AR_25-2_Information_Assurance.pdf

Army Regulation 25–2

Information Management

Information Assurance

Headquarters Department of the Army Washington, DC 24 October 2007

Rapid Action Revision (RAR) Issue Date: 23 March 2009

UNCLASSIFIED

SUMMARY of CHANGE

AR 25–2

Information Assurance

This rapid action revision, dated 23 March 2009--o Clarifies and corrects references to Department of Defense Directive 8750.1 and Army training requirements (para 4-3).

o Removes incorrect course reference to Information Assurance Manager Course and provides correct information on Certified Information Systems Security Professional modules (para 4-3).

o Removes incorrect information regarding Fort Gordon course topics (para 4-3).

o Removes references to the Asset and Vulnerability Tracking Resource compliance reporting database, which is no longer used, to correctly reference the Army Training and Certification Tracking System (para 4-3).

o Deletes incorrect reference to Skillport for required information assurance training (para 4-3).

o Changes Department of Defense Warning Banner verbiage to comply with Department of Defense directed mandatory guidance (para 4-5).

o Corrects references to the National Information Assurance Partnership (para 6-1).

o Adds mandatory Department of Defense Standardized Notice and Consent User Agreement language (app B-3).

o Updates office symbols and acronyms (throughout).

Headquarters Department of the Army Washington, DC 24 October 2007

Information Management

Information Assurance

*Army Regulation 25–2

Effective 13 November 2007

History. This publication is a rapid action revision (RAR). This RAR is effective 23 April 2009. The portions affected by this RAR are listed in the summary of change.

Summary. This regulation provides In-f o r m a t i o n A s s u r a n c e p o l i c y , m a n d a t e s , roles, responsibilities, and procedures for implementing the Army Information As-surance Program, consistent with today’s technological advancements for achieving acceptable levels of security in engineer-ing, implementation, operation, and main-t e n a n c e f o r i n f o r m a t i o n s y s t e m s connecting to or crossing any U.S. Army managed network.

Applicability. This regulation applies to t h e A c t i v e A r m y , t h e A r m y N a t i o n a l Guard/Army National Guard of the United States, and the U.S. Army Reserve, unless otherwise stated. Also, it applies to all users, information systems, and networks a t a l l i n f o r m a t i o n c l a s s i f i c a t i o n l e v e l s ;

program executive officers; direct report-ing program managers; strategic, tactical, and non-tactical environments or installa-tions; internal or external organizations, services, tenants, or agencies (for exam-p l e , D O D , s i s t e r S e r v i c e s , U . S . A r m y Corps of Engineers (USACE); contractors w o r k i n g o n A r m y i n f o r m a t i o n s y s t e m s p u r s u a n t t o A r m y c o n t r a c t s ; A r m y a n d A i r F o r c e E x c h a n g e S e r v i c e ( A A F E S ) ;

morale, welfare, and recreation activities;

e d u c a t i o n a l i n s t i t u t i o n s o r d e p a r t m e n t s (for example, DOD schools, the U.S. Mil-itary Academy at West Point); and Army affiliated or sponsored agencies (for ex-ample, Western Hemisphere Institute for Security Cooperation). During mobiliza-tion, the proponent may modify chapters and policies contained in this regulation.

Proponent and exception authority.

The proponent of this regulation is the Chief Information Officer/G–6. The pro-ponent has the authority to approve ex-ceptions or waivers to this regulation that a r e c o n s i s t e n t w i t h c o n t r o l l i n g l a w a n d regulations. The proponent may delegate this approval authority, in writing, to a d i v i s i o n c h i e f w i t h i n t h e p r o p o n e n t agency or its direct reporting unit or field operating agency, in the grade of colonel or the civilian equivalent. Activities may request a waiver to this regulation by pro-v i d i n g j u s t i f i c a t i o n t h a t i n c l u d e s a f u l l analysis of the expected benefits and must include a formal review by the activity’s senior legal officer. All waiver requests will be endorsed by the commander or s e n i o r l e a d e r o f t h e r e q u e s t i n g a c t i v i t y and forwarded through their higher head-quarters to the policy proponent. Refer to AR 25–30 for specific guidance.

Army management control process.

This regulation contains management con-trol provisions and identifies key manage-ment controls that must be evaluated (see appendix C).

S u p p l e m e n t a t i o n . S u p p l e m e n t a t i o n o f this regulation and establishment of com-mand and local forms are prohibited with-o u t p r i o r a p p r o v a l f r o m t h e C h i e f Information Officer, G–6 (SAIS–ZA), 107 A r m y P e n t a g o n , W a s h i n g t o n D C 20310–0107.

Suggested improvements. Users are invited to send comments and suggested improvements on DA Form 2028 (Recom-m e n d e d C h a n g e s t o P u b l i c a t i o n s a n d B l a n k F o r m s ) d i r e c t l y t o H Q D A , C I O / G – 6 , 1 0 7 A r m y P e n t a g o n , W a s h i n g t o n

DC 20310–0107.

Distribution. Distribution of this publi-c a t i o n i s a v a i l a b l e i n e l e c t r o n i c m e d i a only and is intended for command levels B, C, D, and E for the Active Army, the A r m y N a t i o n a l G u a r d / A r m y N a t i o n a l Guard of the United States, and the U.S.

Army Reserve.

Contents (Listed by paragraph and page number)

Chapter 1 Introduction, page 1 Purpose • 1–1, page 1 References • 1–2, page 1 Explanation of abbreviations and terms • 1–3, page 1 Army Information Assurance Program • 1–4, page 1

*This publication supersedes AR 25–2, dated 3 August 2007. This edition publishes a rapid action revision of AR 25–2.

AR 25–2 • 24 October 2007/RAR 23 March 2009 i

UNCLASSIFIED

Contents—Continued

Overview • 1–5, page 1

Chapter 2 Responsibilities, page 3 Chief Information Officer/G–6 • 2–1, page 3 Principal Headquarters, Department of the Army officials and staff • 2–2, page 4 Administrative Assistant to the Secretary of the Army • 2–3, page 4 Assistant Secretary of the Army for Acquisition, Logistics, and Technology • 2–4, page 4 The Deputy Chief of Staff, G–2 • 2–5, page 5 The Deputy Chief of Staff, G–3/5/7 • 2–6, page 5 The Deputy Chief of Staff, G–4 • 2–7, page 5 Commanders of Army Commands; Army Service Component Commands; Direct Reporting Units; U.S. Army

Reserve; Army National Guard; program executive officers; direct reporting program managers; Regional Chief Information Officers; Functional Chief Information Officers; and the Administrative Assistant to the Secretary of the Army • 2–8, page 6

Commander, 1st Information Operations Command • 2–9, page 6 Commanding General, Network Enterprise Technology Command/9th Signal Command (Army) • 2–10, page 7 Commanding General, U.S. Army Training and Doctrine Command • 2–11, page 7 Commanding General, U.S. Army Materiel Command • 2–12, page 7 Commanding General, U.S. Army Intelligence and Security Command • 2–13, page 8 Commanding General, U.S. Army Criminal Investigation Command • 2–14, page 8 Chief, Army National Guard • 2–15, page 8 Chief, Army Reserve • 2–16, page 8 U.S. Army Reserve Command Chief of Staff • 2–17, page 8 U.S. Army Corps of Engineers Chief of Engineers • 2–18, page 9 U.S. Army Corps of Engineers Chief Information Officer • 2–19, page 9 Commanding General, Eighth Army • 2–20, page 9 Commanding General, U.S. Army Europe • 2–21, page 9 Commanding General, U.S. Army Medical Command • 2–22, page 9 Program executive officers and direct reporting program/project managers • 2–23, page 9 Commanders, directors, and managers • 2–24, page 10 Garrison commanders • 2–25, page 10 U.S. Army Reserve major subordinate command • 2–26, page 11 Army National Guard state DOIM/J6/CIO • 2–27, page 11 Regional Chief Information Officer • 2–28, page 11 Army Reserve command/unit/activity G–6 • 2–29, page 11 Director of Information Management • 2–30, page 11

Chapter 3 Army Information Assurance Program Personnel Structure, page 12 Personnel structure overview • 3–1, page 12 Information assurance personnel structure • 3–2, page 12 Information assurance support personnel • 3–3, page 15

Chapter 4 Information Assurance Policy, page 18

Section I General Policy, page 18 Policy overview • 4–1, page 18 Funding • 4–2, page 19 Information assurance training • 4–3, page 20 Mission assurance category, levels of confidentiality, and levels of robustness • 4–4, page 21 Minimum information assurance requirements • 4–5, page 22 ii AR 25–2 • 24 October 2007

Section II Software Security, page 29 Controls • 4–6, page 29 Database management • 4–7, page 29 Design and test • 4–8, page 30

Section III Hardware, Firmware, and Physical Security, page 30 Hardware–based security controls • 4–9, page 30 Maintenance personnel • 4–10, page 30 Security objectives and safeguards • 4–11, page 31

Section IV Procedural Security, page 31 Password control • 4–12, page 31 Release of information regarding information system infrastructure architecture • 4–13, page 32

Section V Personnel Security, page 32 Personnel security standards • 4–14, page 32 Foreign access to information systems • 4–15, page 35

Section VI Information Systems Media, page 37 Protection requirements • 4–16, page 37 Labeling, marking, and controlling media • 4–17, page 37 Clearing, purging (sanitizing), destroying, or disposing of media • 4–18, page 38

Section VII Network Security, page 38 Cross-domain security interoperability • 4–19, page 38 Network security • 4–20, page 38

Section VIII Incident and Intrusion Reporting, page 43 Information system incident and intrusion reporting • 4–21, page 43 Reporting responsibilities • 4–22, page 43 Compromised information systems guidance • 4–23, page 43

Section IX Information Assurance Vulnerability Management, page 44 Information assurance vulnerability management reporting process • 4–24, page 44 Compliance reporting • 4–25, page 44 Compliance verification • 4–26, page 45 Operating noncompliant information system • 4–27, page 45

Section X Miscellaneous Provisions, page 45 Vulnerability and asset assessment programs • 4–28, page 45 Portable electronic devices • 4–29, page 46 Wireless local area networks • 4–30, page 47 Employee–owned information systems • 4–31, page 47 Miscellaneous processing equipment • 4–32, page 47 iiiAR 25–2 • 24 October 2007

Chapter 5 Certification and Accreditation, page 48 Certification and accreditation overview • 5–1, page 48 Certification • 5–2, page 48 Tailoring • 5–3, page 49 Accreditation • 5–4, page 49 Recertification and re–accreditation • 5–5, page 49 Accreditation documentation • 5–6, page 50 Connection approval process • 5–7, page 50 Designated approving authority • 5–8, page 50 Lead agent of the certification authority • 5–9, page 51 System owner • 5–10, page 52

Chapter 6 Communications Security, page 52 Communications security overview • 6–1, page 52 Protected distribution systems • 6–2, page 53 Approval of protected distribution systems • 6–3, page 53 Radio systems • 6–4, page 54 Telecommunication devices • 6–5, page 54

Chapter 7 Risk Management, page 54 Risk management process • 7–1, page 54 Information operations condition • 7–2, page 55

Appendixes

A. References, page 56

B. Sample Acceptable Use Policy, page 61

C. Management Control Evaluation Checklist, page 67

Table List

Table 4–1: MDEP MS4X, Information Assurance Phased Funding Utilization Plan/Actual Execution Report (RCS:

CSIM–62)

For period ending 092009 (MMYYYY), page 19

Table 4–2: Investigative levels for users with privileged access (IT–I) to ISs, page 34 Table 4–3: Investigative levels for users with limited privileged access (IT–II) to ISs, page 34

Figure List

Figure B–1: Acceptable use policy, page 62 Figure B–1: Acceptable use policy—Continued, page 63 Figure B–1: Acceptable use policy—Continued, page 64 Figure B–2: Information system user agreements, page 66 Figure B–2: Information system user agreements –Continued, page 67

Glossary iv AR 25–2 • 24 October 2007

Chapter 1 Introduction

1–1. Purpose This regulation establishes information assurance (IA) policy, roles, and responsibilities. It assigns responsibilities for all Headquarters, Department of the Army (HQDA) staff, commanders, directors, IA personnel, users, and developers for achieving acceptable levels of IA in the engineering, implementation, operation, and maintenance (EIO&M) for all information systems (ISs) across the U.S. Army Enterprise Infostructure (AEI).

1–2. References Required and related publications and prescribed and referenced forms are listed in appendix A.

1–3. Explanation of abbreviations and terms Abbreviations and special terms used in this regulation are explained in the glossary.

1–4. Army Information Assurance Program

a. The Army Information Assurance Program (AIAP) is a unified approach to protect unclassified, sensitive, or classified information stored, processed, accessed, or transmitted by ISs, and is established to consolidate and focus Army efforts in securing that information, including its associated systems and resources, to increase the level of trust of this information and the originating source. The AIAP will secure ISs through IA requirements, and does not extend access privileges to special access programs (SAPs), classified, or compartmentalized data; neither does it circumvent need-to-know requirements of the data or information transmitted.

b. The AIAP is designed to achieve the most effective and economical policy possible for all ISs using the risk management approach for implementing security safeguards. To attain an acceptable level of risk, a combination of staff and field actions is necessary to develop local policy and guidance, identify threats, problems and requirements, and adequately plan for the required resources.

c. Information systems exhibit inherent security vulnerabilities. Cost-effective, timely, and proactive IA measures and corrective actions will be established and implemented to mitigate risks before exploitation and to protect against vulnerabilities and threats once they have been identified.

(1) Measures taken to attain IA objectives will be commensurate with the importance of the operations to mission accomplishment, the sensitivity or criticality of the information being processed, and the relative risks (the combination of threats, vulnerabilities, countermeasures, and mission impact) to the system. Implementation of an IA operational baseline will be an incremental process of protecting critical assets or data first, and then building upon those levels of protection and trust across the enclave.

(2) Statements of security requirements will be included in the earliest phases (for example, mission needs state-ments, operational requirements document, capstone requirement document) of the system acquisition, contracting, and development life cycles.

d. An operationally focused IA program requires the implementation of innovative approaches. Through the use of IA best business practices (BBPs) the best ideas, concepts, and methodologies acquired from industry and Army resources will be used to define specific standards, measures, practices, or procedures necessary to meet rapidly changing technology or IA requirements in support of Army policy requirements. IA BBPs allow rapid transitional implementation of IA initiatives to integrate, use, improve, or modify technological or procedural changes as required by policy. BBPs are located at https://informationassurance.us.army.mil.

e. The elements of the Defense in Depth (DiD) strategy focus on three areas: people, operations, and defense of the environment (the latter of which encompasses the computing environment, the networks, the enclave boundaries, and the supporting infrastructure).

f. The AIAP is not a stand-alone program, but incorporates related functions from other standards or policies such as; operations security (OPSEC), communications security (COMSEC), transmission security (TRANSEC), information security (INFOSEC), personnel security, and physical security to achieve IA requirements.

g. Failure to implement proactive or corrective IA security measures, guidance, policy, or procedures may prevent system or enclave accreditation, installation, or operation and may increase system vulnerability to foreign and domestic computer network operation (CNO) activities designed to deny service, compromise information, or permit unauthorized access to sensitive information. IA or network personnel may block access to ISs that reflect poor IA security practices or fail to implement corrective measures.

1–5. Overview

a. The AIAP applies to ISs including, but not limited to, computers, processors, devices, or environments (operating in a prototype, test bed, stand-alone, integrated, embedded, or networked configuration) that store, process, access, or transmit data, including unclassified, sensitive (formerly known as sensitive but unclassified (SBU)), and classified data, with or without handling codes and caveats. ISs used for teleworking, telecommuting, or similar initiatives;

contractor owned or operated ISs; ISs obtained with non-appropriated funds; automated tactical systems (ATSs);

1AR 25–2 • 24 October 2007 automated weapons systems (AWSs); distributed computing environments (DCEs); and systems processing intelligence information are required to adhere to the provisions of this regulation.

b. Commanders of activities requiring limited access by any local foreign national (FN) officials or personnel (including information technology (IT) positions) will follow the provisions of this regulation.

c. This regulation applies equally to the operation, safeguarding, and integrity of the infrastructures (for example, power, water, air conditioning), including the environment in which the IS operates.

d. While no regulation or policy on security measures can ever provide a 100 percent solution, implementation of the concepts, procedures, and recommendations in this regulation will drastically reduce the manageability require-ments of assets, and minimize the effects of unauthorized access or loss. The cornerstone philosophy of IA is to design, implement, and secure access, data, ISs, and data repositories; increase trust and trusted relationships; employ technical and operational security mechanisms; deny all unauthorized accesses; and permit necessary exceptions to support Army, DOD, and Joint interagency and multinational (JIM) tactical and sustaining-base operations.

e. Army information constitutes an asset vital to the effective performance of our national security roles. While all communication systems are vulnerable to some degree, the ready availability of low-cost IT, freely distributed attack tools, increased system connectivity and asset distribution, and attack-standoff capabilities make computer network attacks (CNAs) an attractive option to our adversaries. Information Assurance capabilities and actions protect and defend network availability, protect data integrity, and provide the ability to implement effective computer network defense (CND). Management of Army information is imperative so that its confidentiality, integrity, availability, and non-repudiation can be ensured, and that users of that data can be properly identified and authenticated.

f. The AEI architecture requires the establishment, verification, and maintenance of trusted enclaves, trusted connec-tivity, and trusted information and information sources along with the capability to access and distribute that informa-tion by leveraging technology and capabilities to amplify that trust.

g. To accomplish these foundational objectives, this regulation establishes requirements as follows:

(1) Provides administrative and systems security requirements, including those for interconnected systems.

(2) Defines and mandates the use of risk assessments.

(3) Defines and mandates the DiD strategy.

(4) Promotes the use of efficient procedures and cost-effective, computer-based security features and assurances.

(5) Describes the roles and responsibilities of the individuals who constitute the IA security community and its system users, and outlines training and certification requirements.

(6) Requires a life cycle management approach to implementing IA requirements.

(7) Introduces the concepts of mission assurance category, levels of confidentiality, and levels of robustness of information.

(8) Implements DODD 8500.1, DODI 8500.2, and Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01 to align IA goals and requirements to support the DOD Information Management Strategic Plan.

(9) Mandates procedures to document the status of accreditations for all ISs fielded by DOD organizations, Army chartered program managers (PMs), and HQDA staff proponents.

(10) Mandates that DOD and Army-level designated approving authorities (DAAs) meet the system accreditation requirements of this regulation before fielding or testing any system that requires connection to an Army network.

(11) Requires the implementation of a configuration management (CM) process.

(12) Describes the Continuity of Operations Plan (COOP).

(13) Provides the foundation for the Networthiness Certification Program in AR 25–1.

h. Other policies, procedures, or directives also govern certain systems. In the event of conflicts among these policies, procedures, or directives, the more stringent requirement will take precedence. When the most stringent policy cannot be determined, the affected Army component will submit a request for a policy decision through their supporting regional chief information officers/functional chief information officers (RCIOs/FCIOs) to the Chief Infor-mation Officer/G–6 (CIO/G–6).

i. The mention of commercial products in this regulation does not imply endorsement by either DOD or the Army.

j. Military and civilian personnel may be subject to administrative and/or judicial sanctions if they knowingly, willfully, or negligently compromise, damage, or place Army information systems at risk by not ensuring implementa-tion of DOD and Army policies and procedures. Violations are identified in bolded text included in the following paragraphs 3–3, 4–5, 4–6, 4–12, 4–13, 4–16, 4–20, and 6–5.

k. These provisions may be punished as violations as follows:

(1) Sanctions for civilian personnel may include, but are not limited to, some or all of the following administrative actions: oral or written warning or reprimand; adverse performance evaluation; suspension with or without pay; loss or suspension of access to IS or networks, and classified material and programs; any other administrative sanctions authorized by contract or agreement; and/or dismissal from employment. Sanctions for civilians may also include prosecution in U.S. District Court or other courts and any sentences awarded pursuant to such prosecution. Sanctions may be awarded only by civilian managers or military officials who have authority to impose the specific sanction(s) proposed.

2 AR 25–2 • 24 October 2007

(2) Sanctions for military personnel may include, but are not limited to, some of the following administrative actions: oral or written warning or reprimand; adverse performance evaluation; and loss or suspension of access to IS or networks and classified material and programs. Sanctions for military personnel may also include any administrative measures authorized by service directives and any administrative measures or non-judicial or judicial punishments authorized by the Uniform Code of Military Justice (UCMJ).

(3) Defense contractors are responsible for ensuring employees perform under the terms of the contract and applicable directives, laws, and regulations and must maintain employee discipline. The contracting officer, or designee, is the liaison with the defense contractor for directing or controlling contractor performance. Outside the assertion of criminal jurisdiction for misconduct, the contractor is responsible for disciplining contractor personnel.

Only the Department of Justice may prosecute misconduct under applicable Federal laws, absent a formal declaration of war by Congress (which would subject civilians accompanying the force to UCMJ jurisdiction). For additional information on contractor personnel authorized to accompany U.S. Armed Forces, see DODI 3020.41.

Chapter 2 Responsibilities

2–1. Chief Information Officer/G–6 The CIO/G–6 will—

a. Establish and issue IA policy and procedures and serve as the focal point for IA programs and funding.

b. Develop, review, and coordinate DA input into DOD IA policy documents.

c. Establish and maintain Army standardized evaluations and test methodology certification procedures and security requirements as part of the accreditation process.

d. Document, develop, coordinate, present, prioritize, and defend IA resource requirements in the planning, pro-gramming, and budgeting process.

e. Coordinate with the Deputy Chief of Staff, G–2 (DCS, G–2) for the policy, development, dissemination, support, tactics, techniques, and procedures for the design, implementation, and operation of the key management infrastructure (KMI) and systems to support Army encryption requirements.

f. Provide program oversight for Army implementation of the KMI and funding aspects of the Electronic Key Management System (EKMS).

g. Prepare the annual IA readiness report.

h. Provide technical and operational assistance and support to the U.S. Army Audit Agency (USAAA) in its audits and reviews of ISs.

i. Evaluate technological trends in IA and establish a methodology to integrate advancements.

j. Provide IA guidance to Army elements in identifying and incorporating requirements consistent with the KMI requirements in project development.

k. Act as the certification and accreditation (C&A) designated approving authority (DAA) for ISs with the excep-tions found in paragraph 5–8m.

l. Provide a point of contact (POC) with the Defense Information Systems Agency/Center for Information Systems

Security (DISA/CISS) for advice and assistance and implementation of certification tests and programs for Army operated ISs.

m. Serve as the Army member of the Committee on National Security Systems (CNSS) and the Subcommittees for Telecommunications Security (STS) and Information Systems Security (SISS).

n. Provide an Army voting member to the Key Management Executive Committee (KMEC) and Joint Key Management Infrastructure Working Group (JKMIWG).

o. Provide policy, guidance, and oversight on the employment of National Institute of Standards and Technology (NIST) approved cryptography for the protection of unclassified and sensitive information.

p. Appoint the chairperson and alternate chairperson for the Tier 1 System Management Board (TSMB), which has operations management responsibilities for the Tri-Service EKMS Common Tier 1 System (CT1S).

q. Participate with the DCS, G–2; U.S. Army Intelligence and Security Command (INSCOM); Network Enterprise Technology Command/9th Signal Command (Army) (NETCOM/9th SC (A); 1st Information Operations (LAND) Command (1st IO CMD (LAND)); and the U.S. Army Criminal Investigation Command (CID) in analyses and studies concerning foreign intelligence threats, criminal intelligence, or operational vulnerabilities against which IA counter-measures will be directed.

r. Appoint, formally, by name and organization the DAA for ISs that process Army data, upon request, through formal signed memo or digitally signed e-mail. This appointment will be consistent with paragraph 5–8g through k.

s. Ensure the concepts of, and strategies within, this regulation are utilized as the basis for networthiness certifica-tion per AR 25–1.

3AR 25–2 • 24 October 2007

t. Provide technical and operational assistance and support to the Army Web Risk Assessment Cell (AWRAC).

u. Provide program oversight of Communications Security Logistics Activity (CSLA) for an Army cryptographic applications certification process (when developed).

v. Appoint the Director, Office of Information Assurance and Compliance (OIA&C), NETCOM/9th SC (A), as the

Army senior information security officer under the provisions of the Federal Information Systems Management Act

(FISMA).

w. Coordinate with the DCS, G–2 on C&A issues of sensitive compartmented information (SCI) systems and INSCOM/G–6 for SIGINT systems, as applicable.

x. See additional responsibilities at paragraph 2–2, below.

2–2. Principal Headquarters, Department of the Army officials and staff Principal HQDA officials and staff will—

a. Implement IA requirements within their respective functional areas.

b. Develop, coordinate, supervise, execute, and allocate the research, development, test, and evaluation (RDT&E) procurement resources in support of IA program requirements as required in their functional area.

c. Participate collectively with other IA stakeholders in the enterprise planning, acquisition, and operation of IA strategies.

d. Integrate approved IA tools, doctrine, procedures, and techniques into all ISs under their purview.

e. Establish internal procedures for reporting security incidents or violations and report incidents and events to the servicing regional computer emergency response teams (RCERTs) in accordance with Section VIII, Incident and Intrusion Reporting, consistent with paragraphs 4–21 and 4–22, below.

f. Support the Army’s Information Assurance Vulnerability Management (IAVM) Program notification and correc-tion processes. IAVM notification and correction are DOD and Army operational requirements.

g. Develop and implement local acceptable use policy (AUP) for all users authorized access to HQDA ISs (app B presents a sample AUP).

h. Ensure all systems, for which the principal HQDA Army office is the system owner (SO) are accredited, annually revalidated, and re–accredited in accordance with the interim DOD Information Assurance Certification and Accredita-tion Process (DIACAP).

i. Ensure the C&A package is submitted to the Army certification authority (CA) in sufficient time for a review and operational IA risk recommendation in support of DAA authorization decision prior to operations or tests on a live network or with live Army data.

j. Request appointment as the DAA for information systems, as appropriate, from the CIO/G–6 through the OIA&C consistent with paragraph 5–8.

k. Appoint appropriate IA personnel per chapter 3 of this regulation and provide CIO/G–6 a copy of the appointment orders.

l. Identify personnel and procedures at all organizational and subordinate levels, as required, to implement a Configuration Management Board (CMB) or Configuration Control Board (CCB) to effect control and management mechanisms on all ISs, devices, configurations, and IA implementations. Include IA personnel as members of the board.

m. Incorporate related OPSEC, COMSEC, and INFOSEC policies and requirements into a comprehensive IA management program.

2–3. Administrative Assistant to the Secretary of the Army The AASA will—

a. Serve as the commander for Pentagon Information Technology Services (ITS).

b. Request appointment, from the CIO/G–6 through the OIA&C, as the DAA for the Pentagon ITS and IS connected to the Pentagon Common Information Technology (CIT) Enterprise, associated swing space, and alternate COOP sites through the national capital region (NCR).

c. Appoint, once authorized, General Officer (GO), Senior Executive Service (SES) or equivalent within AASA purview as DAAs, when they are the SOs or have life cycle responsibility for the IS, as appropriate. Provide a copy of the appointments to the OIA&C through iacora@us.army.mil.

d. Coordinate connectivity requirements to the Department of Defense Intelligence Information System (DODIIS) IT SCI enterprise backbone within the Pentagon CIT enterprise.

e. See additional responsibilities at paragraph 2–2 and paragraph 2–8.

2–4. Assistant Secretary of the Army for Acquisition, Logistics, and Technology The ASA (ALT) will—

a. Forward to National Security Agency (NSA) and HQDA approved materiel requirements for IA tools and equipment (including cryptographic equipment), along with requests for RDT&E efforts to fulfill those needs.

4 AR 25–2 • 24 October 2007

b. Designate an Army materiel developer to conduct and update threat analyses as outlined by AR 381–11.

c. Monitor NSA, other Service COMSEC, and IA RDT&E projects that are of interest to the Army. Designate Army program managers as defined in AR 70–1 for each project having potential application for Army use. Require the designated manages to maintain a liaison between the developing agency and interested Army agencies of the progress of such projects.

d. Establish coordination with NSA concurrent life cycle management milestones for development of cryptographic equipment in support of IA initiatives.

e. Conduct research and acquire basic knowledge of the techniques and the circuitry required to provide an effective CND capability in appropriate types of Army equipment.

f. Ensure application of capabilities to perform IS risk analysis, reduction, and management.

g. Ensure that Army program executive officers (PEOs) and direct reporting PMs include IA in all systems development activities.

h. Ensure Army PEOs and direct-reporting PMs obtain C&A approval to operate prior to system operations on the

Army network or with Army data.

i. See additional responsibilities at paragraph 2–2.

2–5. The Deputy Chief of Staff, G–2 The DCS, G–2 will—

a. Coordinate the development and dissemination of DOD, national, theater, and DA-level IA threat information to the Army.

b. Coordinate with the CIO/G–6 for the policy, development, dissemination, support, tactics, techniques, and procedures for the design, implementation, and operation of the KMI and systems to support Army encryption requirements.

c. Develop policy and approve procedures for safeguarding and controlling COMSEC and controlled cryptographic item (CCI) material.

d. Ensure all intelligence systems, for which the DCS, G–2 is the Army proponent or sponsor, are accredited or re-accredited in accordance with Director, Central Intelligence Agency Directive (DCID) 6/3.

e. Ensure that the DODIIS Program is implemented and guidance is published.

f. Serve as the approval authority for external IS penetration and exploitation testing of operational networks.

g. Participate with the CIO/G–6, INSCOM, NETCOM/9th SC (A), 1stIO CMD (LAND), and CID in analyses and studies concerning foreign intelligence threats, criminal intelligence, or operational vulnerabilities against which IA countermeasures will be directed.

h. Act as the Service Certifying Organization and DAA for DODIIS processing SCI on the Joint World Wide Intelligence System (JWWICS).

i. Act as the CA for SCI systems processing information at Protection Level (PL) 4.

j. Act as the DAA for SCI systems processing information up to PL 3.

k. See additional responsibilities at paragraph 2–2.

2–6. The Deputy Chief of Staff, G–3/5/7 The DCS, G–3/5/7 will—

a. Support the CIO/G–6 in the accomplishment of IA responsibilities.

b. Ensure IA training is integrated and conducted throughout the Army.

c. Support audits and reviews of ISs and networks through operational and technical assistance, as required.

d. Provide guidance, requirements, and oversight for information operations condition (INFOCON) alerting and implementation measures.

e. Provide guidance, requirements, and oversight for OPSEC measures to support an IA management policy.

f. See additional responsibilities at paragraph 2–2.

2–7. The Deputy Chief of Staff, G–4 The DCS, G–4 will—

a. Develop, as the Army independent logistician, logistics policies (including integrated logistics support policy), concepts, procedures, and guidance for logistics support of IA equipment used in support of all Army missions.

b. Prescribe execution of NSA or DOD logistics management directives that apply to classified COMSEC and CCI materiel.

c. Prescribe and supervise the implementation of procedures for property control and the accounting of CCI materiel during distribution, storage, maintenance, use, and disposal. All guidance will conform to the security standards developed by the DCS, G–2 for safeguarding COMSEC and CCI materiel.

d. Supervise logistics support planning to ensure the availability of materials and publications needed for repair, test measurement, and diagnosis of IA equipment and systems.

5AR 25–2 • 24 October 2007

e. Provide continuous logistical support for fielded IA material and test equipment.

f. See additional responsibilities at paragraph 2–2.

2–8. Commanders of Army Commands; Army Service Component Commands; Direct Reporting Units; U.S. Army Reserve; Army National Guard; program executive officers; direct reporting program managers; Regional Chief Information Officers; Functional Chief Information Officers; and the Administrative Assistant to the Secretary of the Army Commanders of ACOMs; ASCCs; DRUs; U.S. Army Reserve; ARNG; Chief, CAR ; PEOs; direct reporting PMs;

RCIOs/FCIOs; and the AASA are responsible for ensuring that their units, activities, or installations will—

a. Develop and implement an IA program with the hardware, software, tools, personnel, and infrastructure necessary to fill the IA positions and execute the duties and responsibilities outlined in this regulation.

b. Oversee the maintenance, documentation, and updating of the C&A requirements required for the operation of all ISs as directed in this regulation.

c. Implement and manage IT system configurations, including performing IAVM processes as directed by this regulation.

d. Appoint IA and other personnel (for example, alternates) to perform the duties in chapter 3 of this regulation and provide information assurance program manager (IAPM) and/or POC information to the RCIOs, supporting RCERTs/ Theater Network Operations and Security Centers (TNOSCs), and the Army Computer Emergency Response Team (ACERT). The ACOMs/ASCCs IAPMs will also provide reports to the RCIO of the region in which the headquarters is physically located.

e. Appoint DAAs only as authorized in section II and paragraph 5–8.

f. Establish an oversight mechanism to validate the consistent implementation of IA security policy across their areas of responsibility.

g. Ensure annual security education, training, and awareness programs are developed and conducted that addresses, at a minimum, physical security, acceptable use policies, malicious content and logic, and non-standard threats such as social engineering.

h. Oversee the implementation of IA capabilities.

i. Incorporate IA and security as an element of the system life cycle process.

j. Develop and implement an acceptable use policy for privately owned equipment (for example, cell phones, personal digital assistants (PDAs), wireless devices, and removable media) and ISs prohibited during training exercises, deployments, and tactical operations. Incorporate, as a minimum, the prohibition of utilizing such devices or the limitations of acceptable use, as well as the threat of operational exposure represented by these devices in garrison, pre-deployment staging, tactical, and operational areas.

k. Develop procedures for immediate notification and recall of IA personnel as assigned.

l. Adhere to and implement the procedures of the networthiness certification process per AR 25–1.

m. Program, execute, and report management decision packages (MDEPs) MS4X and MX5T resource requirements.

n. See additional responsibilities at paragraph 2–2.

2–9. Commander, 1st Information Operations Command The Commander, 1st IO CMD (LAND) will—

a. Exercise command and control of the ACERT and all of its components (including RCERTs).

b. Establish tactics, techniques, and procedures (TTPs) for the ACERT, RCERTs, and Local Computer Emergency

Response Teams (LCERTs) (if established) as required.

c. Integrate, in conjunction with NETCOM/9th SC (A), computer emergency response, IA, and CND service provider activities into network operations (NETOPS), network management, and information dissemination.

d. Integrate, in coordination with the DCS, G–3/5/7, CND, OPSEC, and INFOCON activities into information operations (IO).

e. Support the Army CND service provider as the focal point for security incidents and violations.

f. Develop and publish incident response guidelines, checklists, and procedures in coordination with law enforce-ment (LE) and counterintelligence (CI) agencies.

g. Provide status reports per directives on unusual activities occurring on Army networks worldwide.

h. Support the IA security tool repository and provide recommendations for including new tools.

i. Provide tools, methodologies, procedures, and oversight for the vulnerability assessment program and perform vulnerability assessments through approved programs.

j. Develop and maintain an Army CND vulnerability database for trend analysis.

k. Support and maintain Army IAVM message staffing, notification, distribution, and resolution.

l. Develop TTPs for a threat warning and notification process.

m. Develop procedures to issue CND lessons learned identified from incidents, intrusions, analyses, or other technical processes.

6 AR 25–2 • 24 October 2007

n. Maintain Army computer network situational intelligence awareness, including network threat analysis and Internet network intelligence.

o. Participate with the CIO/G–6, DCS, G–2, INSCOM, NETCOM/9th SC (A), and CID in analyses and studies concerning foreign intelligence threats, criminal intelligence, or operational vulnerabilities against which IA counter-measures will be directed.

p. See additional responsibilities at paragraph 2–2 and paragraph 2–8.

2–10. Commanding General, Network Enterprise Technology Command/9th Signal Command (Army) The CG, NETCOM/9th SC (A) will—

a. Request appointment from the CIO/G–6 as the DAA for the Army enterprise.

b. Appoint, once authorized, the Director, Enterprise Systems Technology Activity (ESTA) as the DAA for the

Army enterprise.

c. Operate, manage, monitor, administer, and defend the Army portion of the global information grid.

d. Perform configuration and patch management for all Army network components and systems.

e. Execute Computer Network Defense Service Provider (CNDSP) and NETOPS missions and functions.

f. Review, coordinate, evaluate, and approve proposed policies, procedures, directives, standards, doctrinal publica-tions, plans, materiel requirement documents, life cycle management documents, basis-of-issue plans, and system certification and accreditation documents for all systems fielded, or planned to be fielded, to Army installations as well as similar documents that have implications for adherence to policy.

g. Establish TTPs to integrate IA/CND service provider activities with system and network management and information dissemination.

h. Provide timely flows of NETOPS data to maintain an analysis view at all levels.

i. Ensure an operational assessment of IA products is conducted before incorporation into systems under NETCOM/

9th SC (A) management.

j. Maintain a repository of the status and availability of Army critical systems and networks.

k . M a n a g e t h e D i D s e c u r i t y a r c h i t e c t u r e e n v i r o n m e n t , s t r a t e g i e s , c o n n e c t i o n s , a n d c o n f i g u r a t i o n s a g a i n s t u n -authorized access, manipulation, or destruction.

l. Manage the AEI Technical CCB responsible for the Army security architecture. Establish baseline configuration management guidelines and technical and operational TTPs; and review, approve, prioritize, and manage change to the

AEI.

m. Conduct quarterly vulnerability assessments of top level architecture (TLA) critical assets, devices, servers, and IA implemented devices.

n. Participate with the CIO/G–6, DCS, G–2, INSCOM, 1st IO CMD (LAND), and CID in analyses and studies concerning foreign intelligence threats, criminal intelligence, or operational vulnerabilities against which IA counter-measures will be directed.

o. See additional responsibilities at paragraph 2–2 and paragraph 2–8.

2–11. Commanding General, U.S. Army Training and Doctrine Command The CG, TRADOC will—

a. Integrate approved IA tools, doctrine, procedures, legalities, and techniques into applicable programs of instruc-tion for TRADOC schools.

b. Develop timely Armywide IA training literature and training aids, leveraging secure electronic distribution and remote access capabilities.

c. Develop, test, and recommend operational and organizational concepts and doctrine to achieve IA goals.

d. Develop and provide IA requirements to the materiel developers and ensure compliance with AR 381–11 and this regulation.

e. Conduct or participate in operational tests of IA implementations as part of system-wide operational tests, as directed.

f. Integrate IA practices into pre-milestone A activities and events as required.

g. See additional responsibilities at paragraph 2–2 and paragraph 2–8.

2–12. Commanding General, U.S. Army Materiel Command The Commanding General, U.S. Army Materiel Command will—

a. Provide Armywide materiel developer IA support for RDT&E and production.

b. Assist IS functional proponents in identifying security requirements for proposed and existing sustaining base, tactical, and weapons systems.

c. Maintain a repository of tactical IA tools, and distribute tools to fielded tactical systems, as needed. Coordinate with 1st IO CMD to integrate tactical and sustaining-base toolboxes into a seamless repository for Army users.

7AR 25–2 • 24 October 2007

d. Provide a DA authorized (that is, CSLA) cryptographic advisor to the certification authority (CA) throughout the DIACAP process.

e. See additional responsibilities at paragraph 2–2 and paragraph 2–8.

2–13. Commanding General, U.S. Army Intelligence and Security Command The Commanding General, INSCOM will—

a. Serve as the Army Service Cryptologic Element (SCE) and point of contact for ISs under the purview of the

NSA.

b. Provide CI support to Army elements on IA matters and advise accreditation authorities on the foreign intelli-gence threat.

c. Coordinate the C&A for all cryptographic systems and conduct C&A for all Army cryptographic systems at PL 2 (DCID 6/3) and below.

d. Participate with the CIO/G–6, DCS, G–2, 1st IO CMD (LAND), NETCOM/9th SC (A), and CID in analyses and studies concerning foreign intelligence threats, criminal intelligence, or operational vulnerabilities against which IA countermeasures will be directed.

e. See additional responsibilities at paragraph 2–2 and paragraph 2–8.

2–14. Commanding General, U.S. Army Criminal Investigation Command The Commanding General, CID will—

a. Operate the Computer Crime Investigative Unit (CCIU).

b. Conduct criminal investigations involving intrusions into Army networks and computers.

c. Provide criminal and technical intelligence analyses of vulnerabilities, methodology, tools, techniques, or practices obtained from computer crimes or forensic intrusion analyses to support CND, C&A, and program developers or managers.

d. Participate in IAVA Compliance Verification Team (CVT) inspections.

e. Conduct crime prevention surveys to identify crime-conducive conditions involving Army networks and systems.

f. Serve as chief enforcer of Federal laws governing the investigation of criminal offenses involving networks and systems, serve as the sole entity for LE investigation determinations, and serve as the sole Army interface with Federal and civilian LE agencies.

g. Participate with the CIO/G–6, DCS, G–2, INSCOM, NETCOM/9th SC (A), and 1st IO CMD (LAND) in analyses and studies concerning foreign intelligence threats, criminal intelligence, or operational vulnerabilities against which IA countermeasures will be directed.

h. See additional responsibilities at paragraph 2–2 and paragraph 2–8.

2–15. Chief, Army National Guard The Chief, ARNG will—

a. Request appointment as the DAA for the ARNG and GuardNet XXI from the CIO/G–6.

b. Appoint, once authorized, the ARNG state Director of Information Management (DOIM)/J6/CIO for individual states in accordance with paragraph 5–8. General officers within the ARNG are state employees not Title 10 or Title 32 Soldiers, therefore, the state DOIM/J6/CIO will be appointed as DAAs. Provide a copy of these appointments to the CIO/G–6 through the OIA&C.

c. Set the ARNG IA priorities, provide oversight, and ensure the coordination and compliance of the ARNG IA program is accomplished with the CG, NETCOM to leverage Army technical authority standards and ensure compli-ance with this regulation.

d. See additional responsibilities at paragraph 2–2 and paragraph 2–8.

2–16. Chief, Army Reserve The CAR will—

a. Request appointment as the DAA for the U.S. Army Reserve (USAR) from the CIO/G–6.

b. Appoint, once authorized, the Army Reserve Command (USARC) Chief of Staff (COS) as the Army Reserve

Network (ARNET) DAA when the COS meets the requirements of paragraph 5–8. Provide a copy of this appointment to the CIO/G–6 through the OIA&C.

c. Set the USAR IA priorities, provide oversight, and ensure the coordination and compliance of the USAR IA program with the CG, NETCOM to leverage Army technical authority standards and ensure compliance with this regulation.

d. See additional responsibilities at paragraph 2–2 and paragraph 2–8.

2–17. U.S. Army Reserve Command Chief of Staff The USARC COS will—

8 AR 25–2 • 24 October 2007

a. Request appointment as the ARNET DAA, as applicable, from the CAR.

b. Appoint, once authorized, the major subordinate command (MSC) Commander as DAA for command/unit/ activities non-ARNET system/network implementations when the MSC meets the requirements of paragraph 5–8.

Provide a copy of this appointment to the CIO/G–6 through the OIA&C.

c. Ensure all AR commands/units/activities, to include but not limited to, all off installation Government and non- Government satellites, facilities, and buildings, meet the requirements for connecting physically, logically, and/or virtually to the ARNET backbone.

d. Ensure MSC Commanders implement the AR IA program in accordance with CAR priorities and the CG, NETCOM via the applicable Army technical authority standards and ensure compliance with…