA, Tier 3 LE COMSEC Manager, or User), written authorization for access to keying material is not required. All such persons must be first verified to have appropriate and current clearance for access and to have the requisite training as discussed below.

3. Formally appoint an LE COMSEC Manager and Alternate COMSEC Manager to manage the day-to-day activities of the account as detailed in reference (a) chapter 5 and this instruction. For commands in which the PA is the COMSEC manager, an Alternate

COMSEC Manager appointment is required. LEs issued only KSV-21s are exempt from this requirement. A sample LE appointment letter is provided in enclosure (2) to this directive.

4. Review and sign PA COMSEC Appointment Letter/Memorandum provided by MSC parent COMSEC account. A sample PA COMSEC Appointment Letter/Memorandum is provided as enclosure (1) to this directive.

5. LE accounts are to conduct unannounced quarterly spot checks in accordance with reference (a), Article 407, utilizing checklists contained in reference (b). LE accounts where the PA is also the LE COMSEC Manager are exempt from conducting quarterly spot checks and will instead perform quarterly self-assessments per reference (b).

6. Report immediately and only to MSC’s parent account COMSEC Manager any known or suspected Practices Dangerous to Security (PDS) or COMSEC incidents per reference

(a), Chapters 9 and 10.

7. Ensure adherence to provided LE procedures.

8. Ensure LE audit-discovered deficiencies are immediately mitigated with results reported to respective COMSEC Program Manager.

9. Ensure Emergency Action Plan/Emergency Destruction Plan is established and tested annually per reference (a).

10. Ensure Simple Key Loaders are audited per LE procedure 17, per reference (c).

Enclosure (6)

11. Ensure all personnel who have access to COMSEC material have completed training in accordance with paragraph 7, subparagraph (1) on pages 3 and 4 of COMSCINST

2280.3F.

Enclosure (7)

LOCAL ELEMENT (LE) COMMUNICATIONS SECURITY (COMSEC)

MANAGER AND ALTERNATE RESPONSIBILITIES

The following is a comprehensive list of responsibilities:

1. Maintain and adhere to LE procedures.

2. Ensure access to references (a) through (c). All COMSEC manuals and instructions

(the “COMSEC library”) required in the operation of the LE account are available via reference (c). LEs that are unable to access reference (c) can contact their respective

COMSEC Program Manager (PM) for support.

3. Report immediately and only to the Military Sealift Command’s (MSC) parent account COMSEC manager any known or suspected Practices Dangerous to Security

(PDS) or COMSEC incidents per reference (a), Chapters 9 and 10.

4. Ensure each person drawing or using material from the account executes an SD form

572 and is verified beforehand to have a current appropriate security clearance, need to know and training.

5. Administer COMSEC Management Workstation (CMWS) Information Assurance

Vulnerability Alert (IAVA) Patches as directed by COMSEC parent account.

6. Before an extended departure from the command (i.e., permanent transfer or leave/TAD/TDY in excess of 30 days), ensure a proper turnover is conducted in accordance with LE procedure 3, per reference (c).

7. Ensure Special Security Officers (SSOs) (Simple Key Loader (SKL) Audit

Reviewers) conduct and document monthly SKL audits to be retained for two years.

8. Ensure Emergency Action Plan/Emergency Destruction Plan remains up to date per reference (a).

9. Conduct and report training using enclosure (4) at least once per month. Training will be documented and reported to the cognizant (or assigned) COMSEC PM. Training topics will be posted on reference (c) in the “Training” section and a training message listing topics for the calendar year will be sent and used as the foundation for the monthly training.

10. LEs desiring to transit material from any supporting MSC COMSEC facility will ensure that clearance status for personnel picking up material is sent to the parent account prior to actual pickup using enclosure (5) to this directive. In addition to clearance information, personnel picking up COMSEC material will present an ID and courier card prior to being provided custody of such material.

Enclosure (7)

11. Ensure emergency access capability to containers storing COMSEC Material.

Combinations to containers must be protected per reference (a), ART 507 with one exception: If manpower and resources do not support using a two person container to store “properly” sealed combinations (SF-700s) for a Top Secret container, an LE may use a General Services Administration (GSA) approved single-lock container that is limited to a person in authority who does not have access to the Top Secret container and the containers cannot be collocated in the same space. Where an LE has only unclassified Controlled Cryptographic Items (CCI), typically KSV-21 only accounts, contained in a single GSA approved container, the combination for the container is not required to be stored in a separate GSA approved container; instead, the combination can be stored in a separate lockable container where the combination shall be inventoried per reference (a).

12. Contracted LE managers will remain proficient in procedures set forth in enclosure

(9) to this directive “LE Skillset Audit Checklist.”

13. CIVMAR/MILDET LE managers are to train, qualify, and ensure all personnel with access to COMSEC material have completed appropriate PQS qualification as defined in paragraph 7, subparagraph (1) of COMSC Instruction 2280.3F.

14. Ensure containers storing COMSEC material are inventoried each time opened unless those containers are considered LE Issuing “vault” containers typically storing reserve onboard ROB material.

15. Ensure SKLs storing “Top Secret” material have a lanyard ring attached indicating classification, serial number and handling instructions.

16. LEs that anticipate they will be operating in an emission control status will provide prior notification to their cognizant (or assigned) COMSEC PM regarding the anticipated inability to submit destruction reports on time.

17. CMS-25s are required for all issued segmented material except material residing on the CMWS.

Enclosure (8)

LOCAL ELEMENT TRAINING/SKILLSET AUDIT REQUIREMENTS CHART

Notes:

X = Required

O = Recommended

Descriptions:

PA = Principal Authority (Master, CO, or OIC)

COMSEC MGR & ALT MGR = COMSEC Managers (Personnel administering the COMSEC Local Element Account)

COMSEC Users = Users are assigned personnel who have access to or handle COMSEC material

COMSEC COI = Contracted COMSEC course of instruction

Proficiency TRNG = Training provided by Auditor upon completion of Audit

MSC COMSEC PQS = NAVEDTRA/MSC orientated Personnel Qualification Standard for CIVMARS and MILDETs

SKL & KG-175D CBTs: Course Based Training for the Simple Key Loader & KG-175D

Training

Venue

COMSEC Course of

Instruction

MSC CMS PQS

(CIVMAR &

MILDET only)

SKL & KG-

175D CBTs

(Contractors only)

Proficiency TRNG

Skillset Audit

(Contractors only)

Periodicity Every 5 years Once (lifetime) Once (lifetime) Yearly Yearly

Day 5 Day 5 Day

PA

COMSE

C MGR

& ALT

MGR

COM

SEC

Users

PA

COMS

EC

MGR

& ALT

MGR

COM

SEC

Users

PA

COMS

ECMG

R &

ALT

MGR

PA

COMS

EC

MGR

& ALT

MGR

COM

SEC

Users

PA

COMS

EC

MGR

Issuing O X O N/

A

301,30

301 N/A N/A O X X

N/A N/A

Using N/A X O N/

A 301 301 O X O X X

N/A X

Using (KSV

Only) N/A N/A N/A X

N/A

Enclosure (9)

Yes No

4. Key Loading Procedures (Walk through)

AUDITOR: SCMSRO:

COMSEC Local Element Manager Skillset Audit

Secure Terminal Equipment (STE)

IRIDIUM

Simple Key Loader (SKL)

ADMINISTRATIVE

KG-175D

Local Element Manager: Date:

1. STE re-key procedures

2. Verify key expiration date in the KSV-21 card associated to the STE

The Local Element Manager shall demonstrate proficiency in the performance of the listed line items. The Manager can use any the available tools (LE Procedures, Manuals, Crypto Cards, personal notes, etc..) to complete. The Auditor will train to noted deficiencies and post results within formal Audit Report.

3. Conduct a Secure Call

5. Conduct a Secure Call

6. Review the Audit trail log

12. Modern Key Receipt (process and log)

Auditor Comments:

7. View keying material to include identification of effective and supersession dates

8. Procedures to delete keying material

9. Re-initialize Procedures (Walk through)

10. Verify the short title and expiration date of the electronic key loaded in the KG-175D

11. Loading Procedures (Walk through)

LOCAL ELEMENT SKILLSET AUDIT SAMPLE CHECKLIST