NUWCDIVKYPT 5239.1F CH-1.pdf

NUWCDIVKPTINST 5239.1

MAR 2021

Online document is the master Retrieved from server on: 19 April 2021 Printed copy is an uncontrolled copy

CONTROLLED UNCLASSIFIED INFORMATION

i

NAVAL UNDERSEA WARFARE CENTER

DIVISION, KEYPORT

CYBERSECURITY

PROGRAM

NUWCDIVKPTINST 5239.1 F CH-1 Date: 08 MAR 2021

Process Owner: NUWC Division, Keyport Command Information Systems Security Manager

Directive Author: NUWC Division, Keyport Command Information Systems Security Manager

Canceled Directives: This directive supersedes NUWCDIVKPTINST 5239. 1F

Approval Signature:

X

Online document is the master Retrieved from server on: 19 April 2021

CONTROLLED UNCLASSIFIED INFORMATION

ii

Table of Contents

1. Purpose

2. Scope

3. Records Management

4. Policy

5. Roles and Responsibilities

6. Cybersecurity Training

7. Password Policy

8. Assessment and Authorization

9. Data at Rest

10. Electronic Mail and Internet Services

11. PKI

12. Use of Information Technology Assets While on Travel

13. Data Security for Classified Information

14. Vulnerability Management

15. DoD Information Systems Standard Consent Banner

16. SAAR-N Form

17. Malicious Logic

18. Labeling of Information Technology and Data Storage Media

19. Declassification and Destruction of Data Storage Media

20. Personal Electronic Devices (PED)s and Personal Wearable Fitness Devices (PWFDs)

21. Remote Access

22. WI-FI Technologies

23. Electronic Spillage

24. Non- NUWC Division, Keyport Owned Computer Equipment

25. Laboratory Manager’s Cybersecurity Binder

26. Review and Effective Date

27. Releasability and Distribution

1. Purpose. The Naval Undersea Warfare Center (NUWC) Division, Keyport Cybersecurity Program is the Division’s implementation of Federal, Department of Defense (DoD), and Department of Navy (DoN) Cybersecurity policy, directives, instructions and requirements, per references (a) through (aw). This is to ensure that Information Technology (IT) can be used in a way that allows mission owners and operators to (1) have confidence in the confidentiality, integrity, and availability of DoD IT and information and (2) to make informed choices that will contribute to and enhance the overarching assurance of the Cybersecurity Program.

2. Scope.

a. This policy statement applies to all information systems and networks operated by

NUWC Division, Keyport and its detachments that receive, process, store, display, or transmit unclassified, Controlled Unclassified Information (CUI), or classified information and to military, civilian, and contractor personnel supporting the Division. This includes Network Connected Centrally Managed, Closed enclaves, Program of Record (POR) and Platform IT (PIT) Systems.

b. This document provides a comprehensive and collected Cybersecurity policy for the

Division, consolidating what were previously separate Division directives in to a single policy document. Supporting execution information is managed by the Activity Command Information Officer (ACIO)/Information Technology Division (Code 104) and promulgated as standard operating procedures. Additionally, to clarify cybersecurity standards, NUWC Division, Keyport will provide definitive information to further establish and enforce the NUWC Division, Keyport Cybersecurity Program through associated Cybersecurity Control Objectives outlined in references (ay), (az), (ba) and (bb).

3. Records Management. Records created, as a result of this directive, regardless of media or format, must be managed per ref (ac).

4. Policy.

a. Cybersecurity. Cybersecurity is an operational requirement and encompasses security aspects that contribute to the protection of all Division information systems and networks. It ensures that the safeguards provided by physical, administrative, and security operational procedures, personnel, communications, emanations, hardware, software, and firmware security elements, taken together, are adequate to protect against unauthorized (accidental or intentional) disclosure, modification, or destruction of software, hardware, firmware, and data, or loss of processing capability. All security protection for information systems must be determined by, and be commensurate with, the sensitivity level of the information processed, stored, or transmitted through the system, per references (j) through (p).

b. Safeguarding Information and Resources. All DoN information and IT resources must be appropriately safeguarded at all times with respect to confidentiality, integrity, availability, authentication, and non-repudiation based on mission criticality, level of required information assurance, and classification or sensitivity level of information entered, processed, stored, displayed, or transmitted. Safeguarding information system resources and information must be accomplished through the budgeting, funding, and execution of defensive layers and actions

Online document is the master Retrieved from server on: 19 April 2021

CONTROLLED UNCLASSIFIED INFORMATION

necessary to protect all information system resources. DoN IT resources must be used in an acceptable manner and in accordance with policy elaborated in reference (i). Adhering to this policy will further provide a solid defense-in-depth approach to cybersecurity.

c. Information Systems Accountability. All information systems under NUWC Division, Keyport’s cognizance, whether owned by the Government or leased with Government funds, regardless of physical size, location, and processing capacity, must be accounted for and accredited. This requirement also applies to non-NUWC Division, Keyport owned information systems being used to perform mission functions. An information system will be operated only if provided an Authority to Operate (ATO) Platform IT Risk Assessment, or an Interim Authority to Test (IATT) either by the Navy Authorizing Official (NAO), who operates under the authority of the Commander United States (U. S.) Fleet Cyber Command, or by another service authorizing official as applicable. Authorizations must be reviewed at least annually or when changes are made to system functionality, architecture, interfaces, information processed, environment, and user communities, because these changes may increase the risk to the information system and the information stored or processed there in reference (q). The only authorized exception to this is a Local Interim Authority to Test (LIATT) NUWCDIVKPT 5239.27 for temporary connections of Zone C/D enclaves. A LIATT must be approved by the NUWC Division, Keyport Command Information Systems Security Manager (ISSM), reference (au).

d. Configuration Management. Configuration Management documents and manages the information system configuration, while providing stakeholders with the ability to accurately identify and trace information system’s physical and functional requirements. All NUWC Division, Keyport information systems baseline configurations must be documented and maintained throughout system lifecycle in accordance with reference (r). This includes an inventory of the hardware and software that comprise the system. Any changes to Division information systems must be approved and documented. Core Infrastructure Information Systems are administratively managed and controlled through the Code 104’s Configuration Control Board (CCB) Charter and Research, Development, Test & Evaluation (RDT&E) Configuration Management Plan and its associated processes. For all other systems, it is the responsibility of the product line or Program Manager to perform configuration management for these information systems. This management activity applies technical and administrative direction to the life-cycle of the NUWC Division, Keyport information systems, their configuration items, and their related product configuration information.

e. Reporting. All cybersecurity incidents, violations, and possible violations must be reported to the Command ISSM, including malware infection, electronic spillage, intrusion, loss, theft, and abuse. Overarching guidance for execution of cyber incident response throughout NUWC Division, Keyport is provided in the Division’s Cyber Incident Response Plan reference (t).

f. Copyrighted Software. Per reference (s), copyrighted software must not be reproduced within NUWC Division, Keyport except as authorized within existing legal requirements.

Personal accountability must be enforced for all violations of copyright laws or licensing agreements.

Online document is the master Retrieved from server on: 19 April 2021

g. User Requirements. All requirements and procedures pertaining to using information systems, internet services, intranet and e-mail services that are promulgated in this policy document and by the ACIO/IT Division (Code 104) must be strictly followed. All users of DoD information systems are required to sign and submit a completed System Authorization Access Request-Navy (SAAR-N) form (OPNAV 5239/14) prior to being granted access to any DoD or DoN information system per reference (u).

h. Authorized Use. DoN IT resources are provided for official use and authorized purposes only (e.g. contractor time cards) and may not be used for non-government work (i.e., personal businesses, non-NUWC Division, Keyport contractor business). Authorized purposes may include personal use within the following limitations:

(1) Personal use must not adversely affect the performance of official duties or degrade network performance.

(2) Personal use must be of a reasonable duration and frequency, not to exceed authorized break periods.

(3) Personal use includes communications that are most reasonably made during the work day, such as checking in with spouse or minor children, scheduling doctor and auto or home repair appointments.

(4) It is highly recommended that access to personal commercial email accounts be limited to minimize the risk of malware intrusion into DoN IT systems and networks. With the permissible use of personally owned cell phones and smart phones in NUWC Division, Keyport work areas and buildings, the use of DoN IT for authorized personal purposes should be minimized.

i. Access. An access control policy must be in place for each information system. This policy must include features and/or procedures to enforce the Access Control Policy for the information contained within the information system. The identity of each user authorized access to the information system must be positively established prior to authorizing access. Personnel must be authorized by the NUWC Division, Keyport department, division, or branch head and must have on file a SAAR-N form for the level of data that they are processing, (i.e., a SAAR-N form for classified or a SAAR-N form for unclassified, CUI, as applicable). When processing classified data, special measures must be taken to ensure that non-cleared personnel are denied access to the system and to the data being processed. Non-cleared maintenance personnel may only work on a system that has been cleared of all classified and sensitive data under the direct supervision of a cleared employee with Command ISSM approval.

j. Accountability. Access to NUWC Division, Keyport information systems, networks, and other computer resources must be controlled and monitored to ensure that each person having access can be identified and held accountable for his/her actions. It is the responsibility of system custodians and users to remain cognizant of current security regulations and directives.

Online document is the master Retrieved from server on: 19 April 2021

k. Removable Media in Classified Information Systems. Removable media (e.g. diskettes, compact disks (CDs), external hard drives, flash media, and universal serial bus (USB) “thumb drives”) to transfer data to or from classified information systems will be employed only to ensure that command mission tasks are not precluded or significantly impacted, reference (v). U.S.

Cyber Command (USCYBERCOM) and Naval Network Warfare Command communications tasking orders (CTOs) and Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs), per references (w), (x) and (ap), provide direction for the management of classified information systems and direct commands to disable the ability to write classified data to removable storage media, except under specific authorized circumstances.

Reference (e) provides further guidance on removable media that can be connected to a Navy network, workstation or other computing device that would allow data to be transferred or removed.

(l) Removable Media in Classified Information Systems, reference (w), provides local policy for the transfer of classified data to removable media. Media Transfer Agent (MTA) guidance, reference (ar) contains related procedures which must be followed when using removable media with classified information systems.

5. Roles and Responsibilities.

a. Commanding Officer (CO). The CO has been designated by Naval Sea Systems Command (NAVSEA) as the Local Cybersecurity Authority (LCA). This authority must not be delegated. The CO will comply with the requirements of references (a) and (b). Specifically, the CO must:

(1) Be responsible for Cyber/IT and Cybersecurity training and qualification compliance.

(2) Designate personnel whose primary duty (not collateral duty) is to oversee NUWC Division, Keyport Cyber/IT and Cybersecurity functions, administer the Cyber IT/Cyberspace Workforce (CSWF) training and qualification program, and ensure compliance with applicable Cybersecurity directives.

(3) Promote the professional development and qualification of employees who carry out Cyber/IT and Cybersecurity responsibilities.

b. Command Security Manager (CSM). The CSM is designated in writing by the CO, and serves as the principal advisor to the CO in all security matters, not including Cybersecurity, (i.e.

Physical, Personnel, Operational, Communications, Information & Industrial, etc.). The CSM will comply with the requirements of references (c) through (e). Specifically, the CSM must:

(1) Coordinate with the ACIO as required for effective management, use and oversight of classified information in electronic form.

Online document is the master Retrieved from server on: 19 April 2021

CONTROLLED UNCLASSIFIED INFORMATION

(2) Ensure that all security violations or incidents involving the possible compromise of classified information, to include those involving IT systems, are investigated and reported per reference (d).

(3) Coordinate after-incident responses involving classified information processed on IT systems with the ACIO and Command I.

c. ACIO. The ACIO is designated in writing by the CO, and serves as the principal advisor to the CO on all IT matters. The ACIO will comply with the requirements of references (a) through (h). Specifically, the ACIO must:

(1) Provide direction and leadership in the application of IT to support NUWC Division, Keyport’s goals.

(2) Integrate information management/information technology (IM/IT) with NUWC Division, Keyport business processes.

(3) Oversee the implementation of the IM/IT budget.

(4) Ensure that IT is acquired and IT resources are managed in a manner that complies with requirements set forth in references (a) through (e); Develop, maintain, and facilitate the implementation of a sound and integrated IM/IT architecture.

(5) Promote the effective and efficient design and operation of all IM/IT processes for NUWC Division, Keyport, including improvements to work processes.

d. Command ISSM. The Command ISSM is responsible for aiding the ACIO and CO in properly managing all information systems within NUWC Division, Keyport and its detachments. The Command ISSM is designated in writing by the CO and serves as the principal advisor to the CO and ACIO on all matters, technical and otherwise, involving Cybersecurity. The Command ISSM will comply with the requirements of references (b) and (c). Specifically, the Command ISSM must:

(1) Coordinate with the CSM and ACIO to ensure:

(a) Physical security of NUWC Division, Keyport information systems.

(b) Personnel security for those with access to NUWC Division, Keyport networks.

(c) Cybersecurity incident handling and reporting.

(d) Cybersecurity training and awareness.

(2) Provide oversight of NUWC Division, Keyport’s information systems and their operational environment to include reviewing the package’s Enterprise Mission Assurance and

Online document is the master Retrieved from server on: 19 April 2021

CONTROLLED UNCLASSIFIED INFORMATION

Support Service (eMASS) record, managing and controlling changes to the information systems, and assessing the cybersecurity impacts of such changes.

(3) Be trained to a level commensurate with the complexity of NUWC Division, Keyport’s various information systems and ensure that the Information Systems Security Officer (ISSO) for each department is properly trained.

e. Department ISSO. Each department or major organizational component at NUWC Division, Keyport and its detachments has an assigned Department ISSO, designated in writing by the CO or Command ISSM. The department ISSOs work closely with the Command ISSM and IT Division (Code 104) staff to implement and maintain the NUWC Division, Keyport Cybersecurity Program and serve as points of contact for communications, inquiries, training, authorization, and other Cybersecurity-related developments for their department. Each department ISSO will comply with the requirements of reference (b). Specifically, each Department ISSO must:

(1) Be responsible for ensuring that cybersecurity policies and requirements are adhered to throughout their department.

(2) Manage the configuration of the information systems within their department.

(3) Serve as the first responder and primary point of contact (POC) for the Command ISSM regarding all cybersecurity events within their organization.

f. Cybersecurity IT/ CSWF Program Manager (PM). The CSWF-PM is responsible for ensuring all personnel whose duties require inclusion in the CSWF are properly trained and designated, and that they maintain their certification by complying with the requirements associated with their position per references (b), (g) and (y). The CSWF-PM is responsible to the ACIO for maintenance of the program.

g. CSWF Personnel. Department ISSOs and personnel performing cybersecurity functions are assigned to the CSWF per reference (b). This includes command-level enterprise functions performed by Code 104 personnel as well as RDT&E laboratory or system-level functions performed by personnel in other departments. All CSWF personnel are designated in writing by the CO or the C-ISSM and must adhere to the designation and qualification criteria and continuous education requirements associated with their positions per references (b) (g) and (y).

h. Privileged Users. All NUWC Division, Keyport Government personnel and contractors who require privileged access to NUWC Division, Keyport information systems and networks within the Command must complete a Privileged-level Access Agreement (PAA) form and Addendum per references (b) and (h). A sample agreement can be found in Appendix 2 of reference (b) and must be reviewed and signed annually. Personnel who have been granted privileged access will be designated as CSWF per reference (b).

Online document is the master Retrieved from server on: 19 April 2021

CONTROLLED UNCLASSIFIED INFORMATION

i. Authorized Users. All military, civilian, and contractor personnel who are assigned to, employed by, or support NUWC Division, Keyport and use the Division’s information system resources are individually responsible for compliance with cybersecurity requirements as promulgated by this manual.

j. Laboratory Manager. Laboratory Managers serve as the primary POC for all IM/IT and cybersecurity matters within the associated laboratory space. The Laboratory Manager will also be the primary liaison between the Department ISSO, ACIO, command ISSM, and the Code 104 staff.

k. Validators. All command information systems must be assessed and authorized per the provisions of references (e) and (q) and must have their compliance with the applicable security controls validated by a Navy Qualified Validator (NQV) in accordance with reference (q).

Validators, under the direction of the Command ISSM, provide coordination to each department to ensure that an NQV is involved in the Assessment & Authorization (A&A) process for all command information systems being submitted for authorization, reference (f).

6. Cybersecurity Training.

a. All authorized users of NUWC Division, Keyport information systems must complete DoD Cybersecurity training as a condition of access as follows:

b. Initial Cybersecurity Awareness Training must be conducted within 30 days of receiving access to Total Workforce Management Services.

c. Annual Cybersecurity Refresher Training as mandated by DoD or DoN must be completed at least once per rolling 365-day cycle.

d. NAVSEA Cybersecurity 101 or equivalent as mandated by NAVSEA.

7. Password Policy.

a. General User and Privileged Access to centrally managed NUWC Division, Keyport networks requires Public Key Infrastructure (PKI) authentication. Exceptions to this requirement for any account including local/functional/service accounts must be approved by the Command

ISSM.

b. Accounts that must be configured to use username and password for authentication (i.e.

Closed Enclave and Standalone) must meet the following requirements:

(1) Contain at least 15 characters

(2) Include at least two upper case letters, two lower case letters, two numerals, and two special characters.

Online document is the master Retrieved from server on: 19 April 2021

CONTROLLED UNCLASSIFIED INFORMATION

(3) Be changed every 60 days.

(4) Be adequately protected.

(5) Not be shared for any reason.

(6) Not be stored unless necessary.

(7) Only be stored in a manner appropriate to the classification level of the device to which it grants access, subject to approval by the Command ISSM.

c. Service account passwords must be changed annually or whenever personnel with access to the account leave the command.

8. Assessment and Authorization.

a. Command information systems must be assessed and authorized by the applicable Authorizing Official (AO) prior to being placed into operation in accordance with references (f) and (q).

b. Assessment is the comprehensive evaluation of the technical and non-technical security features of an information system and other safeguards. Assessment establishes the extent to which a particular design and implementation meets a set of specified security requirements.

The assessment process results in a risk-based determination for operational use and an authorization recommendation to the appropriate NAO. The ACIO and Command ISSM are responsible to ensure that all NUWC Division, Keyport owned information system, non- NUWC Division, Keyport information systems and PIT systems have a valid authorization.

c. Authorization is the formal declaration by the AO, in writing or by digital signature, that an information system is approved to operate in a particular security mode using a prescribed set of safeguards at an acceptable level of risk. Authorization is granted in the form of an ATO letter or other document from the AO.

(1) Full authorization with an ATO is the goal for all NUWC Division, Keyport information systems.

(2) After issuance of an ATO, corrective actions must be taken within a specified period noted in the ATO. Failure to correct these findings within the allotted time could result in the issuance of a Denial Authority to Operate (DATO).

(3) An IATT is authorized for testing in an operational information environment or with live data for a specified time period, normally 30 to 90 days. An IATT is granted by the AO. An IATT may not be used to avoid ATO determination or requirements for authorizing a system to operate in accordance with reference (q).

Online document is the master Retrieved from server on: 19 April 2021

CONTROLLED UNCLASSIFIED INFORMATION

(4) Test and evaluation of RDT&E systems within the command boundaries may be authorized by the command ISSM in accordance with NAVSEA RDT&E A&A business rules, reference (aq).

d. Per reference (uu), the CO is the approval authority for the temporary connections of accredited RDT&E Zone C/D enclaves. The command ISSM determines the security requirements of the test assets. For Zone C/D enclaves and standalone assets that are not currently accredited, the command ISSM may authorize temporary use via the Local IATT (LIATT) process. Department ISSOs should bring change proposals to the attention of the command ISSM. The NUWCDIVKPT 5239.27 LIATT request form, reference (av) contains information necessary for the command ISSM to make an objective, management-level decision concerning the level of effort, security requirements, risk level, and policy required to allow the connection of assets covered by the applicable A&A packages to participate in the test event as detailed in the NUWCDIVKPT 5239.27 LIATT request form. All requests must be approved and documented prior to implementation.

9. Data at Rest.

a. Applicability. All NUWC Division, Keyport military, civilian, and contractor personnel are responsible to ensure the protection of sensitive information.

b. Data Encryption. All Unclassified Navy and Marine Corps Intranet (NMCI) and RDT&E IT devices must have a DoN approved, operating system specific encryption software solution installed that provides disk and file encryption. The user must ensure that any and all files that have not been approved for public release and are written to the removable media are treated as sensitive and properly encrypted.

c. Media. All electronic media, containing sensitive information, leaving NUWC Division, Keyport (e.g., Compact Disk (CD), Digital Video Disk (DVD), and Hard Disk Drive (HDD) etc.)

will be encrypted per references (x) and (ai).

d. Exceptions. When absolutely required by mission or operational need, exceptions may be granted. The mission or operational need must be clearly identified in the requesting departmental Standard Operating Procedure (SOP), including clear identification of all risk mitigations, and must be approved by the Command ISSM.

e. Non-Government Information Systems. DoD information (other than that approved for public release) may not be transferred to or stored on non-government information systems, unless authorized and protected per contractual obligations to DoD contract companies.

f. Aggregation of Data on Unclassified Networks and Systems. All personnel must be alert to the compilation or aggregation of unclassified data in systems and networks that would render the data sensitive, or even classified. If the aggregation of data results in sensitive information, the information should be protected, stored, and destroyed, per guidance in reference (n). If the

Online document is the master Retrieved from server on: 19 April 2021

CONTROLLED UNCLASSIFIED INFORMATION

aggregation of data becomes classified, the CSM, Supervisor, Department ISSO and the Command ISSM should be notified immediately.

10. Electronic Mail and Internet Services.

a. The DoN Digital Signature and Encryption of Email Policy, per references (b), (c), (aa), and (ac), requires all DoN users to digitally sign, using DoD PKI, all e-mail messages requiring either message integrity and/or non-repudiation and to encrypt messages containing sensitive information, including CUI as defined in references (k) and (ab).

b. The following guidelines apply to the use of NUWC Division, Keyport e-mail regardless of provider:

(1) E-mail Access. Routine access to official e-mail must be via a DoN computer, DoN mobile computing device, or authorized DoN contractor computer under the NMCI Next Generation (NGEN) contract.

(2) E-mail Contents. The unclassified e-mail system must not contain or be utilized for the processing of classified information or unclassified Naval Nuclear Propulsion Information

(U-NNPI).

(3) Encryption. All information transmitted via e-mail that is not approved for public must be encrypted. DoD PKI provides an encryption capability that is a tool for complying with encryption requirements, per reference (z).

(4) Unlawful Endeavors. The e-mail system is not to be used for any unlawful endeavors or to gain unlawful access to information.

(5) Access and Release of E-mail. Copies of e-mail transmissions are subject to possible release under the Freedom of Information Act and discovery in litigation. They are also subject to the records retention requirements of the Federal Records Act and reference (ac).

(6) Authorized Users Only. NUWC Division, Keyport military, civilian, and contractor personnel must not permit access to IT resources or e-mail systems by other individuals by providing use of their credentials, e.g., Common Access Card (CAC) or Secret Internet Protocol Router (SIPR) PKI token.

(7) Use of Commercial E-mail Service. Per reference (x), auto forwarding of official e-mail to a commercial account or use of a commercial e-mail account for official Government business is prohibited.

(8) Use of Non-DoD Internet Services. Reference (ab) describes DoD policy and processes for the identification, control, and protection of critical information that indicates or reveals U.S. capabilities and activities, especially in system acquisition programs. All personnel are therefore advised that the use of non-DoD Internet services (i.e., DropBox, Google Drive, Online document is the master Retrieved from server on: 19 April 2021

CONTROLLED UNCLASSIFIED INFORMATION

Microsoft One Drive etc.) for the conduct of official NUWC Division, Keyport business is prohibited.

(9) Outlook Web Access (OWA). NMCI OWA allows NUWC Division, Keyport personnel to access unclassified NMCI e-mail and calendar data from a non- NMCI computer that has access to the Internet. All OWA users must log on using a CAC.

11. PKI. DoD PKI policy detailed in reference (z) requires that all DoD information systems, including networks and e-mail systems, use DoD issued or approved PKI certificates to support authentication, access control, confidentiality, data integrity, and non-repudiation.

12. Use of Information Technology Assets While on Travel. NUWC Division, Keyport personnel must follow the guidance in reference (e), relating to use of IT Assets while on travel to an outside continental United States /overseas location.

13. Data Security for Classified Information.

a. Classified Data. Classified data is information that has been determined pursuant to reference (ad), or any successor order, or by the Atomic Energy Act of 1954, as amended, to require protection against unauthorized disclosure and is marked to indicate its classification.

b. Data Integrity. No classified data must be introduced on any information system without first identifying the classification of the information system. As a minimum, the classification of the information system must be for the classification level of the data.

c. Security Clearances. All users of a classified information system must have, as a minimum, a security clearance for the highest level of data processed on the information system.

No user of an information system processing classified information may have a clearance level lower than the highest level of classification of data processed on the information system. All users must possess the requisite need-to-know.

d. Classified Processing. All requirements contained in this policy document that pertain to processing classified data must be followed at all times. Any attempt to mask, camouflage, code, or otherwise conceal classified information in order to process it in an unapproved information system is prohibited. The only authorized mode of communication allowed for classified information is either by approved encryption device or by Protected Distribution Dystem (PDS) per reference (ee). No classified information must be sent over unprotected or unapproved communications lines.

e. Cryptographic Devices. Cryptographic devices may be used only when approved and as prescribed by the Communications Security Officer. Classified information must not be processed on any information system that has not been specifically approved for that purpose by the AO. All information systems processing Top Secret or Special Category Information must provide protection against intercept and analysis of compromising emissions from crypto-equipment or an information system in accordance with reference (x) and (af).

Online document is the master Retrieved from server on: 19 April 2021

f. Classified Information Systems. Classified information systems, including networks and closed enclaves, must be accounted for via the A&A process. Unless there is an approved and documented Cross Domain Solution (CDS) in place, no information system authorized to process classified data may be attached to, or communicate with, any unclassified networks, computers, or peripherals. Additionally, the following requirements must be implemented and maintained for processing data on a classified information system:

(1) Access. There must be an access control policy in place for each classified resource.

This policy includes features and/or procedures to enforce the access control policy of the information commensurate with the sensitivity of the resource. The identity of each user that is authorized access must be positively established prior to granting access.

(2) Approval. All information systems must be part of an AO-approved authorization boundary and documented in the appropriate eMass Package. All CSWF and users must understand and must comply with the terms of authorization.

14. Vulnerability Management.

a. The NUWC Division, Keyport Vulnerability Management Plan (VMP), reference (ag), contains policies and guidelines necessary to ensure the command’s systems are configured in compliance with DoD and U.S. Navy Cybersecurity mandates. Proper implementation of the VMP will help protect NUWC Division, Keyport systems, data stored and processed on these systems, and minimize loss or theft of information or disruption of critical computing services due to insufficient system security configurations.

b. All NUWC Division, Keyport systems must be compliant with vulnerabilities including Information Assurance Vulnerability Management (IAVM) and non-IAVMs in accordance with reference (e), or in the case of Zone C or Zone D Systems, their ATO. Additionally, the Command must maintain compliance with all task orders and similar directives promulgated by DoD and DoN to ensure the security of IT resources. All Zone C or D systems are to be scanned on a quarterly basis if not specifically indicated in a scan waiver issued for a specific Zone C or D system.

15. DoD Information Systems Standard Consent Banner. Reference (a), directs that all DoD information system resources must display an electronic log-on notice and consent banner. The instruction establishes DoD policy on the use of DoD information systems. It requires the use of a standard “Notice and Consent Banner” and standard text to be included in user agreements.

The standard mandatory DoD Notice and Consent Banner must be displayed at log-on to all DoD information systems. The banner is mandatory, and deviations are not permitted except as authorized in writing by the Deputy Assistant Secretary of Defense for Information and Identity Assurance.

Online document is the master Retrieved from server on: 19 April 2021

CONTROLLED UNCLASSIFIED INFORMATION

16. SAAR-N Form.

a. All requests for access to an information system requires the use of SAAR-N in accordance with reference (u). In general, the Navy Telecommunication Directive (NTD) stipulates that:

(1) Users. All information system users are required to complete and sign the SAAR-N form prior to being granted information system access and is applicable in all associated environments. The SAAR-N will be submitted through https://wwwdd.csd.disa.mil/cgi-bin/NAVSEA.pl.

(2) Retention. All SAAR-N forms for the division will be stored and recorded by Code 104.

17. Malicious Logic. NUWC Division, Keyport’s information system resources must be protected from malicious logic, such as computer viruses, malware, worms, and spyware, by continuous employment of Navy- approved antivirus (AV) and malware-detection software, per reference (ah). No employee may remove or disable any endpoint protection mechanism without the explicit permission and knowledge of the Department ISSO and approval by the Command

ISSM.

a. Media Protection. All external media (e.g., hard disk or CD/DVD) must be scanned using up-to-date antivirus software before being used with any information system resource.

Data on encrypted media will be scanned before encryption and after decryption.

b. AV Software. AV software is provided by DISA and virus detection software is available under a DoD-wide license for all DoD computer systems. RDT&E systems under enterprise management by Code 104 must have the current DoD mandated endpoint security products installed.

c. Malicious Logic Incident Reporting. All detected viruses and other malware must be reported in accordance with reference (t).

18. Labeling of Information Technology and Data Storage Media.

a. Proper labeling of media and IT assets and equipment at NUWC Division, Keyport is necessary to reduce the risk of electronic spillages and unauthorized cross connections between information systems or networks operated or used by NUWC Division, Keyport and its detachments. Personnel must be informed of the classification level of the information stored on or accessible from the media or equipment they are using to enable them to take the necessary precautions to adequately protect the information/data at the appropriate level per reference (n).

b. Per references (as), and (at), each user-accessible IT asset, information system component, network cable, and wall plate should be labeled to indicate the highest level of classification at which it receives, processes, stores, displays, or transmits data. IT assets and

Online document is the master Retrieved from server on: 19 April 2021

CONTROLLED UNCLASSIFIED INFORMATION

information system components include, but are not limited to: computers, workstations, laptops, servers, displays, monitors, network printers, document scanners, test equipment, switches, network attached storage devices, network components, equipment racks, server chassis, internal and external hard drives, and removable media.

c. Classified storage media must be inventoried in accordance with reference (n).

19. Declassification and Destruction of Data Storage Media.

a. Destruction. Data storage media can be hard drives, removable drives (such as Zip disks), CD-ROM or CD-R discs, DVDs, flash memory, USB drives, magnetic tape, and floppy disks. All computer media, including unclassified, should be handled in accordance with reference (n).

b. Declassification. Requests to declassify Data Storage Media will be handled in accordance with reference (n).

20. Personal Electronic Devices (PED)s and Personal Wearable Fitness Devices (PWFDs).

a. Personal cellular phones or smart phones, with or without cameras, are allowed to be used in NUWC Division, Keyport facilities, except in areas where classified information is processed, stored, or discussed. Bluetooth and Wi-Fi on cellular phones and smart phones must be disabled while they are transported inside NUWC Division, Keyport buildings. Cellular phones, including government issued iPhones, are NOT authorized in any area where classified information is processed, stored, or discussed.

b. Any photography, audio recording, voice-to-text, etc. using PEDs is not permitted at

NUWC Division, Keyport or within its facilities. The use of other PEDs and cellular-enabled equipment or media devices is NOT authorized or approved for use in NUWC Division, Keyport facilities. These devices must remain in an employee or visitor privately owned vehicle (POV), Rideshare or commuter van, or in a designated lock box.

c. Personally-owned laptops and tablets may be brought into the Command by NUWC

Division, Keyport Government employees and onsite contractors (i.e. those with a permanent office on base). These devices must be powered off and remain in an employee or contractor POVs, Rideshare or commuter van, or in a designated lock box. All other visitors, including vendors and badged contractors, are NOT authorized to bring personally-owned laptops or tablets into NUWC Division, Keyport facilities.

d. Reasonable accommodation for individuals with disabilities may be approved through the

Command ISSM and CSM. The Command ISSM and CSM must review the device as part of the approval process to ensure the technology does not introduce an unacceptable risk.

Online document is the master Retrieved from server on: 19 April 2021

CONTROLLED UNCLASSIFIED INFORMATION

e. Personnel detecting an individual with a PED in any unauthorized area must bring this occurrence to the attention of supervisory personnel for action. PEDs must not be connected to NUWC Division, Keyport IT systems or networks.

f. Exceptions. MP3 players that are first-generation iPods, iPod Nanos, or iPod Shuffles, AM/FM radios, and other dedicated music players are allowed into workspaces, including classified workspaces, for use only with headphones and with the following device restrictions:

(1) No camera or photographic capability.

(2) No audio recording capability.

(3) No 802.11 wireless capability.

g. Personal Wearable Fitness Devices (PWFD). References (aj) and (ao) define when PWFDs (e.g., Fitbit, Jawbone Up, and Nike Fuel Band) are allowed in NUWC Division, Keyport spaces where collateral classified information and CUI is processed, stored, or discussed.

PWFDs are allowed if they meet all of the criteria of paragraphs 18 g.1-3 below.

(1) PWFDs are permitted:

(a) If they are commercially available in the U.S. or through a U.S. military exchange, are marketed primarily as fitness or sleep devices, and are designated as Federal Communications Commission (FCC) Class B digital devices (denoted as FCC Class B certified or FCC Class B exempt).

(b) If they have Bluetooth, GPS (receive only), accelerometer, altimeter, gyroscope, heart activity, vibration feature, or nearfield communication capabilities.

(c) If they receive and contain vendor-supplied software updates that do not add any features or capabilities prohibited in paragraphs 18.b.

(2) PWFDs are prohibited if they meet any of the following criteria:

(a) If they contain any external or conflicting hardware or software modifications, including the installation of third-party applications.

(b) If they contain cellular or Wi-Fi, photographic, video capture/recording, microphone, or audio recording capabilities.

(c) If they are used in conjunction with USB accessories, including, but not limited to, Bluetooth dongles and charging cables.

(d) PWFDs must NOT be connected to NUWC Division, Keyport IT systems or networks.

Online document is the master Retrieved from server on: 19 April 2021

21. Remote Access. Remote access is controlled at NUWC Division, Keyport and is only authorized for approved personnel to conduct official government business for a specified period of time. Additional information can be found in reference (ax). With teleworking services improving and changing, refer to reference (ax) for the most recent information. The SOP applies to all NIPR domains.

22. WI-FI Technologies.

a. The use or introduction of IEEE 802.11x wireless (i.e. Wi-Fi) access points on government-owned equipment is not authorized without written approval by the Command ISSM. Wireless access points operating on POVs or personally owned PEDs should be disabled before entering NUWC Division, Keyport.

b. Use of NMCI IEEE 802.11x Wireless Hotspots is explicitly allowed only for connection on NMCI authorized wireless assets (i.e. NMCI Laptops and iPhones). These devices must be placed in “airplane mode” when entering a controlled/classified space.

23. Electronic Spillage.

a. An electronic spillage is defined as data placed on an IT system of a lower classification or possessing insufficient security controls to protect the data at the required classification (e.g., Top Secret spillage onto a Secret IT system, Secret spillage onto an Unclassified IT system).

The term electronic spillage also includes, but is not limited to, situations in which CUI, such as Unclassified Naval Nuclear Propulsion Information (U-NNPI), is introduced to non-U-NNPI hardware.

b. All users are responsible for immediately reporting any electronic spillage to their department ISSOs and supervisors. Department ISSOs are responsible for reporting any spillage to the command ISSM, per references (e), (x), and (ak).

(1) Spillage Origination. Employees that originate an electronic spillage must immediately report any suspected or confirmed spillage to the Department ISSO, Supervisor, Command ISSM, and CSM.

(2) Receiving Spillage: Employees who receive or are affected by an electronic spillage must immediately report any suspected or confirmed spillage to the Department ISSO, Supervisor, Command ISSM, and CSM

c. In either case, the affected user should ensure that they take no actions with the email that could lead to expansion of the spillage (i.e. forwarding the email, copying it to a shared drive or posting to a SharePoint page).

24. Non-NUWC Division, Keyport Owned Computer Equipment.

Online document is the master Retrieved from server on: 19 April 2021

CONTROLLED UNCLASSIFIED INFORMATION

a. The use of non-NUWC Division, Keyport owned computer equipment is prohibited on board NUWC Division, Keyport or its detachments unless approved by the Command ISSM.

This prohibition applies to information system resources owned by individual, vendor, contractor, and other non-NUWC Division, Keyport elements. This prohibition applies in all cases, including any computer equipment resources to be used in vendor demonstrations. Use of Non-NUWC Division, Keyport owned computer equipment to conduct NUWC Division, Keyport official business is strictly prohibited. A non-NUWC Division, Keyport owned computer equipment request must be submitted to the command ISSM.

b. Lost or stolen non-NUWC Division, Keyport owned computer equipment resources are the sole responsibility of the owner.

c. Visitors are authorized to transport and use NMCI-issued laptops on NUWC Division, Keyport property provided the user has a current and signed Property Pass (GSA Optional Form- 7). Use of Wi-Fi (e.g. IEEE 802.11) is not permitted. Visitors may connect to designate NMCI Hotel Ports to access the NMCI network.

d. Use of non-NUWC Division, Keyport owned computer equipment for processing classified information requires coordination with the Command ISSM, contractor/company Information Systems Security Officer, and the CSM. Additional documentation is also required by the Defense Security Service after approval by the Command ISSM.

e. Foreign visitors, including long-term foreign national visitors at NUWC Division, Keyport in support of the Foreign Military Sales program, are not authorized to transport computers into the command.

25. Laboratory Manager’s Cybersecurity Binder.

a. Each laboratory at NUWC Division, Keyport and its detachments, which contains IT assets, regardless of classification level, must maintain certain records, plans, procedures and policies that than can be readily accessed by personnel working in the laboratory as well as auditors who may periodically conduct Cybersecurity Compliance Checks. It is important for ensuring compliance with Cybersecurity regulations and guidelines to have a common set of records, plans, and policies available to auditors when they arrive in the laboratory.

b. The exact method of presenting this information may vary slightly between laboratories, as not all of the described sections will apply to every laboratory (e.g., not all laboratories contain POR assets). However, maintaining consistency across all of NUWC Division, Keyport’s laboratories will improve the ability of Code 104 Cybersecurity auditors to work with Laboratory managers to keep their laboratories in compliance.

26. Review and Effective Date.

a. Per OPNAVINST 5215.17A, NUWC Division, Keyport will review this directive annually on the anniversary of its effective date to ensure applicability, currency, and

Online document is the master Retrieved from server on: 19 April 2021

CONTROLLED UNCLASSIFIED INFORMATION

consistency with Federal, Department of Defense, SECNAV, and Navy policy and statutory authority.

b. This directive will automatically expire ten (10) years after effective date unless reissued or canceled prior to the 10-year anniversary date, or an extension has been granted.

27. Releasability and Distribution. This instruction is not cleared for public release. It is available electronically only via Keyport Directive Web site located on the Keyportal SharePoint site.

Online document is the master Retrieved from server on: 19 April 2021

REVISION HISTORY

Revision Date Brief Description of Change A 8/3/2006 Added new level two directives B 9/24/2007 Added 2 new level two directive KPT 5239-08 & -22 C 10/8/2008 Minor Revision D 12/30/2009 Minor Revision and added 4 new Level II directives to index

NR 7/12/2010 Updated header per KPT 5215, no change to context

NR 6/22/2011 Changed review period to triennial.

NR 9/7/2012 Reviewed with minor revision: and added 2 new Level II directives to Implementing Directives table and updated titles.

E 5/5/2015 Updated, removed or changed roles and responsibilities according to Cybersecurity as per DoDI 8500.01 14 March 2014 F 11/26/2019 Policy consolidation with moving procedural activities to individual SOPs.

F CH-1 03/08/2021 Reviewed with minor revision.

REFERENCES

Document Number Document Title

(a) DoDI 8500.01 Cybersecurity, 7 Oct 2019

(b) OPNAVINST 5239.1D Navy Cybersecurity Program, 18 Jul

(c) SECNAVINST 5239.3C Cybersecurity Policy, 2 May 2016

(d) SECNAVINST M-5239.1 Information Assurance Program, 5 Nov

(e) NAVSEAINST 5239.2B NAVSEA Cybersecurity…