Attachment_0010_-_AFMAN33-285.pdf

BY ORDER OF THE

SECRETARY OF THE AIR FORCE

AIR FORCE MANUAL 33-285

20 MARCH 2015

Communications and Information

CYBERSECURITY WORKFORCE

IMPROVEMENT PROGRAM

COMPLIANCE WITH THIS PUBLICATION IS MANDATORY

ACCESSIBILITY: Publications and forms are available on the e-publishing website at www.e-publishing.af.mil for downloading and ordering.

RELEASABILITY: There are no releasability restrictions on this publication.

OPR: SAF/CIO A6SF Force Development

Supersedes: AFMAN33-285, 17 June 2011

Certified by: SAF/CIO A6S

(Col Mary Hanson, AF SISO)

Pages: 60

This Air Force Manual (AFMAN) implements Department of Defense (DoD) Directive (DoDD)

8570.01, Information Assurance Training, Certification, and Workforce Management; DoD

8570.01-M, Information Assurance Workforce Improvement Program; Air Force Policy

Directive (AFPD) 33-2, Information Assurance Program and Air Force Instruction (AFI) 33-

200, Information Assurance Management. This manual applies to Air Force military, civilian and contractor personnel under contract to the DoD who develop, acquire, deliver, use, operate, or manage Air Force information systems. This publication also applies to the Air National Guard

(ANG) and the Air Force Reserve Command (AFRC). Direct questions, comments, recommended changes, or conflicts to this publication through command channels using the AF

Form 847, Recommendation for Change of Publication, to SAF/CIO A6. Send any supplements to this publication to SAF/CIO A6 for review, coordination, and approval prior to publication.

Unless otherwise noted, the SAF/CIO A6 is the waivering authority to policies contained in this publication. The authorities to waive wing/unit level requirements in this publication are identified with a Tier (“T-0, T-1, T-2, T-3”) number following the compliance statement. See

AFI 33-360, Publications and Forms Management, Table 1.1 for a description of the authorities associated with the Tier numbers. Submit requests for waivers through the chain of command to the appropriate Tier waiver approval authority, or alternately, to the Publication OPR for non-tiered compliance items. Ensure that all records created as a result of processes prescribed in this publication are maintained in accordance with (IAW) AFMAN 33-363, Management of Records, and disposed of IAW Air Force Records Disposition Schedule (RDS) located in the Air Force

Records Information Management System (AFRIMS). The use of the name or mark of any specific manufacturer, commercial product, commodity, or service in this publication does not imply endorsement by the Air Force.

http://www.e-publishing.af.mil/

2 AFMAN33-285 20 MARCH 2015

SUMMARY OF CHANGES

This publication has been revised. This rewrite identifies cybersecurity baseline certification requirements for the AF cybersecurity workforce; stipulates minimum certification requirements for various cyber roles and risk management positions; sets qualifications criteria; clarifies the cybersecurity-coding position process; and codifies the waiver policy for baseline certification requirements. The AF Cybersecurity Position Certification Determination Guide, Attachment 2, was also added to this manual clarifying certification requirements for the technical and management categories.

Chapter 1—GENERAL INFORMATION 5

1.1. Objectives

1.2. Goal

1.3. Applicability

1.4. Requirements

1.5. Background

Chapter 2—ROLES AND RESPONSIBILITIES 8

2.1. Air Force Chief of Information Dominance and Chief Information Officer

(SAF/CIO A6)

2.2. Assistant Secretary of the Air Force, Acquisition (SAF/AQ)

2.3. Deputy Chief of Staff of the Air Force, Manpower, Personnel and Services

(SAF/A1)

2.4. MAJCOMs/FOAs/DRUs

2.5. Headquarters Air Education and Training Command (HQ AETC)

2.6. Air Force Personnel Operations Agency (AFPOA)

2.7. Air Force Personnel Center (AFPC)

2.8. Air Force Space Command (AFSPC)

2.9. Director of Security, Special Programs Oversight (SAF/AAZ)

2.10. Authorizing Officials (AO)

2.11. Air Force Career Field Manager(s) (AF CFMs)

2.12. MAJCOM/FOA/DRU WIP Representative(s)

2.13. Wing Cybersecurity Office (WCO, formerly called Wing Information Assurance

Office)

2.14. Information System Security Managers (ISSMs)

2.15. Civilian Personnel Section (CPS)

AFMAN33-285 20 MARCH 2015 3

2.16. Program/Project Managers (PMs), System Managers (SMs), Program

Management Offices (PMOs), Developmental/Operational Test Agencies, and

Units

2.17. Unit Training Managers (UTM)

2.18. Supervisors

2.19. Individuals (Civilian and Military)

2.20. Individuals (Contractors)

Chapter 3—CYBERSECURITY WORKFORCE IDENTIFICATION 16

3.1. Position Identification

3.2. Cybersecurity Workforce

3.3. Primary, Additional, and Embedded Duty

3.4. Recording the Cybersecurity Workforce Position Requirement

Table 3.1. Civilian SEIs (Positions Coded with Equivalent Enlisted AFSCs)

Table 3.2. Civilian SEIs (Positions Coded with Equivalent Officer AFSCs)

Table 3.3. Military Personnel SEIs

Figure 3.1. DFARS Mandatory Contract Language

3.5. Deployments and Unit Type Code (UTC)

Chapter 4—WORKFORCE QUALIFICATIONS 29

4.1. Qualified Cybersecurity Workforce Criteria

4.2. Computing Environment/Operating System Training Completion Certificate

4.3. Privileged Access Agreement

4.4. Additional CND Certification Requirement

Chapter 5—CYBERSECURITY WORKFORCE CERTIFICATION PROCESS 30

5.1. Cybersecurity Baseline Certifications

5.2. AF Preferred Cybersecurity Baseline Certifications (Civilian and Military Only).

5.3. Minimum Cybersecurity Baseline Certification Requirement for Five Enlisted

AFSCs (3D0X2, 3D0X3, 3D1X1, 3D1X2, and 1B4X1)

5.4. Future Minimum Cybersecurity Baseline Certification Requirements for 17X

Officer Career Field

5.5. Exams (Civilians and Military Only)

5.6. Certification Exam Failure/Decertification

5.7. Continuing Education Units (CEUs)

5.8. Maintenance of Cybersecurity Baseline Certifications

4 AFMAN33-285 20 MARCH 2015

5.9. Recording Certification Completion

5.10. Recording Computing Environment/Operating System Training Completion

5.11. Community College of the Air Force Credit

Chapter 6—CYBERSECURITY WORKFORCE TRAINING 36

6.1. Initial Skills Training

6.2. Distributive/Online Learning

6.3. Authorizing Official (AO) Training

6.4. Contracted Training

6.5. Military Computing Environment/Operating System Training Options

6.6. Civilian Computing Environment/Operating System Training Options

6.7. Contractor Computing Environment/Operating System Training Options

Chapter 7—CYBERSECURITY WORKFORCE REPORTING METRICS AND

VALIDATION 38

7.1. Reporting

7.2. Metrics

7.3. Annual Cybersecurity Position Validation:

Chapter 8—CYBERSECURITY BASELINE CERTIFICATION WAIVERS (CIVILIANS

AND MILTARY ONLY) 39

8.1. IAW DoD 8570

8.2. Waiver Process

Attachment 1—GLOSSARY OF REFERENCES AND SUPPORTING INFORMATION 40

Attachment 2—AF CYBERSECURITY POSITION CERTIFICATION

DETERMINATION GUIDE 44

Attachment 3—MILITARY CERTIFICATION FAILURE POLICY (INITIAL

CERTIFICATION ATTAINMENT) 54

Attachment 4—SAMPLE CYBERSECURITY WORKFORCE METRICS 57

Attachment 5—SAMPLE - FORMAL STATEMENT OF RESPONSIBILITIES 59

Attachment 6—SAMPLE - FORMAL STATEMENT OF RESPONSIBILITIES 60

AFMAN33-285 20 MARCH 2015 5

Chapter 1

GENERAL INFORMATION

1.1. Objectives. This manual implements DoDD 8570.01, Information Assurance (IA)

Training, Certification and Workforce Management, 15 August 2004 and DoD 8570.01-M, Information Assurance Workforce Improvement Program, 19 December 2005 and specifically identifies AF requirements, roles, and responsibilities. The primary objective of the Air Force

(AF) Cybersecurity Workforce Improvement Program (WIP) is to train, educate, certify, and qualify personnel commensurate with their responsibilities to develop, use, operate, administer, maintain, defend, and dispose/retire DoD Systems. All authorized users of DoD information systems (ISs)/Platform Information Technology (PIT) systems must receive initial cybersecurity user awareness training as a condition of access to an IS IAW DoD 8570.01-M, Paragraph

C6.2.2.; thereafter, all users will complete annual cybersecurity awareness refresher training (T-

0). This training can be found on the Defense Information Systems Agency (DISA) Information

Assurance Support Environment (IASE) portal: http://iase.disa.mil/eta/Pages/index.aspx. This manual also identifies AF cybersecurity workforce positions, certification and qualifications requirements, and provides policy on cybersecurity workforce reporting, metrics and validation

Unless noted, the cybersecurity position requirements (e.g. certification, training, etc.) specified in this manual are the minimum required. Commanders are authorized to increase requirements to reflect specific duties and or function(s).

1.2. Goal. IAW DoD 8570.01-M, the goal of the Cybersecurity WIP is to “develop a DoD cybersecurity [IA] workforce with a common understanding of the concepts, principles, and applications of cybersecurity for each category, level, and function to ensure the confidentiality, integrity, and availability (CIA) of DoD information, information systems, networks and information stored within.” The Cybersecurity WIP provides warfighters qualified cybersecurity personnel in each category, specialty and level: Information Assurance Technical (IAT), Information Assurance Management (IAM), Computer-Network Defense - Service Providers

(CND-SPs), IA System Architects and Engineers (IASAEs), Authorizing Officials (formerly called Designated Accrediting/Approving Authorities [DAAs]), and Assessing Functions.

1.3. Applicability. Cybersecurity workforce functions and associated DoD approved baseline cybersecurity certifications are identified in DoD 8570.01-M by category (IAT and IAM) or specialty (CND-SP and IASAE). The cybersecurity workforce positions on a unit manning document (UMD) will reflect the certification required using established special experience identifiers (SEIs). The cybersecurity workforce consists of all civilian, military, and contractors performing a cybersecurity function IAW DoD 8570.01-M, requires possession of a current/valid cybersecurity baseline certification, and all Airmen who are required to possess a valid/current baseline cybersecurity certifications as a precondition of their respective Air Force Specialty

Code (AFSC). This manual applies to all AF civilian, military, and contractor (US citizens, Foreign Nationals [FNs], and Local Nationals [LNs]) personnel performing cybersecurity functions or tasks IAW DoD Chief Information Officer (DoD CIO) policies. AFMAN 33-285 compliance is required for the Intelligence Community (IC) and Special Access Program (SAP) unless AFMAN conflicts with the Office of Director of National Intelligence (ODNI) or the DoD

Director, Special Access Programs Central Office (DoD SAPCO) directives respectfully. When in conflict, the ODNI and DoD SAPCO Guidance take precedence for the IC and SAP http://iase.disa.mil/eta/Pages/index.aspx

6 AFMAN33-285 20 MARCH 2015

community. Although DoD 8570.01-M requirements have been vetted through OSD legal channels and with National Unions, DoD CIO has strongly recommended continuous engagements with appropriate local parties such as the local or country Human Resources section of the Office of Personnel Management (OPM) or local unions.

1.3.1. For this manual, the term civilian includes AF employees (US citizens, FNs and LNs) paid by appropriated funds. The definitions for FNs and LNs can be found in DoD 8570.01-

M, Appendix 1.

1.3.2. For this manual, the term military reflects the Total Force (Active Air Force, Air

National Guard, and Air Force Reserve Components). Also, the term military includes US citizens and FNs.

1.3.3. For the manual, the term contractor includes US citizens, FNs, and LNs.

1.3.4. For this manual, the term major command (MAJCOM) includes field operating agency (FOA) and direct reporting unit (DRU).

1.3.5. For this manual, the term Program Management Office (PMO) is synonymous with the Program/Project Manager (PM) or System Manager. PMOs or PMO-like entities manage the acquisition, delivery, and sustainment of information technology, including ISs/PIT systems.

1.3.6. For this manual, the term IA Managerial (IAM) refers to the management category of

8570-related certifications, but is not synonymous with the Information System Security

Manager (ISSM) (formerly called Information Assurance Manager) position.

1.3.7. For this manual, the term Base/Wing ISSM is synonymous with the Wing

Cybersecurity Officer (formerly called Wing Information Assurance Officer).

1.3.8. For this manual, the term AF 8570 Program (centralized) funds refers to the budget/funds managed by AF Space Command Cyber Support Squadron (AFSPC CYSS) to pay for both cybersecurity baseline certifications exams and maintenance fees for AF civilian and military personnel.

1.4. Requirements. Commanders and supervisors will do the following: identify cybersecurity workforce positions in manpower databases/systems; ensure personnel are trained, certified, and qualified; record cybersecurity workforce information in personnel systems; track and ensure certifications are current; and report certification status (T-0). DoD has agreed to adhere to certification currency requirements as stipulated by the International Organization for

Standardization/International Electro-technical Commission (ISO/IEC) 17024 for the commercial cybersecurity certifications. For civilian and military personnel, the cybersecurity workforce information will be recorded in manpower and personnel databases/systems (e.g.

Military Personnel Data System [MILPDS] and Defense Civilian Personnel Data System

[DCPDS]), to include but not limited to, AFSC or civilian occupational series (T-0). For contractors, all cybersecurity requirements, including currency, must be recorded in the contracts

(new or modified)/Performance-Based Work Statement (PWS) IAW DoD 8570-01-M, Paragraph

C1.4.4.5 (T-0). Details on the contractor cybersecurity workforce must be locally collected and tracked (T-3).

1.4.1. All AF workforce (civilian, military, and contractor) positions regardless of AFSC, occupational series, or job title performing one or more cybersecurity functions must be

AFMAN33-285 20 MARCH 2015 7

identified, managed, and tracked as part of the DoD cybersecurity workforce IAW DoD

8570.01-M, Paragraph C1.4.4.7 (T-0). Individuals occupying these positions will attain and maintain a DoD approved cybersecurity baseline certification(s) as outlined in DoD 8570.01-

M, Paragraph AP2.1.2.1 (T-0). Also, all AF cybersecurity workforce personnel will become qualified in assigned cybersecurity position IAW DoD 8570.01-M, Paragraph C2.3.6 (T-0).

Please see the AF Cybersecurity Position Certification Determination Guide, Attachment 2, for further guidance on certification requirements.

1.4.2. All AF positions involved in the performance of cybersecurity functions must be identified in manpower and personnel databases/systems (T-0).

1.4.3. AF supervisors should have the capability to identify, manage, and track personnel performing cybersecurity functions, regardless of military specialty or occupational series.

1.4.4. The status of cybersecurity qualifications must be monitored and tracked IAW DoD

8570.01-M, Paragraph C8.1.1 (T-0).

1.5. Background. The AF recognizes the following agencies must provide support as listed in

DoD 8570.01-M: (1) The DoD CIO will provide overarching cybersecurity policy and guidance and coordinate the implementation and sustainment requirements of DoD 8570.01-M to include supporting tools and resources (e.g., conferences, websites, database integration, workforce identification, etc.); (2) The Under Secretary of Defense for Personnel and Readiness (USD

[P&R]) will support and provide appropriate representation to the USD (P&R) Cybersecurity

Training, Certification, and Workforce Management Oversight Advisory Council; and (3) The

Director of DISA will coordinate with the Defense-wide Information Assurance Program office and the components to develop and maintain online resources correlating DoD cybersecurity training products and classes.

8 AFMAN33-285 20 MARCH 2015

Chapter 2

ROLES AND RESPONSIBILITIES

2.1. Air Force Chief of Information Dominance and Chief Information Officer (SAF/CIO

A6).

2.1.1. Develop policy and direct implementation of AF requirements and processes.

Interpret and promulgate cybersecurity workforce directives, policies and requirements such as DoD 8570.01-M.

2.1.1.1. Provide direction on position determinations for the cybersecurity workforce.

2.1.1.2. Provide direction and updates to the Enlisted and Officer Classification

Directories to reflect SEI requirements for the cybersecurity workforce.

2.1.1.3. Provide direction on reporting metrics of the cybersecurity workforce.

2.1.1.4. Provide programming and budget guidance to Core Function Leads (CFLs) and

MAJCOMs for cybersecurity workforce management and improvement programs to include certification exam and maintenance fee costs, and computer-based training.

2.1.1.5. Provide direction on annual validation of the cybersecurity workforce.

2.1.1.6. Provide direction on supplemental cybersecurity workforce training.

2.1.2. Oversee Cybersecurity WIP and distribution of certification funds for the AF.

2.1.3. Identify, track, and monitor cybersecurity personnel and qualifications, including certifications.

2.1.4. Collect and report on qualification metrics and submit reports to the DoD CIO as directed such as for Federal Information Security Management Act (FISMA) reporting, standardizing reporting across Air Force.

2.1.5. Track Authorizing Official-signed certification waivers, as discussed in Chapter 8.

2.1.6. Participate as member on various DoD cybersecurity workforce forums and groups.

2.1.7. Assist certification providers with AF policy when applying to use the .mil network to proctor electronic certification exams (e.g. Certify and Accredit the software needed by the education offices using .mil).

2.1.8. Coordinate with SAF/A1 to integrate institutional education and training programs and requirements (i.e. ancillary, Professional Military Education (PME), and accessions) into the appropriate venues prior to levying on the Total Force. Note: Career field specific requirements are coordinated with the respective career field manager for integration into

Career Field Training Plan (CFETP)/Specialty Training Standard (STS)/Course Training

Standard (CTS) as appropriate.

2.1.9. Acquire capability for PMOs/units to track and manage qualifications of AF cybersecurity workforce.

2.1.10. Update skill-awarding and supplemental courses for the cyber workforce to facilitate gaining certification upon course completion, if cost-benefit analysis supports such action.

AFMAN33-285 20 MARCH 2015 9

2.1.11. Ensure AETC has the most current DoD approved with annual cybersecurity user awareness training product(s).

2.1.12. Work with SAF/A1 and SAF/AQ on a capability to automate reporting of the qualification status of the AF cybersecurity workforce.

2.2. Assistant Secretary of the Air Force, Acquisition (SAF/AQ).

2.2.1. Ensure ISs/PIT systems acquisitions address cybersecurity workforce requirements.

2.2.2. Ensure programs budget for certified and qualified cybersecurity support for certified and qualified personnel throughout system life cycles.

2.3. Deputy Chief of Staff of the Air Force, Manpower, Personnel and Services (SAF/A1).

2.3.1. Provide a capability to identify, record and track civilian and military cybersecurity positions via SEIs on the UMD IAW DoD Instructions, DoD 8570.01-M, and AF policies.

2.3.2. Provide a capability to identify and track civilian and military cybersecurity personnel.

2.3.3. Provide advice on union representation related to cybersecurity workforce requirements (e.g. certifications, positions).

2.3.4. Ensure guidance is provided to support human resources (HR) agencies for management of cybersecurity workforce within manpower and personnel databases/systems.

2.4. MAJCOMs/FOAs/DRUs.

2.4.1. Ensure cybersecurity workforce is identified, trained, certified, qualified, tracked, and managed IAW DoD and AF cybersecurity WIP directives and policies such as DoDD

8570.01, DoD 8570.01-M, and this manual.

2.4.2. Ensure the cybersecurity workforce positions are reviewed periodically and validated annually. SAF/CIO A6 will provide the reporting instructions for validations.

2.4.3. Appoint MAJCOM/FOA/DRU Cybersecurity WIP representatives to SAF/CIO A6.

This individual should brief MAJCOM/A6 on implementation issues.

2.4.4. Act as the command focal point (or equivalent) and provide MAJCOM guidance and oversight for DoD 8570.01-M issues.

2.4.5. Consolidate base/wing reporting inputs on civilian, military, and contractor cyberspace workforce requirements.

2.4.6. Provide AFSPC CYSS contact information for POCs.

2.4.7. Report the status of their cybersecurity workforce (civilian, military, and contractors) qualifications to the SAF/CIO A6 IAW Paragraph 7.2.

2.4.8. Report on annual validation of civilian and military cybersecurity workforce positions to the SAF/CIO A6 IAW Paragraph 7.3.

2.5. Headquarters Air Education and Training Command (HQ AETC).

2.5.1. Provide and sustain availability of cybersecurity user awareness training provided by the SAF/CIO A6.

10 AFMAN33-285 20 MARCH 2015

2.5.2. Provide schoolhouse training, certification testing, and cybersecurity user awareness training to students as appropriate.

2.6. Air Force Personnel Operations Agency (AFPOA).

2.6.1. Extract reports from manpower and personnel databases/systems (e.g. MILPDS and

DCPDS) to identify cybersecurity workforce certification requirements and certified personnel for AF compliance reporting.

2.6.2. Provide technical assistance to the SAF/CIO A6 on manpower and personnel systems such as data field entries.

2.7. Air Force Personnel Center (AFPC).

2.7.1. Upon the request of the appropriate SAF/CIO A6 Career Field Manager (CFM), update the Air Force Enlisted Classification Directory (AFECD) and/or AF Officer

Classification Directory (AFOCD) with SEIs to track the military cybersecurity workforce.

2.7.2. Validate cybersecurity certification completion for civilian personnel in civilian personnel database(s)/system(s).

2.7.3. Validate cybersecurity certification completion for military personnel in military personnel database(s)/system(s).

2.8. Air Force Space Command (AFSPC).

2.8.1. Collect, monitor, and analyze data in support of program management actions.

2.8.2. Submit Program Objective Memorandum (POM) for AF-wide training and tracking of approved civilian and military cybersecurity workforce authorizations.

2.8.3. Supplement formal training programs with commercial cybersecurity training as needed.

2.8.4. Provide on-line training materials via AF e-learning program.

2.8.5. Publish information regarding AF-endorsed certification requirements.

2.8.6. Execute AF centralized funds for preferred certifications and maintenance fees.

2.9. Director of Security, Special Programs Oversight (SAF/AAZ). Ensure SAP information systems and platform information technologies compliance with cybersecurity/IA workforce requirements with certified and qualified personnel throughout system and platform life cycles.

2.10. Authorizing Officials (AO).

2.10.1. Comply with cybersecurity training requirements IAW Paragraph 3.2.4. The AO training is located on the DISA IASE portal: http://iase.disa.mil/eta/Pages/index.aspx.

2.10.2. Provide oversight over cybersecurity personnel and positions, supporting responsible

ISs/PIT systems IAW Paragraph 3.2.11.

2.10.3. Provide oversight over the cybersecurity baseline certification waiver process IAW

Chapter 8. These waivers must be only applicable to cybersecurity-related positions under the AO’s authority.

http://iase.disa.mil/eta/Pages/index.aspx

AFMAN33-285 20 MARCH 2015 11

2.11. Air Force Career Field Manager(s) (AF CFMs).

2.11.1. Periodically review AFSC(s) or occupational series and certification level for inclusion/removal in the cybersecurity workforce program.

2.11.2. Ensure enlisted and officer classification directories are updated with SEIs for tracking cybersecurity workforce requirements or certifications for the AFSC(s) the CFM manages.

2.11.3. Ensure civilian position description (PD) guidance is provided for tracking cybersecurity workforce requirements or certifications for applicable occupational series.

2.12. MAJCOM/FOA/DRU WIP Representative(s).

2.12.1. Ensure cybersecurity workforce requirements in DoDD 8570.01 and DoD 8570.01-

M are met.

2.12.2. Provide oversight over the qualification status (e.g. training, certification, continuing education, etc.) for all personnel identified as part of the AF cybersecurity workforce.

2.12.3. Ensure qualification status of AF cybersecurity workforce is tracked and reported as an element of mission readiness and as a management review item.

2.12.4. Provide cybersecurity workforce compliance statistical data in appropriate format to the SAF/CIO A6 IAW Paragraph 7.2.

2.13. Wing Cybersecurity Office (WCO, formerly called Wing Information Assurance

Office).

2.13.1. Will monitor status of AF cybersecurity workforce including certification, training, and qualifications criteria (e.g. on-the-job evaluation [OJE], continuing education, and personnel security investigation [e.g. National Agency Check [NAC], NAC plus Written

Inquiries, Background Investigation, Single Scope Background Investigation [SSBI]]) (T-1).

2.13.2. Provide oversight over the Privileged Access Agreement process of cybersecurity workforce (civilians, military and contractors) within their wing/base.

2.13.3. Will report statistics on Wing’s cybersecurity workforce personnel compliance IAW this manual to the MAJCOM/FOA/DRU WIP Representative(s) as an element of mission readiness and as a management review item (T-1).

2.14. Information System Security Managers (ISSMs).

2.14.1. Will develop a process to validate an individual has signed a Privileged Access

Agreement, completed the appropriate clearance or personnel security investigation appropriate for access, and cybersecurity baseline certification(s) before privileged access to

IS/PIT system is granted (T-2).

2.14.2. Will track Privileged Access Agreements for each responsible ISs/PIT system (T-2).

Provide updates to the WCO.

2.14.3. Will ensure the ISs/PIT system cybersecurity workforce certification and training meets compliance for mission readiness and management review items (T-2).

12 AFMAN33-285 20 MARCH 2015

2.15. Civilian Personnel Section (CPS).

2.15.1. Will process personnel action request(s) such as Authorization Change Request

(ACRs) to identify cybersecurity workforce requirements within appropriate personnel database(s)/system(s) (T-2).

2.15.2. Will ensure information is forwarded to the servicing classification office for review and appropriate action, to include updating personnel data systems and, if necessary, updating core personnel document (CPD) and position classification (T-2).

2.15.3. Ensure the Labor Relations Officer confirms collective bargaining obligations are met.

2.16. Program/Project Managers (PMs), System Managers (SMs), Program Management

Offices (PMOs), Developmental/Operational Test Agencies, and Units.

2.16.1. Will enforce tracking and management of their cybersecurity workforce (civilian, military, and contractor) personnel, ensuring personnel are certified and qualified IAW DoD

8570.01-M and this manual (T-0).

2.16.2. Will review the UMD to ensure all civilian and military cybersecurity-related positions are identified and recorded positions with the appropriate SEI (T-1). Identify positions to be updated and notify the servicing manpower office to update the SEI on the

UMD (T-1).

2.16.3. Will ensure personnel in cybersecurity workforce positions possess the appropriate clearance or personnel security investigation for position IAW DoD 8570.01-M, Paragraph

C1.4.4.6.4 (T-0).

2.16.3.1. Will not approve/initiate privileged access requests for an IS/PIT system until individual possesses the appropriate the clearance or personnel security investigation (T-

0).

2.16.4. Will ensure civilian CPDs/PDs reflect accurately cybersecurity workforce requirements (T-0).

2.16.5. Will identify organization’s civilian positions in the cybersecurity workforce IAW

DoD 8570.01-M, Paragraph C7.3.2.2 (T-0).

2.16.6. Will ensure servicing CPS and position classification functions are notified of any changes to civilian positions in the cybersecurity workforce (T-2).

2.16.7. Will provide corrective actions, when necessary, to implement the requirements within this manual (T-2).

2.16.8. Will ensure contractor cybersecurity workforce requirements and compliance are managed through the contract process (T-0).

2.16.8.1. Will ensure contractor personnel, IAW DoD 8570.01-M, Paragraph C2.3.9, have appropriate DoD approved cybersecurity baseline certification(s) prior to supporting any cybersecurity functions for new or recently modified contracts (T-0).

2.16.8.2. , Will ensure, IAW DoD 8570.01-M, Paragraphs C1.4.4.5, all contracts (new or modified) and PWSs must state all cybersecurity requirements, including baseline certification category/specialty and level, for contractor personnel (T-0). The PWS

AFMAN33-285 20 MARCH 2015 13

should state the following: "The contractors will comply with the Defense Acquisition

Regulations (DFARS) 252.239.7001 and all cybersecurity requirements stipulated in the contract...”

2.16.8.3. The Contracting Officer (CO) will ensure, IAW DoD 8570.01-M, Paragraph

C2.3.9, all contractor personnel are appropriately certified (T-0). For instance, the CO will validate all newly assigned contractors have the appropriate certification(s) prior to being given privileged access to the network and/or assuming cybersecurity responsibilities (T-0).

2.16.8.4. Will ensure all contractor personnel complete/sign a formal statement of assigned cybersecurity responsibilities (T-0). A suggested format can be found in

Appendix 6 for contactors.

2.16.8.5. Contractor personnel who are required to have a cybersecurity baseline certification and do not maintain the certification(s), in good standing, will be immediately removed from task (T-0). Contractors are ineligible for certification baseline waivers as described in Chapter 8. Coordinate with the servicing contracting office regarding removal process (T-0).

2.16.9. Will only assign US citizens to IA Workforce Technical (IAT) Category Level III, IA Workforce Management (IAM) Category Level III, and IA Workforce System Architect and Engineer Specialty Level III positions IAW DoD 8570.01-M, Tables C3.T6, C4.T6, and

C10.T6 (T-0).

2.16.10. Will take appropriate actions IAW Paragraph 5.6 on civilian and military personnel in cybersecurity workforce positions when cybersecurity baseline certifications are not achieved within six months of filling the position, baseline certification waivers (see

Chapter 8) are not obtained, an individual has become decertified, or a baseline certification has expired (T-0).

2.16.11. Will budget for training and re-testing for individuals who fail their certification exam; for individuals who will be re-certificated due to failure of maintaining baseline certification in good standing; and for those individuals who desire training over and above the training resources provided by SAF/CIO A6 or AFSPC CYSS (T-3).

2.16.12. Will not initiate certification waivers for contractors IAW DoD 8570.01-M, Paragraphs C2.3.9 (T-0).

2.16.13. Will report the status of their cybersecurity workforce (civilian, military, and contractors) qualifications to the SAF/CIO A6 IAW Paragraph 7.2 (T-0).

2.16.14. Will conduct annual validation of civilian and military cybersecurity workforce positions (T-0).

2.16.15. Will provide update on cybersecurity workforce qualifications statistics to the local

WCO (T-0).

2.17. Unit Training Managers (UTM).

2.17.1. Will initiate and coordinate AF Form 2096(s) for commander approval (with further submission to servicing personnel function (Force Support Squadron [FSS], Military

14 AFMAN33-285 20 MARCH 2015

Personnel Flight [MPF], or equivalent), to award SEI for military cybersecurity members achieving certification (T-3).

2.17.2. Will plan and organize required cybersecurity training and certification for the organization's civilian and military cybersecurity workforce (T-3).

2.17.3. Will track, monitor, and document the progress of the baseline training, continuing education (CE) units, and Computing Environment/Operating System training for the organization’s civilian and military cybersecurity workforce (T-3).

2.17.4. Will ensure every civilian, military, and contractor in the organization/unit has authorized release of their cybersecurity baseline certification to the Defense Manpower Data

Center (DMDC) IAW DoD 8570.01-M, Paragraph C2.3.12 (T-0). The authorization release can be found at this link: https://www.dmdc.osd.mil/appj/dwc/index.jsp. The UTM should engage applicable MAJCOM/FOA/DRU WIP Representative(s) for latest info on released cybersecurity baseline certifications.

2.18. Supervisors.

2.18.1. Will incorporate cybersecurity certification and qualification requirements IAW

Chapters 4 and 5 within the Master Training Plan and training documentation for cybersecurity workforce (T-3).

2.18.2. Will ensure personnel identified in the cybersecurity workforce are prepared to attain and maintain qualifications (T-3).

2.18.3. Will ensure civilians and military complete/sign a formal statement of assigned cybersecurity responsibilities (T-0). A suggested format can be in Appendix 5 for civilians and military.

2.18.4. Will ensure the member is earning continuing educational units as required by the commercial provider to maintain cybersecurity baseline certification in good standing (T-3).

2.18.5. Will approve certification exam requests for eligible civilian and military personnel in coded cybersecurity workforce positions with at least one year retainability (T-0).

2.18.6. Will validate personnel (civilian and military) have completed, if applicable, the appropriate computing environment/operating system training IAW Paragraph 4.2 for assigned duties (T-0).

2.19. Individuals (Civilian and Military).

2.19.1. Will attain appropriate DoD approved cybersecurity baseline certification(s) applicable for cybersecurity functions required for the DoD position held, within six months of filling position IAW DoD 8570.01-M, Paragraphs C3.2.4.1.1, C4.2.3.2, C10.2.3.2, and

C11.2.4.1.1 (T-0).

2.19.2. Will maintain in good standing cybersecurity baseline certification(s) IAW DoD

8570.01-M, Paragraph C2.3.7 (T-0). Please see Paragraph 5.7 for more details on continuing education units and maintenance fees.

2.19.3. Will become qualified in cybersecurity position as defined in Chapter 4 (T-0).

2.19.4. Will sign a formal statement of assigned cybersecurity responsibilities IAW DoD

8570.01-M, Paragraphs C3.2.4.4, C4.2.3.6, and C10.2.3.6 (T-0).

https://www.dmdc.osd.mil/appj/dwc/index.jsp

AFMAN33-285 20 MARCH 2015 15

2.19.5. Will sign Privileged Access Agreement if privileged access is required, for each

IS/PIT system necessary to perform assigned duties IAW DoD 8570.01-M, Paragraph C2.1.4

(T-0). An example agreement can be found in DOD 8570.01-M, Appendix 4.

2.19.6. Will authorize release of cybersecurity baseline certification data to DoD via DMDC

IAW DoD 8570.01-M, Paragraphs C2.3.12 (T-0). The authorization release can be found at:

https://www.dmdc.osd.mil/appj/dwc/index.jsp.

2.19.7. Will report Continuing Education Units (CEUs) status to supervisor and UTM (T-0).

2.20. Individuals (Contractors).

2.20.1. Will attain appropriate cybersecurity certification(s) applicable for assigned cybersecurity workforce position prior to start of contractual duties IAW DoD 8570.01-M, Paragraph C2.3.9 (T-0).

2.20.2. Will maintain in good standing cybersecurity baseline certification(s) IAW DoD

8570.01-M, Paragraph C2.3.7 (T-0). Please see Paragraph 5.7 for more details on continuing education credits and maintenance fees.

2.20.3. Will become qualified in cybersecurity position as defined in Chapter 4 (T-0).

2.20.4. Will sign a formal statement of assigned cybersecurity responsibilities IAW DoD

8570.01-M, Paragraphs C3.2.4.4, C4.2.3.6, and C10.2.3.6 (T-0).

2.20.5. Will sign the Privileged Access Agreement if privileged access is required, for each

IS/PIT system necessary to perform assigned duties IAW DoD 8570.01-M, Paragraph C2.1.4

(T-0). An example agreement can be found in DoD 8570.01-M, Appendix 4.

2.20.6. Will authorize the release of cybersecurity baseline certification data to DMDC IAW

DoD 8570.01-M, Paragraphs C2.3.12 (T-0). The authorization release can be found at:

https://www.dmdc.osd.mil/appj/dwc/index.jsp.

2.20.7. Will not be eligible for cybersecurity baseline certification waivers IAW DoD

8570.01-M, Paragraphs C2.3.9 (T-0).

16 AFMAN33-285 20 MARCH 2015

Chapter 3

CYBERSECURITY WORKFORCE IDENTIFICATION

3.1. Position Identification. Supervisors and managers will review all manpower positions, duty descriptions, or statements of work to determine if cybersecurity functions are required to be performed by that position IAW DoD 8570.01-M, Chapters 3, 4, 5, 10, and 11 (T-0). Please refer to the AF Cybersecurity Position Certification Determination Guide, Attachment 2, to assist supervisors and managers in the identification process. If a position is identified as part of the cybersecurity workforce, then the requirement must be recorded and, if encumbered, the assigned individual will achieve the appropriate certification commensurate with the position (T-

0). If a position is performing functions spanning across one or more levels within a category/specialty, then the position certification requirements must be those of the highest level function(s) IAW DoD 8570.01-M, Paragraph C2.2.5 (T-0). Supervisors should try to consolidate positions performing cybersecurity functions as an additional duty (performing functions 15 to

24 hours weekly) or an embedded duty (performing functions up to 14 hours weekly) maximizing resources. Likewise, supervisors should try to limit number of individuals requiring privileged access to the minimum necessary to support mission tasks.

3.2. Cybersecurity Workforce. The AF cybersecurity workforce is grouped by categories IA

(IAT and IAM) or specialties (CND-SP and IASAE). The categories and specialties are subdivided further into levels, related to functional skill requirements and/or system environment focus. Civilians and military personnel will attain a DoD approved cybersecurity baseline within six months of formal assignment of cybersecurity duties, except as noted in Paragraph 3.2.8 for software developers/engineer/programmers, and IAW DoD 8570.01-M, Paragraph C3.2.4.1.1

(T-0). The list of DoD approved cybersecurity baseline certifications can be found at:

http://iase.disa.mil/iawip/Pages/iabaseline.aspx. Please note the AO position does not have a mandatory cybersecurity baseline certification.

3.2.1. IA Technical (IAT) Category. An IAT position is defined as anyone who has been given access rights to manage core/DoD Information Networks Operations (DoDIN Ops) service(s), servers, or end-point devices. Core/DoDIN Ops services include but are not limited to the following: messaging/email services, directory services, application/web hosting services, vulnerability management, network boundary management, etc.

3.2.1.1. IAT Level I. An IAT Level I position ensures client-level workstations or end user devices (i.e. mobile device, laptop, etc.) are more secure by correcting anomalies/vulnerabilities and/or implementing security controls in the hardware or software installed. This environment usually consists of a client-level workstation/end user device, its operating system, peripherals, and applications. An individual in an IAT

Level I position will attain and maintain a cybersecurity baseline certification commensurate to the category and level from the DoD approved listing located at:

http://iase.disa.mil/iawip/Pages/iabaseline.aspx IAW DoD 8570.01-M, Paragraphs

C2.3.2 (T-0). Examples of IAT Level I could include a Client Support Technician having root access/rights to the operating system at the workstation or end user device and help desk support staff.

http://iase.disa.mil/iawip/Pages/iabaseline.aspx

AFMAN33-285 20 MARCH 2015 17

3.2.1.2. IAT Level II. An IAT Level II position provides networked environment (NE) support. For this manual, networked is defined as two or more workstations or ISs/PIT systems interconnected. Also, the IAT Level II pays special attention to intrusion detection, finding and fixing unprotected vulnerabilities, and ensuring that remote access points are well secured. An individual in an IAT II position will attain and maintain a cybersecurity baseline certification commensurate to the category and level from the

DoD approved listing located at this link:

http://iase.disa.mil/iawip/Pages/iabaseline.aspx IAW DoD 8570.01-M, Paragraphs

C2.3.2 (T-0). Examples of IAT Level II could include technician of internetworking devices such as routers and switches, personnel supporting cabling infrastructures, and system administrators for networked, but non-enterprise (i.e. not accessible to global end users) servers.

3.2.1.3. IAT Level III. An IAT Level III position is responsible for incident response and making local technical decisions regarding the cybersecurity posture of the enterprise asset. An individual in an IAT III position will attain and maintain a cybersecurity baseline certification commensurate to the category and level from the DoD approved listing located at: http://iase.disa.mil/iawip/Pages/iabaseline.aspx IAW DoD 8570.01-

M, Paragraphs C2.3.2 (T-0). An example of IAT Level III could include a Security

Control Assessor Representative (formerly called Certifying Authority Representative) who performs mostly technical assessments/audits and an individual responsible for the overall administration of enterprise-level network devices/servers/services.

3.2.2. IA Management (IAM) Category. An IAM Category position is defined as anyone who has oversight of cybersecurity programs or functions involving management decisions for the administration of core/DoDIN Ops service(s), network devices, servers or end-point devices. Core/DoDIN Ops services included but are not limited to the following:

messaging/email services, directory services, application/web hosting services, vulnerability management, network boundary management, etc. An individual possessing an IAM certification typically does not possess privileged access or require computing environment/operating system certification.

3.2.2.1. IAM Level I. An individual in an IAM Level I position will attain and maintain a cybersecurity baseline certification commensurate to the category and level from the

DoD approved listing located at: http://iase.disa.mil/iawip/Pages/iabaseline.aspx IAW

DoD 8570.01-M, Paragraphs C2.3.2 (T-0). Examples of an IAM Level I could include crew commanders and WCO staff, except for the Base/Wing ISSM.

3.2.2.2. IAM Level II. An individual in an IAM Level II position will attain and maintain a cybersecurity baseline certification commensurate to the category and level from the

DoD approved listing located at: http://iase.disa.mil/iawip/Pages/iabaseline.aspx IAW

DoD 8570.01-M, Paragraphs C2.3.2 (T-0). An Example of an IAM Level II is the

Base/Wing ISSM.

3.2.2.3. IAM Level III. An individual in an IAM Level III position will attain and maintain a cybersecurity baseline certification commensurate to the category and level from the DoD approved listing located at this link:

http://iase.disa.mil/iawip/Pages/iabaseline.aspx IAW DoD 8570.01-M, Paragraphs

C2.3.2 (T-0). Examples of an IAM Level III could include the AF Senior Information http://iase.disa.mil/iawip/Pages/iabaseline.aspx http://iase.disa.mil/iawip/Pages/iabaseline.aspx http://iase.disa.mil/iawip/Pages/iabaseline.aspx

18 AFMAN33-285 20 MARCH 2015

Security Officer (AF SISO), SAF/CIO A6 cybersecurity staff personnel, several

MAJCOM cybersecurity staff positions, Security Control Assessor (SCA), and ISSM for

IS(s)/PIT system(s) providing enterprise capabilities and/or services to AF end users worldwide (T-1).

3.2.3. AF Senior Information Security Officer (SISO). The AF SISO is the official responsible for directing the Air Force's cybersecurity program on behalf of the AF CIO. The

AF SISO will attain and maintain an IAM Level III cybersecurity baseline certification. It is recommended the AF SISO attain other certifications. AF centralized funds will pay for cybersecurity baseline certification exam and maintenance fees (T-1).

3.2.4. Authorizing Official (AO). The AO is the official with the authority to formally assume responsibility for operating a system at an acceptable level of risk. IAW DoD

8570.01-M, Paragraph C5.3.11, the AO will complete a DoD mandated AO training module within 60 days of assignment (T-0).

3.2.5. Assessment Functions.

3.2.5.1. Security Control Assessor (SCA). The SCA (formerly called Certifying

Authority [CA]) is the senior official having the authority and responsibility for the assessment of an IS/ PIT system. The SCA roles and responsibilities are addressed in AFI

33-210. SCAs will attain and maintain a DoD approved IAM Level III cybersecurity baseline certification (T-1). Also, it is highly recommended SCAs should both complete the AO training module and attain the Committee on National Security Systems

Instruction (CNSSI) 4016 certificate, for supplemental training on the AO responsibilities and risk analysis/mitigation, respectively.

3.2.5.2. Security Control Assessor Representative (SCAR). SCARs will attain and maintain a DOD approved Level III cybersecurity baseline certification commensurate to assigned position (T-1). The SCAR position will be classified as either IAM Level III or

IAT Level III. The AO can designate the SCAR as an IAT Level III position, if the

SCAR is performing predominately technical assessment/validation of security controls.

Otherwise, the AO can designate the SCAR as an IAM Level III position. Also, it is highly recommended SCARs should complete the AO training module and attain the

CNSSI 4016 certificate or supplemental training on the AO responsibilities and risk analysis/mitigation, respectively.

3.2.6. IA System Architect and Engineer (IASAE) Specialty.

3.2.6.1. IASAE Level I. An IASAE Level I position is responsible for the design, development, implementation, and/or integration of a DoD IS/PIT system cybersecurity architecture, system, or system component for use. Examples include Information System

Security Engineers (ISSEs) supporting standalone or point-to-point systems, as well as, supporting only the client or endpoint components of a larger IS/PIT system. An individual in an IASAE Level I position will attain and maintain a cybersecurity baseline certification commensurate to the category and level from the DoD approved listing located at: http://iase.disa.mil/iawip/Pages/iabaseline.aspx IAW DoD 8570.01-M, Paragraph C2.3.2 (T-0).

3.2.6.2. IASAE Level II. An IASAE Level II position is responsible for the design, development, implementation, and/or integration of a DoD cybersecurity architecture, AFMAN33-285 20 MARCH 2015 19 system, or system component for use within the Network Environment (NE). For this manual, networked is defined as two or more ISs/PIT systems, workstations and/or end user devices directly interconnected, but where the adverse impacts can be localized/isolated only to those interconnected. Examples could include ISSEs supporting functional-level systems connected to the DoDIN, but where adverse impacts can be isolated to only those who are interconnected. An individual in an IASAE Level II position will attain and maintain a cybersecurity baseline certification commensurate to the category and level from the DoD approved listing located at:

http://iase.disa.mil/iawip/Pages/iabaseline.aspx IAW DoD 8570.01-M, Paragraph

C2.3.2 (T-0).

3.2.6.3. IASAE Level III. An IASAE Level III position is responsible for the design, development, implementation, and/or integration of a DoD cybersecurity architecture, system, or system component for use within enterprise environments. They ensure that the architecture and design of DoD IS(s)/PIT system(s) are operational and secure.

Examples include ISSEs supporting enterprise-level (irrespective of functional community) IS(s) connected to the DoDIN. An individual in an IASAE Level III position will attain and maintain a cybersecurity baseline certification commensurate to the category and level from the DoD approved listing located at:

http://iase.disa.mil/iawip/Pages/iabaseline.aspx IAW DoD 8570.01-M, Paragraph

C2.3.2 (T-0).

3.2.7. Computer Network Defense – Service Provider (CND-SP) Specialty Positions. These positions are located within organization(s) providing cybersecurity provider functions.

3.2.7.1. CND-SP Analyst (CND-A). A CND-A uses data collected from a variety of cyber tools (including intrusion detection system alerts, firewall and network traffic logs, and host system logs) to analyze events that occur within their environment. An individual in a CND-A position will attain and maintain both an IAT cybersecurity baseline certification and a CND baseline certification commensurate assigned position from the DoD approved listing located at:

http://iase.disa.mil/iawip/Pages/iabaseline.aspx IAW DoD 8570.01-M, Paragraph

C2.3.2 and Table C 11.T2 (T-0).

3.2.7.2. CND-SP Infrastructure Support (CND-IS). A CND-IS tests, implements, deploys, maintains, and administers the infrastructure assets/equipment which are required to effectively manage the cybersecurity provider network and resources. Assets may include, but is not limited to routers, firewalls, and intrusion detection/prevention systems. An individual in a CND-IS position will attain and maintain both an IAT cybersecurity baseline certification commensurate to assigned level and a CND baseline certification commensurate to assigned position from the DoD approved listing located at: http://iase.disa.mil/iawip/Pages/iabaseline.aspx IAW DoD 8570.01-M, Paragraph

C2.3.2 and Table C 11.T4 (T-0).

3.2.7.3. CND-SP Incident Responder (CND-IR). A CND-IR investigates and analyzes all response activities related to cyber incidents.