Appendix_1__NetOps_and_Infrastructure_Solutions_Standards_ _References.pdf

Appendix N3: NetOps and Infrastructure Solutions Standards & References

Purpose:

The following certifications, specifications, standards, policies and procedures in Table 2 represent documents and standards that may be placed on individual contract task orders.

Individual task orders may impose additional standards to those required at the contract level.

The list below is not all-inclusive and the most current version of the document in the AF Standard Center of Excellence Repository (SCOER) at the time of task order issuance will take precedence. Other documents required for execution of tasks issued under NETCENTS-2 will be cited in the relevant Task Order, such as specific FIPS, NIST, or MIL-Standards. Web links are provided wherever possible.

NETWORK OPERATIONS AND INFRASTRUCTURE SOLUTIONS

(COMPLIANCE)

Standard URL Description

1.

AFI 10-206

Operational Reporting http://static.e-publishing.af.mil/production/1/af_a3_ 5/publication/afi10-206/afi10-206.pdf

This instruction implements Air Force Policy Directive (AFPD) 10-2, Readiness. It applies to all US Air Force Major Commands (MAJCOM), Air National Guard (ANG), Air Force Reserve Command (AFRC), Field Operating Agencies (FOA), and Direct Reporting Units (DRU). Prior to mobilization/activation AF, ANG, and AFRC units will address the HQ AF Service Watch Cell (AFSWC) on all applicable record copy Air Force Operational Reports (AF OPREP- 3). It establishes and describes the Air Force Operational Reporting System. It explains the purpose and gives instructions for preparing and submitting these reports.

Refer recommended changes and questions about this publication to AF/A3O, 1480 Air Force Pentagon, Washington, D.C. 20330-1480, Office of Primary Responsibility (OPR) using the AF Form 847, Recommendation for Change of Publication. MAJCOMs are authorized to supplement this Air Force Instruction (AFI) instead of repeating instructions in separate directives.

NETWORK OPERATIONS AND INFRASTRUCTURE SOLUTIONS

(COMPLIANCE)

Standard URL Description

2.

AFI 10-208 Air Force Continuity of

Operations (COOP) Program.

http://static.e-publishing.af.mil/production/1/af_a3_ 5/publication/afi10-208/afi10-208.pdf

This Instruction implements Air Force Policy Directive (AFPD) 10-2, Readiness, and is consistent with AFPD 10-8, Homeland Security. It describes policy and requirements for implementing DODI 3020.42, Defense Continuity Plan Development, and DODI O-3020.43, Emergency Management and Incident Command of the Pentagon Facilities; DODI O-3000.08 Balanced Survivability Assessments (BSAs);and O-DODI 5110.11, Raven Rock Mountain Complex (RRMC).

3.

AFI 10-601

Operational Capability

Requirements Development http://static.e-publishing.af.mil/production/1/af_a3_ 5/publication/afi10-601/afi10-601.pdf

The primary intent of this instruction is to facilitate timely development and fielding of affordable and sustainable operational systems needed by the combatant commander. The primary goal is to fulfill stated defense strategy needs with effects based, capabilities-focused materiel and non-materiel solutions. These solutions must be well integrated to provide suitable, safe, and interoperable increments of capability that are affordable throughout the life cycle.

4.

AFI 10-701

Operations Security

(OPSEC)

http://static.e-publishing.af.mil/production/1/af_a3_ 5/publication/afi10-701/afi10-701.pdf

This publication provides guidance for all Air Force personnel (military and civilian) and supporting contractors in implementing, maintaining and executing OPSEC programs. It describes the OPSEC process and discusses integration of OPSEC into Air Force plans, operations and support activities.

5.

AFI-1604 Air Force Information Security

Program http://static.e-publishing.af.mil/production/1/saf_aa/ publication/afi16-1404/afi16-1404.pdf

This publication implements Air Force Policy Directive (AFPD) 16-14, Security Enterprise Governance; Department of Defense (DoD) Directive 5210.50, Management of Serious Security Incidents Involving Classfied Information, DoD Instruction (DoDI) 5210.02, Access and Dissemination of RD and FRD, DoDI 5210.83, DoD Unclassified Controlled Nuclear Information (UCNI), DoD Manual (DoDM) 5200.01, DoD Information Security Program, Volume 1, Volume 2, Volume 3, and Volume 4; and DoDm 5200.45, Instructions for Developing Security Classification Guides.

(COMPLIANCE)

Standard URL Description

6.

AFI 31-501

Personnel Security

Program Management http://static.e-publishing.af.mil/production/1/af_a4_ 7/publication/afi31-501/afi31-501.pdf

Use this instruction with the DOD Regulation 5200.2-R and AFPD 31-5 to implement the personnel security program.

This instruction requires collecting and maintaining information protected by the Privacy Act of 1974 authorized by Executive Orders 9397, 9838, 10450, 11652, and 12968; and 5 United States Code (U.S.C.) 7513, 7532, 7533; 10 U.S.C.

8013.

7.

AFI 32-10112

Installation Geospatial

Information and Services (Installation

GI&S)

http://static.e-publishing.af.mil/production/1/af_a4_

7/publication/afi32-10112/afi32- 10112.pdf

This instructions convey guidance and procedures allowing commanders and Air Force professionals to maintain a flow of timely geospatial information with due regard for national security, accuracy, and privacy. Describe Geospatial Information and Services (GI&S) support for the installation and facilities mission, hereafter referred to as the GeoBase Program or GeoBase. Explain the organization and execution of the GeoBase Program for all levels of command. GI&S is the key platform for cross functional integration, and to that end this AFI provides guidance for those organizations seeking to integrate with the Geo-Base Service. Provide guidance and procedures for all Air Force military and civilian personnel that perform or utilize GeoBase functions, products or systems, including those in the Air National Guard and U.S. Air Force Reserve. This instruction is not intended to overlap or supersede GI&S guidance found in AFI 14- 205, Geospatial Information and Services, 4 May 2004. Ensure that all records created as a result of processes prescribed in this publication are maintained in accordance with AFMAN 37-123, Management of Records and disposed of in accordance with the Air Force Records Disposition Schedule (RDS) located at https://afrims.amc.af.mil/. The use of the name or mark of any specific manufacturer, commercial product, commodity, or service in this publication does not imply endorsement by the Air Force.

(COMPLIANCE)

Standard URL Description

8.

AFI 33-332 Air Force

Privacy And Civil Liberties Program http://static.e-publishing.af.mil/production/1/saf_cio

_a6/publication/afi33-332/afi33- 332.pdf

Records that are retrieved by name or other personal identifier of a U.S. citizen or alien lawfully admitted for permanent residence are subject to Privacy Act requirements and are referred to as a Privacy Act system of records. The Air Force must publish SORNs in the Federal Register, describing the collection of information for new, changed or deleted systems to inform the public and give them a 30 day opportunity to comment before implementing or changing the system.

9.

AFI 33-364 Records Disposition

Procedures and Responsibilities http://static.e-publishing.af.mil/production/1/saf_cio

_a6/publication/afi33-364/afi33- 364.pdf

Records Disposition Procedures

10. AFI 33-401 Air Force Architecting http://static.e-publishing.af.mil/production/1/saf_cio

_a6/publication/afi33-401/afi33- 401.pdf

This Air Force Instruction (AFI) implements Air Force Policy Directive (AFPD) 33-4, Enterprise Architecting. This instruction describes the federation of Air Force architectures and its concept for federated architecture development, its associated business rules, governance, and the roles and responsibilities for appropriate Air Force organizations.

11.

AFI 33-580

Spectrum

Management http://static.e-publishing.af.mil/production/1/saf_cio

_a6/publication/afi33-580/afi33- 580.pdf

This instruction establishes guidance and procedures for Air Force-wide management and use of the electromagnetic spectrum and implements Department of Defense Instruction (DoDI) 4650.01, Policy and Procedures for Management and Use of the Electromagnetic Spectrum; DoDI 8320.05, Electromagnetic Spectrum Data Sharing; National Telecommunications and Information Administration (NTIA) Manual of Regulations and Procedures for Federal Radio Frequency Management; Air Force Policy Directive (AFPD) 33-5, Warfighting Integration; and the procedures established by the Joint Staff J65A United States Military Communications-Electronics Board

(USMCEB).

12. AFI 33-590 Radio Management http://static.e-publishing.af.mil/production/1/saf_cio

_a6/publication/afi33-590/afi33- 590.pdf

This standard specifies requirements for types of land mobile radios, frequency ranges and encryption standards. It provides requirements processing, validation, and handling procedures for classified and unclassified Personal Wireless Communication Systems (PWCS), and training. It provides procedures for the management, operation, and procurement of commercial wireless service for all

PWCS.

(COMPLIANCE)

Standard URL Description

13.

AFI 36-2201 Air Force Training

Program http://static.e-publishing.af.mil/production/1/af_a1/p ublication/afi36-2201/afi36-2201.pdf

This Air Force Instruction (AFI) applies to Total Force – Active Duty, Air Force Reserve, Air National Guard (ANG), and Department of Air Force Civilian. Ensure that all records created as a result of processes prescribed in this publication are maintained in accordance with AFMAN 33- 363, Management of Records, and disposed of in accordance with the Air Force Records Disposition Schedule (RDS) located at https://www.my.af.mil/afrims/afrims/afrims/ri ms.cfm. Refer recommended changes and questions about this publication to the Office of Primary Responsibility (OPR) using the AF IMT 847, Recommendation for Change of Publication; route AF IMT 847s from the field through Major Commands (MAJCOMS) publications/forms managers.

14.

AFI 61-204

Disseminating Scientific And

Technical Information http://static.e-publishing.af.mil/production/1/saf_aq/ publication/afi61-204/afi61-204.pdf

This instruction updates the procedures for identifying export-controlled technical data and releasing export-controlled technical data to certified recipients and clarifies the use of the Militarily Critical Technologies List. It establishes procedures for the disposal of technical documents.

15.

AFI 99-103

Capabilities-Based Test And Evaluation http://static.e-publishing.af.mil/production/1/af_te/p ublication/afi99-103/afi99-103.pdf

It describes the planning, conduct, and reporting of cost effective test and evaluation (T&E) programs as an efficient continuum of integrated testing known as seamless verification. The overarching functions of T&E are to mature sys-tem designs, manage risks, identify and help resolve deficiencies as early as possible, and ensure systems are operationally mission capable (i.e., effective and suitable). The Air Force T&E community plans for and conducts integrated testing as an efficient continuum known as seamless verification in collaboration with the requirements and acquisition communities.

(COMPLIANCE)

Standard URL Description

16.

AFMAN 33-152 User Responsibilities and

Guidance for information Systems http://static.e-publishing.af.mil/production/1/saf_cio

_a6/publication/afman33- 152/afman33-152.pdf

This instruction implements Air Force Policy Directive (AFPD) 33-1, Information Resources Management, AFPD 33-2, Information Assurance (IA) Program, and identifies policies and procedures for the use of cyberspace support systems/services and compliance requirements of Secretary of the Air Force, Chief of Warfighting Integration and Chief Information Officer (SAF/CIO A6) managed programs. These programs ensure availability, interoperability, and maintainability of cyberspace support systems/services in support of Air Force mission readiness and warfighting capabilities. This manual applies to all Air Force military, civilians, contractor personnel under contract by the Department of Defense (DOD), and other individuals or organizations as required by binding agreement or obligation with the Department of the Air Force. This manual applies to the Air National Guard (ANG) and the Air Force Reserve Command

(AFRC).

17.

AFMAN 33-153

Information

Technology (IT) Asset Management

(ITAM)

http://static.e-publishing.af.mil/production/1/saf_cio

_a6/publication/afman33- 153/afman33-153.pdf

This Air Force Manual (AFMAN) implements Executive Order (E.O.) 13103, Computer Software Piracy and Air Force Policy Directives (AFPD) 33-1, Cyberspace Support and supports AFPD 33-2, Information Assurance (IA) Program; AFPD 63-1/20-1, Integrated Life Cycle Management; and AFPD 10-6, Capabilities- Based Planning & Requirements Development. This AFMAN provides the overarching guidance and direction for managing IT hardware and software. The hardware management guidance identifies responsibilities for supporting Air Force (AF) IT hardware (IT assets) and maintaining accountability of Personal Wireless Communications Systems (PWCS) including cellular telephones and pagers. The software management guidance identifies responsibilities for management of commercial off-the-shelf (COTS) and AF-unique software acquired/developed by the AF (other than software internal to a weapon system; see AFPD 63-1/20-1, Integrated Life Cycle Management).

(COMPLIANCE)

Standard URL Description

18.

AFMAN 33-282

Computer Security

(COMPUSEC)

http://static.e-publishing.af.mil/production/1/saf_cio

_a6/publication/afman33- 282/afman33-282.pdf

This AFMAN implements Computer Security in support of AFPD 33-2, Information Assurance Program and AFI 33-200, IA Management Computer Security (COMPUSEC) is defined within the IA Portion of AFI 33-200.

19.

AFMAN 33-363

Management of

Records http://static.e-publishing.af.mil/production/1/saf_cio

_a6/publication/afman33- 363/afman33-363.pdf

This manual implements Department of Defense (DoD) Directive (DoDD) 5015.2, DoD Records Management Program, and Air Force Policy Directive (AFPD) 33-3, Information Management. It establishes the requirement to use the Air Force Records Information Management System (AFRIMS); establishes guidelines for managing all records

(regardless of media); and defines methods and the format for record storage, file procedures, converting paper records to other media or vice versa, and outlines the minimum to comply with records management legal and policy requirements.

20.

AFPD 33-3

Information

Management http://static.e-publishing.af.mil/production/1/saf_cio

_a6/publication/afpd33-3/afpd33- 3.pdf

This policy directive establishes Air Force policy for the management of information assets (all forms of data and content), across all AF information sources, as both a strategic resource and corporate asset supporting the warfighter during mission and support operations.

21.

AFPD 33-4

Information Technology Governance http://static.e-publishing.af.mil/production/1/saf_cio

_a6/publication/afpd33-4/afpd33- 4.pdf

This directive establishes the AF policy for IT Governance to fulfill the AF CIO responsibilities established in federal laws and DoD issuances and the AF IT Governance Executive Board, which will oversee existing IT investment councils, boards, and working groups throughout the IT lifecycle to effectively and efficiently deliver capabilities to users. This directive focuses on aligning IT policy, CIO policy, and capabilities management with doctrine, statutory, and regulatory guidelines that govern accountability and oversight over IT requirements to resource allocation, program development, test, and deployment and operations under the direction and authority of the AF IT Governance Executive Board chaired by the AF CIO.

(COMPLIANCE)

Standard URL Description

22.

DoDI 8510.01 - DoD Risk Management Framework (RMF) for DoD Information Technology http://www.dtic.mil/whs/directives/corr es/pdf/851001_2014.pdf

Provides procedural guidance for the reciprocal acceptance of authorization decisions and artifacts within DoD, and between DoD and other federal agencies, for the authorization and connection of information systems (ISs).

Revised from 2007 version on 12 March 2014.

23. DoDI 8500.01 – Cyber Security (CS) http://www.dtic.mil/whs/directives/corr es/pdf/850001_2014.pdf

The purpose of the Defense Cybersecurity program is to ensure that IT can be used in a way that allows mission owners and operators to have confidence in the confidentiality, integrity, and availability of IT and DoD information, and to make choices based on that confidence

24.

DoDI 8551.01 – Ports, Protocols and

Services Management http://www.dtic.mil/whs/directives/corr es/pdf/855101p.pdf

25.

CJCSI 6211.02D –

Defense Information

Systems Network

(DISN)

Responsibilities http://www.dtic.mil/cjcs_directives/cda ta/unlimit/6211_02.pdf

This instruction establishes policy and responsibilities for the connection of information systems (ISs) (e.g., applications, enclaves, or outsourced processes) and unified capabilities (UC) products to the DISN provided transport (including data, voice, and video) and access to information services transmitted over the DISN (including data, voice, video, and cross-domain).

26.

DFARS 252.227-

7013 Rights in

Technical Data Non- Commercial Items http://farsite.hill.af.mil/reghtml/regs/far 2afmcfars/fardfars/dfars/Dfars252_22

7.htm#P696_47162

Provides guidelines for rights in technical data on non-commercial items

(COMPLIANCE)

Standard URL Description

27.

Department of Defense

Architecture Framework (DoDAF)

Ver2.02 Aug 2010 http://dodcio.defense.gov/dodaf20.as px

The Department of Defense Architecture Framework (DoDAF), Version 2.0 is the overarching, comprehensive framework and conceptual model enabling the development of architectures to facilitate the ability of Department of Defense (DoD) managers at all levels to make key decisions more effectively through organized information sharing across the Department, Joint Capability Areas (JCAs), Mission, Component, and Program boundaries. The DoDAF serves as one of the principal pillars supporting the DoD Chief Information Officer (CIO) in his responsibilities for development and maintenance of architectures required under the Clinger-Cohen Act. DoDAF is prescribed for the use and development of Architectural Descriptions in the Department. It also provides extensive guidance on the development of architectures supporting the adoption and execution of Net-centric services within the Department.

28.

DFARS 252.227-

7014 Rights in Non-commercial Computer Software http://farsite.hill.af.mil/reghtml/regs/far 2afmcfars/fardfars/dfars/Dfars252_22

7.htm#P696_47162

Guidance on rights in technical data and computer software small business innovation research (SBIR) program.

29.

DFARS 252.227-

7015 Technical Data Commercial Items http://www.acq.osd.mil/dpap/dars/dfar s/html/current/227_71.htm#227.7102-

Provides the Government specific license rights in technical data pertaining to commercial items or processes. DoD may use, modify, reproduce, release, perform, display, or disclose data only within the Government. The data may not be used to manufacture additional quantities of the commercial items and, except for emergency repair or overhaul and for covered Government support contractors, may not be released or disclosed to, or used by, third parties without the contractor's written permission.

30.

DFARS 252.227-

7017 Identification and Assertion of Use, Release, or

Disclosure Restrictions http://farsite.hill.af.mil/reghtml/regs/far 2afmcfars/fardfars/dfars/Dfars252_22

7.htm#P1182_92447

Provides requirements for the identification and assertion of technical data.

31.

DoD 5220.22-M, National Industrial Security Program Operating Manual http://www.dtic.mil/whs/directives/corr es/pdf/522022m.pdf

Provides baseline standards for the protection of classified information released or disclosed to industry in connections with classified contracts under the National Industrial Security Program.

(COMPLIANCE)

Standard URL Description

32.

DoD Discovery Metadata

Specification

(DDMS)

https://metadata.ces.mil/dse/irs/DDM S/

Visibility, accessibility, and understandability are the high priority goals of the DoD Net-Centric Data Strategy. Of these goals, visibility and discovery are intimately linked. Visibility of a resource is, in a practical sense, useless, if the resource is not easily discoverable. With the express purpose of supporting the visibility goal of the DoD Net-Centric Data Strategy, the DDMS specifies a set of information fields that are to be used to describe any data or service asset, i.e., resource, that is to be made discoverable to the Enterprise, and it serves as a reference for developers, architects, and engineers by laying a foundation for Discovery Services.

33.

DoD Manual 5200.01, DoD

Information Security Program: Overview, Classification, and

Declassification, V1- V4 http://www.dtic.mil/whs/directives/corr es/pdf/520001_vol1.pdf

The purpose of this manual is to implement policy, assign responsibilities, and provide procedures for the designation, marking, protection, and dissemination of controlled unclassified information (CUI) and classified information, including information categorized as collateral, sensitive compartmented information (SCI), and Special Access Program (SAP).

34.

TIA/EIA-TSB-72,

Centralized Optical

Fiber Cabling Guidelines http://www.tiaonline.org/

Must be purchased.

ANSI/TIA/EIA-568-B series standard incorporates and refines the technical content of TSB67, TSB72, TSB75, TSB95 and TIA/EIA-568-A-1, A-2, A-3, A-4 and A- 5.

35. DoD Mobile Application Strategy http://archive.defense.gov/news/dod mobilitystrategy.pdf

It is intended to align the progress of various mobile device pilots and initiatives across DoD under common objectives, ensuring that the warfighter benefits from such activities and aligns with efforts composing the Joint Information Environment.

36.

DoD CIO Net- Centric Data

Strategy http://dodcio.defense.gov/Portals/0/D ocuments/Net-Centric-Data-Strategy-

2003-05-092.pdf

This Strategy lays the foundation for realizing the benefits of net centricity by identifying data goals and approaches for achieving those goals. To realize the vision for net-centric data, two primary objectives must be emphasized: (1) increasing the data that is available to communities or the Enterprise and (2) ensuring that data is usable by both anticipated and unanticipated users and applications.

(Source: Department of Defense Net- Centric Data Strategy, DoD CIO, 9 May

(COMPLIANCE)

Standard URL Description

37.

DoD CIO Net-

Centric Services Strategy http://dodcio.defense.gov/Portals/0/d ocuments/DoD_NetCentricServicesSt rategy.pdf

The DoD Net-Centric Services Strategy (NCSS) [R1313] builds upon the DoD Net- Centric Data Strategy's (May 2003) goals of making data assets visible, accessible, and understandable. The NCSS establishes services as the preferred means by which data producers and capability providers can make their data assets and capabilities available across the DoD and beyond. It also establishes services as the preferred means by which consumers can access and use these data assets and capabilities.

38.

DoDD 5205.02E, Operations Security (OPSEC) Program http://www.dtic.mil/whs/directives/corr es/pdf/520502e.pdf

Underscores the importance of OPSEC and how it is integrated as a core military capability within Information Operations (IO) that must be followed in daily application of military operations.

39.

DoDD 8000.01 Management of the

Department of Defense Information

Enterprise http://www.dtic.mil/whs/directives/corr es/pdf/800001p.pdf

Provides direction on creating an information advantage for DoD personnel and mission partners, and establishing and defining roles for CIOs at various levels within the Department of Defense

40.

DoDD 8100.02, Use of Commercial

Wireless Devices, Services, and

Technologies in the DoD Global

Information Grid

(GIG)

http://www.dtic.mil/whs/directives/corr es/pdf/810002p.pdf

Establishes policy and assigns responsibilities for the use of commercial wireless devices, services, and technologies in the DoD Global Information Grid (GIG) (DoD Directive 8100.1, "Global Information Grid (GIG) Overarching Policy," September 19, 2002). Directs the development and use of a Knowledge Management (KM) process to promote the sharing of wireless technology capabilities, vulnerabilities, and vulnerability mitigation strategies throughout the Department of Defense. Promotes joint interoperability using open standards throughout the Department of Defense for commercial wireless services, devices, and technological implementations.

41.

DoDI 1100.22 Policy and Procedures For

Determining Workforce Mix http://www.dtic.mil/whs/directives/corr es/pdf/110022p.pdf

Provides manpower mix criteria and guidance for risk assessments to be used to identify and justify activities that are inherently governmental (IG); commercial (exempt from private sector performance);

and commercial (subject to private sector performance).

42.

AFI 63-101/20-101,

Integrated Life Cycle Management http://static.e-publishing.af.mil/production/1/saf_aq/ publication/afi63-101_20-101/afi63-

101_20-101.pdf

It identifies elements of Air Force systems engineering (SE) practice and management required to provide and sustain, in a timely manner, cost-effective products and systems that are operationally safe, suitable, and effective.

(COMPLIANCE)

Standard URL Description

43.

DoDI 3222.03, DoD Electromagnetic Environmental

Effects (E3) Program http://www.dtic.mil/whs/directives/corr es/pdf/322203p.pdf

Reissue DoD Directive (DoDD) 3222.3 (Reference (a) as a DoD instruction (DoDI) in accordance with the authority in DoDD

5144.02 (Reference (b)).

The mission of the DoD E3 IPT is to promote communication, coordination, commonality, and synergy among the DoD Components for E3-related matters.

44.

DoDD 5230.24, Distribution

Statements on Technical

Documents http://www.dtic.mil/whs/directives/corr es/pdf/523024p.pdf

This instruction updates policies and procedures for marking technical documents, including production, engineering, and logistics information, to denote the extent to which they are available for distribution, release, and dissemination without additional approvals or authorizations.

45.

AFI 33-200, Air Force Cybersecurity

Program Management http://static.e-publishing.af.mil/production/1/saf_cio

_a6/publication/afi33-200/afi33- 200.pdf

This AFI provides general direction for implementation of IA and management of IA programs according to AFPD 33-2.

Compliance ensures appropriate measures are taken to ensure the availability, integrity, and confidentiality of Air Force ISs and the information they process. Using appropriate levels of protection against threats and vulnerabilities help prevent denial of service, corruption, compromise, fraud, waste, and abuse.

46.

AFI 33-210, AF

Certification and

Accreditation (C&A) Program (AFCAP) http://static.e-publishing.af.mil/production/1/saf_cio

_a6/publication/afi33-210/afi33- 210.pdf

AF C&A program guidance

(COMPLIANCE)

Standard URL Description

47.

DODI 8330.01

Interoperability of

Information Technology (IT), Including National Security Systems

(NSS)

http://www.dtic.mil/whs/directives/corr es/pdf/833001p.pdf

Establishes policy, assigns responsibilities, and provides direction for certifying the interoperability of IT and NSS pursuant to sections 2222, 2223, and 2224 of Title 10, United States Code (Reference (c)).

Establishes a capability-focused, architecture-based approach for interoperability analysis. Establishes the governing policy and responsibilities for interoperability requirements development, test, certification and prerequisite for connection of IT, including NSS (referred to in this instruction as “IT”). Defines a doctrine, organization, training, materiel, leadership and education, personnel, facilities, and policy (DOTMLPF-P) approach to enhance life-cycle interoperability of IT. Establishes the requirement for enterprise services to be certified for interoperability. Incorporates and cancels DoDD 4630.05, DoDI 4630.8, and DoD Chief Information Officer (CIO) memorandum (References (d), (e), and (f)).

48.

NetCentric Enterprise Solutions for Interoperability

(NESI)

https://nesix.spawar.navy.mil/home.ht ml

NESI is a body of architectural and engineering knowledge that guides the design, implementation, maintenance, evolution, and use of the Information Technology (IT) portion of net-centric solutions for defense application.

49.

AFMAN 33-145

Collaboration

Services and Voice Systems

Management http://static.e-publishing.af.mil/production/1/saf_cio

_a6/publication/afman33- 145/afman33-145.pdf

It establishes procedures and guidance for Collaboration Services including electronic collaboration and management of Video Teleconferencing (VTC) resources to include systems, equipment, personnel, time, and money and provides the directive guidance for Air Force VTC and voice systems management activities.

50.

DoDI 8520.02 Public Key Infrastructure

(PKI) and Public Key (PK) Enabling http://www.dtic.mil/whs/directives/corr es/pdf/852002p.pdf

This instruction establishes and implements policy, assign responsibilities, and prescribe procedures for developing and implementing a DoD-wide PKI and enhancing the security of DoD information systems by enabling these systems to use PKI for authentication, digital signatures, and encryption.

51. Installation Energy Management http://www.dtic.mil/whs/directives/corr es/pdf/417011p.pdf

ENERGY STAR is a joint program of the U.S. Environmental Protection Agency and the U.S. Department of Energy helping us all save money and protect the environment through energy efficient products and practices. It was enacted by Executive Order 13423 and governed by FAR 23.704.

(COMPLIANCE)

Standard URL Description

52.

Federal Information Security

Management Act

(FISMA) 2002

http://www.dhs.gov/federal-information-security-management-act-fisma

FISMA was enacted as part of the E- Government Act of 2002 to “provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support Federal operations and assets,” and also to “provide for development and maintenance of minimum controls required to protect Federal information and information systems.”

FISMA requires Federal agencies to:

•designate a Chief Information Officer

(CIO),

•delegate to the CIO authority to ensure compliance with the requirements imposed by FISMA, •implement an information security program, •report on the adequacy and effectiveness of its information security policies, procedures, and practices, •participate in annual independent evaluations of the information security program and practices, and •develop and maintain an inventory of the agency’s major information systems.

FISMA requires the Director of the Office of Management and Budget (OMB) to ensure the operation of a central Federal information security incident center. FISMA makes the National Institute of Standards and Technology (NIST) responsible for “developing standards, guidelines, and associated methods and techniques” for information systems used or operated by an agency or contractor, excluding national security systems.

53.

FedRAMP Security Controls for Cloud Service Providers http://cloud.cio.gov/document/fedram p-security-controls

The attachment at the link contains a listing for the FedRAMP low and moderate baseline security controls, along with additional guidance and requirements for Cloud Service Providers. Those controls, guidance, and requirements are key standards for NetOps vendors to meet for any Cloud-related task orders that might have issues on NetOps.

(COMPLIANCE)

Standard URL Description

54.

GiG Technical

Guidance Federation GIG-F https://gtg.csd.disa.mil/uam/login.do

The GIG Technical Guidance Federation (GTG-F) is a suite of software applications on the NIPRNet and SIPRNet (June 2012) that provides technical guidance across the Enterprise to achieve net-ready, interoperable, and supportable GIG systems. The GTG-F assists program managers, portfolio managers, engineers and others in answering two questions critical to any Information Technology (IT) or National Security Systems (NSS): (1) Where does the IT or NSS fit, as both a provider and consumer, into the GIG with regard to End-to-End technical performance, access to data and services, and interoperability; (2) What must an IT or NSS do to ensure technical interoperability with the GIG. The GTG-F content provides the technical information to various users in addressing and resolving technical issues needed to meet functional requirements (i.e., features and capabilities) of the GIG.

This GTG-F content consists of and is based on GIG net-centric IT standards, associated profiles, engineering best practices and reference implementation specifications.

55.

Homeland Security Presidential

Directive 12 (HSPD 12) http://www.dhs.gov/homeland-security-presidential-directive-12

Federal law signed by George Bush that directed promulgation of a Federal standard for secure and reliable forms of identification for Federal employees and contractors. Part two provides detailed specifications that will support technical interoperability among PIV systems of Federal departments and agencies. NIST has been designated as the approval and testing authority to certify products. FIPS 201 implements this policy.

56.

ICD 503, IT Systems Security, Risk Management, Certification and Accreditation http://www.dni.gov/files/documents/IC D/ICD_503.pdf

This Intelligence Community Directive (ICD) establishes Intelligence Community (IC) policy for information technology systems security risk management, certification and accreditation. This ICD focuses on a more holistic and strategic process for the risk management of information technology systems, and on processes and procedures designed to develop trust across the intelligence community information technology enterprise through the use of common standards and reciprocally accepted certification and accreditation decisions.

(COMPLIANCE)

Standard URL Description

57.

IEEE/EIA 12207.0

Standard for Information Technology http://IEEE.org

IEEE/EIA 12207.0, "Standard for Information Technology – Software Life Cycle Processes", is a standard that establishes a common framework for software life cycle process. This standard officially replaced MIL-STD-498 for the development of DoD software systems in May 1998.[1] Other NATO nations may have adopted the standard informally or in parallel with MIL-STD-498.This standard defines a comprehensive set of processes that cover the entire life-cycle of a software system—from the time a concept is made to the retirement of the software. The standard defines a set of processes, which are in turn defined in terms of activities. The activities are broken down into a set of tasks. The processes are defined in three broad categories: Primary Life Cycle Processes, Supporting Life Cycle Processes, and Organizational Life Cycle Processes.

58.

AFI 33-115 Air Force Information

Technology (IT) Service management http://static.e-publishing.af.mil/production/1/saf_cio

_a6/publication/afi33-115/afi33- 115.pdf

This Air Force instruction (AFI) implements Air Force Policy Directive (AFPD) 33-1, Information Resources Management. It sets forth policies regarding the official or authorized use of government-provided electronic messaging systems on both Non-secure Internet Protocol Router Network (NIPRNet) and SECRET Internet Protocol Router Network (SIPRNet). It identifies the Defense Message System (DMS) as the core-messaging system of record for the Air Force. It provides the roles, standards, and guidance relating to the messaging classes used by the Air Force: organizational DMS High Grade Service (HGS), and Simple Mail Transfer Protocol (SMTP) electronic mail (E-mail) messaging. This instruction applies to all Air Force organizations, personnel, Air National Guard, Air Force Reserve Command, and contractors regardless of the information classification transmitted or received. This instruction provides guidance to differentiate between record and non-record E-mail.

(COMPLIANCE)

Standard URL Description

59. ISO/IEC 20000 http://www.iso.org/iso/home.html

ISO/IEC 20000 is an international standard for IT Service Management (ITSM). It allows IT organizations to ensure the alignment between ITSM processes and their overall organization strategy. It requires the service provider to plan, establish, implement, operate, monitor, review, maintain and improve a service management system (SMS). ISO/IEC 20000 consist of 5 separate documents, ISO/IEC 20000-1 through 20000-5

60.

ITU

Recommendation

H.320, Narrow-band Visual Telephone

Systems and Terminal Equipment http://www.itu.int/rec/T-REC-H.320

International Telecommunication Union recommendation that DoD requires for VTC and DISN Video Services equipment must meet. This standard sets BONDING (Bandwidth on Demand) algorithms to ensure bandwidth in proper increments.

This included with FTR 1080B-2002.

61.

CJCSI 6212.01F

Interoperability and

Supportability of Information

Technology and National Security

Systems http://www.dtic.mil/cjcs_directives/cda ta/unlimit/6212_01.pdf

Establishes policies and procedures for developing, coordinating, reviewing, and approving Information Technology (IT) and National Security System (NSS) Interoperability and Supportability (I&S) needs. Establishes procedures to perform I&S Certification of Joint Capabilities Integration and Development System (JCIDS) Acquisition Category (ACAT) programs/systems. Establishes procedures to perform I&S Certification of Information Support Plans (ISPs) and Tailored ISPs (TISPs) for all ACAT, non-ACAT and fielded programs/systems. Defines the five elements of the Net-Ready Key Performance Parameter (NR-KPP).

Provides guidance for NR-KPP development and assessment. Establishes procedures for the Joint Interoperability Test Command (JITC) Joint Interoperability Test Certification. Adds the requirement from Joint Requirements Oversight Council Memorandum (JROCM) 010-08, 14 January 2008, “Approval to Incorporate Data and Service Exposure Criteria into the Interoperability and Supportability Certification Process” for reporting of data and service exposure information as part of I&S submissions.

62.

DODI 5015.02 DoD Records

Management Program http://www.dtic.mil/whs/directives/corr es/pdf/501502p.pdf

Establishes policy and assigns responsibilities for the management of DoD records in all media, including electronic

(COMPLIANCE)

Standard URL Description

63.

Section 508 of the

Rehabilitation Act of http://www.opm.gov/html/508-textOfLaw.asp

On August 7, 1998, President Clinton signed into law the Rehabilitation Act Amendments of 1998 which covers access to federally funded programs and services.

The law strengthens section 508 of the Rehabilitation Act and requires access to electronic and information technology provided by the Federal government. The law applies to all Federal agencies when they develop, procure, maintain, or use electronic and information technology.

Federal agencies must ensure that this technology is accessible to employees and members of the public with disabilities to the extent it does not pose an "undue burden." Section 508 speaks to various means for disseminating information, including computers, software, and electronic office equipment. It applies to, but is not solely focused on, Federal pages on the Internet or the World Wide Web.

64.

DODD 8100.02

Use of Commercial Wireless Devices, Services, and Technologies in the

DoD Information Network (DODIN) http://www.dtic.mil/whs/directives/corr es/pdf/810002p.pdf

Establishes policy and assigns responsibilities for the use of commercial wireless devices, services, and technologies in the DoD Global Information Grid (GIG) (DoD Directive 8100.1, "Global Information Grid (GIG) Overarching Policy," September 19, 2002). Directs the development and use of a Knowledge Management (KM) process to promote the sharing of wireless technology capabilities, vulnerabilities, and vulnerability mitigation strategies throughout the Department of Defense. Promotes joint interoperability using open standards throughout the Department of Defense for commercial wireless services, devices, and technological implementations.

65.

DODD 8100.1

Department of

Defense Information Network (DoDIN)

Overarching Policy http://www.acq.osd.mil/ie/bei/pm/ref-library/dodd/d81001p.pdf

Establishes policy and assigns responsibilities for GIG configuration management, architecture, and the relationships with the Intelligence Community (IC) and defense intelligence components.

(COMPLIANCE)

Standard URL Description

66.

DODI 8320.02

Sharing Data, Information, and Information

Technology (IT) Services in the Department of

Defense http://www.dtic.mil/whs/directives/corr es/pdf/832002p.pdf

Establishes policies and responsibilities to implement data sharing, in accordance with Department of Defense Chief Information Officer Memorandum, “DoD Net-Centric Data Strategy,” May 9, 2003, throughout the Department of Defense. Directs the use of resources to implement data sharing among information capabilities, services, processes, and personnel interconnected within the Global Information Grid (GIG), as defined in DoD Directive 8100.1, “Global Information Grid (GIG) Overarching Policy,” September 19, 2002.

67.

Security Technical

Implementation Guides (STIGs) http://iase.disa.mil/stigs/Pages/index.

aspx

The Security Technical Implementation Guides (STIGs) are the configuration standards for DoD IA and IA-enabled devices/systems. The STIGs contain technical guidance to 'lock down' information systems/software that might otherwise be vulnerable to a malicious computer attack.

68. Title 44 USC Section http://us-code.vlex.com/vid/sec-definitions-19256373

(2)(A) The term “national security system” means any information system (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency—

(i) the function, operation, or use of which—

(I) involves intelligence activities;

(II) involves cryptologic activities related to national security;

(III) involves command and control of military forces;

(IV) involves equipment that is an integral part of a weapon or weapons system; or

(V) subject to subparagraph (B), is critical to the direct fulfillment of military or intelligence missions; or

(ii) is protected at all times by procedures established for information that have been specifically authorized under criteria established by an Executive order or an Act of Congress to be kept classified in the interest of national defense or foreign policy.

(B) Subparagraph (A)(i)(V) does not include a system that is to be used for routine administrative and business applications (including payroll, finance, logistics, and personnel management applications).

(COMPLIANCE)

Standard URL Description

69.

Security Technical Implementation Guides (STIGs)

CJCSI 6510.01F

Information Assurance (IA) AND

Support To Computer Network

DEFENSE (CND)

http://www.dtic.mil/cjcs_directives/cda ta/unlimit/6510_01.pdf

The Security Technical Implementation Guides (STIGs) and the NSA Guides are the configuration standards for DOD IA and IA-enabled devices/systems. Since 1998, DISA Field Security Operations (FSO) has played a critical role enhancing the security posture of DoD's security systems by providing the Security Technical Implementation Guides (STIGs). The STIGs contain technical guidance to "lock down" information systems/software that might otherwise be vulnerable to a malicious computer attack. DISA FSO is in the process of moving the STIGs towards the use of the NIST Security Content Automation Protocol (S-CAP) in order to be able to “automate” compliance reporting of the STIGs.

70.

CNSSI 1253:

Security

Categorization and Controls Selection for National Security Systems http://disa.mil/Services/DoD-Cloud- Broker/~/media/Files/DISA/Services/

Cloud-Broker/cnssi-security-categorization.pdf

Instruction serves as a companion document to NIST SP 800-53 for organizations that employ NSS.

71.

NIST SP 500-292:

Cloud Computing

Reference Architecture http://disa.mil/Services/DoD-Cloud- Broker/~/media/Files/DISA/Services/

Cloud-Broker/nist-cloud-ref-architecture.pdf

Overview of the five major roles & responsibilities using the Cloud Computing Taxonomy.

72.

NIST SP 800-146:

Cloud Computing

Synopsis & Recommendations http://disa.mil/Services/DoD-Cloud- Broker/~/media/Files/DISA/Services/ Cloud-Broker/nist-cloud-synopsis.pdf

NIST explains the cloud computing technology and provides recommendations for information technology decision makers.

73.

NIST SP 800-145:

Definition of Cloud

Computing http://disa.mil/Services/DoD-Cloud- Broker/~/media/Files/DISA/Services/

Cloud-Broker/NIST-SP800145- DefinitionofCloudComputing.pdf

NIST provides a baseline for what cloud computing is and how to best use cloud computing. The services and deployment models are defined within this document.

74.

NIST SP 800-53:

Security and Privacy Controls for Federal Information Systems and Organizations http://disa.mil/Services/DoD-Cloud- Broker/~/media/Files/DISA/Services/

Cloud-Broker/NIST-SP80053- SecurityandPrivacyControls.pdf

Guidelines for selecting and specifying security controls for organizations and information systems supporting the executive agencies of the federal government to meet requirement FIPS Publication 200.

75.

Best Practices for Acquiring IT as a

Service http://disa.mil/Services/DoD-Cloud- Broker/~/media/Files/DISA/Services/

Cloud-Broker/Creating-Effective- Cloud-Computing-Contracts-for-the-

Federal-Government.pdf

Guidance on the implementations of shared services as well as navigate through the complex array of issues that are necessary to move to a shared service environment.

76.

Department of Defense Chief

Information Officer Cloud Computing

Strategy http://dodcio.defense.gov/Portals/0/D ocuments/Cloud/DoD%20Cloud%20

Computing%20Strategy%20Final%20 with%20Memo%20-

%20July%205%202012.pdf

This strategy is to enable the Department to increase secure information sharing and collaboration, enhance mission effectiveness, and decrease costs using cloud services.

(COMPLIANCE)

Standard URL Description

77.

CNSSI 4009:

National Information

Assurance (IA) Glossary http://jitc.fhu.disa.mil/pki/documents/c ommittee_on_national_security_syste ms_instructions_4009_june_2006.pdf

This revision of CNSSI 4009 incorporates many new terms submitted by the CNSS Membership. Most of the terms from the 2006 version of the Glossary remain, but a number of them have updated definitions in order to remove inconsistencies among the communities.

78.

Executive Order 13526: Classified National Security

Information http://www.whitehouse.gov/the-press-office/executive-order-classified-national-security-information

This order prescribes a uniform system for classifying, safeguarding, and declassifying national security information, including information relating to defense against transnational terrorism.

79.

Designation of the Defense Information Systems Agency as the Department of

Defense Enterprise Cloud Service

Broker http://www.disa.mil/Services/DoD- Cloud-

Broker/~/media/Files/DISA/Services/ Cloud-Broker/disa-designation-memo.pdf

This memorandum establishes Defense Information Systems Agency (DISA) as the DoD Enterprise Cloud Service Broker.

80.

Interim Guidance Memorandum on

Use of Commercial Cloud Computing

Services http://www.disa.mil/services/dod-cloud-broker/~/media/files/disa/services/clo ud-broker/interim-guidance-memo-on-use-of-commerical-cloud-computing-services.pdf

This Memorandum serves to reinforce existing policy and processes, and is in effect for all DoD networks and systems.

81. DoD Instructions, 8500 Series http://www.dtic.mil/whs/directives/corr es/ins1.html DoD Issuances

82.

FIPS 199:

Standards for

Security Categorization of

Federal Information and Information

Systems http://csrc.nist.gov/publications/fips/fip s199/FIPS-PUB-199-final.pdf

This publication is to develop standards for categorizing information and information systems.

83.

NIST SP 800-59:

Guideline for Identifying an

Information System as a National

Security System http://csrc.nist.gov/publications/nistpu bs/800-59/SP800-59.pdf

The purpose of these guidelines is to assist agencies in determining which, if any, of their systems are national security systems as defined by FISMA and are to be governed by applicable requirements for such systems, issued in accordance with law and as directed by the President.

84.

NIST SP 800-66,

Revision 1: An

Introductory Resource Guide for Implementing the Health Insurance

Portability and Accountability Act (HIPAA) Security

Rule http://csrc.nist.gov/publications/nistpu bs/800-66-Rev1/SP-800-66-

Revision1.pdf

This Special Publication summarizes the HIPAA security standards and explains some of the structure and organization of the Security Rule. The publication helps to educate readers about information security terms used in the HIPAA Security Rule and to improve understanding of the meaning of the security standards set out in the Security Rule.

(COMPLIANCE)

Standard URL Description

85.

NIST SP 800-88,

Revision 1: Draft:

Guidelines for Media Sanitization http://nvlpubs.nist.gov/nistpubs/Speci alPublications/NIST.SP.800-88r1.pdf

This guide will assist organizations and system owners in making practical sanitization decisions based on the categorization of confidentiality of their information.

86.

NIST SP 800-122:

Guide to Protecting the Confidentiality of

Personally Identifiable

Information (PII) http://csrc.nist.gov/publications/nistpu bs/800-122/sp800-122.pdf

This document provides guidelines for a risk-based approach to protecting the confidentiality of PII. The recommendations in this document are intended primarily for U.S. Federal government agencies and those who conduct business on behalf of the agencies, but other organizations may find portions of the publication useful.

87.

NIST SP 800-144:

Guidelines on

Security and Privacy in Public Cloud

Computing http://csrc.nist.gov/publications/nistpu bs/800-144/SP800-144.pdf

The primary purpose of this…