Defense Security Service

Industrial Security Field Operations (ISFO)

Office of theDesignated Approving Authority

(ODAA)

August 2010

Defense Security Service

Overview

• ODAA Documentation

• ISFO Process Manual (August 2010)

• Certification & Accreditation (C&A)

• Common Errors/Findings

Defense Security Service

ODAA Documentation

– NISPOM (Chapter 8) (February 2006)

– Industrial Security Letters (ISLs)

– ISFO Process Manual (August 2010)

Defense Security Service

ISFO Process Manual

• System Security Plans (SSP) Types

– Standalone

– Local Area Network (LAN)

– Wide Area Network (WAN)

– Network Security Plan (NSP)

Defense Security Service

ISFO Process Manual

• Stand Alone

– Single User Stand Alone (SUSA)• Only one general user• Physical security

– Closed area– Restricted area– Classification level

– Multi User Stand Alone (MUSA)• Two or more general users• Physical security

– Closed area– Restricted area– Classification level

Defense Security Service

ISFO Process Manual

• Local Area Network (LAN)

– Peer to peer• Local user authentication

– Closed area– Restricted area– Classification level

– Domain controlled• Central user authentication

– Closed area– Restricted area– Classification level

Defense Security Service

ISFO Process Manual

• Wide Area Network (WAN)

– Unified WAN• RDAA of host node will accredit• IATO not allowed• Single unified network SSP

– Must include all nodes on the unified network

– Interconnected WAN• Separately accredited systems• Network Security Plan (NSP)• IATO may be issued

Defense Security Service

ISFO Process Manual

• Network Security Plan (NSP)

– Allows interconnection of separately accredited systems

– ATO/IATO will list nodes approved for connection

– Provides overall network view

– RDAA of host node will accredit

– Network ISSO is responsible

Defense Security Service

ISFO Process Manual

• Self Certification

– Authority granted in MSSP/Profile, Approval to Operate (ATO)

– Allows ISSM to self certify like systems• Specific to system type and similar operations

– Only systems that are NISPOM compliant may be self certified

– Documentation for self certified systems

– Notify IS Rep, ISSP and ODAA

Defense Security Service

Certification & Accreditation (C&A)

• Plan Submission

– Must use approved SSP/MSSP/NSP templates

– Assign Unique Identifier (UID)• Once assigned, UIDs never change

– Email to ODAA• CC ODAA, IS Rep and ISSP• Email subject line• Email body

Defense Security Service

Table E-1 Subject Line Requirements for Plan Submissions

Unique Identifiers

¹ Use the facility's 5 character Cage Code

² Use the date on the SSP or MSSP

³ Use a number from 00001 - 99999. Each plan must use a unique number.

4 Use a number from 00001 - 99999. Each plan must use a unique number.

Variables

MSSP Use MSSP when the plan is a Master Security Plan

REV Use Rev when the plan has been resubmitted after the Contractor has made revisions as required by the ODAA.

SIPR Use when the IS seeking accreditation has a connection to the SIPRNet.

TERM Use when the IS is no longer used for classified processing

INT Use INT for SSPs with International connections

NSP Use NSP for Network Security Plans

DIB Use DIB for DIBCS System Security Plans

Region PLAN Unique Identifier IS # Identifier Variables

XXXXX-YYYYMMDD-XXXXX

CapitalNorthernSouthernWestern

CageCode¹ YYYYMMDD² XXXXX³ XXXXX4 See Variables

Defense Security Service

Certification & Accreditation (C&A)

• Process

– Email plan to ODAA

– ODAA accepts or rejects plan

– Once accepted, ISSP performs desktop review

– RDAA can deny or issue IATO

– If required ISSM resubmits corrections

– ISSP will perform on site verification

– RDAA issues ATO

Defense Security Service

C&A Common Errors

• Missing or incomplete UID • Not using approved DSS templates• Missing signed IS Security Package Submission and Certification

Statement• Missing signed DSS Form 147• Missing ISSM System Certification Test Checklist• Missing GCA risk acceptance letter for variances• Missing MOU if required• Missing published and promulgated IS Security Policy addressing

the classified processing environment • ISSM fails to submit required corrections

Defense Security Service

Common Errors

– Passwords

– SSPs not properly updated (Hardware list, software list, configuration diagram not accurate)

– Changing the security posture of the system without authorization

Defense Security Service

Audit Issues

– References: NISPOM 8-602, ISL 2007-01 items 44 & 45

– Security Relevant Objects (SRO), file, and folder permission & auditing

– System auditing

Defense Security Service

Questions & Answers