Exhibit_B_-_SYSTEM_ACCESS_TRAINING_REQUIREMENTS.pdf

SYSTEM ACCESS TRAINING REQUIREMENTS

Minimum Certifications Required Level DOD 8570.01-M Requirements (one certification required within each level) Other Requirements

IAT Level I (Computing Environment)

A+, Network+, SSCP

Basic DOD IA Awareness, Privacy/HIPAA Training, DOD IASO Training

IAT Level II (Network and Advanced Computing)

Security+, GSEC, SCNP, SSCP

IAT Level III (Enclave) CISA, CISSP, GSE, SCNA IAM Level I Security+, GISF, GSLC IAM Level II CISSP, GSLC, CISM IAM Level III CISSP, GSLC, CISM

AR25-2 Requirements IT-I (IA personnel with privileged-level access to control, manage, or configure IA tools or devices, individual & Networked IS devices, and enclaves)

Favorable National Agency Check (NAC) current within 180 Days; Initiation of Single Scope Background Investigation (SSBI); Favorable review of SF85P, SF86 & Supplemental Questionnaire

Basic DOD IA Awareness, Privacy/HIPAA Training, DOD IASO Training, Required favorable Security Investigation, Security Clearance or Formal Access Approvals and fulfill any Need-To-Know Requirements

IT-II (IA personnel with limited privileged-level access to control, manage, or configure ISs and devices with very limited (single device) or no IA device access or management)

Favorable review of local personnel, base/military, medical, and other security records as appropriate. Initiation of NAC with Credit Check and Written Inquiries (NACIC) (for civilians) or a NAC with Local Agency and Credit Checks (NACLC) (for military and contractors), as appropriate favorable review of SF85P and Supplemental Questionnaire.

IT-III (1) IA personnel such as power users or a SA on an individual system with limited privileged-level access to that IS(s) or device(s). A position of higher trust. (2) Personnel with roles and responsibilities and access authorization of normal users with non-privileged level access to the IS or device. OR (3) Personnel with non-privileged level access authorization in the role of official or statutory volunteers. AR 608-1 covers provisions for statutory volunteers.

Favorable review of local personnel, base and military, medical, and other security records as appropriate. Initiation of NACIC (for civilians) or NAC (for military and contractors), as appropriate and favorable review of SF85P and Supplemental Questionnaire.

Descriptions

1. IAT Level I personnel make the Computing Environment (CE) less vulnerable by correcting flaws and implementing IAT controls in the hardware or software installed within their operational systems. IAT Level I certification is required prior to being authorized any unsupervised privileged access. Personnel performing these functions, regardless of their occupational title (e.g., system administrator, help desk technician, information system technician, etc,) shall be identified as part of the IA workforce and must comply with these requirements.

2. IAT Level II personnel provide network environment (NE) and advanced level CE support. They pay special attention to intrusion detection, finding and fixing unprotected vulnerabilities, and ensuring that remote access points are well secured.

3. IAT Level III personnel focus on the enclave environment and support, monitor, test, and troubleshoot hardware and software IA problems pertaining to the CE, NE, and enclave environments. [An enclave is any secured, self-contained computational system within a system of local area networks.]

4. IAM Level I personnel are responsible for the implementation and operation of a DOD IS or system component within their CE. Incumbents ensure that IA related IS are functional and secure within the CE.

5. IAM Level II personnel are responsible for the IA program of an Information System (IS) within the Network Environment (NE). Incumbents in these positions perform a variety of security related tasks, including the development and implementation of system information security standards and procedures. They ensure that the IS are functional and secure within the NE.

6. IAM Level III personnel are responsible for ensuring that all enclave ISs are functional and secure. They determine the enclaves’ long term IA systems needs and acquisition requirements to accomplish operational objectives. They also develop and implement information security standards and procedures.