CDRL_A003.C A_Documentation.IA_Services.pdf

CONTRACT DATA REQUIREMENTS LIST

(1 Data Item)

Form Approved OMB No. 0704-0188

Public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302, and to the Office of Management and Budget, Paperwork Reduction Project (0704-0188), Washington, DC 20503. Please DO NOT RETURN your form to either of these addresses. Send completed form to the Government Issuing Contractor Officer for the Contract/PR No. Listed in Block E.

A. CONTRACT LINE ITEM NO.

B. EXHIBIT

A

C. CATEGORY:

TDP _________ TM- _________ OTHER ADMIN

D. SYSTEM / ITEM

PA IA Services

E. CONTRACT / PR NO.

TBD

F. CONTRACTOR

TBD

1. DATA ITEM NO.

A003

2. TITLE OF DATA ITEM

Information Systems Accreditation Documentation

3. SUBTITLE

C&A Documentation

4. AUTHORITY (Data Acquisition Document No.)

DI-ADMIN-80239

5. CONTRACT REFERENCE

Para 6.0

6. REQUIRING OFFICER

NSWC CORONA, PA00

7. DD 250 REQ.

9. DIST STATEMENT

REQUIRED

10. FREQUENCY

12. DATE OF FIRST SUBMISSION

14. DISTRIBUTION

LT ASREQ SEE BLK 16 b. COPIES

8. APP CODE C 11. AS OF DATE 13. DATE OF SUBSEQUENT

SUBMISSION

a. ADDRESSEE

Draft

Final

N/A SEE BLK 16 SEE BLK 16 Reg Repr o

16. REMARKS

Blk-4 – Contractor format is acceptable; submit documentation using the latest guidance per cognizant DAA for package format and content

Blk 9: "DISTRIBUTION STATEMENT C: Distribution authorized to U. S.

Government agencies and their contractors only (Administrative Use). (01 Oct

2015). Other requests for this document shall be referred to the Naval Surface

Warfare Center, Corona Division, California, Code PA00"

Blk 10, 12, 13 – The reporting period for the Information Systems Accreditation

Documentation shall be due upon the completion of each review, not later than 15 days after the review is completed.

Blk 14 - ELECTRONIC COPY SHALL BE BY E-MAIL IN MICROSOFT

OFFICE COMPATIBLE FILE FORMAT

NSWC Corona, Dennis Pangan

15. TOTAL 1

G. PREPARED BY

//s// Dennis Pangan

H. DATE

1 Sept 2015

I. APPROVED BY

Kimberly Brayton, PA00

J. DATE

1September 2015

DD Form 1423–1, FEB 2001 Previous editions are obsolete Page __1__ of __1__ Pages

DATA ITEM DESCRIPTION

Form AEWOVWJ

OMB No. 0704 -018C

EW 0.31s: 4“” 30, 1

TITLE 2. IDENTIFICATION NUMBER

InformationSystemsAccreditationDm2umantation

DI-ADMN-80239

DESCRIPTIONI.PURPOSE

3.1. ThE Data IterIDescription(DID)identifiesthe formatand contentrequirem coveredby the swcific and discretetaskfor the contractorto preparethisdata prcductidentifiedin the contractStatementof Work (SOW).

(continuadon page 2)

APPROVAL DATE 5. oFFICE OF PRIMARY RESPONSIBILITY (OPR) 6., DTIC REQUIRED 8b. G!DEP REOUll

:YYMMOO)

860915 A/ASSH-RMT

APPLICATION/ lNTERRELATlONSHIP

7.1. This DID cortati the fomt and content preparationinstructionfor the da productqeneratedby the specificand discretetaskrequirematfor thisdata includedin the contract.

7.2. This DID is applicableto all informationsystemsas SIXXified in AR 380-38C

7.3. ThisDID supersedesDI-s-1831.

APPROVAL LIMITATION 9.. APPLICABLE FORMS 9b, AIJSC NUMBER

A3963

PREPARATION INSTRUCTIONS

10.1 Contract. Thisdata is aeneratedby the contractwhichcontainsa q=ecific discretev.wk tasktm developthisdata mxxluct.

10.2 Contentand Format. Contentand Formatshal1 ke as describedbelow:

10.2.1 SectionI - ExecutiveSumrary.

a. Key Vulnerabilities.A summaryof key vulnerabilitiesidemtified during riskanalvsisprocessand exceptionalcircumstancespsrt.ainingto operatingthe system(s)in the facilityat the statedlevel. A discussionof actiOnsMen to minimizetheserisksmustte includd alongwitha descriptionof the exceptional circumstances,if any, justifyingoperationin thisenvironmsmt.

b. Male of Greration. De$cribsoptionsand proceduresin use at the facilit as follows:

(1) Icg-onattemots.

‘(2) Procedures,if processingin a lowersensitivitylevel.

(3) Majorsoftwaresystems,executive,and applications.

(4) Use of dataencryptionif any.

(5) Securityfeatuxes.

(6) Use of localnatiomls.

Form 18S4, FEB 85 .,.”,0”. e.. mo. !. “..”!

PAc3E~ —P~G=OF 3

3.

3.2.

DI-ADMN-80239

DEXRIFTICN/PUPXXE (cent‘d)

This DID definesthe dab requiredto obtaininformationsystemaccreditation in accordancewith AR 380-380,“AutrnnationSecurity.” Regulationcan be obtained from: ccmmnder, USAAGPublicationsCenter,2800-stern Blvd.,~l~re, ~ 21220-2896.

10. PREPARATIONIWSTRUCTTXXS(Cent’d)

10.2.1. (rent‘d)

c. WaiversRequested. Identifytitle,na and dateof any waiversgranted or rquestd for the Xormtion systi.

10.2.2. SectionII - AccreditationObjective.

a. Eackgrcund.Cesmiptionof relevanteventaleadingto and the objectiveof thisaccreditation;tbe essentialnatureof the missionand otherfactorsrrotivating thisaccreditaticm.otheroperationalalternatives(forexample,splitsystem, mcuremnt of separab cxxmuter)conaiderexlpriorto selectingthis courseofP action. Rationalefor rejectingotheropxational alternatives.

b: proposedsystem@sration. Detailedinformationconcerningfeaturesof operatloml and securitymalesto be i@em.nted, ti includedescriptionof syst~ (S) hardwareand software,significantapplications,and systeminterfaces.

10.2.3. SectionIII - Risk ManagementReview. Threatidentification(allexternal and internalthreats)will includea detailedvulnerabilityanalysis,risk assessmnt, and countermeasuresasscciatd with each threat.

10.2.4. SectionIV - Inplemmtationof SecurityControlsand Countemeasures.

a. SecurityFeatures. ~ibe h detailthe followingin existence:

(1) Security!4anagemnt.

(2) software.

(3) Hardmre.

(4) Procedural.

(5) Cannunications.

(6) Persoxlw?l.

(7) Dwunlentation.

(8) Physicaland Environwntal.

Page 2 of 3 pages

DI-ADMN-80239

10. PREPARATI~ INSTRUCrICNS(Cent’d)

b. I@emntation Procedures.Describereconmmded countemneasuresand alternatives,cost and tineestimatesto implementthesemwwres, milestones,task interdependenciesand initialand finaloperationalcapabilities.

c. ProblemAreas. Identifyproblemspotentiallydisruptiveof system accreditationtasks,processes,and schedules.

10.2.5. SectionV - System(s)Testand Evaluation(ST&E)Plan.

a. Test Requiremmts. A statementof the purpose,scow, objectivesand requirementsof the test.

b. TestMethodology.Identifythe follcwing:

(1) Test na.hcd to be used.

(2) Investigativeand analyticalapproachesto ke used.

(3) Supportrequirements,if any.

10.2.6. Appendices.The followingappendicesshal1 k included:

a. Glossarycontaininga listof abbreviationsor term.

b. Additionalappmdices shallbe used to furnishexamples,charts,exhibits, flowcharts,and scenario[s)thaturovideadditionalsupportivedata.

Page 3 of 3 Pages