AFSSI_7703_PDS.pdf

BY ORDER OF THE AIR FORCE SYSTEMS SECURITY INSTRUCTION 7703

SECRETARY OF THE AIR FORCE 26 AUGUST 2008

Communications and Information

COMMUNICATIONS SECURITY: PROTECTED

DISTRIBUTION SYSTEMS (PDS)

COMPLIANCE WITH THIS PUBLICATION IS MANDATORY

ACCESSIBILITY: Publication is available for downloading or ordering on the e-publishing website at: https://private.afca.af.mil/ip/ .

RELEASABILITY: There are no releasability restrictions on this publication.

OPR: AFCA/EVPI Certified By: SAF/XCPPI Kenneth Brodie Pages: 54

This instruction implements the Communications Security: Protected Distributed Systems program as defined in Air Force Policy Directive (AFPD) 33-2, Information Assurance (IA), and its implementing departmental publications. It also implements portions of National Security Telecommunications and Information Systems Security Instruction (NSTISSI) No. 7003, Protected Distribution Systems (PDS). This instruction gives the implementation requirements for the construction and approval requirements for a protected distribution system (PDS) component of information assurance (IA) as outlined in Air Force Instruction (AFI) 33-202, Volume 1, Network and Computer Security (will become AFI 33-200, Information Assurance (IA) Management). This instruction applies to Air Force military, civilian and contractor personnel under contract to the Department of Defense (DOD), who develop, acquire, deliver, administer, or manage Emission Security (EMSEC) for Air Force information systems. This publication applies to the Air Force Reserve Command (AFRC) and the Air National Guard (ANG). The term major command (MAJCOM), when used in this publication, includes field operating agencies (FOA) and direct reporting units (DRU). The use of extracts from this instruction is encouraged. This Air Force Systems Security Instruction (AFSSI) is authorized by AFI 33-102, Communications and Information Specialized Publications. Direct questions or comments on the contents of this instruction, through appropriate command channels, to Headquarters Air Force Communications Agency (HQ AFCA/EVPI), 203 W. Losey Street, Room 2100, Scott AFB IL 62225-5222. Our https://private.afca.af.mil/emsec/ emission security (EMSEC) electronic mail is AFCA.CTTA.EMSEC@scott.af.mil. Refer recommended changes and conflicts between this and other publications, through appropriate command channels, using Air Force (AF) Form 847, Recommendation for Change of Publication, to HQ AFCA/EASD, 203 W. Losey Street, Room 1100, Scott AFB IL 62225-5222. Send any supplements to this publication to HQ AFCA/EVP for review, coordination, and approval prior to publication. Ensure that all records created as a result of processes prescribed in this instruction are maintained in accordance with Air Force Manual (AFMAN) 33-363, Management of Records, and disposed of in accordance with Air Force Records Information Management System (AFRIMS) Records Disposition Schedule (RDS) located at: https://afrims.amc.af.mil/rds_series.cfm. See Attachment 1 for a glossary of references and supporting information.

This instruction replaces substantial portions of AFI 33-201, Volume 8, Communications Security: Protected Distribution Systems (PDS).

TABLE OF CONTENTS

Section A – General 3

1. Introduction 3

2. Applicability 3

3. Objectives 4

Section B - Organizational Roles and Responsibilities 4

4. Secretary of the Air Force, Policy and Resources Directorate (SAF/XCP) 4

5. Headquarters Air Force Communications Agency (HQ AFCA) 4

6. Air Force Certified TEMPEST Technical Authority (AF-CTTA) 4

7. Wing Information Assurance (IA) Office 4

8. Air Force Base/Direct Reporting Unit (DRU)/Field Operating Agency (FOA) 5

9. Communications and Information Systems Officer (CSO) 5

10. Informations System Owner (ISO) 5

Section C – Policy 5

11. Protected Distribution System (PDS) Environment 5

12. Protected Distribution System (PDS) Selection Considerations 7

13. Protected Distribution System (PDS) Justification 7

14. Protected Distribution System (PDS) Plan 8

15. Protected Distribution System (PDS) Plan Validation 9

16. Protected Distribution System (PDS) Construction 10

17. Protected Distribution System (PDS) Certification 10

18. Protected Distribution System (PDS) Approval 11 mailto:AFCA.CTTA.EMSEC@scott.af.mil https://afrims.amc.af.mil/rds_series.cfm

19. Protected Distribution System (PDS) Recertification 11

20. Protected Distribution System (PDS) Deactivation 12

21. Forms Adopted and Prescribed 12

Attachment 1 – Glossary of References and Supporting Information 13

Attachment 2 – Protected Distribution Systems (PDS) Process Flow Chart 17

Attachment 3 – Controlled Access Area (CAA) Decision Tree 19

Attachment 4 – Protected Distribution Systems (PDS) Operation Requirements 20

Attachment 5 – Protected Distribution Systems (PDS) Physical Security Requirements 22

Attachment 6 – Protected Distribution Systems (PDS) Signal Line Requirements 28

Attachment 7 – Protected Distribution Systems (PDS) Construction Requirements 30

Attachment 8 – Protected Distribution Systems (PDS) Circuit Separation Requirements 35

Attachment 9 – Protected Distribution Systems (PDS) Technical Inspections 36

Attachment 10 – Protected Distribution Systems (PDS) Plan Template 38

Section A - General

1. Introduction. AFI 33-201, Volume 1, For Official Use Only (FOUO) Communications Security (COMSEC) (will become AFSSI 4201 [FOUO]), requires the use of National Security Agency (NSA)-endorsed communications security (COMSEC) products and services to secure classified telecommunications by all Air Force activities and their contractors. Information systems or networks that process classified national security information in more than one controlled access area (CAA) and require the transfer of that information between CAAs, must use a secure means of transference-secure telecommunications or courier. If secure telecommunications is chosen, include a secure telecommunications requirement (COMSEC) in the systems security policy. In order of preference, the COMSEC requirement is met by NSA-endorsed COMSEC systems (encryption), NSA-endorsed intrusion detection optical communications system (IDOCS), or a PDS. AFI 33-201, Volume 1 (FOUO) (will become AFSSI 4201[(FOUO]) also requires the use of NSA-endorsed COMSEC products, techniques, and protected services to protect certain unclassified, sensitive telecommunications involving Air Force activities and their contractors.

When certain unclassified, sensitive information must be protected, and a PDS is chosen, follow the standards in this instruction for CONFIDENTIAL information. Attachment 2 is a flow chart of the process to design, construct, approve, and operate a PDS.

2. Applicability.

2.1. This program applies to all information systems, including information system components of weapon systems that provide the management infrastructure and connections among other information systems, and networks that are used to process, store, display, transmit or protect DoD information, regardless of classification or sensitivity. This document is also binding on all users that operate, connect, or interact with information systems owned, maintained, and controlled by the DoD.

2.2. More restrictive DoD and Director of Central Intelligence Agency directive requirements governing Special Access Program information take precedence over this instruction.

2.3. This instruction is not applicable to Sensitive Compartmented Information (SCI) information systems. For SCI systems, refer to the Joint Department of Defense Intelligence Information Systems/Cryptologic SCI Information Systems Security Standards.

3. Objectives. Although it is less desirable than encryption, a PDS may be used to transmit unencrypted, clear-text, classified national security information. The PDS must provide adequate electrical, electromagnetic, physical, and procedural safeguards identified in this instruction. In establishing the standards for PDS construction and use, national managers incorporated the philosophy of risk management rather than risk avoidance. As such, the standards specified in this instruction are the minimum protection standards based on national guidance. The assumption of any additional risk to lessen the minimum specified standards is not an option. Organizations wishing to discuss this policy may send their specific concerns through command channels to HQ AFCA/EVPI. Develop the technical solution using the process described in AFI 33-100, Requirements Development and Processing, to justify a PDS. Using any PDS not meeting the standards of this instruction is prohibited.

Section B - Organizational Roles and Responsibilities

4. Secretary of the Air Force, Policy and Resources Directorate (SAF/XCP). SAF/XCP is the Air Staff focal point for harmonizing operations rigor and discipline to create an integrated, secure, net-centric environment to enable all aspects of the Air Force mission.

4.1. It develops policies and procedures for daily communication enterprise operations and maintenance.

4.2. SAF/XCPP is responsible for EMSEC policy according to AFPD 33-2. It establishes Air Force EMSEC policy and doctrine, and coordinates with the other military departments and government agencies to eliminate duplication and to exchange technical data. It appoints Air Force Certified TEMPEST Technical Authorities (CTTA) according to AFSSI 7700, Emission Security.

5. Headquarters Air Force Communications Agency (HQ AFCA). On behalf of SAF/XCP:

5.1. Reviews national TEMPEST publications and identifies those required for issuance to Air Force activities and makes recommendations on implementation to SAF/XCPP.

5.2. Posts the related EMSEC PDS publication on the AFCA EMSEC homepage, https://private.afca.af.mil/emsec/ and the EMSEC Community of Practice website.

5.3. Is assigned Air Force CTTA responsibility (see paragraph 6).

6. Air Force Certified TEMPEST Technical Authority (AF-CTTA).

6.1. Evaluates and approves commercial-off-the-shelf PDS systems.

6.2. Reviews PDS alarm systems and provides a list of approved PDS alarm systems.

7. Wing Information Assurance (IA) Office:

7.1. Provides a PDS identification number to the requesting office preparing the PDS plan.

7.2. Validates the PDS plan prior to construction.

https://private.afca.af.mil/emsec/

7.3. Inspects and certifies PDS installation.

7.4. Keeps original approved PDS plan and advises originating organization of final approval.

7.5. Recertifies a PDS as part of the system recertification and reaccreditation.

8. Air Force Base/Direct Reporting Unit (DRU)/Field Operating Agency (FOA).

8.1. The requesting organization prepares the PDS plan.

8.2. After construction, the requesting organization requests certification by Wing IA Office.

8.3. The requesting organization keeps copy of original PDS plan.

9. Communications and Information Systems Officer (CSO):

9.1. The CSO provides approval to build PDS.

9.2. After construction, the CSO provides preliminary approval of PDS.

9.3. The CSO forwards PDS approval to the Wing IA office.

10. Informations System Owner (ISO)

10.1. The ISO provides final approval of the PDS.

10.2. The ISO notifies CSO of final PDS approval.

Section C - Policy

11. Protected Distribution System Environment. Do not use a PDS within a TEMPEST High Threat environment as defined by the Director, National Security Agency TEMPEST Threat List.

The latest threat list can be found on the EMSEC SECRET Internet Protocol Router Network (SIPRNET) website.

11.1. Controlled Access Area (CAA). In this area, only personnel authorized to the level of the classified information being processed are allowed unescorted access or are under continuous physical or electronic surveillance. This area can be an office, room, group of rooms, Wing, floor, or building. When the CAA is not occupied, it must be secured in such a manner that an undetected break-in is not possible or is easily detectable. Within the CAA, there are three levels of control: TOP SECRET/Special Category (SPECAT), SECRET, and CONFIDENTIAL. Within a CAA, a PDS will not be required for classified information processed at or below the classification to which access to the CAA is controlled. When two or more CAAs of the same level of control are adjoining, they can be considered one CAA and a PDS is not needed between them.

11.2. Establishing or defining both CAA boundaries is important because a PDS is installed between CAAs, usually traversing a Limited-Control Area (LCA) or an Uncontrolled Access Area (UAA). The PDS will not terminate within a LCA or in an UAA. A signal line carrying classified information within the same level CAA is considered a RED signal line, although a PDS may extend into a CAA.

11.3. The ISO, based on input from the local security manager, the local facility manager, and the Wing IA office designates in writing, the facility/room/area that meets the definition of a CAA per this instruction.

11.4. A CAA shall comply with the following minimum physical security and hardening requirements:

11.4.1. Walls, Floor and Roof. The walls, floor, and roof construction shall be of permanent construction materials; i.e., plaster, gypsum wallboard, brick, metal panels, hardboard, wood, plywood, or other materials offering resistance to and evidence of unauthorized entry into the area. Exterior or perimeter CAA walls shall be extended from true floor to true ceiling with permanent construction materials or 18-gauge (min.) expanded steel screen. If the walls cannot be extended, then an intrusion detection system/alarm shall be installed to monitor the ceiling space. This is not required for walls within a CAA.

11.4.2. Doors. The access door to the area shall be substantially constructed of wood, metal, or glass. Note that for higher classification areas, such as open storage areas additional physical security requirements are required; (AFI 31-101, The Air Force Installation Security Program, 3 Mar 2003 and AFI 31-401, Information Security Program Management, 1 Nov 2005) may apply. As a minimum for CAAs, the door shall have a high security dead bolt lock with a 1-inch throw, with a cylinder which meets the requirements of Underwriters Laboratories Inc UL 437 standard or equivalent standard for key locks. As an alternative, a built-in GSA-approved combination lock meeting Federal Specification FF-l-2740 or equivalent standard can be used.

The hinge pins of outswing doors shall be peened, brazed, or spot-welded to prevent removal.

When double doors are used, an astragal (a protective exterior molding) will be installed on the active leaf of the door. Doors other than the access door shall be secured from the inside (for example, by a dead bolt lock, panic dead bolt lock, or rigid wood or metal bar which extends across the width of the door, or by any other means that will prevent entry from the outside).

Procedures shall be established to ensure that doors are secured at the end of the workday.

During working hours, the CAA shall be 1) occupied; 2) have access controlled through the use of a cipher lock or a swipe badge system; or, 3) have the doors locked when unoccupied.

11.4.3. Windows. All windows, which might reasonably afford visual observation of classified activities within the facility, shall be made opaque or equipped with blinds, drapes, or other coverings. Windows that are less than 18 feet above the ground measured from the bottom of the window, or that are easily accessible by means of objects directly beneath the windows will be constructed in a manner to show indications of forced entry and / or be locked at all times.

The locking mechanism or window construction shall be such as to provide indications of any attempt of unauthorized/forced entry. If the locking mechanism or window construction is inadequate to provide said indication, then permanently seal the window or install protective coverings, such as bars, over the window. The protection provided to the windows need be no stronger than the strength of the contiguous walls.

11.4.4. Openings. Utility openings such as ducts and vents shall be kept at less than man-passable (96 square inches) opening. Openings larger than 96 square inches shall be hardened per the Military Handbook, Design Guidelines for Physical Security of Facilities, 1013/1A.

11.5. Figure A3.1 of Attachment 3 is a decision tree that determines what constitutes a CAA and specifies the requirements of a CAA.

12. Protected Distribution System (PDS) Selection Considerations. The “Simple” Distribution System provides a reduced level of physical protection as compared to the hardened distribution system.

12.1. Study solutions. The requesting organization, in concert with the CSO and Systems Telecommunications Engineering Manager (STEM), must carefully consider using other COMSEC solutions before selecting a PDS. Economic, technical, or operational factors may make a PDS necessary in comparison to other COMSEC solutions.

12.2. Operation Considerations. Operating a PDS requires continual physical security integrity after construction. The cost and operational impact of maintaining the security of a PDS can easily exceed the construction costs. Consider using a PDS only after the requesting organization agrees to provide it the required degree of protection 24 hours-a-day, 7 days-a-week and the maintenance support required to include performing and documenting PDS line route or visual inspections as scheduled per specified intervals.

12.3. Classification Level Considerations. When reviewing communications needs, consider future requirements in regard to the classification level of the information being transmitted, the requisite physical controls needed, and the geographical location of the PDS site. Typically it is easier and less costly to include the capability for future requirements than to retrofit an installed system for such updates.

12.4. Physical Security Considerations. The operating agency must follow normal procedures to protect the PDS terminal equipment and interconnecting signal lines within any adjoining CAA such that only persons who are cleared for the highest classification and category of information transmitted over the system may have unrestricted access to the system. Escort all personnel who do not have the appropriate security clearance, but require occasional, temporary access to the PDS terminal equipment and interconnecting lines (e.g., safety and fire inspectors) to prevent a compromise of the information or the security integrity of the PDS. Maintain the physical security integrity of the PDS on a continual basis, regardless of whether the PDS is in continuous operation or not. The intent is to detect any signs of tampering or penetration as early as possible, and before the system is used again.

12.5. Signal wires in PDS. Do not run BLACK signal wire lines in a PDS with RED signal wire lines because of crosstalk. BLACK fiber optic signal lines may be run in a PDS with RED signal lines, but this practice is discouraged for three reasons: (1) It is difficult to identify BLACK signal lines anywhere within the PDS except at the ends. (2) Any person with a need to access the BLACK signal lines must have the appropriate clearance or be escorted. (3) All breakouts of BLACK signal lines running in a PDS must be made in a CAA. See AFSSI 7702, Emission Security Countermeasures Reviews.

13. Protected Distribution System (PDS) Justification. Justify a PDS using the technical solution process of AFI 33-103 and meet the requirements of this instruction before approving construction or use. The requesting organization, CSO, and STEM must justify using a PDS instead of an approved COMSEC system, IDOCS, or courier before submitting the technical solution for approval.

13.1. Justify the PDS by:

13.1.1. Showing that courier is not timely, practical, or feasible.

13.1.2. Using a capability or cost basis.

13.2. If the justification is based on capability, the CSO must show:

13.2.1. There is no COMSEC system or IDOCS with the capability to handle the data to be passed over the PDS.

13.2.2. A capable COMSEC system exists; however, equipment is not available to support this requirement. IDOCS provides the capability to secure communications over optical fiber lines without the use of encryption or a PDS.

13.3. If the justification is based on cost, the requesting organization must clearly indicate a PDS is less costly than using an approved COMSEC system or IDOCS. When using this justification, compare and show the total life-cycle cost of COMSEC equipment or IDOCS to the total life-cycle cost of the proposed PDS. As a minimum, the PDS plan must show the following:

13.3.1. PDS construction costs.

13.3.2. Annual operation and maintenance costs. Note that the operations and maintenance costs will be funded for and incurred by the requesting organization.

13.3.3. Annual physical security costs.

13.4. The PDS package file consists of the following documents. A separate file is required for each PDS system.

13.4.1. PDS Justification.

13.4.2. PDS Plan.

13.4.3. PDS Plan Validation

13.4.4. PDS Construction Approval

13.4.5. PDS Inspection

13.4.6. PDS Certification.

13.4.7. PDS Preliminary Approval.

13.4.8. PDS Final Approval

13.4.9. PDS Recertification.

14. Protected Distribution System (PDS) Plan. The requesting organization must prepare a PDS plan prior to constructing a PDS. Obtain a PDS identification number from the Wing IA office.

This number consists of the MAJCOM, the base, and a unique three-digit number (e.g., AMC- Scott-001). This plan identifies and assigns responsibility for operational security requirements and specifies the design and construction requirements. A sample PDS Plan is attached in Attachment 10.

14.1. Information and Access Requirements. Identify:

14.1.1. Highest classification level and category of information carried by the PDS.

Classify the PDS Plan as FOUO at a minimum.

14.1.2. Minimum security clearance level of individuals with unrestricted access to any portion of the PDS.

14.2. User Information. Identify:

14.2.1. Name and location of the requesting organization. This normally is the office of record for the PDS. The office of record maintains a copy of the PDS file with the original PDS package being maintained by the Wing IA office.

14.2.2. Name, organization, and office symbol of the CSO and ISO (see paragraph 18).

14.2.3. CAAs (buildings and room numbers) connected by the PDS. There are three levels of control for CAAs: open storage areas, secured facilities, and open offices that are locked at night and on weekends (see definition of CAA in Attachment 1, Terms). The open offices present the most difficulties in meeting security requirements.

14.2.4. Organizations and office symbols occupying the CAAs identified in paragraph

14.2.3. connected by the PDS.

14.3. PDS Operation Requirements. Specify the operation requirements (see Attachment 4).

Document each requirement with an official memorandum, a letter of appointment, an operating instruction, or other official means. Drafts are permitted for validation. Finalize drafts prior to certification.

14.3.1. Identify the type of PDS chosen, Hardened or Simple:

14.3.1.1. If Hardened PDS, identify the type of Hardened PDS chosen:

14.3.1.2. Above ground or buried;

14.3.1.3. Alarmed or not alarmed; or

14.3.1.4. Continuously viewed.

14.3.2. PDS Physical Security Requirements. Identify the physical security requirements from Attachment 5.

14.3.3. PDS Signal Line Requirements. Identify the signal line requirements from Attachment 6.

14.3.4. PDS Construction Requirements. Identify the physical construction requirements from Attachment 7. Identify the organization proposed to install the PDS.

14.3.5. Circuit Separation Requirements. Refer to Attachment 8 for circuit separation criteria when sharing a single distribution system.

15. Protected Distribution System (PDS) Plan Validation. The requesting organization submits a copy of the PDS justification and the PDS plan to the Wing IA office for validation.

15.1. The Wing IA office reviews the justification for adequacy and the plan for obvious errors such as requiring unnecessary redundancy in protection or any major omissions. If all the operational security requirements are met, the Wing IA office validates the PDS plan and creates a PDS file (see paragraph 13.4).

15.2. Document the validation as a memorandum. Attach the validation to the PDS file (see paragraph 13.4).

15.3. The Wing IA office keeps the copy of the PDS file to be used during certification.

15.4. Modifications. When proposing a modification to an existing PDS, the Wing IA office, in coordination with the requesting organization, determines the need for a new or revised PDS plan based on the increased size and complexity of the existing PDS itself. The Wing IA office may request a cost analysis to ensure that a PDS is still the best solution.

15.5. The Wing IA office submits the PDS Plan to the CSO for approval to construct the PDS.

16. Protected Distribution System (PDS) Construction. Construct the PDS according to the validated plan. The CSO provides approval to construct the PDS. Do not use the PDS to pass classified national security information until the finished PDS is approved by the ISO. Document all deviations. Deviations are defined as minor changes made during the installation, such as different routing of conduit, discontinuance of a feeder line, or even the addition of a high-priority user on the PDS while the system is being installed and after the plan is approved. All members of the team constructing the PDS must have an appropriate security clearance to prevent any instance of “pre-tampering” of the system. If adequately cleared personnel are not available, uncleared installers or construction worker must be escorted at all times by someone from outside the team with an appropriate clearance. The escort must have sufficient technical knowledge to recognize any attempts of tampering or penetration.

17. Protected Distribution System (PDS) Certification. After construction and installation, and prior to using the PDS, the requesting organization requests certification from the Wing IA office.

Provide the Wing IA office documentation for any deviations from the plan. The deviation documentation becomes a part of and is attached to the original PDS plan. Include finalized instructions, memorandums, and letters of agreement. Replace the drafts with the final documents in the PDS file. The Wing IA office reviews the plan and the deviations.

17.1. The Wing IA office certifies:

17.1.1. Compliance with the construction plan, including deviations.

17.1.2. Successful completion of prescribed lines route inspection, as required.

17.1.3. Alarm circuit verification procedures, as required.

17.1.4. Continuous viewing procedures, as required.

17.1.5. The PDS passed a technical inspection by the technical inspector, (usually designated by the Wing IA office [see Attachment 9]).

17.1.6. The controlling office is identified.

17.1.7. The incident reporting and investigating system is in effect.

17.2. The Wing IA office:

17.2.1. Ensures all discrepancies are corrected before certifying the PDS.

17.2.2. Documents the certification as a memorandum. Attaches the certification memorandum to the PDS file (see paragraph 13.4).

17.2.3. Keeps a copy and sends the certification to the requesting organization.

17.2.4. Attaches any deviations and the certification to the PDS file (see paragraph 13.4).

18. Protected Distribution System (PDS) Approval.

18..1. After PDS construction is completed, the Wing IA office submits the PDS certification memorandum to the CSO. The PDS file is separate from the Certification & Accreditation process.

18.2. Preliminary approval of PDS. The CSO provides preliminary approval of the PDS.

18.3. Final approval of PDS. The ISO provides final approval of the PDS.

18.4. Filing the Approval. The ISO sends the approval to the Wing IA office for their files via the CSO. The Wing IA office attaches the PDS approval to the PDS file as shown in paragraph 13.4.

18.5. Approving Authorities. Except as noted below, the ISO provides final approval of the PDS as a part of the C&A process for the network or information system the PDS is supporting.

AFPD 33-2 requires that all systems be certified and accredited prior to operation. AFI 33-202, Volume 1 {Chapter 6 will become AFI 33-210, Air Force Certification and Accreditation Program (AFCAP)}, details the process used to certify and accredit Air Force systems.

Complete the requirements part of AFI 33-202, Volume 1, (Chapter 6 will become AFI 33-210) before obtaining approval to operate.

18.5.1. Temporary Systems. The ISO may approve temporary system configurations without processing a formal approval package after meeting all the following conditions:

18.5.1.1. The temporary PDS is in place for no more than 1 month.

18.5.1.2. The temporary PDS is confined within United States (US) Government installations.

18.5.1.3. The temporary PDS will not process higher than SECRET information.

18.5.2. Contractor Facilities. The head of the government contracting department or agency is the approving authority for a contractor-owned and operated PDS.

18.5.3. Tactical Systems. Mobile systems employing an inter-shelter PDS need not be reapproved for each relocation if the relocation provides security comparable to that of the original approval, as determined by the local IA office. Otherwise, new approval must be obtained.

18.5.4. Systems without an ISO. For those systems not requiring an ISO, the approving authority is the CSO.

19. Protected Distribution System (PDS) Recertification.

19.1. The Wing IA office recertifies a PDS as part of the system recertification and reaccreditation.

19.1.1. Recertify every 3 years, if installed within the US, its trust territories, and possessions.

19.1.2. Recertify annually, if installed outside the US.

19.1.3. Maintain records for 3 years from last certification/recertification date.

19.2. Recertify the PDS after verifying the following:

19.2.1. Lines route inspections (if needed): The PDS meets requirements and previous inspections were completed on schedule.

19.2.2. Technical inspections: The PDS was within limits and the inspections were completed on schedule (see Attachment 9).

19.2.3. Alarm circuit (if used) verification: Previous alarm circuit tests were successful and completed on schedule.

19.2.4. PDS events record: Evidence that this record is current and includes all significant events. Keep logs for 3 years from recertification date.

19.3. Attach the recertification to the PDS file as shown in paragraph 13.4.

19.4. A PDS that does not meet the above requirements may not be recertified.

19.4.1. The Wing IA office notifies the ISO immediately when a PDS is not recertified.

19.4.2. The PDS is shut down immediately and users are notified.

19.4.3. The requesting organization corrects deficiencies discovered during recertification within 30 days and requests recertification. The CTTA may be consulted for clarification on site-specific PDS items.

19.4.4. A PDS that fails recertification cannot be used until recertified.

20. Protected Distribution System (PDS) Deactivation. The operating agency reports deactivation of an approved PDS to the CSO, ISO, and Wing IA office within 5 days of deactivation. The Master PDS Plan and files pertaining to the deactivated PDS shall be marked “DEACTIVATED ON (Date)”.

21. Forms Adopted and Prescribed.

21.1. Adopted Forms. SF 702, Security Container Checksheet, and AF Form 847, Recommendation for Change of Publication.

21.2. Prescribed Forms. No forms are prescribed by this publication.

MICHAEL W. PETERSON, Lt Gen, USAF Chief of Warfighting Integration and Chief Information Officer

Attachment 1

GLOSSARY OF REFERENCES AND SUPPORTING INFORMATION

References

CNSSI 7000, (C) TEMPEST Countermeasures for Facilities (U), May 2004

NSTISSI No. 7003, Protected Distribution Systems (PDS), 13 December 1996

DoD 5200.1-R, Information Security Program, 14 January 1997

AFPD 33-2, Information Assurance (IA) Program, 19 April 2007

AFI 31-101, (FOUO) The Air Force Installation Security Program, 1 March 2003

AFI 33-102, Communications and Information Specialized Publications, 17 July 2007

AFI 33-103, Requirements Development and Processing, 18 March 1999 (Incorporating Through Change 3, 16 March 2007)

AFI 33-201, Volume 1, (FOUO) Communications Security (COMSEC), 1 May 2005 (will become

AFSSI 4201 [FOUO])

AFI 33-202, Volume 1, Network and Computer Security, 3 February 2006 {Incorporating Through Change 5, 18 May 2007 (will become AFI 33-200)}

AFSSI 7700, Emission Security (EMSEC), 24 Oct 2007

AFSSI 7702, Emission Security Countermeasures Review, 30 January 2008

AFMAN 33-363, Management of Records, 1 March 2008

AFSSI 4212, (FOUO) Reporting COMSEC Deviations, 25 July 2007

Abbreviations and Acronyms

AF—Air Force (when used with a form title)

AFCA—Air Force Communications Agency

AFI—Air Force Instruction

AFMAN—Air Force Manual

AFOSI—Air Force Office of Special Investigations

AFPD—Air Force Policy Directive

AFRIMS—Air Force Records Information Management System

AFSSI—Air Force System Security Instructions

C&A—Certification and Accreditation

CA—Certification Authority

CAA—Controlled Access Area

CNSSI—Committee on National Security Systems Instruction

COMSEC—Communications Security

CSO—Communications and Information Systems Officer

CTTA—Certified TEMPEST Technical Authority

DAA—Designated Approving Authority dB—Decibels

DMS—Defense Message System

DoD—Department of Defense

DRU—Direct Reporting Unit

EMSEC—Emission Security

EMT—Electrical Metallic Tubing

FOA—Field Operating Agency

FOUO—For Official Use Only

GFSP—General Field Service Padlock

GSA—General Services Administration

IA—Information Assurance

IDOCS—Intrusion Detection Optical Communications System

ISO—Information System Owner

JWICS—Joint Worldwide Intelligence Communication System

LCA—Limited Controlled Area

MAJCOM—Major Command

NSA—National Security Agency

NSN—National Stock Number

NSTISSI—National Security Telecommunications and Information Systems Security Instruction

PDS—Protected Distribution System

RDS—Records Disposition Schedule

SAF—Secretary of the Air Force

SCI—Sensitive Compartmented Information

SCIF—Sensitive Compartmented Information Facility

SF—Standard Form

SIPRNET--Secret Internet Protocol Router Network

SPECAT—Special Category

STEM—Systems Telecommunications Engineering Manager

STP—Shielded Twisted-Pair

TDR—Time Domain Reflectometry

UAA—Uncontrolled Access Area

US—United States

WWW—World Wide Web

Terms

Access Control--Process of limiting access to the resources of an information system only to authorized users, programs, processes, or other systems.

Certifying Authority (CA)—The senior official having the authority and responsibility for the certification of information systems. This authority can be formally delegated as necessary.

Controlled Access Area (CAA)—The room, building, or facility area under direct physical control within which unauthorized persons are denied unrestricted access and are either escorted by authorized persons or are under continuous physical or electronic surveillance. Within the greater CAA, there are three levels of data control: TOP SECRET/SPECAT, SECRET, and CONFIDENTIAL. Examples of these are open storage areas, secured facilities, and open offices that are locked at night and on weekends. These levels correspond to division of Table A5.1. and Table A5.2.

Communications and Information Systems Officer (CSO)— The term CSO identifies the supporting systems officer at all levels. At base-level, this is the commander of the communications unit responsible for carrying out base communications and information systems responsibilities. At MAJCOM and other activities responsible for large quantities of communications and information systems, it is the person designated by the commander as responsible for overall management of systems budgeted and funded by the MAJCOM or activity.

The CSO function uses the office symbol SC that is expanded to three and four digits to identify specific functional areas. CSOs are accountable officers for all automated data processing equipment in their inventory.

Designated Accrediting Authority (DAA)—Official with the authority to formally assume responsibility for operating a system at an acceptable level of risk. Synonymous with Designated Approving Authority and Delegated Accrediting Authority. (DoDI 8500.2)

Information System Owner (ISO)—Ultimate recipient? of the Information System (IS). Official responsible for the oversight of the procurement, development, integration, modification, and operation and maintenance of an IS. Informs key officials of the need to conduct a security certification and accreditation of the system, ensures appropriate resources are available for the effort, and provides necessary system-related documentation to the Certification Authority (CA).

Submits certification and accreditation package to the Certification Authority’s Representative for validation and recommendations, and then to the DAA’s designated representative for adjudication.

(NIST Special Publication 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems).

Limited-Control Area (LCA)—The space surrounding a protected distribution system within which exploitation is not considered likely or have legal authority to identify or remove a potential exploitation exists. Also known as Inspectable Space.

Line Route—The actual path of the PDS, including the conductor, inside the PDS.

Lockbox—A metallic box with a lock attached to the end of the PDS within the CAA large enough to hold the signal line. The purpose of the lockbox is to provide authorized access to classified information only when required. Normally, the lockbox houses a live Secret Internet Protocol Router Network SIPRNET connection point and therefore is a security container. The lockbox can use an approved padlock or the newer lockbox can use a high security combination lock or electronic lock, similar to the lock on a safe. Lockboxes should be GSA-approved containers; are covered under DoD 5200.1-R, Information Security Program; and require a Standard Form (SF) 702, Security Container Checksheet. See paragraph A7.4.1.10. for more information. See A7.4.1.7 for lock information.

Protected Distribution System (PDS)—A wire line or fiber optics distribution system with adequate electrical, electromagnetic, and physical safeguards to permit its use for the transmission of unencrypted classified national security information. Note: This definition does not include IDOCS approved by the NSA.

Special Category (SPECAT)—The definition is FOUO. See CNSSI 7000 (C).

Uncontrolled Access Area (UAA)—The area external or internal to a facility over which no personnel access controls can be or are exercised. The area outside the fence surrounding an Air Force base, and accessible to the general public is an UAA.

Attachment 2

PROTECTED DISTRIBUTION SYSTEMS (PDS) PROCESS FLOW CHART

A2.1. Figure A2.1. is a flow chart of the process to design, construct, and approve a PDS.

Figure A2.1. Protected Distribution System (PDS) Process Flow Chart.

Attachment 3

CONTROLLED ACCESS AREA (CAA) DECISION TREE

A3.1. Figure A3.1. is a flow chart that determines what constitutes a CAA.

Figure A3.1. SIPRNET Controlled Access Area Requirements.

Attachment 4

PROTECTED DISTRIBUTION SYSTEMS (PDS) OPERATION REQUIREMENTS

A4.1. Introduction. This attachment identifies the operation requirements needed to ensure and maintain the security of the PDS. The operation requirements listed in this attachment are the minimum requirements. Document these requirements with an official memorandum, such as a letter of appointment, an operating instruction, or other official means. Ensure that the Wing IA office is kept aware of new PDSs or modifications to existing PDSs. Advise the local Staff Judge Advocate when the PDS traverses UAAs.

A4.2. Controlling Office. The Controlling Office is the office of primary responsibility for the PDS operation; with the Wing IA office, civil engineer, CSO, and the ISO playing major roles. The ISO is the final authority granting approval to operate.

A4.2.1. Establish the operational security procedures for the PDS. Draft procedures are permitted for validation (see paragraph 15). Finalize them for certification (see paragraph 17).

A4.2.2. Establish the requirement for all personnel in the CAAs to be aware of their responsibility to assist in the close supervision of the visible components of the PDS. They are to report all incidents of suspicious activity immediately.

A4.3. Security Office. Identify a PDS security office or person (may be the same as the Controlling Office or the Record Office). Neither the MAJCOM nor the Wing IA office will be identified as the Security Office. This office or person will:

A4.3.1. Establish and review the PDS Log at least monthly.

A4.3.2. Receive reports of alarms (if used) and incidents of tampering, penetration, or unauthorized interception, immediately make the initial investigation, and resolve or notify the specified investigating agency such as Security Forces, Air Force Office of Special Investigations (AFOSI), etc.

A4.3.3. Receive reports of suspicious activity in the area of the PDS, immediately make the initial investigation, and resolve or report such activities to security forces for appropriate action.

A4.3.4. Make required notifications.

A4.4. Record Office. Specify the office, or person, to establish and maintain a record of events for the PDS (may be the same as the Controlling Office or the Security Office). Neither the MAJCOM nor the Wing IA office will be identified as the Record Office. Record in the PDS Log, all PDS events such as alarms, lines route inspections, technical inspections, and other pertinent information.

A4.5. Reporting Procedures. Establish the procedures for reporting incidents of tampering, penetration, or unauthorized interception. These incidents are most likely discovered during lines route inspections and technical inspections. Ensure these incidents are reported immediately.

Specify the means for reporting, such as secure telephone, in person, etc. Include the requirement to immediately discontinue using the PDS until the approval authority assesses the incident and its security status is determined.

A4.5.1. Immediately report these incidents to the PDS Security Office or person, for review and initiation of an investigation.

A4.5.2. Immediately report these incidents as a physical security COMSEC incident following the procedures established for physical security incidents in AFSSI 4212, (FOUO) Reporting COMSEC Deviations.

A4.6. Investigating Procedures. Establish the procedures for investigating reports of tampering, penetration, or unauthorized interception. This should involve the AFOSI since these incidents could be acts of espionage.

A4.7. Monitoring Alarms. If the PDS is alarmed, identify who monitors the alarm indicator.

A4.8. Responding to Alarms. If the PDS is alarmed, establish the requirement to respond to an alarm within 15 minutes and identify the individuals responding.

A4.9. Investigating Alarms. If the PDS is alarmed, identify who initially investigates alarms to determine if an attempt at tampering, penetration, or unauthorized interception is suspected. If an attempt is suspected, notify the specified investigating agency; typically, this is the AFOSI.

A4.10. Inspections. Specify the office responsible for conducting the required inspections as delineated in Attachment 5.

A4.11. Testing Requirements. Each alarm system is unique and therefore has unique testing requirements. Refer to the vendor’s operating and testing instructions.

Attachment 5

PROTECTED DISTRIBUTION SYSTEMS (PDS) PHYSICAL SECURITY

REQUIREMENTS

A5.1. General. This attachment provides requirements for selecting the appropriate type of distribution system to provide the required physical security for the signal line. The intent of operational security procedures in combination with construction requirements allows for rapid detection of any attempted penetration of the PDS rather than ensuring the prevention of a penetration. Varying degrees of protection are based on the PDS construction and other physical protection measures incorporated.

A5.2. Determine Type of Distribution System. Identify the highest security classification of information, including SPECAT, using the system and the type of area to be traversed by the PDS (UAA, LCA, or CAA). Use Table A5.1. and Table A5.2. to determine the type of distribution system required, simple or hardened. Note that the threat level associated with a base is classified CONFIDENTIAL. If the PDS plan states either the threat level or which table was used, this information is classified CONFIDENTIAL.

Table A5.1. Required Type of Distribution Systems within the US and Outside the US Low Threat.

Type of Area TRAVERSED

TYPE OF DATA UAA LCA CONFIDENTIAL

CAA

SECRET

CAA

TOP SECRET

CAA

1 CONFIDENTIAL Hardened Simple (Note) (Note) (Note)

2 SECRET Hardened Hardened Simple (Note) (Note)

3 TOP SECRET Hardened Hardened Simple Simple (Note)

4 SPECAT Hardened Hardened Simple Simple Simple

Note: PDS not required, consider as a RED signal line within the CAA.

Table A5.2. Required Type of Distribution Systems Outside the US - Medium Threat.

TYPE OF DATA

Type of Area TRAVERSED

UAA

LCA

CONFIDENTIAL

CAA

SECRET

CAA

TOP SECRET

CAA

1 CONFIDENTIAL Hardened Simple (Note) (Note) (Note)

2 SECRET Hardened Hardened Simple (Note) (Note)

3 TOP SECRET Hardened Hardened Hardened Simple (Note)

4 SPECAT Hardened Hardened Hardened Simple Simple

Note: PDS not required, consider as a RED signal line within the CAA.

A5.3. Hardened Distribution System. Identify the type of hardened carrier (above ground or buried, alarmed or continuously viewed) to be used.

A5.3.1. Hardened Carrier: If a hardened carrier was chosen.

A5.3.1.1. All security requirements must be enforced 24 hours-a-day, 7 days-a-week, whether or not the PDS is in continuous operation.

A4.3.1.2. Do not conceal a hardened carrier from view behind walls, above ceilings, or below floors, unless it is alarmed. If the carrier is even partially concealed from view, it must be alarmed. In lieu of alarming the carrier, and within the US, the carrier may be buried a minimum of 1 meter deep. If buried on an installation outside the US, in a MEDIUM or higher threat location, the carrier must be encased in concrete and buried a minimum of 1 meter deep. The concrete encasement must be a minimum of 20 centimeters (8 in.) in all directions.

A5.3.1.3. Secure the termination when the network security policy requires it. Normally, the termination is secured when not in use and the signal lines from the carrier terminate at a user equipment terminal location not maintained as a CAA 24 hours-a-day, 7 days-a-week.

This requirement usually does not apply to CAAs accredited for open storage or CAAs in secure facilities (e.g., a Sensitive Compartmented Information Facility [SCIF]). Solutions are: (1) Shut down the circuit to the unattended terminal; (2) Use a lockbox.

A5.3.1.4. Lines route visual inspection requirements.

A5.3.1.4.1. Identify the required minimum interval for lines route visual inspections from Table A5.3. (this information, when applied to a specific PDS, is CONFIDENTIAL). Daily inspections must be performed on weekends and holidays, as specified.

A5.3.1.4.2. A line route inspection consists of a close visual inspection of the PDS for signs of penetration, tampering, and any other anomaly that may cause a deterioration of protection safeguards. The close visual inspection must include the total surface (360 degrees) of the PDS (especially those parts close to walls); using a mirror is recommended. For buried PDS, the visual inspection must extend 5 meters (16 feet) on either side of the PDS route; inspect for evidence of unauthorized digging.

A5.3.1.4.3. PDS lines route inspectors need not be qualified installers or technicians, but must recognize physical changes in the PDS including attempts at penetration or tampering.

Table A5.3. Protected Distribution System (PDS) Lines Route Daily Visual Inspection Schedule. (Note 1 and Note 4)

Facility Location

HIGHEST

CLASSIFICATION

OF DATA CARRIED

WITHIN THE US

OUTSIDE THE US

LOW THREAT (Note 2)

OUTSIDE THE US

MEDIUM THREAT

(Note 2)

UAA LCA UAA LCA UAA LCA

1 SPECAT or

Top Secret

2 1 2 1 6 3

2 Secret 1 1(Note 3) 1 1(Note 3) 4 2

3 Confidential 1 None 1 None 2 1

Notes:

1. Minimum number of randomly scheduled inspections per day per location.

2. The TEMPEST threat environment is defined by NSA.

3. For buildings that are secured when not occupied (nights and weekends); lines route inspec tions may be accomplished on a weekly basis.

4. Alarmed carriers do not require lines route inspections. (See paragraph A5.3.2.7.)

A5.3.1.5. Technical inspection requirements.

A5.3.1.5.1. Identify the minimum interval to perform technical inspections from Table A5.4. (this information, when applied to a specific PDS, is CONFIDENTIAL). Note that the threat level associated with a base is classified CONFIDENTIAL. If the PDS plan states either the threat level or which table was used, this information is classified

CONFIDENTIAL.

A5.3.1.5.2. Specify the office or organization responsible for performing the technical inspections. Technical inspection requirements are defined in Attachment 9.

Table A5.4. Protected Distribution System (PDS) Technical Inspection Schedule. (Note 1)

FACILITY LOCATION

HIGHEST

CLASSIFICATION OF

DATA CARRIED

WITHIN

THE US

OUTSIDE THE US

LOW THREAT

(Note 2)

OUTSIDE THE US

MEDIUM THREAT

(Note 2)

1 SPECAT or TOP SECRET 1 1 4

2 SECRET 1 1 2

3 CONFIDENTIAL 1 1 1

Notes:

1. Minimum number of randomly scheduled technical inspections per year.

2. The threat environment is defined by CNSSI 7000, (C) TEMPEST Countermeasures for Facilities (U), Annex A, (S) TEMPEST Threat to Facilities (U) or the NSA TEMPEST Threat List.

A5.3.2. Alarmed Carrier.

A5.3.2.1. All security requirements must be enforced 24 hours-a-day, 7 days-a-week whether or not the PDS is in continuous operation.

A5.3.2.2. Identify the office to monitor the PDS alarm, 24 hours-a-day, 7 days-a-week.

A5.3.2.3. Specify the required responses to alarm…