(U) NGAI 5205.6_Lifecycle Protection of Geospatial Info_16OCT2018.pdf

UNCLASSIFIED

National Geospatial-Intelligence Agency

INSTRUCTION

NUMBER 5205.6

16 October 2018

SI

SUBJECT: Lifecycle Protection of Geospatial Information

References: See Enclosure 1.

1. PURPOSE. This Instruction:

a. Establishes policy, assigns responsibilities, and provides procedures for Geospatial Protection Plan (GPP) Development.

b. Prescribes protection standards and methodologies for Critical Program Information (CPI) associated with comprehensive lifecycle protection for Geospatial Intelligence (GEOINT) Phenomenology, Research, Development, and Acquisition (RDA) Activities, Technology Transfers (Reference (z)), and Operational Programs.

c. Defines the strategy and processes by which NGA information, technologies, and systems are identified and protected IAW References (j), (k), and (r).

d. Applies an effective, broad range of geospatial protection strategies to protect CPI and maintain NGA’s strategic advantage regarding GEOINT. NGA CPI is either organic, inherited, or horizontal IAW Reference (r).

e. Rescinds NGA Directive (NGAD) 3330, “Program Protection Planning,” 19 May 2015, and NGA Manual (NGAM) 3330.1, “Program Protection Planning,” 04 May 2015.

2. APPLICABILITY. This Instruction applies to all NGA civilian employees, military service members, other Government agency personnel assigned to NGA, and contractors working on or off site, hereinafter referred to as personnel.

3. DEFINITIONS. See Glossary.

4. POLICY. It is NGA policy to:

a. Manage and mitigate risks to NGA programs and projects IAW References (r) and (af).

b. Ensure geospatial protection policy enhances NGA’s use of scientific processes and basic and applied research (fundamental research) IAW Reference (x).

NGAI 5205.6

c. Resource geospatial protection functions across the lifecycle of NGA programs and projects IAW Reference (r).

d. Establish baseline GPPs for relevant GEOINT phenomenologies that will guide and inform program and project protection plans.

e. Evaluate the local, regional, national, and international environments to determine what, if any, factors may influence phenomenology for program and project protection determinations.

f. Mitigate phenomenology, program, and project risk through the assessment and development of strategic communication planning, as required.

g. Ensure identification and protection of organic CPI over the lifecycle of NGA programs and projects IAW Reference (r).

h. Identify and protect horizontal CPI consistently and efficiently across programs based on the exposure of the system, consequence of CPI compromise, and assessed threats IAW Reference (r).

i. Identify and protect inherited CPI in the manner originally prescribed by the CPI’s GPP unless reestablished through collaboration between the original GPP owner and new Program Managers and Project Managers and SI.

j. Establish and maintain a robust analytical risk management and assessment process to enable informed decisions regarding acquisition, technology transfer, and protection of existing programs and projects IAW Reference (ad).

k. Integrate comprehensive security (personnel, information, cyber, industrial, physical, special) and counterintelligence (CI) functions into all program and project phases such as basic and applied research (fundamental research), outreach, source selection, acquisition, assessments, authorizations, and supply chain risk management (SCRM) to protect CPI IAW Reference (aa).

l. Identify the risks to NGA’s supply chain and develop countermeasures to mitigate foreign intelligence threats IAW Reference (l).

m. Perform annual geospatial protection reviews and reassessments at critical program/project phases and other milestones.

n. Ensure NGA CPI is identified, prioritized, and protected IAW the protection strategies and processes.

o. Apply strategies and processes to CPI in analysis, maintenance, storage, use, development, transport, and production.

5. RESPONSIBILITIES. See Enclosure 2.

6. PROCEDURES. See Enclosure 3.

7. EFFECTIVE DATE. This Instruction is effective on the date of signature.

Harry E. Mornston Executive Director

Enclosures

1. References

2. Responsibilities

3. Procedures

4. Process Flow Diagrams

Glossary

TABLE OF CONTENTS

CHANGE LOG

ENCLOSURE 1: REFERENCES

ENCLOSURE 2: RESPONSIBILITIES

Director, NGA Director, Security and Installations Senior Procurement Executive Chief Information Officer and Director, Information Technology Services Inspector General Director, Human Development Director, International Affairs General Counsel Component Acquisition Executive Chief Financial Executive Director, Research Directorate Heads Director, Office of Security Director, Office of Counterintelligence Senior Geospatial Protection Officer Geospatial Protection Officer Program Managers and Project Managers

ENCLOSURE 3: GEOSPATIAL PROTECTION PLAN DEVELOPMENT

PROCEDURES

ENCLOSURE 4: PROCESS FLOW DIAGRAMS

Diagram 1. Critical Program Information Protection Plan Diagram 2. Geospatial Protection Plan Development Process

GLOSSARY

CHANGE LOG

Change Type

Change Date

Revised By

Pages Affected

Change Description

ENCLOSURE 1

REFERENCES

(a) National Institute of Standards and Technology (NIST) Special Publication (SP)

800-30 Revision 1, “Guide for Conducting Risk Assessments,” September 2012

(b) NIST SP 800-37 Revision 1, “Guide for Applying the Risk Management Framework to Federal Information Systems,” February 2010

(c) NIST SP 800-53 Revision 4, “Security and Privacy Controls for Federal Information

Systems and Organizations,” April 2013

(d) NIST SP 800-137, “Information Security Continuous Monitoring (ISCM) for Federal

Information Systems and Organizations,” September 2011

(e) NIST SP 800-161, “Supply Chain Risk Management Practices for Federal

Information Systems and Organizations,” April 2015

(f) Committee on National Security Systems Directive 505, “Supply Chain Risk

Management (SCRM),” 26 July 2017

(g) CNSS Instruction (CNSSI) 1253, “Security Categorization and Control Selection for

National Security Systems,” 27 March 2014

(h) CNSSI 4009, “CNSS Glossary,” 06 April 2015

(i) Intelligence Community Directive (ICD) 503, “Intelligence Community Information

Technology Systems Security Risk Management,” Technical Amendment, 21 July 2015

(j) ICD 700, “Protection of National Intelligence,” 07 June 2012

(k) ICD 703, “Protection of Classified National Intelligence Including Sensitive

Compartmented Information,” 21 June 2013

(l) ICD 731, “Supply Chain Risk Management,” 07 December 2013

(m) ICD 750, “Counterintelligence Programs,” 05 July 2013

(n) Intelligence Community Standard 500-34, “Electronic Waste (E-Waste)

Management and Disposal,” 24 September 2015

(o) Department of Defense Directive 5105.42, “Defense Security Service (DSS),” 03

August 2010

(p) Department of Defense Instruction (DoDI) 5000.02, “Operation of the Defense

Acquisition System,” 07 January 2015, Incorporating Changes 1 and 2, Effective 02 February 2017

(q) DoDI 5200.01, “DoD Information Security Program and Protection of Sensitive Compartmented Information (SCI),” 21 April 2016, Incorporating Change 1, Effective 01 May 2018

(r) DoDI 5200.39, “Critical Program Information (CPI) Identification and Protection Within Research, Development, Test, and Evaluation (RDT&E),” 28 May 2015

(s) DoDI 5200.44, “Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN),” 05 November 2012, Incorporating Change 2, 27 July 2017

(t) DoDI 8510.01, “Risk Management Framework (RMF) for DoD Information Technology (IT),” Change 1, 24 May 2016

(u) DoDI O-5240.24, “Counterintelligence (CI) Activities Supporting Research, Development, and Acquisition (RDA),” 08 June 2011

(v) DoD 5220.22-M, “National Industrial Security Program,” 28 February 2006, Incorporating Change 2, 18 May 2016

(w) DoD Regulation 5220.22-R, “Industrial Security Regulation,” 04 December 1985

(x) NGA Directive (NGAD) 3200, “Research and Development/Science and

Technology (R&D/S&T),” 16 September 2013, Administrative Update 18 October 2015

(y) NGAD 8010, “Information Systems Risk Management Framework,” 27 August 2015, Administrative Update 16 November 2015

(z) NGA Instruction (NGAI) 3200.1, “Technology Transfer (T2)”, 12 July 2013, Administrative Update 30 October 2017

(aa) NGAI 5100.1, “NGA Acquisition Regulation Implementation (NARI),” 13 July 2016

(ab) NGAI 5200.4, “Operations Security,” 11 August 2016

(ac) NGAI 8410.2, "Software Asset Management," 02 June 2017, Update 2:

05 October 2017

(ad) NGA Manual (NGAM) 3021.2, Volume 7, “Risk Management,” 29 January 2015, Administrative Update 20 November 2015

(ae) NGA Acquisition Strategy, October 2016

(af) NGA Security Classification Guide (SCG), 05 October 2016 (S//NF)

(ag) NGA GEOINT Concepts of Operations 2022, 01 April 2016 (TS//SI/TK//NF)

(ah) NGA Geospatial Protection Steering Group Charter, 21 June 2017

(ai) NGA Information Assurance Requirements Catalog (IARC), (Current Version) (https://ngaonline/sites/CIO-T/TS/TSR/Pages/TSR_Reference_Library.aspx)

ENCLOSURE 2

RESPONSIBILITIES

1. Director, NGA (D/NGA) designates the Director, SI (D/SI), to oversee the protection of geospatial information.

2. D/SI.

a. Oversees the development and implementation of geospatial information protection IAW References (j), (p), (r), and (ag).

b. Ensures geospatial information protection and CI support is provided to NGA programs and projects.

3. Senior Procurement Executive (SPE).

a. Works in conjunction with the Program Managers, Project Managers, and Geospatial Protection Officers (GPOs) to ensure required geospatial information protection documentation and NGA procurement activities (e.g., Requests for Information (RFI), Requests for Proposals (RFP), and other solicitation materials) are compliant with GPP policies and procedures.

b. Works in conjunction with Program Managers, Project Managers, and GPOs to ensure RFP pre-award vendor responses and subsequent NGA contracts contain appropriate GPP language to identify and protect CPI IAW Reference (aa).

c. Ensures appropriate GPP contract clauses are in place on NGA post-award contracts in contractor-owned or -operated facilities IAW Reference (o).

4. Chief Information Officer and Director, Information Technology Services (D/CIO-T).

a. Ensures computer hardware and software are assessed for vulnerabilities and NGA Software Whitelist Assurance Process (SWAP) IAW Reference (s).

b. Oversees and manages the NGA data strategy, policy, and infrastructure to safeguard and protect NGA data.

c. Assists Program Managers, Project Managers, and GPOs to ensure compliance with cybersecurity and information assurance requirements IAW Reference (g).

d. Integrates Information and Communications Technology (ICT) SCRM and relevant countermeasures into hardware and software approval and acquisition policies and processes IAW References (e), (f), (l), (s), and (ac).

e. Serves as the primary Authorizing Official (AO) and oversees additional appointed AOs and Designated Authorizing Officials (DAOs) in the following activities:

(1) Appoints a Security Control Assessor to conduct a preliminary, comprehensive, and continuous thereafter, assessment(s) of the selected management, operational, and technical security controls based on the security categorization of the information and information system. These assessments will serve as the basis for subsequent Security Assessment Reports and Risk Assessment Reports upon which the AO/DAO will make their ongoing system risk and authorization decisions, IAW References (a), (b), (g), (i), and (t).

(2) Includes ICT supply chain considerations in authorization decisions. To accomplish this, ICT supply chain risks and compensating controls documented in ICT SCRM plans or system security plans should be included in the decision-making process. Risks should be determined and associated compensating controls selected based on output from criticality, threat, and vulnerability analyses IAW Reference (e).

(3) Understands and accepts the risk to organizational operations and assets, individuals, and the Nation based on the implementation of a defined set of security controls and the current security state of the information system IAW References (d), (i), and (t).

5. Inspector General.

a. Evaluates, as required, and recommends improvements to NGA’s GPP policy, procedures, and activities.

b. If applicable, adheres to DoD guidelines on inspection of GPP IAW References (q), (v), and (w).

6. Director, Human Development (D/HD), ensures the NGA College provides classroom space for NGA geospatial protection training.

7. Director, International Affairs (D/IA), coordinates with OCS contracting personnel to ensure NGA international programs integrate program protection processes into program arrangements and agreements, and other related GEOINT sharing security documentation that involve contracts with international partners.

8. General Counsel provides legal advice on all aspects of geospatial protection operations and acquisitions.

9. Component Acquisition Executive (CAE) ensures protection measures are included in acquisition activities outlined in Reference (ae).

10. Chief Financial Executive (CFE) assists the CAE, Program Managers, and Project Managers with developing a methodology for planning and tracking GPP expenditures.

11. Director, Research (D/R).

a. Ensures program protection, known as Research and Technology Protection (RTP), for basic and applied research programs implemented and documented using Risk Acceptance Documents (RADs) and other associated documents IAW References

(k) and (ab).

b. Serves as the final approval authority and signatory for all RADs for NGA/R programs.

c. Ensures RTP processes documented in NGA/R policy IAW References (k) and (ab).

12. Directorate Heads.

a. Ensure GEOINT Phenomenology, RDA Activity, Technology Transfer, and Operational Program has designated in writing a program manager or project manager IAW Reference (z).

b. Ensure effective geospatial protection implementation in collaboration with the program manager or project manager that includes, but is not limited to, identifying potential vendors, completing CPI surveys, participating in program reviews, and producing GPPs.

c. Review and forward cost and budgets associated with the protection of CPI for approval.

d. Execute approved GPP budgets.

e. Ensure allocation of resources to support GPP IAW Reference (p).

f. Support the AO in understanding the risk to organizational operations and assets, individuals, and the Nation based on the implementation of assigned set of cybersecurity controls and the current security state of the information system.

g. Provide final authority for program prioritization (pg. 14 (step 1(b)).

h. The final authority for program prioritization is the Directorate Head.

13. Director, Office of Security (D/SIS).

a. Implements, enforces, and monitors geospatial protection strategy, policy, and procedures across the NGA Enterprise.

b. Ensures collaboration among geospatial protection stakeholders in support of GPP development and implementation.

c. Ensures geospatial protection training is developed and delivered.

d. Serves as or designates the NGA Senior GPO.

14. Director, Office of Counterintelligence (D/SIC).

a. Coordinates with representatives from the Defense Intelligence Agency (DIA) on all-source vendor threat assessments proposed for NGA procurements and SCRM collection requirements IAW References (s) and (u).

b. Performs Company Risk Assessment (CRA) to identify Key Management Personnel (KMP), Foreign Ownership, Control, and Influence (FOCI), and other potential CI issues for vendors IAW References (o), (v), and (w).

c. Performs CI threat assessments and builds CI Support Plans for relevant NGA programs and projects IAW Reference (m).

d. Provide CI support as requested by the GPO in support of NGA activities.

15. Senior GPO.

a. Prioritizes and submits for consideration and approval candidate programs and projects for formal GPP.

b. Establishes and maintains a geospatial protection steering group IAW Reference (ah).

c. Develops and delivers geospatial protection training such as, computer based, in-person, and brown bags for the NGA enterprise.

d. Assigns, develops, and manages the GPO cadre.

e. Ensures all relevant geospatial protection personnel take the mandatory class “Introduction to Geospatial Protection Planning” at NGA. Ensures all Program Managers and Project Managers take the same training within one year of assignment.

16. GPO.

a. Works in conjunction with the SPE, Program Managers, and Project Managers to ensure NGA procurement activities are compliant with GPP policies and procedures.

Coordinates all aspects of physical, industrial, personnel, and counterintelligence security for a phenomenology or programs and projects.

b. Coordinates with the Program Managers or Project Managers, completes CPI surveys, participates in program reviews, and produces GPPs.

c. Coordinates completion of criticality analysis, risk management activities, and vulnerability assessments.

d. Provides CI threat assessments and support plans for relevant NGA programs and projects IAW References (o), (v), and (w).

e. Oversees day-to-day implementation of the GPP and monitoring of geospatial protection functions.

f. Adjudicates CPI issues such as identification, prioritization, impact of compromise, and countermeasures for NGA programs and projects in conjunction with the Program Managers or Project Managers and Subject Matter Experts (SMEs).

g. Ensures registration of programs containing CPI within the DoD Acquisition Security Database (ASDB) and/or NGA SCI CPI Database IAW Reference (r).

h. Establishes and executes periodic geospatial protection reevaluations.

17. Program Managers and Project Managers.

a. Perform day-to-day oversight of GPP implementation.

b. Develop System Security Plan and Body of Evidence (BOE) and implement and continuously maintain the cybersecurity controls as assigned by the AO, IAW References (a), (b), (c), (i), (t), and (ai).

c. Work in conjunction with the SPE and GPOs to ensure NGA procurement activities are compliant with GPP policies and procedures.

d. Coordinate all aspects of physical, industrial, personnel, and counterintelligence security for a phenomenology or programs and projects.

e. Develop proposed budgets for GPP costs.

f. Develop, implement, and evaluate GPPs in conjunction with the GPO.

g. Report incidents of loss, compromise, or theft of CPI to SI.

h. Complete required GPP training to include “Introduction to Geospatial Protection Planning.”

i. Coordinate with International Affairs (IA), Office of General Counsel (OGC), and SI regarding international transfers, cooperative development, and exports of CPI or critical technologies to allies and mission partners IAW References (o), (v), and (w).

j. The Program Managers or Project Managers have final authority in determining whether his/her phenomenology or program contains CPI.

ENCLOSURE 3

GEOSPATIAL PROTECTION PLAN DEVELOPMENT PROCEDURES

1. Overview (See Enclosure 4, Process Flow Diagrams 1 and 2).

a. The nine-step GPP integrates multiple stakeholders and disciplines (program management, security, CI, cybersecurity, SCRM, foreign disclosure, and Operations Security (OPSEC) to protect CPI (mission critical functions, mission critical components, and NGA’s supply chain)).

b. The Senior GPO coordinates with appropriate entities listed in Enclosure 2 of this Instruction, as required, to formulate and execute GPPs.

2. Step One. Identify Phenomenology/Program/Project.

a. There are three entry points for programs to be assessed for geospatial protection requirements:

(1) Existing funded NGA programs.

(2) Programs initiated and developed within NGA.

(3) External programs transitioned to NGA.

b. Review the three entry points to identify NGA phenomenologies, programs or projects that require formal GPPs. Limited resources may elevate the priority given to some programs above others. Priority assigned by: GEOINT value, perishability of analysis or data, stakeholder priority, or any other factor deemed appropriate by NGA leadership. The final authority for program prioritization is the NGA Directorate Head.

3. Step Two. Perform CPI Assessment (see Enclosure 4, Diagram 1). The GPO, in collaboration with the relevant Program Managers, Project Managers, and SMEs completes the required CPI questionnaire. If CPI is identified, then development of a GPP is required as part of Step Three. If no CPI, there is no need to develop a GPP.

The GPP process is complete for that program. NGA programs, by the very nature of NGA’s business, have a high probability of containing CPI. The assumption is that a program contains CPI unless proven otherwise. The Program Managers or Project Managers have final authority in determining whether his/her phenomenology or program contains CPI.

4. Step Three. Develop the Geospatial Protection Strategies (see Diagram 2) and draft the GPP. If CPI is identified in Step Two, the GPO, in conjunction with relevant program manager and program representative, drafts the GPP. The template for the GPP outlines the CPI protection strategies (Reference (ai)). The GPP should include complete and concise descriptions of the CPI and actionable protection strategies. Step

Three concludes when the GPP is signed; or at a minimum, signed by both the Program Manager or Project Manager and GPO.

5. Step Four. Implement Security Controls & Countermeasures. Step Four implements the GPP. The GPO works with program personnel, including the Program Manager or Project Manager to develop, implement, continuously monitor, and maintain all protection measures IAW References (c), (d), (e), (g), (i), and (ai).

6. Step Five. Continuously Evaluate Geospatial Protection. A key component of geospatial protection is the continuous evaluation of security controls and countermeasures to ensure they are providing the level of protection required as the program evolves. The GPO, in coordination with the AO, will lead the evaluation and evolution of geospatial protection over the lifecycle of the programs and projects.

7. Step Six. Modify Security Controls and Countermeasures. If required, the GPO, in coordination with the AO, will modify security controls and countermeasures over the lifecycle of the program IAW continuous evaluation.

8. Step Seven. Implement Transition. A transition will occur when the program or project is completed, moved to an external partner, deemed end-of-life, or other transitory events occur. During this time, the GPO dedicated to the programs and projects works in conjunction with the Program Manager or Project Manager to transition the program and projects to its final state.

9. Step Eight. Evaluate and Evolve Geospatial Protection. A transitioning program/project has rapidly evolving protection needs. During this phase the GPO, in coordination with the AO, will constantly evaluate those needs and modify the projection strategy IAW the transition strategy and specific milestones.

10. Step Nine. Decommission GPP. Decommissioning the GPP is the final step in program and project transition and can take many forms. Elements of decommissioning a GPP include declassification and public release of information, removal of physical security and countermeasures, debriefing individuals, and transitioning protection to a third party IAW References (n) and (af).

11. Waivers and Exceptions. Directorates cannot waive or exempt GPP requirements detailed in this Instruction.

ENCLOSURE 4

LIFECYCLE PROTECTION PROCESS FLOW DIAGRAMS

Diagram 1: Critical Program Information Protection Plan

Diagram 2: Geospatial Protection Plan Development Process

GLOSSARY

Acquisition Security Database

(ASDB)

The horizontal protection database providing online storage, retrieval, and tracking of CPI and supporting program protection documents to facilitate comparative analysis of defense systems’ technology and align CPI protection activities across the DoD. (Reference (r))

Authorizing Official

(AO)

A senior (federal) official or executive with the authority to formally assume responsibility for operating an information system at an acceptable level of risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation. (Reference (b))

Countermeasure The employment of a device or technique that impairs the operational effectiveness of enemy activities.

Countermeasures may include anything that effectively negates an adversary’s ability to exploit vulnerabilities.

(Reference (r))

Criticality Analysis An end-to-end functional decomposition performed by systems engineers to identify mission critical functions and components. Includes identification of system missions, decomposition into the functions to perform those missions, and traceability to the hardware, software, and firmware components that implement those functions. Criticality is assessed in terms of the impact of function or component failure on the ability of the component to complete the system missions(s). (Reference (h))

Critical Component A component that is or contains information communication technology, including hardware, software, and firmware, whether custom, commercial, or otherwise developed, and that delivers or protects mission critical functionality of a system or that, because of the systems design, may introduce vulnerability to the mission critical functions of an applicable system. (Reference (s))

Critical Program Information (CPI)

US capability elements that contribute to the warfighters’ technical advantage, which if compromised, undermine US preeminence. US capability elements may include, but are not limited to, software algorithms and specific hardware residing on the system, its training equipment, or maintenance support equipment. (Reference (r))

Cybersecurity Prevention of damage to, protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation. (Reference (h))

Foreign Ownership, Control, or Influence (FOCI)

A US company is considered under FOCI whenever a foreign interest has the power, direct or indirect, and whether or not exercised or whether or not exercisable through the ownership of the US company’s securities, by contractual arrangements or other means, to direct or decide matters affecting the management or operations of that company in a manner that may result in unauthorized access to classified information or may adversely affect the performance of classified contracts. (Reference (v))

GPO Cadre The group of Security and Installation (SI) individuals that performs geospatial project functions on behalf of NGA Directorate Heads and program/project managers.

(Definition created by NGA for NGA Purposes Only)

Geospatial Protection Plan

(GPP)

A comprehensive strategy to ensure mission effectiveness of a project, program, or phenomenology. (Definition created by NGA for NGA Purposes Only)

Inherited CPI CPI that is owned and generated by one Research, Development, Test, and Evaluation (RDT&E) program, subsystem, or project that is incorporated into and used by another RDT&E program. (Reference (r))

Mission Critical Function

Any function, the compromise of which would degrade the system effectiveness in achieving the core mission for which it was designed. (Reference (s))

Organic CPI Unique CPI owned and generated by an RDT&E program, subsystem or project that is incorporated into and used by another RDT&E program. (Reference (r))

Program or Project Programs and projects both have discrete outcomes and/or deliverables and schedules. They differ in that a program is a group of related projects managed in a coordinated manner to obtain benefits not available from managing individual projects alone. For NGA, both programs and projects may require protection plans. (Definition created by NGA for NGA Purposes Only)

Program Manager and Project Manager

Personnel responsible for the day-to-day management, budget, cost, schedule, and performance of RDA programs and projects. At NGA this includes, but is not limited to, team leads, acquisition program managers, R&D project managers, and project scientists. (Definition created by NGA for NGA Purposes Only)

Research, Development, and Acquisition (RDA)

All activities associated with research and engineering, acquisition, international transfers of technology, and disposal of defense-related technology. (Reference (u))

Risk Assessment

(RA)

The process of identifying, estimating, and prioritizing risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of an information system. Part of risk management, incorporates threat and vulnerability analyses, and considers mitigations provided by security controls planned or in place. Synonymous with risk analysis. (Reference (h))

Risk Management

(RM)

The process of managing risks to Agency operations (including mission, functions, image, or reputation), Agency assets, or individuals, resulting from the operation of an information system. It includes risk assessment; cost-benefit analysis; selection, implementation, and assessment of security controls; and formal authorization to operate the system. The process considers effectiveness, efficiency, and constraints due to laws, directives, policies, or regulations (Reference (y))

Software Whitelist Assurance Process

(SWAP)

An automated paperless enterprise process for submission and adjudication of NGA software requests. The SWAP process uses source-code analysis or research to identify whether software contains vulnerabilities or is foreign owned, controlled, or influenced. (Definition created by NGA for NGA Purposes Only)

Supply Chain Risk Management

(SCRM)

A systematic process for managing risk to the integrity, trustworthiness, and authenticity of products and services within the supply chain. It is conducted through identification of threats, vulnerabilities, and consequences throughout the supply chain and development of mitigation strategies to address the respective threats. (Reference (l))

Threat Assessment Process of formally evaluating the degree of threat to an information system or enterprise and describing the nature of the threat. (Reference (h))

Vulnerability Assessment

Systematic examination of an information system or product to determine the adequacy of security measures, identify security deficiencies, provide data from which to predict the effectiveness of proposed security measures, and confirm the adequacy of such measures after implementation. (Reference (h))