# Information Assurance Workforce Improvement Program

Incorporating Change 4,
11/10/2015

# December 19, 2005 Assistant Secretary Of Defense For Networks And Information Integration/Department Of Defense Chief Information Officer


December 19, 2005


## Foreword


This Manual is issued under the authority of DoD Directive 8570.1 "Information Assurance Training, Certification, and Workforce Management," August 15, 2004 DoD Directive 5144.02 (Reference (a)) to implement the policy in DoD Directive 8140.01 (Reference (ab)). It provides guidance and procedures for the training, certification, and management of the DoD workforce conducting Information Assurance (IA) functions in assigned duty positions.  It also provides information and guidance on reporting metrics and the implementation schedule for Reference
(ab).


This Manual applies to the Office of the Secretary of Defense (OSD), the Military Departments, the Chairman of the Joint Chiefs of Staff, the Combatant Commands, the Office of the Inspector General of the Department of Defense, the Defense Agencies, the DoD Field Activities, and all other organizational entities in the Department of Defense (hereafter referred to collectively as the "DoD Components").


This Manual is effective immediately and is mandatory for use by all the DoD Components. Send recommended changes to the Manual to the following address:


Deputy Assistant Secretary of Defense for Information and Identity Assurance Assistant Secretary of Defense for Network and Information Integration/Department of Defense Chief Information Officer (ASD(NII)/DoD CIO) 1155 Defense Pentagon Washington, DC 20301-1155

The DoD Components, other Federal agencies, and the public may download this Manual from the DoD Issuances Web Site at http://www.dtic.mil/whs/directives.


## Table Of Contents

Page


FOREWORD
2


TABLE OF CONTENTS
3


FIGURES
6


TABLES
6


REFERENCES
7


ACRONYMS
9


CHAPTER 1 - GENERAL INFORMATION
12
C1.1.  PURPOSE
12
C1.2.  DEFINITIONS
12
C1.3.  DoD IA WORKFORCE MANAGEMENT OBJECTIVES
12
C1.4.  RESPONSIBILITIES
13


CHAPTER 2 - IA WORKFORCE STRUCTURE OVERVIEW
17
C2.1.  INTRODUCTION
17
C2.2.  IA WORKFORCE CATEGORIES, SPECIALTIES, AND LEVELS
18
C2.3.  TRAINING AND CERTIFICATION PROGRAMS
19


CHAPTER 3 - IA WORKFORCE TECHNICAL CATEGORY
21
C3.1.  INTRODUCTION
21
C3.2.  TECHNICAL CATEGORY DESCRIPTION
21
C3.3.  INFORMATION ASSURANCE TECHNICAL LEVEL I
25
C3.4.  INFORMATION ASSURANCE TECHNICAL LEVEL II
27
C3.5.  INFORMATION ASSURANCE TECHNICAL LEVEL III
29


CHAPTER 4 - IA WORKFORCE MANAGEMENT CATEGORY
32
C4.1.  INTRODUCTION
32
C4.2.  MANAGEMENT CATEGORY DESCRIPTION
32
C4.3.  INFORMATION ASSURANCE MANAGEMENT IAM LEVEL I
34
C4.4.  INFORMATION ASSURANCE MANAGEMENT IAM LEVEL II
36
C4.5.  INFORMATION ASSURANCE MANAGEMENT IAM LEVEL III
38

CHAPTER 5 - DESIGNATED ACCREDITING AUTHORITY (DAA)
REQUIREMENTS
41
C5.1.  INTRODUCTION
41
C5.2.  DAA FUNCTIONS AND RESPONSIBILITIES
41
| C5.3.  DAA TRAINING AND CERTIFICATION REQUIREMENT         | 42                                                |
|-----------------------------------------------------------|---------------------------------------------------|
|                                                           |                                                   |
| CHAPTER 6 - AUTHORIZED USER MIMINUM IA AWARENESS          |                                                   |
| REQUIREMENTS                                              | 44                                                |
| C6.1.  INTRODUCTION                                       | 44                                                |
| C6.2.  GENERAL REQUIREMENTS                               | 44                                                |
| C6.3.  SPECIFIC REQUIREMENTS                              | 45                                                |
|                                                           |                                                   |
| CHAPTER 7 - IA WORKFORCE IDENTIFICATION, TRACKING, AND    |                                                   |
| ASSIGNMENT                                                | 48                                                |
| C7.1.  INTRODUCTION                                       | 48                                                |
| C7.2.  IA WORKFORCE MANAGEMENT                            | 48                                                |
| C7.3.  IA WORKFORCE IDENTIFICATION REQUIREMENTS           | 49                                                |
|                                                           |                                                   |
| CHAPTER 8 - IA WORKFORCE MANAGEMENT REPORTING AND METRICS | 52                                                |
| C8.1.  INTRODUCTION                                       | 52                                                |
| C8.2.  REPORTING                                          |                                                   |
|                                                           |                                                   |
| CHAPTER 9 - IA WORKFORCE IMPLEMENTATION REQUIREMENTS      | 5                                                 |
| 7                                                         |                                                   |
|                                                           |                                                   |
| C9.1.  INTRODUCTION                                       | 5                                                 |
| 7                                                         |                                                   |
|                                                           |                                                   |
| C9.2.  GENERAL REQUIREMENTS                               | 5                                                 |
| 7                                                         |                                                   |
|                                                           |                                                   |
| C9.3.  SPECIFIC REQUIREMENTS                              | 5                                                 |
| 7                                                         |                                                   |
|                                                           |                                                   |
| C9.4.  IMPLEMENTATION PLAN REPORTING REQUIREMENTS         | 60                                                |
|                                                           |                                                   |
| CHAPTER 10 - IA WORKFORCE SYSTEM ARCHITECTURE AND         |                                                   |
| ENGINEERING (IASAE) SPECIALTY                             | 6                                                 |
| 0                                                         |                                                   |
|                                                           |                                                   |
| C10.1.  INTRODUCTION                                      | 6                                                 |
| 0                                                         |                                                   |
|                                                           |                                                   |
| C10.2.  IASAE SPECIALTY DESCRIPTION                       | 6                                                 |
| 0                                                         |                                                   |
|                                                           |                                                   |
| C10.3.  IASAE LEVEL I                                     | 6                                                 |
| 2                                                         |                                                   |
|                                                           |                                                   |
| C10.4.  IASAE LEVEL II                                    | 6                                                 |
| 5                                                         |                                                   |
|                                                           |                                                   |
| C10.5.  IASAE LEVEL III                                   | 6                                                 |
| 8                                                         |                                                   |
|                                                           |                                                   |
|                                                           |                                                   |
| CHAPTER 11 - COMPUTER NETWORK DEFENSE-SERVICE PROVIDER    |                                                   |
|                                                           |                                                   |
| (CND-SP) SPECIALTY                                        | 7                                                 |
| 2                                                         |                                                   |
|                                                           |                                                   |
| C11.1. INTRODUCTION                                       | 7                                                 |
| 2                                                         |                                                   |
|                                                           |                                                   |
| C11.2.                                                    | ACCREDITED                                        |
| 2                                                         |                                                   |
|                                                           |                                                   |
| C11.3.                                                    | COMPUTER NETWORK DEFENSE ANALYST                  |
| CND-A                                                     |                                                   |
|                                                           | 7                                                 |
| 5                                                         |                                                   |
|                                                           |                                                   |
| C11.4.                                                    | COMPUTER NETWORK DEFENSE INFRASTRUCTURE SUPPORT   |
| CND-IS                                                    |                                                   |
|                                                           |                                                   |
| 7                                                         | 7                                                 |
| 6                                                         |                                                   |
|                                                           |                                                   |
| C11.5.                                                    | COMPUTER NETWORK DEFENSE INCIDENT RESPONDER       |
| CND-IR                                                    |                                                   |
| 7                                                         | 8                                                 |
| 7                                                         |                                                   |
|                                                           |                                                   |
| C11.6.                                                    | COMPUTER NETWORK DEFENSE AUDITOR                  |
| CND-AU                                                    |                                                   |
| 80                                                        |                                                   |
| 79                                                        |                                                   |
|                                                           |                                                   |
| C11.7.                                                    | COMPUTER NETWORK DEFENSE SERVICE PROVIDER MANAGER |
| 0                                                         |                                                   |
|                                                           |                                                   |
| CND-SPM                                                   |                                                   |

## Appendices

| AP1.  Appendix 1, DEFINITIONS                                     |   8 |   3 |
|-------------------------------------------------------------------|-----|-----|
| 2                                                                 |     |     |
|                                                                   |     |     |
| AP2.  Appendix 2, IA WORKFORCE LEVELS, FUNCTIONS AND              |     |     |
| CERTIFICATION APPROVAL PROCESS                                    | 89  |     |
| AP3.  Appendix 3, IA WORKFORCE REQUIREMENTS AND CERTIFICATIONS 91 |     |     |
| AP4.  Appendix 4                                                  |     |     |
| ,                                                                 |     |     |
| SAMPLE STATEMENT OF ACCEPTANCE OF                                 |     |     |
| RESPONSIBILITIES                                                  |   9 |   6 |
| 4                                                                 |     |     |
|                                                                   |     |     |


## Figures

| Figure C2.F1. Overview of Basic IA Workforce Structure    | 19         |
|-----------------------------------------------------------|------------|
| Figure C5.F1. Sample DAA Certificate of Completion        | 43         |
| Figure C8.F1. IA WIP Annual Report Format and Workforce   | Management |
| 5                                                         |            |
|                                                           |            |
|                                                           |            |

## Tables


IA Technical Workforce Requirements
24
IA Technical Level I Position Requirements
25
IA Technical Level I Functions
25
IA Technical Level II Position Requirements
27
IA Technical Level II Functions
27
IA Technical Level III Position Requirements
29
IA Technical Level III Functions
30
IA Management IAM Workforce Requirements
32
IA Management IAM Level I Position Requirements
34
IA Management IAM Level I Functions
35
IA Management IAM Level II Position Requirements
36
IA Management IAM Level II Functions
37
IA Management IAM Level III Position Requirements
38
IA Management IAM Level III Functions
39
Table C3.T1. Table C3.T2. Table C3.T3. Table C3.T4. Table C3.T5.
Table C3.T6.
Table C3.T7. Table C4.T1. Table C4.T2. Table C4.T3. Table C4.T4. Table C4.T5. Table C4.T6. Table C4.T7. Table C5.T1.
DAA Functions
42
Table C10.T1.  IASAE Workforce Requirements
610
Table C10.T2.  IASAE Level I Position Requirements
632
Table C10.T3.  IASAE Level I Functions
643
Table C10.T4.  IASAE Level II Position Requirements
665
Table C10.T5.  IASAE Level II Functions
676
Table C10.T6.  IASAE Level III Position Requirements
698
Table C10.T7.  IASAE Level III Functions
7069
Table C11.T1.  Accredited CND-SP Workforce Requirements
754
Table C11.T2.  CND Analyst *CND-A* Position Requirements
765
Table C11.T3.  CND Analyst *CND-A* Functions
776
Table C11.T4.  CND Infrastructure Support *CND-IS* Position Requirements
776
Table C11.T5.  CND Infrastructure Support *CND-IS* Functions
787
Table C11.T6.  CND Incident Responder *CND-IR* Position Requirements
798
Table C11.T7.  CND Incident Responder *CND-IR* Functions
798
Table C11.T8.  CND Auditor *CND-AU* Position Requirements
8079
Table C11.T9.  CND Auditor *CND-AU* Functions
810
Table C11.T10.CND Service Provider Manager *CND-SPM* Position Requirements
810
Table C11.T11.CND Service Provider Manager *CND-SPM* Functions
821
Table AP3.T1 Summary of IA Workforce Requirements
91

## References

(a)
DoD Directive 5144.02, "DoD Chief Information Officer (DoD CIO)," November 21, 2014
(ab) DoD Directive 8570.1, "Information Assurance Training, Certification, and Workforce
Management," August 15, 2004 DoD Directive 8140.01, "Cyberspace Workforce Management," August 11, 2015
(bc) DoD Instruction 8500.2, "Information Assurance (IA) Implementation," February 6, 2003

DoD Instruction 8500.01, "Cybersecurity," March 14, 2014
(cd) Section 3544 of tTitle 44, United States Code (de) DoD Instruction 5105.18, "DoD Intergovernmental and Intragovernmental Committee
Management Program," July 10, 2009*, as amended*
(df)
Section 1607 of Title 29, Code of Federal Regulations, section 1607, current edition
(eg) Office of Personnel Management Job Family Position Classification Standard for
Administrative Work in the Information Technology Group, GS-2200; Information
Technology Management, GS-2210, May 2001, as revised1
(g)
DoD 1400.25-M Subchapter 1920, "Classification," April 28, 2006
(h)
DoD Directive 8500.1, "Information Assurance (IA)," October 24, 2002
(ih)
DoD Directive O-8530.1, "Computer Network Defense (CND)," January 8, 2001
(ji)
DoD 5200.2-R, "Personnel Security Program," January 1987, as amended
(kj)
DoD Instruction 8510.01, "DoD Information Assurance Certification and Accreditation
Process (DIACAP)," November 28, 2007  "Risk Management Framework (RMF) for DoD Information Technology (IT)," March 12, 2014
(lk)
Section 2224 of tTitle 10, United States Code. "Defense Information Assurance

Program"
(ml) Section 278g-3 of tTitle 15, United States Code (nm) Office of Management and Budget Circular A-130 *Revised*, "Management of Federal
Information Resources, Transmittal Memorandum No. 4," Appendix 3,

November 30 28, 2000
(on) Department of Homeland Security National Cyber Security Division Program
Management Office, "Customer Agency Guide Information Systems Security Line of Business (ISS LOB), Shared Service Centers for Tier 1 Security Awareness Training and FISMA Reporting," February 27, 2007
(po) DoD Directive 1000.25, "DoD Personnel Identity Protection (PIP) Program," July 19,
2004
(qp) DoD Instruction 7730.64, "Automated Extracts of Manpower and Unit Organizational
Element Files," December 11, 2004
(rq)
DoD Instruction 1336.05, "Automated Extract of Active Duty Military Personnel
Records," May 2, 2001*July 28, 2009, as amended*
(sr)
DoD Instruction 7730.54, "Reserve DoD Components Common Personnel Data System
(RCCPDS)," August 6, 2004 May 20, 2011
(ts)
DoD Instruction 1444.2, "Consolidation of Automated Civilian Personnel Records," September 16, 1987  1444.02, Volume 1, "Data Submission Requirements for DoD Civilian
Personnel: Appropriated Fund (APF) Civilians," November 5, 2013
(ut)
DoD 8910.1-M, "DoD Procedures for Management of Information Requirements," June 30, 1998  DoD Manual 8910.01, Volume 1, " DoD Information Collections Manual:
Procedures for DoD Internal Information Collections," June 30, 2014
(vu) Director of Central Intelligence Directive 6/3, "Protecting Sensitive Compartmented
Information within Information Systems," June 5, 1999
(wv) Committee on National Security Systems Instruction No. 4009, "National Information
Security System *Assurance (IA)* Glossary," as revised May 2003 April 26, 2010
(xw) Joint Publication 1-02, "Department of Defense Dictionary of Military and Associated
Terms," as amended current edition
(yx) Chapter 51 of tTitle 5, United States Code (zy) International Standards Organization/International Electronics Commission (ISO/IEC)
17024, "*Conformity Assessment -* General Requirements for Bodies Operating
Certification of Persons," April 2003 July 3, 2012
(aaz)
DoD 5500.07-R, "DoD Joint Ethics Regulation *(JER)*," August 130, 1993, as amended


## Acronyms

Acronym
Meaning

ASD(NII)/DoD CIO
Assistant Secretary of Defense for Networks and Information Integration/DoD Chief Information Officer
C&A
Certification and Accreditation
CBT
Computer Based Training
CDS
Cross Domain Solutions
CE
Computing Environment
CIO
Chief Information Officer
CO/XO
Commanding Officer/Executive Officer
CND
Computer Network Defense

CND-A
Computer Network Defense Analyst
CND-AU
Computer Network Defense Auditor
CND-IS
Computer Network Defense Infrastructure Support
CND-IR
Computer Network Defense Incident Responder
CND-SP
Computer Network Defense Service Provider
CND-SPM
Computer Network Defense Service Provider Manager
COOP
Continuity of Operations Plan

CUI
Controlled Unclassified Information
DAA
Designated Accrediting Authority
DCIO
Deputy Chief Information Officer
DCPDS
Defense Civilian Personnel Data System
DEERS
Defense Eligibility Enrollment Reporting System
DIAP
Defense-wide Information Assurance Program
DISA
Defense Information Systems Agency
DMDC
Defense Manpower Data Center
DoD
Department of Defense

DWCA
Defense Workforce Certification Application
e-JMAPS
e-Joint Manpower and Personnel System
FISMA
Federal Information Security Management Act
FN
Foreign National
Acronym
Meaning
FY
Fiscal Year
GIG
Global Information Grid
GS
General Schedule
IA
Information Assurance
IAM
Information Assurance Management
IAO
Information Assurance Officer
IASE
Information Assurance Support Environment (DoD IA Portal)
IASAE
Information Assurance System Architect and Engineer
IAT
Information Assurance Technical
IAVA
Information Assurance Vulnerability Alert
IAVB
Information Assurance Vulnerability Bulletin
IAVM
Information Assurance Vulnerability Management
IA WIPAC
Information Assurance Workforce Improvement Program Advisory Council
INFOSEC
"Security" (The parenthetical title in DCPDS for
civilian personnel performing security (IA) functions)
IRT
Incident Response Teams
IS
Information System
(ISC)2
International Information Systems Security Certification Consortium
ISO/IEC
International Organization for Standardization/International Electrotechnical Commission
ISS LoB
Information System Security Line of Business
ISSM
Information System Security Manager
ISSO
Information System Security Officer
IT
Information Technology
LN
Local National
MAC
Mission Assurance Category
NE
Network Environment
NIPRNet
Non-classified Internet Protocol Router Network
OJT
On the Job Training
Acronym
Meaning
OMGB
Office of Management and Budget
OPM
Office of Personnel Management
OSD
Office of the Secretary of Defense
PSC
Position Specialty Code
SCI
Sensitive Compartmented Information
SIPRNet
Secret Internet Protocol Router Network
SP
Service Provider
SSC
Shared Service Center
TA
Technical Advisory
USD(AT&L)
Under Secretary of Defense for Acquisition, Technology, and Logistics
USD(I)
Under Secretary of Defense for Intelligence
USD(P&R)
Under Secretary of Defense for Personnel and Readiness
USSTRATCOM
United States Strategic Command
WIP
Workforce Improvement Program

## C1.  Chapter 1 General Information



## C1.1.  Purpose

This Manual:
C1.1.1.  Implements DoD Directive 8570.1 ( *the policy in* Reference (ab)).


C1.1.2.  Provides guidance for the identification and categorization of positions and certification of personnel conducting Information Assurance (IA) functions within the DoD
workforce supporting the DoD Global Information Grid (GIG) per DoD Instruction 8500.2
8500.01(Reference (bc)).  The DoD IA Workforce includes, but is not limited to, all individuals performing any of the IA functions described in this Manual. Additional chapters focusing on personnel performing specialized IA functions including certification and accreditation (C&A) and vulnerability assessment will be published as changes to this Manual.



C1.1.3.  Establishes IA workforce management reporting requirements to support
Reference (ab).


C1.2.  DEFINITIONS.  See Appendix 1.

## C1.3.  Dod Ia Workforce Management Objectives:


C1.3.1.  Develop a DoD IA workforce with a common understanding of the concepts, principles, and applications of IA for each category, specialty, level, and function to enhance protection and availability of DoD information, information systems, and networks.



C1.3.2.  Establish baseline technical and management IA skills among personnel performing
IA functions across the DoD enterprise.
C1.3.3.  Provide warfighters qualified IA personnel in each category, specialty and level.
C1.3.4.  Implement a formal IA workforce skill development and sustainment process, comprised of resident courses, distributive training, blended training, supervised on the job training (OJT), exercises, and certification/recertification.

C1.3.5.  Verify IA workforce knowledge and skills through standard certification testing.
C1.3.6.  Augment and expand on a continuous basis the knowledge and skills obtained through experience or formal education.

C1.4.  RESPONSIBILITIES

In addition to the responsibilities listed in Reference (ab) and section 3544 of title 44, United States Code (Reference (cd)), this Manual assigns the following:


C1.4.1.  The Assistant Secretary of Defense for Networks and Information Integration/DoD
Chief Information Officer (ASD(NII)/DoD CIO) shall:

C1.4.1.1.  Coordinate changes and updates to this Manual to maintain state of the art
functional and certification requirements for the IA workforce.

C1.4.1.2.  Develop, coordinate, and publish baseline certification requirements for
personnel performing specialized IA functions.

C1.4.1.3.  Coordinate the implementation and sustainment requirements of this Manual to
include supporting tools and resources (e.g., conferences, website, database integration, workforce identification).

C1.4.1.4.  Per DoD Instruction 5105.18 (Reference (de)) and in coordination with
the Under Secretary of Defense for Personnel and Readiness (USD(P&R)), establish an IA Workforce Improvement Program Advisory Council (IA WIPAC), to ensure that the requirements of Reference (ab) and this Manual are met.  The IA WIPAC shall:

C1.4.1.4.1.  Meet at least annually at the call of the DoD Deputy Chief Information
Officer (DCIO).  At a minimum, its composition will include representatives from the Chairman of the Joint Chiefs of Staff; USD(P&R); the Under Secretary of Defense for Intelligence (USD(I)); the Under Secretary of Defense for Acquisition, Technology, and Logistics (USD(AT&L)); the Military Departments and Services; the Defense Information Systems Agency (DISA); and the U.S. Strategic Command (USSTRATCOM).  Members must be fulltime or permanent part-time Federal employees or active-duty military members.

C1.4.1.4.2.  Establish an approval process for IA baseline certifications to be added to
or deleted from the approved IA baseline certification list on the DISA IA Support Environment (IASE) website.  Certifications must have a strong correlation to IA workforce levels and functions. The Defense-wide Information Assurance Program (DIAP) office will provide oversight to the IA WIPAC and IA baseline certification approval process outlined in AP2.2 and post updates to the DISA IASE website. The IA WIPAC Executive Secretariat will publish a memorandum to announce updates to the Certification Table.

C1.4.1.4.3.  Review and update the IA levels, functions, and associated certification
requirements contained in this Manual.

C1.4.1.4.4. Monitor the DoD IA certification program process improvements.

C1.4.1.4.5.  Review DoD Component programs and plans to validate/approve
compliance with DoD baseline IA workforce management requirements.  Reviews will include the following:

C1.4.1.4.5.1.  DoD Component implementation and sustainment plans for IA
workforce identification, training, certification, management, metrics, and documentation requirements as established in this Manual and References (ab) and (cd).

C1.4.1.4.5.2.  DoD Component plans and methodologies to track, monitor, and
document completion of IA Awareness training requirements for all network users as established in this Manual and References (ab) and (cd).

C1.4.1.4.6.  Report recommended actions to the ASD(NII)/DoD CIO and the
USD(P&R) based on these reviews or other information available to it (such as Federal Information Security Management Act (FISMA) Reporting Information or metrics required by this Manual) to improve the program.

C1.4.1.4.7.  Conduct assessments to ensure the validity of the IA workforce functions,
training, and certification requirements per 29 CFR Volume 4, section 1607 (Reference (ef)).

C1.4.1.4.8.  Prioritize enterprise-wide requirements for the development of training
content to address gaps and deficiencies.

C1.4.1.5.  Prepare an IA Workforce Improvement Program (WIP) Annual Report. C1.4.1.6.  Require the Director of the Defense Information Systems Agency (DISA) to:
C1.4.1.6.1.  Provide appropriate representation to the IA WIPAC.

C1.4.1.6.2.  Coordinate with the  DIAP Office, USD(AT&L), and the DoD
Component IA WIP Office of Primary Responsibility Points of Contact (OPR POC) to develop and maintain online resources correlating DoD IA training products and classes to requirements defined in law, executive orders, and DoD issuances. Additionally, provide information correlating IA functions (Chapters 3, 4, 5, 10, and 11) to workforce categories,
specialties, and levels to core IA training curriculum.

C1.4.1.6.3.  Serve as the DoD Shared Service Center (SSC) for the Office of
Management and Budget (OMB)-directed Information System Security Line of Business (ISS LoB) for Tier I Awareness training.  See Chapter 6 for additional information/requirements.

C1.4.1.7.  Require the DIAP to provide IA workforce management oversight and
coordination for the requirements established in this Manual.

C1.4.2.  The Under Secretary of Defense for Personnel and Readiness (USD(P&R)) shall support and provide appropriate representation to the IA WIPAC.  The Defense Activity for Non-Traditional Education Support (DANTES) will manage the certification testing process requirement for the Department.

C1.4.3.  The Undersecretary of Defense for Intelligence shall provide appropriate
representation to the IA WIPAC to represent the intelligence community.

C1.4.4.  The Heads of the DoD Components shall:


C1.4.4.1.  Comply with the responsibilities and requirements of Reference (ab) and this
Manual.

C1.4.4.2.  Provide support for the continuous improvement of the IA workforce
management processes and maintenance of requirements.  Provide appropriate representation as required to the IA WIPAC.

C1.4.4.3.  Provide for initial IA orientation and annual awareness training to all
authorized users to ensure they know, understand, and can apply the IA requirements of their system(s) in accordance with Reference (ab) (see Chapter 6).

C1.4.4.4.  Per Reference (ab), identify all positions performing information system
management, specialized, or privileged access IA functions by category, specialty, and level as described in Chapters 3, 4, 5, 10, and 11 of this Manual.  This applies to all positions with IA
duties, whether performed as primary or additional/embedded duties (see Chapters 2, 3, 4, 5, 7, 10, and 11).  This requirement applies to military and civilian positions including those staffed by local nationals (LNs).

C1.4.4.5.  Identify all IA function requirements to be performed by contractors in their
statement of work/contract including LNs.  Ensure contractors are appropriately certified, and have the appropriate background investigation to perform those IA functions.

C1.4.4.6.  Train, certify, and obtain the proper background investigation for all military
and civilian personnel identified as part of the IA workforce to accomplish their IA duties (see Chapters 3, 4, 5, 10, and 11, and Appendices 2 and 3).

C1.4.4.6.1.  Include requirements for IA training in all DoD Component and local
policy and procedures as part of the IA program.

C1.4.4.6.2.  Ensure IA personnel performing IA functions obtain/maintain a
certification corresponding to the highest level function(s) required by their position.

C1.4.4.6.3.  Nominate, as appropriate, other certifications that correspond to the IA functions established for a particular level. Nominations may include operating system certifications that include the appropriate IA requirements.  Provide nominations to the IA WIPAC.

C1.4.4.6.4.  Obtain the appropriate background investigation per Reference (bc)
prior to granting unsupervised privileged access or management responsibilities to any DoD system.

C1.4.4.7.  Identify, track, and monitor IA personnel performing IA functions (as
described in Chapters 3, 4, 5, 10, and 11) to ensure that IA positions are staffed with trained and certified personnel (see Chapter 7).

C1.4.4.8.  Collect metrics and submit reports to the ASD(NII)/DoD CIO to support
planning and analysis of the IA workforce and annual FISMA reporting according to Reference (cd) (see Chapter 8).

C1.4.4.9.  Establish, resource, and implement plans, policies, and processes to meet the requirements of Reference (ab) and this Manual (see Chapter 9).



C1.4.4.10.  Identify all GS-2210 and other civilian positions/personnel (e.g., 0854, 1550)
using the Office of Personnel Management (OPM) specified parenthetical specialty titles per OPM Job Classification Standard (Reference (f and g).  Enter the appropriate parenthetical specialty title for the primary function and may enter another specialty to identify additional duty responsibilities in the Defense Civilian Personnel Data System (DCPDS) or equivalent civilian personnel database.  This is required for all DoD personnel even if the individual performs more than two specialties.

C1.4.4.11.  Enter "INFOSEC" as the "Position Specialty Code" into the DCPDS in
accordance with Reference (ab) for 2210 and other civilian personnel (e.g., 0854, 1550)
performing IA functions described in Chapters 3, 4, 5, 10, and 11 as primary, additional, or embedded duty and their category, specialty and level.

C1.4.4.12.  Ensure that all DoD contracts requiring performance of IA functions
(specified in Chapters 3, 4, 10, and 11) include the requirement to report contractor personnel's IA certification status and compliance with this Manual.  Contractors also must meet the background investigation requirements of Reference (bc).

C1.4.4.13.  Ensure personnel performing IA functions on national security systems meet
the Committee on National Security Systems training requirements.  This is in addition to the requirements of this Manual.

C1.4.4.14.  Include appropriate IA content in officer accession programs, Flag,
Commanding/Executive Officer (CO/XO), and Warrant Officer indoctrination, and DoD Component professional military education.  The training is intended to develop leadership understanding of the critical importance of information assurance to the successful execution of DoD's mission at all levels of the Department of Defense.

## C2.  Chapter 2 Ia Workforce Structure Overview C2.1.  Introduction

C2.1.1.  IA functions focus on the development, operation, management, and enforcement of security capabilities for systems and networks.  Personnel performing IA functions establish IA policies and implement security measures and procedures for the Department of Defense and affiliated information systems and networks.



C2.1.2.  IA measures protect and defend information and information systems by ensuring
their availability, integrity, authentication, confidentiality, and non-repudiation.  This includes
providing for their restoration by incorporating protection, detection, and reaction capabilities.

C2.1.3.  IA duties may be performed as primary or additional/embedded duties, by a DoD
employee (civilian, including LNs, or military) or by a support contractor (including LNs).

C2.1.4.  As a condition of privileged access to any information system, personnel performing
IA functions described in this Manual must satisfy both preparatory and sustaining DoD IA training and certification requirements (see Chapters 3, 4, 5, 10, and 11).  Additionally, personnel with privileged access must complete a "Privileged Access Agreement," a sample of which is shown in Appendix 4, DoD Components may expand the requirements of this agreement to meet their needs.

C2.1.5.  The certification requirements of this Manual apply to DoD civilian employees,

military personnel, LNs, and support contractors performing the IA functions below and described in detail in Chapters 3, 4, 5, 10 and 11.

C2.1.6.  Personnel performing IA duties addressed by Reference (ab) and this Manual include the following IA oversight responsibilities:


C2.1.6.1.  Work closely with data owners, information system owners, and users to
ensure secure use and operation of information systems (IS) and networks.

C2.1.6.2.  Ensure rigorous application of IA policies, principles, and practices in the
delivery of all information technology (IT) services.

C2.1.6.3.  Maintain system audit functions and periodically review audit information for
detection of system abuses.
C2.1.6.4.  Identify IA requirements as part of the IT acquisition development process.
C2.1.6.5.  Assess and implement identified corrections (e.g., system patches and fixes)
associated with technical vulnerabilities as part of the Information Assurance Vulnerability


Management (IAVM) program, consistent with References (ab) and (bc), DoD Directive 8500.1 (Reference (fh)), and DoD Directive O-8530.1 (Reference (ih)).
C2.1.6.6.  Maintain configuration control of hardware, systems, and application software.
C2.1.6.7.  Identify and properly react to security anomalies or integrity loopholes such as
system weaknesses or vulnerabilities.

C2.1.6.8.  Install and administer user identification or authentication mechanisms.
C2.1.7.  The IA workforce training and certification program establishes a baseline of validated (tested) knowledge that is relevant, recognized, and accepted across the Department of Defense.


C2.2.  IA WORKFORCE CATEGORIES, SPECIALTIES, AND LEVELS

C2.2.1.  This Manual identifies categories and specialties within the IA workforce.

Categories are IA Technical (IAT) and IA Management (IAM).  Specialties are Computer Network Defense Service Providers (CND-SPs) and IA System Architects and Engineers (IASAEs).  These categories and specialties are subdivided into levels each based on functional skill requirements and/or system environment focus (see Chapters 3, 4, 5, 10, and 11).



C2.2.2.  The levels and functions in the Technical, Management, CND-SP, and IASAE
categories and specialties apply to civilian, military, and contractor personnel (including those LNs specifically authorized to perform IA functions according to Reference (bc)).

C2.2.3.  The levels and functions provide the basis to determine all IA Technical, IA
Management, CND-SP, and IASAE staffing requirements.  They also provide a framework for the identification of IAT, IAM, CND-SP and IASAE positions and qualified personnel (or those who can become qualified) across the Department of Defense.

C2.2.4.  Each DoD position responsible for IA functional requirement(s) must be correlated
with a category or specialty and level. Assigning position category or specialty levels based on functions across the Department of Defense establishes a common framework for identifying the IA workforce.

C2.2.5.  A position may include functions spanning multiple levels. In these cases, the level,
and related certification requirements will be those of the highest level functions.  Individuals performing functions in multiple categories or specialties must hold certifications appropriate to the functions performed in each category or specialty.  (Note: one certification may cover more than one category or specialty and level, (e.g., a Security + certification can qualify someone to fill both an IAT-I and an IAM-I position.)

C2.2.6.  IA workforce categories or specialties and levels do not necessarily correlate to
civilian grades, military ranks, or any specific occupational classification standard.
C2.2.7.  Figure C2.F1., below, provides an overview of the basic IA workforce structure.



## C2.3.  Training And Certification Programs


C2.3.1.  IA certification programs are intended to produce IA personnel with a baseline understanding of the fundamental IA principles and practices related to the functions of their assigned position.  Each category, specialty, and skill level has specific training and certification requirements.  Meeting these requirements will require a combination of formal training and experiential activities such as on-the-job training and continuing education.  These training and certification requirements must be provided by the Department of Defense at no cost to government employees (military or civilian).


C2.3.2.  The DoD Components must use certifications approved (and published on the DISA IASE website) by the office of the ASD(NII)/DoD CIO to meet the minimum IA baseline certification requirement.


C2.3.3.  Approved certifications will demonstrate close correlation to the IA categories, specialties, levels, and functions described in Chapters 3, 4, 5, 10, and 11, and demonstrate portability throughout the Department of Defense, the Federal government, and the private sector.


C2.3.4.  Individuals in IA positions, as defined in Chapters 3, 4, 5, 10, and 11 not meeting qualification requirements must be reassigned to other duties, consistent with applicable law. Until certification is attained, individuals in IA positions not meeting qualification requirements may perform those duties under the direct supervision of an appropriately certified individual unless the qualification requirement has been waived due to severe operational or personnel constraints. (See paragraphs C3.2.4.2., C3.2.4.3., C.4.2.3.2.1., C4.2.3.4.2., C10.2.3.4., and C11.2.4.2.)


C2.3.5.  Appendix 2 establishes the IA workforce certification requirement and criteria for assigned responsibilities.  It also includes a requirement for the periodic review of DoD categories, specialties, functions, levels, and the approval of their associated certifications.


C2.3.6.  Appendix 3 provides a matrix of qualifications and the categories, specialties and levels to which they apply.  IA workforce members must obtain all the qualifications corresponding to their IA functions as defined in Chapters 3, 4, 5, 10, and 11, and Appendix 3.


C2.3.7.  Certification holders must adhere to all recertification policies set by their certification provider and ensure that their certifications stay active.  Expired certifications must be renewed.  Expired certifications are not to be considered in the workforce metrics.


C2.3.8.  To support IA professionals, the DoD IA Portal at Defense Knowledge Online and the IASE provides DoD IA policy, training requirements, and DoD- sponsored training.  The DoD IA Portal is located at http://www.us.army.mil and the IASE is located at http://iase.disa.mil/.


C2.3.9.  Contractor personnel supporting IA functions in Chapters 3, 4, 10, and 11 shall obtain the appropriate DoD-approved IA baseline certification prior to being engaged. Contractors have up to 6 months to obtain the rest of the qualifications for their position outlined in AP3.T1.  The contracting officer will ensure that contractor personnel are appropriately certified.  Additional training on local or system procedures may be provided by the DoD organization receiving services.



C2.3.10.  Organizations employing LNs should coordinate in advance with appropriate
offices such as the Status of Forces Agreement, the Local or Country Human Resources section of OPM, local unions, and/or training.  Effective coordination will greatly enhance the capability to achieve the requirements of this Manual.

C2.3.11.  Personnel IA certification status and renewal rates are management review items
according to Reference (bc).

C2.3.12.  All personnel holding an approved IA baseline certification in fulfillment of the
requirements of this Manual must release their certification information to the Department of Defense through the Defense Workforce Certification Application (DWCA): https://www.dmdc.osd.mil/appj/dwc/index.jsp.

## C3.  Chapter 3 Ia Workforce Technical Category


## C3.1.  Introduction

C3.1.1.  This chapter provides detailed position guidelines and IA functions for each level within the Technical category.


C3.1.2.  The functions associated with each of these levels are intended to be baseline DoD
requirements.  The DoD Components are expected to have additional requirements reflecting their operating policy and information system technical environment.  The requirements of this Manual do not exempt individuals from meeting their own organization's standards and requirements.



## C3.2.  Technical Category Description


C3.2.1.  This category comprises IAT Levels I, II, and III.

C3.2.2.  Personnel required to perform any technical category IA functions (one or more functions) at any level must be certified to the highest level function(s) performed.  An IAT position's functions for a particular level establish the basis for the individual's certification requirement.


C3.2.2.1.  The IAT category's functions are cumulative.  Thus, an IAT Level II or III
position requires mastery of the functions of the preceding levels.



C3.2.3.  IAT Category Training Requirements:

C3.2.3.1.  Participation in initial training (classroom, distributive, or blended) before, or
immediately on, assignment of IA responsibilities.  Training need not result in award of a military specialty code (e.g., Military Occupational Specialty, Navy Enlisted Classification Code, and/or Air Force Specialty Code), but must be sufficient to meet minimum certification standards outlined here and in Appendices 2 and 3.

C3.2.3.2.  Completion of an on the job skills practical evaluation to meet functional
requirements listed in this chapter.

C3.2.3.3.  Completion of sustainment training/continuing education as required to
maintain certification status.  For planning purposes the standard is normally a minimum of 20 to 40 hours annually, or 120 hours over 3 years.

C3.2.4.  IAT Category Certification Requirements:

C3.2.4.1.  The certification program for IAT category positions must include the functions identified for that level.  All IAT category personnel, whether they perform IA functions as primary or additional/embedded duty, must be certified based on the IA functions of the position.



C3.2.4.1.1. Within 6 months of assignment of IA duties, all military and Government
civilian IAT personnel must achieve the appropriate IA certification unless a waiver is granted per paragraphs C3.2.4.2 or C3.2.4.3.

C3.2.4.1.1.1.  DoD employees and contractors performing IA functions on the
effective date of this Manual have up to 4 years to comply with the certification requirements, based on DoD Component plans to meet the implementation milestones established in Chapter 9.

C3.2.4.1.1.2.  New hires' qualification periods begin the date they start in the
position (i.e., they must obtain the appropriate certification within 6 months of being assigned IA functions).

C3.2.4.1.2.  IAT Level I certification is the minimum requirement prior to IA
Managers authorizing unsupervised privileged access for personnel performing IAT Levels I through III functions described in this Chapter.

C3.2.4.2.  Designated Accrediting Authorities  (DAAs) may waive the certification
requirement under severe operational or personnel constraints. The waiver will be documented by the DAA using a memorandum for the record stating the reason for the waiver and the plan to rectify the constraint.  Waivers will not extend beyond 6 months, must include an expiration date, and be documented in the individual's IA training record.  Consecutive waivers for personnel are not authorized except as noted in paragraph C3.2.4.3.  Waivers must be a management review item per Reference (bc).  Uncertified IAT Level Is are not authorized to have unsupervised privileged access.

C3.2.4.3.  IAT category personnel must be fully trained and certified prior to deployment
to a combat environment.  The DAA may approve a waiver for certified IAT-I's to fill level IAT- II or IAT-III billets without attaining the appropriate certification while deployed to a combat environment. The DAA may grant an interim waiver limited to the period of the deployment. The interim waiver places an individual in a suspense status and must be time limited and include an expiration date not to exceed 6 months following date of return from combat status.

C3.2.4.4.  Personnel in technical category positions must be issued and retain an
appointing letter to their IA duties including a statement of responsibilities for the system. Appendix 4 provides a sample statement of acceptance of responsibilities.  DoD Components will appropriately edit this form and maintain a completed copy in the individual's personnel record or with the contracting officer's technical representative for contractors.

C3.2.4.5.  Personnel in technical category positions must maintain certifications, as
required by the certifying provider, to retain privileged system access.  Level 1 certification is required prior to being authorized unsupervised privileged access.

C3.2.4.6.  Personnel who are not appropriately  qualified within 6 months of assignment to

a position or who fail to maintain their certification status shall not be permitted privileged access.  The DoD Components will develop programs to address remedial training and conditions for individuals to attain or return to certified status.

C3.2.4.7.  The DoD Components must document and maintain the certification status of
their IAT category personnel as long as they are assigned to those duties.  Identification and tracking requirements are addressed in Chapter 7.

C3.2.4.8.  To support the GIG infrastructure security requirements, certification standards
apply equally to DoD civilian, military, and contractor personnel including those staffed by LNs (with conditional privileged access per Reference (bc)).

C3.2.4.8.1.  New contract language must specify certification requirements.  Existing
contracts must be modified, at an appropriate time during the phased implementation, to specify certification requirements.

C3.2.4.8.2.  Per References (bc) and (ih) and DoD 5200.2-R (Reference (ji)), LNs and
Foreign Nationals (FNs) must comply with background investigation requirements and cannot be assigned to IAT Level III positions.

C3.2.4.8.3.  In addition to the IA baseline certification requirement for their level,
IATs with privileged access must obtain appropriate Computing Environment (CE) certifications for the operating system(s) and/or security related tools/devices they support as required by their employing organization.  If supporting multiple tools and devices, an IAT should obtain CE certifications for all the tools and devices they are supporting. At a minimum the IAT should obtain a certification for the tool or device he or she spends the most time supporting.  For example, if an IAT is spending most of his or her time supporting security functions on a CISCO router, the IAT should obtain a CE certification for that equipment.  This requirement ensures they can effectively apply IA requirements to their hardware and software systems.

C3.2.4.8.4.  New hire civilian personnel must agree as a "condition of employment"
that they will obtain the appropriate certification for the position to be filled.

C3.2.4.8.5.  All personnel must agree to release their IA baseline certification
qualification(s) to the Department of Defense through the DWCA.

C3.2.4.9.  Technical category training requirements are summarized in Table C3.T1.

| IAT Level                                                                      | Civilian, Military, Contractor*    |
|--------------------------------------------------------------------------------|------------------------------------|
| (Including Civilian or Contractor                                              | I - III                            |
| LNs)                                                                           |                                    |
| (FN and LN Levels I & II only)                                                 |                                    |
| Initial Training **                                                            | Yes                                |
|                                                                                |                                    |
| IA Baseline                                                                    |                                    |
|                                                                                |                                    |
| Certification                                                                  | Yes                                |
| (from approved list)                                                           | (within 6 months)                  |
| Yes                                                                            |                                    |
| Initial OJT                                                                    |                                    |
| Evaluation                                                                     |                                    |
| (for initial position)                                                         |                                    |
|                                                                                |                                    |
| CE/OS Certificate                                                              | Yes                                |
|                                                                                |                                    |
| Maintain Certification Status                                                  |                                    |
| Yes                                                                            |                                    |
| (as required by certification)                                                 |                                    |
| Yes                                                                            |                                    |
|                                                                                |                                    |
|                                                                                |                                    |
|                                                                                |                                    |
| Continuous Education or                                                        |                                    |
| Sustainment Training                                                           |                                    |
| (as required by certification (e.g.,                                           |                                    |
| International Information Systems                                              |                                    |
| Security Certification Consortium,                                             |                                    |
| (ISC)2 requires 120 hours within 3                                             |                                    |
| years for the CISSP))                                                          |                                    |
|                                                                                |                                    |
| Background Investigation                                                       |                                    |
| As required by IA level and                                                    |                                    |
| Reference (                                                                    | b                                  |
| c                                                                              |                                    |
| )                                                                              |                                    |
|                                                                                |                                    |
| Sign Privileged Access Statement                                               | Yes                                |
| *Contractor category, level, and certification requirements to be specified in |                                    |
| the contract                                                                   |                                    |
| **Classroom, distributive, blended, government, or commercial provider         |                                    |

## C3.3.  Iat Level I

C3.3.1.  IAT Level I personnel make the CE less vulnerable by correcting flaws and implementing IAT controls in the hardware or software installed within their operational systems.  IAT Level I position requirements are listed in Table C3.T2.

IAT Level I

Attribute

Level

Experience
Normally has 0 to 5 or more years of experience in IA technology or a related field.
System Environment
CE.


Knowledge
Applies basic knowledge of IA concepts, practices,
and procedures within the CE.

Supervision
Works under supervision and typically reports to a CE manager.

Other
Actions are usually authorized and controlled by policies and established procedures. Within 6 months of assignment to position and mandatory for unsupervised privileged access.
IA Baseline Certification & CE/OS Certificate


C3.3.2.  Table C3.T3. lists the specific functions associated with the IAT Level I position.

Personnel performing these functions, regardless of their occupational title (e.g., system administrator, help desk technician, information system technician, mechanic, infantry, logistics, aviation mechanic, etc.) shall be identified as part of the IA workforce and must comply with the requirements in the tables above and C3.T1.

## Table C3.T3.  Iat Level I Functions



T-I.1.  Recognize a potential security violation, take appropriate action to report the incident as
required by regulation, and mitigate any adverse impact.

T-I.2.  Apply instructions and pre-established guidelines to perform IA tasks within CE.

T-I.3.  Provide end user IA support for all CE operating systems, peripherals, and applications.

T-I.4.  Support, monitor, test, and troubleshoot hardware and software IA problems pertaining
to their CE.

T-I.5. Apply CE specific IA program requirements to identify areas of weakness.

T-I.6. Apply appropriate CE access controls.

T-I.7.
Install and operate the IT systems in a test configuration manner that does not alter the
program code or compromise security safeguards.

T-I.8.
Conduct tests of IA safeguards in accordance with established test plans and
procedures.

T-I.9.
Implement and monitor IA safeguards for CE system(s) in accordance with
implementation plans and standard operating procedures.

T-I.10.  Apply established IA security procedures and safeguards and comply with
responsibilities of assignment.

T-I.11.  Comply with system termination procedures and incident reporting requirements
related to potential CE security incidents or actual breaches.

T-I.12.  Implement online warnings to inform users of access rules for CE systems.

T-I.13.  Implement applicable patches including IA vulnerability alerts (IAVA), IA
vulnerability bulletins (IAVB), and technical advisories (TA) for the CE operating system(s).

T-I.14.  Install, test, maintain, and upgrade CE operating systems software and hardware to
comply with IA requirements.

T-I.15.   Understand and implement technical vulnerability corrections.

T-I.16.   Enter assets in a vulnerability management system.

T-I.17.   Apply system security laws and regulations relevant to the CE being supported.

T-I.18.   Implement DoD and DoD Component password policy.

T-I.19.   Implement specific IA security countermeasures.

## C3.4.  Iat Level Ii

C3.4.1.  IAT Level II personnel provide network environment (NE) and advanced level CE
support.  They pay special attention to intrusion detection, finding and fixing unprotected vulnerabilities, and ensuring that remote access points are well secured.  These positions focus on threats and vulnerabilities and improve the security of systems.  IAT Level II personnel have mastery of the functions of the IAT Level I position. IAT Level II position requirements are listed in Table C3.T4.



IAT Level II
Attribute
Level
Experience
Normally has at least 3 years in IA technology or
a related area.
System Environment
NE and advanced CE.
Knowledge
- Mastery of the functions of the IAT Level I
position.
- Applies knowledge and experience with
standard IA concepts, practices, and procedures within the NE.
Supervision
Works under general supervision and typically reports to network manager.
Other
Relies on experience and judgment to plan and accomplish goals within the NE. Within 6 months of assignment to position.
IA Baseline Certification & CE/OS Certificate


C3.4.2.  Table C3.T5. lists the specific functions associated with the IAT Level II position.

Personnel performing these functions, regardless of their occupational title (e.g., system administrator, help desk technician, information system technician, mechanic, infantry, logistics coordinator) shall be identified as part of the IA workforce and must comply with the requirements in the table above and C3.T1.



T-II.1. Demonstrate expertise in IAT Level I CE knowledge and skills.

T-II.2. Examine potential security violations to determine if the NE policy has been breached,
assess the impact, and preserve evidence.

T-II.3. Support, monitor, test, and troubleshoot hardware and software IA problems pertaining
to the NE.
T-II.4. Recommend and schedule IA related repairs in the NE. T-II.5. Perform IA related customer support functions including installation, configuration,
troubleshooting, customer assistance, and/or training, in response to customer
requirements for the NE.
T-II.6. Provide end user support for all IA related applications for the NE. T-II.7. Analyze patterns of non-compliance and take appropriate administrative or
programmatic actions to minimize security risks and insider threats.
T-II.8.
Manage accounts, network rights, and access to NE systems and equipment.
T-II.9.
Analyze system performance for potential security problems.
T-II.10.  Assess the performance of IA security controls within the NE.
T-II.11.  Identify IA vulnerabilities resulting from a departure from the implementation plan or
that were not apparent during testing.
T-II.12.  Provide leadership and direction to IA operations personnel. T-II.13.  Configure, optimize, and test network servers, hubs, routers, and switches to ensure
they comply with security policy, procedures, and technical requirements.
T-II.14.  Install, test, maintain, and upgrade network operating systems software and hardware to
comply with IA requirements.
T-II.15.  Evaluate potential IA security risks and take appropriate corrective and recovery action. T-II.16.  Ensure that hardware, software, data, and facility resources are archived, sanitized, or
disposed of in a manner consistent with system security plans and requirements.
T-II.17.  Diagnose and resolve IA problems in response to reported incidents. T-II.18.  Research, evaluate, and provide feedback on problematic IA trends and patterns in
customer support requirements.
T-II.19.  Ensure IAT Level I personnel are properly trained and have met OJT program
requirements.
T-II.20.  Perform system audits to assess security related factors within the NE. T-II.21.  Develop and implement access control lists on routers, firewalls, and other network
devices.
T-II.22.  Install perimeter defense systems including intrusion detection systems, firewalls, grid
sensors, etc., and enhance rule sets to block sources of malicious traffic.
T-II.23.  Work with other privileged users to jointly solve IA problems. T-II.24.  Write and maintain scripts for the NE. T-II.25.  Demonstrate proficiency in applying security requirements to an operating system for
the NE or CE used in their current position.
T-II.26.  Implement applicable patches including IAVAs, IAVBs, and TAs for their NE. T-II.27.  Adhere to IS security laws and regulations to support functional operations for the NE. T-II.28.  Implement response actions in reaction to security incidents.
T-II.29.  Support the design and execution of exercise scenarios. T-II.30.  Support Security Test and Evaluations (Part of C&A Process). T-II.31.  Obtain and maintain IA certification appropriate to position.
C3.5.  IAT LEVEL III

C3.5.1.  IAT Level III personnel focus on the enclave environment and support, monitor, test, and troubleshoot hardware and software IA problems pertaining to the CE, NE, and enclave environments.  IAT Level III personnel have mastery of the functions of both the IAT Level I and Level II positions.  IAT Level III position requirements are listed in Table C3.T6.



IAT Level III
Attribute
Level
Experience
Normally has at least seven years experience in IA
technology or a related area.
System Environment
Enclave Environment, advanced NE, and advanced CE.
Knowledge
- Expert in all functions of both IAT Level I and IAT
Level II positions.
- Applies extensive knowledge of a variety of the IA
field's concepts, practices, and procedures to ensure the secure integration and operation of all enclave systems.
Supervision
- Works independently to solve problems quickly and
completely.
- May lead and direct the work of others. - Typically reports to an enclave manager.
Other
- Relies on extensive experience and judgment to plan
and accomplish goals for the enclave environment.
- Supports, monitors, tests, and troubleshoots hardware
and software IA problems pertaining to the enclave environment.
- Must be a U.S. Citizen. Within 6 months of assignment to position.
IA Baseline Certification & CE/OS Certificate

C3.5.2.  Table C3.T7. lists the specific functions associated with the IAT Level III position.

Personnel performing these functions, regardless of their occupational title (e.g., system administrator, help desk technician, information system technician, aviation mechanic, infantry, logistics coordinator) shall be identified as part of the IA workforce and must comply with the requirements in the table above and C3.T1.

## Table C3.T7.  Iat Level Iii Functions

T-III.1.   Mastery of IAT Level I and IAT Level II CE/NE knowledge and skills. T-III.2.   Recommend, schedule, and/or implement IA related repairs within the enclave
environment.
T-III.3.   Coordinate and/or provide support for all enclave applications and operations.
T-III.4.   Lead teams and/or support actions to quickly resolve or mitigate IA problems for the
enclave environment.
T-III.5.   Formulate or provide input to the enclave's IA/IT budget. T-III.6.   Support the installation of new or modified hardware, operating systems, and software
applications ensuring integration with IA security requirements for the enclave.
T-III.7.   Identify and/or determine whether a security incident is indicative of a violation of law
that requires specific legal action.
T-III.8.   Direct and/or implement operational structures and processes to ensure an effective
enclave IA security program including boundary defense, incident detection and response, and key management.
T-III.9.   Provide direction and/or support to system developers regarding correction of security
problems identified during testing.
T-III.10. Evaluate functional operation and performance in light of test results and make
recommendations regarding C&A.
T-III.11. Examine enclave vulnerabilities and determine actions to mitigate them. T-III.12. Monitor and evaluate the effectiveness of enclave IA security procedures and
safeguards.
T-III.13. Analyze IA security incidents and patterns to determine remedial actions to correct
vulnerabilities.
T-III.14. Support development and/or implementation of the enclave termination plan to ensure
that IA security incidents are avoided during shutdown and long term protection of archived resources is achieved.
T-III.15. Implement vulnerability countermeasures for the enclave. T-III.16. Provide support for IA customer service performance requirements. T-III.17. Provide support for the development of IA related customer support policies,
procedures, and standards.
T-III.18. Write and maintain scripts required to ensure security of the enclave environment.
T-III.19. Implement and maintain perimeter defense systems including, but not limited to,
intrusion detection systems, firewalls, grid sensors.
T-III.20. Schedule and perform regular and special backups on all enclave systems.
T-III.21. Establish enclave logging procedures to include:  important enclave events; services
and proxies; log archiving facility.
T-III.22. Provide OJT for IAT Level I and II DoD personnel. T-III.23. Analyze IAVAs and Information Assurance Vulnerability Bulletins for enclave impact
and take or recommend appropriate action.
T-III.24. Obtain and maintain IA certification appropriate to position.

## C4.  Chapter 4 Ia Workforce Management Category



## C4.1.  Introduction

C4.1.1.  This chapter provides detailed position guidelines and IA functions for each level within the Information Assurance Management (IAM) category.


C4.1.2.  The functions associated with each of these levels are intended to be baseline DoD
requirements.  The DoD Components are expected to have additional requirements reflecting their operating policy and information system technical environment.  The requirements of this Manual do not exempt individuals from meeting their own organization's standards and requirements.



## C4.2.  Management Category Description


C4.2.1.  This Category comprises IAM Levels I, II, and III, as well as the DAA function covered in Chapter 5.  Positions required to perform IA Manager responsibilities, as established in Reference (bc), and performing functions defined in this chapter are included in the Information Assurance Management category.


C4.2.2.  The levels and functions in the management category are not necessarily cumulative. Table C4.T1. provides IAM category requirements.



| IAM Level I - III                 | Civilian, Military, or Contractor*    |
|-----------------------------------|---------------------------------------|
| (Including LNs )                  | (FN/LN Levels I & II** only)          |
| Initial Training ***              | Yes                                   |
| Yes                               | IA Baseline Certification             |
| (from approved list)              | (within six months)                   |
|                                   |                                       |
| Initial OJT Evaluation            | No                                    |
|                                   |                                       |
| CE/OS Certificate                 | No                                    |
|                                   |                                       |
| Maintain Certification Status     |                                       |
| Yes                               |                                       |
| (as required by certification)    |                                       |
| Yes                               |                                       |
|                                   |                                       |
|                                   |                                       |
| (as required by certification     |                                       |
| (e.g., (ISC) 2 requires 120 hours |                                       |
| Continuous Education or           |                                       |
| Sustainment Training              |                                       |
| within 3 years for CISSP))        |                                       |
|                                   |                                       |
| Background Investigation          |                                       |
| As required by IA level and       |                                       |
| Reference (                       | b                                     |
| c                                 |                                       |
| )                                 |                                       |

*Requirements to be stated in contract
** FN/LN IAM Level II must meet conditions of References (bc), (ih) and (ji) ***Classroom, distributive, blended, government, or commercial provider


## C4.2.3.  Iam Category Certification Requirements:


C4.2.3.1.  The certification requirement for IAM category positions includes all the functions identified for that level.  All management category personnel, whether they perform IA functions as primary or as an additional/embedded duty, will be certified based on the IA functions of the position.



C4.2.3.1.1. Personnel required to perform any management category IA function(s)
(one or more functions) at any level must be certified to the highest level function(s) performed. An IAM position's functional requirement(s) for a particular level establish the basis for the
certification requirement.

C4.2.3.1.2.  IAM positions that also perform IAT functions must also obtain the
appropriate technical level certification and complete the other IAT level requirements prior to being granted unsupervised privileged access.

C4.2.3.2.  Within 6 months of assignment of IA duties, management category military
and Government civilian personnel must achieve the appropriate IA baseline certification for their level.  The requirements in paragraphs C3.2.4.1.1.1. and C3.2.4.1.1.2. for current and new hire DoD employees also apply to IAMs.

C.4.2.3.2.1.  DAAs may waive the certification requirement under severe operational
or personnel constraints. The waiver will be documented by the DAA using a memorandum for the record stating the reason for the waiver and the plan to rectify the constraint.

C4.2.3.2.2.  Waivers will not extend beyond 6 months and must include an expiration
date and be documented in the individual IA training record. Consecutive waivers for personnel are not authorized except as noted in paragraph C4.2.3.4.2.  Waivers must be a management review item.

C4.2.3.3. Personnel in management category positions must maintain certifications, as
required by their certification provider to retain their position.

C4.2.3.4.  Personnel not certified within 6 months of assignment of IA duties or who fail
to maintain their certified status will not be permitted to carry out the responsibilities of the position.  The DoD Components must develop programs to address remedial training and to establish conditions allowing management personnel to return to certified status.

C4.2.3.4.1.  If after appropriate remediation efforts individuals do not meet
certification requirements, they must be reassigned to other duties.

C4.2.3.4.2.  IAM category personnel must be fully trained and certified prior to
deployment to a combat environment.  However, the DAA may grant an interim waiver for

personnel required to fill IAM II or III level billets with IAM I or IAM II certified individuals who cannot obtain the appropriate certification while deployed in a combat environment.  The interim waiver may be granted by the DAA for the period of deployment.  The interim waiver places an individual in a suspense status and must be time limited and include an expiration date not to
exceed 6 months following the date of return from the combat environment.

C4.2.3.5.  The DoD Components must document and maintain the certification status of
their management category personnel as long as they are assigned to those duties.  Identification and tracking requirements are addressed in Chapter 7.

C4.2.3.6. Personnel in management category positions will retain an appointing letter
assigning them IA responsibilities for their system(s) per Reference (bc).  If a management category position requires IA privileged access, a statement of responsibility for the system(s) will
also be executed per Reference (bc).  Appendix 4 provides a sample statement of acceptance of
responsibilities.

C4.2.3.7.  In support of GIG infrastructure security requirements, certification standards
apply equally to DoD civilian, military, contractor personnel, and LNs.

C4.2.3.7.1.  New contract language must specify certification requirements.  Existing
contracts must be modified to specify certification requirements during the phased implementation described in Chapter 9.

C4.2.3.7.2.  LNs or FNs may be conditionally assigned to IAM Level II but may not be
assigned to IAM Level III positions (per Reference (bc)).  They must comply with background investigation requirements per Reference (ji).
C4.3.  IAM LEVEL I

C4.3.1.  IAM Level I personnel are responsible for the implementation and operation of a DoD IS or system DoD Component within their CE.  Incumbents ensure that IA related IS are functional and secure within the CE.  IAM Level I position requirements are listed in Table C4.T2.

IAM Level I
Attribute
Level
Experience
Usually an entry level management position with 0 to 5 or more years of management experience.
System Environment
CE IAM.
Knowledge
Applies knowledge of IA policy, procedures, and structure to develop, implement, and maintain a secure CE.
Supervision
- For IA issues, typically reports to an IAM
Level II (NE).
- May report to other management for other CE operational requirements.
Other
Manages IA operations for a CE system(s).
IA Baseline Certification Within 6 months of assignment to position.


C4.3.2.  Table C4.T3. lists the specific functions associated with the IAM Level I position.

Personnel performing these functions, regardless of their occupational title (e.g., ISSO, IAO, ISSM, logistics manager, pilot, infantry officer) shall be identified as part of the IA workforce and must comply with the requirements in the table above and C4.T1.



## Table C4.T3.  Iam Level I Functions



M-I.1.  Use federal and organization specific published documents to manage operations of
their CE system(s).

M-I.2.  Provide system related input on IA security requirements to be included in statements of
work and other appropriate procurement documents.

M-I.3.  Support and administer data retention and recovery within the CE.

M-I.4.  Participate in the development or modification of the computer environment IA security
program plans and requirements.

M-I.5.  Validate users' designation for IT Level I or II sensitive positions, per Reference (bc).

M-I.6.  Develop procedures to ensure system users are aware of their IA responsibilities before
granting access to DoD information systems.

M-I.7.  Recognize a possible security violation and take appropriate action to report the
incident, as required.

M-I.8.  Supervise or manage protective or corrective measures when an IA incident or
vulnerability is discovered.

M-I.9.  Ensure that system security configuration guidelines are followed.

M-I.10. Ensure that IA requirements are integrated into the Continuity of Operations Plan
(COOP) for that system or DoD Component.

M-I.11. Ensure that IA security requirements are appropriately identified in computer
environment operation procedures.

M-I.12. Monitor system performance and review for compliance with IA security and privacy
requirements within the computer environment.

M-I.13. Ensure that IA inspections, tests, and reviews are coordinated for the CE.

M-I.14. Participate in an IS risk assessment during the Certification and Accreditation process.

M-I.15. Collect and maintain data needed to meet system IA reporting requirements.

M-I.16. Obtain and maintain IA baseline certification appropriate to position.

## C4.4.  Iam Level Ii

C4.4.1. IAM Level II personnel are responsible for the IA program of an IS within the NE.

Incumbents in these positions perform a variety of security related tasks, including the development and implementation of system information security standards and procedures. They ensure that IS are functional and secure within the NE.  IAM Level II position requirements are listed in Table C4.T4.

IAM Level II
Attribute
Level
Experience
Usually has at least five years of management experience.
System Environment
NE IAM.
Knowledge
Applies knowledge of IA policy, procedures, and workforce structure to develop, implement, and maintain a secure NE.
Supervision
- For IA issues, typically reports to an IAM
Level III (Enclave) Manager or DAA.
- May report to other senior management for
network operational requirements.
Other
- Relies on experience and judgment to plan and
accomplish goals.
- Manages IA operations for a NE(s).
IA Baseline Certification
Within six months of assignment to position.


C4.4.2.  Table C4.T5. lists the specific functions associated with the IAM Level II position.

Personnel performing these functions, regardless of their occupational title (e.g., ISSO, IAO, ISSM, logistics manager, pilot, infantry officer) shall be identified as part of the IA workforce and must comply with the requirements in the table above and C4.T1.

M-II.1. Develop, implement, and enforce policies and procedures reflecting the legislative

intent of applicable laws and regulations for the NE.

M-II.2. Prepare, distribute, and maintain plans, instructions, guidance, and standard operating

procedures concerning the security of network system(s) operations.

M-II.3. Develop NE security requirements specific to an IT acquisition for inclusion in

procurement documents.

M-II.4. Recommend resource allocations required to securely operate and maintain an

organization's NE IA requirements.

M-II.5. Participate in an IS risk assessment during the C&A process. M-II.6. Develop security requirements for hardware, software, and services acquisitions

specific to NE IA security programs.

M-II.7. Ensure that IA and IA enabled software, hardware, and firmware comply with

appropriate NE security configuration guidelines, policies, and procedures.
M-II.8. Assist in the gathering and preservation of evidence used in the prosecution of
computer crimes.

M-II.9. Ensure that NE IS recovery processes are monitored and that IA features and

procedures are properly restored.

M-II.10. Review IA security plans for the NE. M-II.11. Ensure that all IAM review items are tracked and reported.

M-II.12. Identify alternative functional IA security strategies to address organizational NE
security concerns.
M-II.13. Ensure that IA inspections, tests, and reviews are coordinated for the NE.

M-II.14. Review the selected security safeguards to determine that security concerns identified

in the approved plan have been fully addressed.

M-II.15. Evaluate the presence and adequacy of security measures proposed or provided in

response to requirements contained in acquisition documents.

M-II.16. Monitor contract performance and periodically review deliverables for conformance

with contract requirements related to NE IA, security, and privacy.

M-II.17. Provide leadership and direction to NE personnel by ensuring that IA security

awareness, basics, literacy, and training are provided to operations personnel commensurate with their responsibilities.

M-II.18. Develop and implement programs to ensure that systems, network, and data users are

aware of, understand, and follow NE and IA policies and procedures.
M-II.19. Advise the DAA of any changes affecting the NE IA posture.

M-II.20. Conduct an NE physical security assessment and correct physical security weaknesses. M-II.21. Help prepare IA certification and accreditation documentation. M-II.22. Ensure that compliance monitoring occurs, and review results of such monitoring
across the NE.
M-II.23. Obtain and maintain IA baseline certification appropriate to position.

## C4.5.  Iam Level Iii


C4.5.1.  IAM Level III personnel are responsible for ensuring that all enclave IS are functional and secure.  They determine the enclaves' long term IA systems needs and acquisition requirements to accomplish operational objectives.  They also develop and implement information security standards and procedures through the DoD certification and accreditation process. IAM Level III position requirements are listed in Table C4.T6.

IAM Level III
Attribute
Level
Experience
Usually has at least 10 years of management experience.
System Environment
Enclave Environment IAM.
Knowledge
Applies knowledge of IA policy, procedures, and workforce structure to develop, implement, and maintain a secure enclave environment.
Supervision
- Typically reports to a DAA for IA issues.
- May report to other senior managers for enclave
operational requirements.
Other
- Must be a U.S. Citizen. - Relies on extensive experience and judgment to
plan and accomplish enclave security related goals.
- Manages IA operations for an enclave(s).
IA Baseline Certification
Within 6 months of assignment to position.

C4.5.2.  Table C4.T7. lists the specific functions associated with the IAM Level III position.

Personnel performing these functions, regardless of their occupational title (e.g., ISSO, IAO, ISSM, logistics manager, pilot, infantry officer) shall be identified as part of the IA workforce and must comply with the requirements in the table above and C4.T1.

## Table C4.T7.  Iam Level Iii Functions

M-III.1.
Securely integrate and apply Department/Agency missions, organization, function,
policies, and procedures within the enclave.
M-III.2.
Ensure that protection and detection capabilities are acquired or developed using the
IS security engineering approach and are consistent with DoD Component level IA architecture.
M-III.3.
Ensure IAT Levels I - III, IAM Levels I and II, and anyone with privileged access
performing IA functions receive the necessary initial and sustaining IA training and certification(s) to carry out their IA duties.
M-III.4.
Prepare or oversee the preparation of IA certification and accreditation
documentation.
M-III.5.
Participate in an IS risk assessment during the C&A process.
M-III.6.
Ensure information ownership responsibilities are established for each DoD IS and
implement a role based access scheme.
M-III.7.
Analyze, develop, approve, and issue enclave IA policies.
M-III.8.
Evaluate proposals to determine if proposed security solutions effectively address
enclave requirements, as detailed in solicitation documents.
M-III.9.
Identify IT security program implications of new technologies or technology
upgrades.
M-III.10.  Evaluate cost benefit, economic and risk analysis in decision making process. M-III.11.  Interpret and/or approve security requirements relative to the capabilities of new
information technologies.
M-III.12.  Interpret patterns of non compliance to determine their impact on levels of risk and/or
overall effectiveness of the enclave's IA program.
M-III.13.  Analyze identified security strategies and select the best approach or practice for the
enclave.
M-III.14.  Ensure that security related provisions of the system acquisition documents meet all
identified security needs.
M-III.15.  Evaluate and approve development efforts to ensure that baseline security safeguards
are appropriately installed.
M-III.16.  Evaluate the presence and adequacy of security measures proposed or provided in
response to requirements contained in acquisition documents.
M-III.17.  Take action as needed to ensure that accepted products meet Common Criteria
requirements as stated in Reference (bc).
M-III.18.  Monitor and evaluate the effectiveness of the enclaves' IA security procedures and
safeguards to ensure they provide the intended level of protection.
M-III.19.  Provide enclave IA guidance for development of the COOP. M-III.20.  Ensure all IAM review items are tracked and reported. M-III.21.  Advise the DAA of changes affecting the enclave's IA posture. M-III.22.  Obtain and maintain IA baseline certification appropriate to position.

## C5.  Chapter 5 Designated Accrediting Authority (Daa) Requirements



## C5.1.  Introduction

C5.1.1. Reference (bc) directs that a DAA be appointed for each DoD information system operating within, or on behalf of, the Department of Defense.  It requires that all DAAs be U.S. citizens.  They must also be DoD employees, with a level of authority allowing them to accept, in writing, the risk of operating DoD ISs under their purview.  Reference (ab) further requires that all DoD personnel be adequately trained and certified in order to perform the tasks associated with their IA responsibilities and makes the heads of the DoD Components responsible for ensuring that DAAs are appointed for all DoD Component ISs.



C5.1.1.1.  DAA functions may be performed on a full- or part-time basis by a DoD
civilian or military employee in the designated role.

C5.1.1.2.  DAA performing other management functions such as IAM-II or IAM-III,
must also meet the training and certification requirements for those categories and levels.

C5.1.2.  All personnel performing DAA functions must satisfy both preparatory and

sustaining DoD training and certification requirements.


## C5.2.  Daa Functions And Responsibilities C5.2.1.  Daa Functional Description


C5.2.1.1.  The official with the authority to formally assume responsibility for operating a system at an acceptable level of risk.



C5.2.1.2.  Establishes and directs the long term goals, policies, and procedures relating to
the IS security requirements.

C5.2.1.3. Ensures that the policies, systems, and procedures comply with and support IA
requirements.

C5.2.1.4.  Given a final report requesting approval to operate an IS at a specified level of
trust, the DAA will analyze and judge the information for validity and reliability to ensure the system is able to operate at the proposed level of security.

C5.2.1.5.  Review accreditation documents to confirm the level of risk is acceptable for an
IS.  This decision will be made by weighing the system mission requirements against the identified level of risk per DoD Instruction 8510.01 (Reference (kj)) (or its successor documents)

and implemented countermeasures to known vulnerabilities. Additional factors to consider include system architecture, system security measures, system operations policy, system security management plan, and provisions for system operator and end-user training.


C5.2.1.6.  Table C5.T1. lists the DAA's functions.


## Table C5.T1.  Daa Functions


DAA.1. Grant the authority to operate an IS or network at an acceptable level of risk. DAA.2. Review accreditation documents to confirm that the level of risk is within acceptable
limits for each network and/or IS.
DAA.3. Verify that each IS complies with IA requirements. DAA.4. Ensure establishment, administration, and coordination of security for systems that
Component personnel or contractors operate.
DAA.5. Ensure the program manager defines the system security requirements for acquisitions. DAA.6. Manages the IA workforce.  Assigns IA responsibilities to the individuals reporting
directly to the DAA.
DAA.7. Ensures individuals filling IA positions are assigned in writing, trained, certified, and
sign a statement of responsibilities.
DAA.8. Assign the mission assurance category in accordance with References (bc) and (h) for
each IS and approve the classification level required for the applications implemented on them.
DAA.9. Allocate resources to achieve and maintain an acceptable level of security and to
remedy security deficiencies.
DAA.10. Resolve issues regarding those systems requiring multiple or joint accreditation.  This
may require documentation of condition or agreements in Memoranda of Agreement.
DAA.11. Ensure that, when classified or sensitive unclassified information is exchanged
between ISs or networks (internal or external), the content of this communication is protected from unauthorized observation or modification by acceptable means.

## C5.3.  Daa Training And Certification Requirement


C5.3.1.  Each assigned DAA must:

C5.3.1.1.  Complete the DoD DAA computer-based training (CBT) or Web-based training (WBT) product within 60 days of assignment to the position.  The CBT, titled "DAA, Designated Accrediting Authority," is located on the DoD IA Portal for those with a CAC or directly from IASE.



C5.3.1.2.  The DAA and the unit training officer will sign the DAA CBT certificate upon completion of the DISA DAA Certification Course (Figure C5.F1.).


C5.3.1.3.  Maintain the course completion certificate (Figure C5.F1.), also available at the DoD IA Portal, as a part of the DAA's official personnel file.



C5.3.1.4.  Recertify every 3 years.

C5.3.2.  The DAA may substitute the following National Defense University/Information Resource Management College Courses for the DoD DAA CBT:

C5.3.2.1.  Computer Network Security Systems Instruction No. 4012 (DAA) course and certificate.  The IRMC official transcript shall be used to document completion of the requirement.


C5.3.2.2.  The Information System Certification and Accreditation course (catalog #
6209).  The IRMC Transcript will serve as proof of Completion.


C5.3.3.  The DoD Components are encouraged to provide additional training specific to their unique requirements.



## C6.  Chapter 6 Authorized User Minimum Ia Awareness Requirements C6.1.  Introduction

C6.1.1.  IT has enabled the Department of Defense to transmit, communicate, collect, process, and store unprecedented amounts of information.



C6.1.2.  Increasing dependence on information systems has focused attention on the need to
ensure that these assets, and the information they process, are protected from actions that would jeopardize the DoD's ability to effectively function.

C6.1.3.  Responsibility for securing the Department's information and systems lies with the
DoD Components.  The trained and aware user is the first and most vital line of defense.

C6.1.4.  IT users need to maintain a degree of understanding about IA policies and doctrine commensurate with their responsibilities.  They must be capable of appropriately reporting and responding to suspicious activities, and know how to protect the information and IT systems to which they have access.



C6.1.5.  IA training must be current, engaging, and relevant to the target audience to enhance
its effectiveness.  Its primary purpose is to educate and influence behavior.  The focus must be on education and awareness of threats and vulnerabilities so users do not perform actions that lead to or enable exploitations of the DoD ISs.  Authorized users must understand that they are a critical link in their organization's overall IA success.

C6.1.6.  DISA's DoD IA Awareness CBT is the DoD baseline standard. It meets all DoD
level requirements for end user awareness training.  DISA will ensure it provides distributive awareness content to address evolving requirements promulgated by Congress, the OMB under the ISS LoB for Tier I, or the Office of the Secretary of Defense.  DISA's training products can be accessed via the DoD IA Portal for those with a CAC or directly from IASE.

C6.1.7.  The DoD Components are required to use the DoD SSC as their IA Awareness
Provider.  The DoD IA Awareness Course will be used to meet the initial and annual training mandated by this Manual and Reference (cd). However, Components are expected to address organization specific topics and local incident reporting procedures.

C6.1.8   The DoD SSC Intelligence Community IA Awareness Training product meets all
DoD requirements and may be substituted for the DoD SSC IA Awareness Training product.

## C6.2.  General Requirements



C6.2.1  The requirements for computer security awareness training have been established under the authority of 2224 of title 10, United States Code; section 278g-3 of title 15, United States Code; and OMB Circular A-130 (References (lk), (ml), and (nm)).  References (bc) and
(ih) implement the requirements and extend it to IA.


C6.2.2.  To ensure understanding of the critical importance of IA, all individuals with access to DoD IT systems are required to receive and complete initial IA awareness training before being granted access to the system(s) and annual IA awareness training to retain access.


C6.2.3.  The DoD Components must document and maintain the status of awareness compliance for each user.  Required versus actual IA awareness will be a management review item.


C6.2.4.  All users will be informed of their information and IS security responsibilities, and consent to monitoring.


C6.2.5.  At a minimum, the following themes must be conveyed in IA initial annual awareness programs:


C6.2.5.1.  Critical reliance on information and IS resources.

C6.2.5.2.  Commitment to protect information and IS resources to include personal
identifiable information.

C6.2.5.3.  Threats, vulnerabilities, and related risks associated with IS.

C6.2.5.4.  Consequences for inadequate protection of the organization's IS resources. C6.2.5.5.  The essential role of the DoD employee.

C6.3.  SPECIFIC REQUIREMENTS

User awareness programs shall address the topics specified in ISS LoB, Reference (on), to include but not limited to the following:


C6.3.1.  The importance of IA to the organization and to the authorized user.

C6.3.2.  Relevant laws, policies, and procedures, and how they affect the authorized user
(e.g., copyright, ethics, and standards of conduct).

C6.3.3.  Examples of external threats such as script kiddies, crackers, hackers, protesters, or
agents in the employ of terrorist groups or foreign countries.

C6.3.4.  Examples of internal threats such as malicious or incompetent authorized users,
users in the employ of terrorist groups or foreign countries, disgruntled employees or Service members, hackers, crackers, and self-inflicted intentional or unintentional damage.

C6.3.5.  The potential elevated sensitivity level of aggregated unclassified information. C6.3.6.  Authorized user risk from social engineering. C6.3.7.  Common methods to protect critical system information and procedures.

C6.3.8.  Principles of shared risk in networked systems (i.e., how a risk assumed by one
person is imposed on the entire network) and changes in the physical environment (e.g., water, fire, and dust/dirt).

C6.3.9.  Risks associated with remote access (e.g., telecommuting, during deployment, or on
temporary duty).

C6.3.10.  Legal requirements regarding privacy issues, such as email status (see DoD
Directive 1000.25 (Reference (po)) and the need to protect systems containing payroll, medical and personnel records.

C6.3.11.  Knowledge of malicious code (e.g., logic bomb, Trojan horse, malicious mobile
code, viruses, and worms) including how they attack, how they damage an IS, how they may be introduced inadvertently or intentionally, and how users can mitigate their impact.

C6.3.12.  The impact of distributed denial of service attacks and what users can do to
mitigate them.

C6.3.13.  How to prevent self-inflicted damage to system information security through
disciplined application of IA procedures such as proper logon, use of passwords, preventing spillage of classified information, e-mail security, etc.

C6.3.14.  Embedded software and hardware vulnerabilities, how the Department of Defense
corrects them (e.g., IAVA process), and the impact on the authorized user.

C6.3.15.  Prohibited or unauthorized activity on DoD systems (e.g., peer-to-peer file sharing,
gambling, personal use, and gain issues).

C6.3.16.  Requirements and procedures for reporting spillage, unauthorized or suspicious
activity, and local IA office point of contact information.

C6.3.17.  Categories of information classification and differences between handling
information on the Non-Classified Internet Protocol Router Network (NIPRNet) or the SECRET Internet Protocol Router Network (SIPRNet).
C6.3.18.  Software issues including license restrictions on DoD systems, encryption, and media sanitation requirements and procedures.



C6.3.19.  Requirements and procedures for transferring data to/from a non-DoD network. C6.3.20.  Requirements and procedures for protection of Data at Rest. C6.3.21.  Requirements and procedures for sharing information.

## C7.  Chapter 7 Ia Workforce Identification, Tracking, And Assignment



## C7.1.  Introduction

C7.1.1.  The Department of Defense must manage its IA workforce effectively and efficiently to provide trained, skilled personnel who will protect the operation of its IS.



C7.1.2.  The DoD Components will leverage existing manpower and personnel databases,
learning management systems, other tools, and procedures to support effective management of their IA workforces.

C7.1.3.  Tools and procedures must enable the assignment and tracking of qualified
personnel both within the DoD Components and in support of joint assignments.

C7.1.4.  As a prerequisite to effective IA management, the DoD Components must identify
all positions and personnel with IA responsibilities, regardless of occupational specialty, or whether the duty is performed as primary or as an additional/embedded duty.  Positions and personnel will be aligned to an IA category, specialty and level, per Chapters 3, 4, 5, 10, and 11, and documented in the appropriate database(s).  IA Workforce data elements must comply with requirements established in Reference (bc), and DoD Instruction 7730.64, DoD Instruction 1336.05, and DoD Instruction 7730.54 (References (qp), (rq), and (sr)).

C7.1.5.  The DoD Components must use, to the extent possible, existing
personnel/manpower and unit organizational databases, such as DCPDS, to satisfy the requirements outlined in this chapter.  DoD Components are responsible for providing this information per References (rq) and (sr) for military members.  *Volume 1 of* DoD Instruction 1444.02 (Reference (ts)) dictates DoD civilian database requirements.

C7.1.6.  The Defense Manpower Data Center (DMDC) will leverage DoD Component
provided information on civilian and military IA positions and personnel to support development of an integrated picture of the DoD IA workforce per Chapter 8 and References (bc), (qp), (rq), (sr), and (ts).

## C7.2.  Ia Workforce Management

C7.2.1.  The DoD Components must identify military, civilian, and contractor personnel performing IA functions whether performed as their primary duty, or as an additional/embedded duty.  Chapters 3, 4, 5, 10, and 11 provide a DoD standard naming convention and descriptions of IA categories, specialties, levels, and their related functions.


C7.2.2.  Identify all positions required to perform IA functions, by category or specialty and

level, in manpower tables of organization. Identification of the IA workforce positions must be a management review item.

C7.2.3.  Assign appropriately trained and certified personnel to IA positions (internal and
joint positions), per Chapters 2-5, 10 and 11.

C7.2.4.  Require each individual assigned IA responsibilities to sign a statement of
responsibilities appropriate for that position.  Appendix 4 provides a recommended statement of responsibilities for privileged access users.

C7.2.5.  Track IA personnel training and certification against position requirements.
Positions required to perform functions in more than one category or level of management,
technical, or specialized IA functions must be identified individually in the appropriate
manpower database.  Personnel filling these positions must be aligned with the position and maintain the appropriate certification/qualifications for each.

C7.2.6.  Collect metrics on DoD Component training (including awareness) and
certification programs in accordance with Chapter 8.

## C7.3.  Ia Workforce Identification Requirements

C7.3.1.  To manage the IA workforce effectively, the DoD Components must comply with the following requirements for each employee group.



C7.3.2.  Civilians:

C7.3.2.1.  DoD personnel in the 2210 job series and other civilian IA job series (e.g.,
0854, 1550)  General Schedule (GS) shall be classified by GS parenthetical specialty title. They must indicate a primary title based on the position's primary or paramount duties.  They must also indicate a secondary parenthetical specialty title if performing additional/embedded duties beyond those primary duties.



C7.3.2.2.  Identify all civilian positions and personnel required to perform IA functions
described in this Manual in the appropriate database(s) (e.g., DCPDS, e-Joint Manpower and Personnel System (e-JMAPS), or equivalent), including Local Nationals, performing IA functions, regardless of series, and align them with the categories and levels described in Chapters 3, 4, 5, 10, and 11.  IA workforce management metrics include the following:

C7.3.2.2.1.  All IA positions, regardless of whether IA functions are performed as a
primary duty, or as an additional/embedded duty.

C7.3.2.2.2.  Certification status of incumbent including certification or recertification
date, cost of certification/recertification test, and associated training (if paid by the government).
C7.3.2.2.3.  Waivers granted for personnel filling IA positions.

C7.3.2.3.  Verify that DCPDS or its equivalent has the correct data (down to the
parenthetical specialty level for the series).

C7.3.2.4.  Use the DCPDS Special civilian titling to align  workforce metrics
across the Department of Defense based on the following:

C7.3.2.4.1.  Use the existing authorized Position Specialty Code, "INFOSEC," to
support IA workforce identification and management requirements across the Department of Defense.  The DoD Components will ensure that DCPDS reflects the following guidance:

C7.3.2.4.2.  All positions in the 2210 or other civilian IA job series (e.g., 0854, 1550)
must comply with Office of Personnel Management (OPM) guidance on standardized titling.
Positions in job series with primary or additional/embedded IA functions must enter at least one but not more than two authorized parenthetical titles.

C7.3.2.4.3.  Ensure that all DoD civilian positions and personnel with IA functions,
regardless of OPM series or job title, use "INFOSEC" as the Position Specialty Code (PSC) in
the Defense Civilian Personnel Data System.  The PSC allows identification of a DoD civilian position with IA functions regardless of OPM series or job title.  The abbreviation for Security, "INFOSEC," established in this Manual, supports civilian IA workforce identification and management requirements across the Department of Defense.


## C7.3.3.  Military:


C7.3.3.1.  Identify all military positions and personnel required to perform IA functions
described in this Manual in the appropriate database(s) (e.g., e-JMAPS, or DoD Component Manpower/Personnel Systems), including Foreign Nationals, regardless of occupational specialty, and align them with the categories and levels described in Chapters 3-5, 10, and 11.

C7.3.3.2.  Identify the following, regardless of occupational specialty, in, e-JMAPS, or
the DoD Component manpower and/or personnel management systems, as appropriate:

C7.3.3.2.1.  All IA positions, regardless of whether IA responsibilities are performed
as a primary duty, or as an additional/embedded duty.

C7.3.3.2.2.  All personnel performing IA functions.

C7.3.3.2.3.  Certification status of incumbent including certification or recertification
date, cost of certification/recertification test, and associated training (if paid by the government).

C7.3.3.3.  Assign a code to each IA position that identifies its category or specialty and
level, and the corresponding minimum certification requirements per Chapters 3-5, 10, 11, and Appendix 3.
C7.3.3.4.  Assign a code to individuals based on their certification level. C7.3.3.5.  Match the certified individuals against required positions.
C7.3.3.6.  Track the IA workforce against the required positions.

## C7.3.4.  Contractors


C7.3.4.1.  Identify all contractors performing IA functions and align them with the
categories and levels described in Chapters 3, 4, 10, and 11.

C7.3.4.2.  Ensure that contractor personnel, including LNs, have the appropriate IA
certification and background investigation.

C7.3.4.3.  Ensure the capability to collect metrics in detail on individual contractor
employee certification(s) and certification status.

C7.3.4.4.  Specify contractor certification and training requirements in all contracts that
include acquisition of IA services.  Eligible contractor personnel must have their IA certification and function level documented in DMDC supported application which will support tracking contractors IA category or specialty, level, and certification qualification.

C7.3.4.5.  Contracting officers' technical representatives will enter the required data into
the DMDC application which will support tracking contractors IA category, specialty, level, and certification qualification.

## C8.  Chapter 8 Ia Workforce Management Reporting And Metrics C8.1.  Introduction

C8.1.1.  To manage its IA workforce effectively and efficiently, and provide trained and qualified personnel when and where needed, the Department of Defense must know IA position requirements, the existing IA workforce and its qualifications, and where these critical assets are employed.


C8.1.2.  The workforce metrics outlined in this chapter support the DoD current and long term management of critical IA personnel resources.


C8.1.3.  The DoD Components must use, to the extent possible, existing personnel/manpower/unit organizational databases and tools to satisfy these IA reporting and workforce management metrics requirements.


C8.1.4.  The IA WIP Annual Report is due at the end of the fiscal year and will support the Federal Information Security Management Act (FISMA) report (Reference (bc)) requirements.  The IA WIP Annual Report consolidates IA qualification and workforce management reporting requirements per References (ab), (bc), (h), (ih), and (ji).



## C8.2.  Reporting And Ia Workforce Metrics Requirements


C8.2.1.  ASD(NII)/DoD CIO coordinates IA Training and Certification Program management requirements, and ensures that collected information supports ASD(NII)/DoD CIO validation of DoD IA workforce readiness.  Each DoD Component must provide DMDC with the individual and position level data required to populate the tables in Figure C8.F1., which will be used to generate the IA WIP Annual Report to support FISMA requirements and IA workforce management at each level of the DoD.


C8.2.2.  All the DoD Components are required to submit data on the status of their IA
workforce for inclusion in the IA WIP Annual Report.



C8.2.3.  The DoD Components will provide both qualitative and quantitative information.
The information reported will support the following IA workforce management critical information requirements:
C8.2.3.1.  Methodologies used to identify employees required to perform IA functions.

C8.2.3.2.  Training and certification requirements developed by the DoD Components for
employees performing IA functions.


C8.2.3.3.  Tracking processes used to determine requirements for how many employees
perform IA functions and have received IA training and certification.

C8.2.3.4.  Plans and methodologies to track, monitor, and document completion of IA
awareness training for all network users.

C8.2.3.5.  The ASD(NII)/DoD CIO will review and validate/approve the methodologies
and processes reported by the DoD Components to implement and maintain the DoD baseline requirements of this Manual.

C8.2.4.  To support DoD IA Workforce management requirements, the ASD(NII)/DoD CIO
will combine metrics from the DoD Components to assemble a consolidated IA WIP Annual Report and status.  The IA WIP Annual Report will include DoD Component comments
regarding IA workforce lessons learned, issues from the previous calendar year, and plans for the
next.  It will also provide statistics for personnel performing IA functions on a primary or additional/embedded duty basis, broken down by IA category, specialty and level.

C8.2.5.  In addition to the reporting requirements outlined in this chapter, ASD(NII)/DoD
CIO will gather data on numerous aspects of the IA workforce including recruitment, retention, training, and impact on IA operations.  This data will be combined with the DoD Component submitted reports to develop a comprehensive picture of the IA workforce and its operational effectiveness.

C8.2.6.  The DoD Components will submit quantitative data as part of IA WIP annual
reporting that identifies its positions, number filled, and qualifications of the personnel filling them to support both DoD FISMA reporting and the DoD CIO's IA workforce management responsibility.

C8.2.6.1.  Each DoD Component must ensure that its personnel and staffing databases
are properly configured, per References (qp) through (ts), to capture the following quantitative data.  If a given metric cannot be captured to a database it must be collected manually and included with the submission of the qualitative data described above.

C8.2.6.2.  IA workforce positions and manning status.

C8.2.6.2.1.  Number of IA positions by category, specialty and level.

C8.2.6.2.1.1.  Primary duty IA positions.

C8.2.6.2.1.2.  Additional/embedded duty IA positions.

C8.2.6.2.2.  Number of IA positions filled, by category or specialty, and level.
C8.2.2.3.  Number of IA positions filled with qualified incumbents by category or specialty and level.


C8.2.6.3.  Personnel qualified levels:  (This is a management review item.)
C8.2.6.3.1.  Number of personnel qualified, by category or specialty, and


level.

C8.2.6.3.2.  Number of personnel qualified, by category, specialty, and level who
are actually filling an IA position.

C8.2.6.4.  Number of users who completed the IA awareness training requirement versus total number of authorized users.  (This is a management review item.)

C8.2.7.  The IA WIP Annual Report covers 1 October through 30
September each fiscal year.  Each DoD Component must provide the DMDC with individual and position level data required to populate the tables in Figure C8.F1 for the preceding fiscal year.  The DoD Components will submit their qualitative information to ASD NII/DoD CIO by 30 September for the preceding fiscal year.  The DMDC will create a consolidated report capturing the DoD Components' IA Workforce Metrics reflected in the tables in Figure C8.F1. (Note:  LNs are included in two employee groups:  Civilian and Contractor.  LN includes all individuals working for the Department of Defense in a foreign country who are nationals or non U.S. residents of that country).


C8.2.8.  The IA WIP Annual Report referred to in paragraphs C1.4.1.5., C8.1.4., C8.2.1., C8.2.2., C8.2.4., C8.2.6., C8.2.7., and Figure C8.F1. of this issuance has been assigned report control symbol DD-NII(A)2274 in accordance with the procedures in *Volume 1 of* DoD Manual 8910.01 (Reference (ut)).


total of approximately $188,000 in Fiscal Years 2012 - 2017.

Generated on 2011Nov15 1034

RefID: 5-2B2C687


Civilian
Military
Contractor
Number
Filled Qualified* / Waiver
IAT I


IAT II


IAT III


IAM I


IAM II


IAM III


CND-A


CND- IS


CND-IR


CND-AU


CND-SPM


IASAE I


IASAE II


IASAE III


Total


* Qualified in accordance with the policy for that position. Report waivers approved by the DAA (see paragraph C3.2.4.2., C3.2.4.3., C4.2.3.2., or C4.2.3.4.2.) separately from qualified (e.g., 100/10).  Count personnel filling IAT, CND-SP, IASAE, and IAM Category or specialty positions in all categories or specialties according to C2.2.5. and AP2.1.2.3.


Civilian
Military
Contractor
Number
Filled Qualified* /Waiver
IAT I


IAT II


IAT III


IAM I


IAM II


IAM III


CND-A


CND- IS


CND-IR


CND-AU


CND-SPM


IASAE I


IASAE II


IASAE III


Total
Number
Filled
Filled Qualified* /Waiver Qualified*
/Waiver
Number
Filled Qualified* / Waiver
Filled Qualified*
/ Waiver

* Qualified in accordance with the policy for that position. Report waivers approved by the DAA (see paragraph C3.2.4.2., C3.2.4.3., C4.2.3.2., or C4.2.3.4.2.) separately from qualified (e.g,. 100/10).  Count personnel filling IAT, CND-SP, IASAE, IAM Category or Specialty positions in all categories per C2.2.5. and AP2.1.2.3.

## C9.  Chapter 9 Ia Workforce Implementation Requirements C9.1.  Introduction

C9.1.1.  This chapter provides guidance to support a coordinated and orderly transition from the legacy systems and processes to full compliance with the DoD's requirements.  These actions require in-depth budget and personnel management planning.


C9.1.2.  Adhering to the categories, specialties and levels outlined is critical to support the effective identification of the IA workforce across the Department of Defense.  Standardizing skill sets supports joint assignments and system interoperability.



## C9.2.  General Requirements


C9.2.1.  The DoD Components must:

C9.2.1.1.  Plan for, and incrementally complete, these requirements over four years from the effective date of this manual.  Complete requirements to this Manual within 5 years from the publication date (1 extra year to implement CND-SP and IASAE Specialties).


C9.2.1.2.  Develop and submit to the IA WIPAC implementation policies, processes, and plans to support compliance with the requirements outlined below within 6 months of the publication date of this Manual.

C9.2.1.3.  Provide representation to the IA WIPAC as required in Chapter 1.



## C9.3.  Specific Requirements

C9.3.1.  To allow for proper identification and planning of requirements, the Department of Defense has adopted a phased approach to this implementation.  The first year provides time for the identification of specific requirements to support budget and staffing planning, and to certify the initial 10 percent of the IA workforce.  The next 3 years provide time to bring the full IA workforce into compliance with the requirements in phases.  Thirty percent of the workforce must come into compliance each year, as outlined below.


C9.3.2.  Within 12 months of the effective date of this Manual, the DoD Components must:


C9.3.2.1.  Provide Component IA Manager and Human Resource Management participation in the DoD sponsored Component Implementation Workshop that will be conducted by the Defense-wide Information Assurance Program (DIAP) Office within three months of publication of this Manual.



C9.3.2.2.  Identify all positions per Chapters 3-5, 7, 10 and 11, required to execute the IA
functions listed in Chapters 3-5, 10 and 11 as primary or additional/embedded duties.

C9.3.2.3.  Assign IA workforce category, specialty and level codes for the Component's
staffing and personnel data systems based on the categories and levels described in Chapters 3-5, 10 and 11.  These codes must be identified to DMDC per References (qp), (rq), (sr), and (ts). The data elements will be routinely captured by the DMDC and formatted to support the DoD's IA workforce management requirements.  If a Component uses a personnel or manpower system
or database that does not exchange data with DMDC systems, develop the necessary data fields
to track IA workforce requirements.

C9.3.2.4.  Budget for IA training, certification, and workforce management requirements
of DoD government personnel, as described below.  The budget plan must ensure implementation of the requirements over a three year period, and must specifically include resources for:

C9.3.2.4.1.  Staffing identified IA positions (primary or additional/embedded duty). C9.3.2.4.2. Training incumbents. C9.3.2.4.3.  Ensuring staffing and unit databases/tools are upgraded to support IA
workforce management requirements as appropriate.

C9.3.2.4.4.  Training for staffing managers on the systems and processes required to
support the IA workforce training and management requirements.

C9.3.2.4.5.  Certifying (including training and testing) current and planned IA
workforce members.

C9.3.2.5.  The DoD Components must plan to meet the following milestones.  The

milestone plan will begin with the next planning, program, and budget cycle to execute these requirements beginning in Calendar Year (CY)-07.  The phases of this implementation approach are:

C9.3.2.5.1.  Year One (CY-07):  Identify IA workforce positions, fill 10 percent of
the IA positions with certified personnel.  Develop budget to support follow-on implementation years twofour.

C9.3.2.5.2.  Year Two (CY-08):  Fill a total of 40 percent of the IA positions with
certified personnel.
C9.3.2.5.3.  Year Three (CY-09):  Fill a total of 70 percent of the IA positions with certified personnel.

C9.3.2.5.4.  Year Four (CY-10):  All IAT and IAM Category positions are held by certified personnel.

C9.3.2.5.5.  Year Five (CY-11):  All CND-SP and IASAE Specialty positions are held by certified personnel.

C9.3.2.5.6.  Thereafter, all incumbents and new hires must be trained, certified, and recertified in accordance with this Manual.

## C10.  Chapter 10 Ia Workforce System Architect And Engineer (Iasae) Specialty



## C10.1.  Introduction

C10.1.1.  This chapter provides detailed position guidelines and IA functions for each level within the IASAE specialty.


C10.1.2.  The functions associated with each of these levels are intended to be baseline DoD
requirements.  The DoD Components are expected to have additional requirements reflecting their operating policy and information system technical environment.  The requirements of this Manual do not exempt individuals from meeting their own organization's standards and requirements.



## C10.2.  Iasae Specialty Description


C10.2.1.  This specialty comprises IASAE Levels I, II, and III.

C10.2.2.  The levels and functions in the IASAE specialty are not necessarily cumulative.

Table C10.T1. summarizes IASAE position requirements.



| Civilian, Military or Contractor*    | IASAE Level I - III            |
|--------------------------------------|--------------------------------|
| (Including LNs )                     | (FN/LN Levels I and II** only) |
| Initial Training ***                 | Yes                            |
| Yes                                  | IA Baseline Certification      |
| (from approved list)                 | (within 6 months)              |
|                                      |                                |
| Initial OJT Evaluation               | No                             |
|                                      |                                |
| No                                   |                                |
| CE/OS                                |                                |
| Certificate                          |                                |
|                                      |                                |
| Maintain Certification Status        |                                |
| Yes                                  |                                |
| (as required by certification)       |                                |
| Yes                                  |                                |
|                                      |                                |
|                                      |                                |
| (as required by certification (e.g., |                                |
| (ISC)2 requires 120 hours within 3   |                                |
| Continuous Education or              |                                |
| Sustainment Training                 |                                |
| years for the CISSP))                |                                |
|                                      |                                |
| Background Investigation             |                                |
| As required by IA level and          |                                |
| Reference (                          | b                              |
| c                                    |                                |
| )                                    |                                |

*Requirements to be stated in contract
**FN/LN IASAE Level II must meet conditions of References (bc), (ih) and (ji)
***Classroom, distributive, blended, *government,* or commercial provider

## C10.2.3.  Iasae Specialty Certification Requirements:


C10.2.3.1.  The certification requirement for IASAE specialty positions includes all the functions identified for that level.  All IASAE specialty personnel, whether they perform IA functions as primary or as an additional/embedded duty, will be certified based on the IA functions of the position.



C10.2.3.1.1. Personnel required to perform any IASAE specialty IA function(s) (one
or more functions) at any level must be certified to the highest level function(s) performed.  An IASAE position's functional requirement(s) for a particular level establish the basis for the certification requirement.

C10.2.3.1.2.  IASAE positions that also perform IAT functions must also obtain the
appropriate computing environment certification and complete the other IAT level requirements prior to being granted unsupervised privileged access.

C10.2.3.2.  Within 6 months of assignment of IA duties, IASAE specialty military and
Government civilian personnel must achieve the appropriate IA baseline certification for their level.

C10.2.3.2.1.  New hires' qualification periods begin the date they start in the position
(i.e., they must obtain the appropriate certification within 6 months of being assigned IA functions).

C10.2.3.2.2.  DoD employees and contractors performing IA functions on the
effective date of this Manual have up to 4 years to comply with the certification requirements, based on DoD Component plans to meet the implementation milestones established in Chapter 9.

C10.2.3.2.3.  DAAs may waive the certification requirement under severe operational
or personnel constraints. The waiver will be documented by the DAA using a memorandum for the record stating the reason for the waiver and the plan to rectify the constraint.

C10.2.3.2.4.  Waivers will not extend beyond 6 months, must include an expiration
date, and be documented in the individual's IA training record.  Consecutive waivers for personnel are not authorized except as noted in paragraph C10.2.3.4.2.  Waivers must be a management review item.

C10.2.3.3.  Personnel in IASAE specialty positions must maintain certifications, as
required by their certification provider to retain their position.

C10.2.3.4.  Personnel not certified within 6 months of assignment of IA duties or who fail
to maintain their certified status will not be permitted to carry out the responsibilities of the position.  The DoD Components must develop programs to address remedial training and to establish conditions allowing IASAE personnel to return to certified status.

C10.2.3.4.1.  Individuals continuing to not meet certification requirements after

appropriate remediation efforts shall be reassigned to other duties.

C10.2.3.4.2.  IASAE specialty personnel must be fully trained and certified prior to
deployment to a combat environment.  However, the DAA may grant an interim waiver for the period of the deployment for IASAE personnel to fill IASAE billets one level higher than their current certification.  The interim waiver places an individual in a suspense status and must be time limited and include an expiration date not to exceed 6 months following the date of return from the combat environment.

C10.2.3.5.  The DoD Components must document and maintain the certification status of
their IASAE specialty personnel as long as they are assigned to those duties.  Identification and tracking requirements are addressed in Chapter 7.

C10.2.3.6.  Personnel in IASAE specialty positions will retain an appointing letter
assigning them IA responsibilities for their system(s) in accordance with Reference (bc).  If an IASAE specialty position requires IA privileged access, a statement of responsibility for the system(s) will also be executed in accordance with Reference (bc).  Appendix 4 provides a sample statement of acceptance of responsibilities.

C10.2.3.7.  In support of GIG infrastructure security requirements, certification standards
apply equally to DoD civilian, military, contractor personnel, and LNs.

C10.2.3.7.1.  New contract language must specify certification requirements.
Existing contracts must be modified to specify certification requirements during the phased implementation described in Chapter 9.

C10.2.3.7.2.  LNs or FNs may be conditionally assigned to IASAE Level II but may
not be assigned to IASAE Level III positions in compliance with Reference (bc). IASAE positions/personnel with privileged access or management functions must comply with background investigation requirements in Table E3.T1. of Reference (bc).


C10.3.  IASAE LEVEL I

C10.3.1.  IASAE Level I personnel are responsible for the design, development,
implementation, and/or integration of a DoD IA architecture, system, or system component for use within their CE.  Incumbents ensure that IA related IS will be functional and secure within the CE.  IASAE Level I position requirements are listed in Table C10.T2.



IASAE Level I
Attribute
Level
Experience
Usually an entry level IASAE position with 0 or more years of IASAE experience.
| System Environment                                       | CE IASAE.                                        |
|----------------------------------------------------------|--------------------------------------------------|
| Knowledge                                                | Applies knowledge of IA policy, procedures, and  |
| structure to design, develop, and implement CE           |                                                  |
| system(s), system components, or system                  |                                                  |
| architectures.                                           |                                                  |
| Supervision                                              |                                                  |
| -                                                        | For IA issues, typically reports to an IASAE     |
| Level II, IAM, or DAA.                                   |                                                  |
| -                                                        | May report to other management for other CE      |
| operational requirements.                                |                                                  |
| Other                                                    | Actions are usually authorized and controlled by |
| policies and established procedures.                     |                                                  |
| IA Baseline                                              |                                                  |
|                                                          |                                                  |
| Certification Within 6 months of assignment to position. |                                                  |


C10.3.2.  Table C10.T3. lists the specific functions associated with the IASAE Level I
position.  Positions responsible for performing any of these functions, regardless of the incumbent's occupational title (Engineer, Scientist, Computer Specialist, ISSO, IAO, ISSM, manager, pilot, infantry officer, etc.) shall be identified as part of the IA workforce and must comply with the requirements in Tables C10.T1. and C10.T2.

## Table C10.T3.  Iasae Level I Functions



IASAE-I.1.   Identify information protection needs for CE system(s) and network(s).

IASAE-I.2.   Define CE security requirements in accordance with applicable IA requirements
(e.g., Reference (bc), Director Central Intelligence Directive 6/3 (Reference (vu)), organizational security policies).

IASAE-I.3.   Provide system related input on IA security requirements to be included in
statements of work and other appropriate procurement documents.

IASAE-I.4.   Design security architectures for CE system(s) and network(s).

IASAE-I.5.   Design and develop IA or IA-enabled products for use within a CE.

IASAE-I.6.   Integrate and/or implement Cross Domain Solutions (CDS) for use within a CE.

IASAE-I.7.   Design, develop, and implement security designs for new or existing CE system(s).
Ensure that the design of hardware, operating systems, and software applications adequately address IA security requirements for the CE.

IASAE-I.8.   Design, develop, and implement system security measures that provide
confidentiality, integrity, availability, authentication, and non-repudiation.

IASAE-I.9.   Develop and implement specific IA countermeasures for the CE.

IASAE-I.10. Develop interface specifications for CE system(s).

IASAE-I.11. Develop approaches to mitigate CE vulnerabilities, recommend changes to system
or system components as needed.

IASAE-I.12. Ensure that system designs support the incorporation of DoD-directed IA
vulnerability solutions, e.g., IAVAs.

IASAE-I.13. Develop IA architectures and designs for DoD IS with basic integrity and
availability requirements, to include MAC III systems as defined in References
(bc) and (h); systems with a Basic Level-of-Concern for availability or integrity in
accordance with Reference (wv); and other DAA designated systems.

IASAE-I.14. Develop IA architectures and designs for systems processing Sensitive
Compartmented Information (SCI) that will operate at Protection Level 1 or 2 as defined in Reference (vu).

IASAE-I.15. Assess threats to and vulnerabilities of CE system(s).

IASAE-I.16. Identify, assess, and recommend IA or IA-enabled products for use within a CE;
ensure recommended products are in compliance with the DoD evaluation and validation requirements of References (bc) and (h).

IASAE-I.17. Ensure that the implementation of security designs properly mitigate identified
threats.

IASAE-I.18. Assess the effectiveness of information protection measures utilized by CE
system(s).

IASAE-I.19. Ensure security deficiencies identified during security/certification testing have
been mitigated, corrected, or a risk acceptance has been obtained by the appropriate DAA or authorized representative.

IASAE-I.20. Provide input to IA C&A process activities and related documentation (system lifecycle support plans, concept of operations, operational procedures and maintenance training materials, etc.).

IASAE-I.21. Participate in an IS risk assessment during the C&A process and design security
countermeasures to mitigate identified risks.

IASAE-I.22. Provide engineering support to security/certification test and evaluation activities.

IASAE-I.23. Document system security design features and provide input to implementation
plans and standard operating procedures.

IASAE-I.24. Recognize a possible security violation and take appropriate action to report the
incident.

IASAE-I.25. Implement and/or integrate security measures for use in CE system(s) and ensure
that system designs incorporate security configuration guidelines.

IASAE-I.26. Ensure the implementation of CE IA policies into system architectures.

IASAE-I.27. Obtain and maintain IA baseline certification appropriate to position.

## C10.4.  Iasae Level Ii


C10.4.1.  IASAE Level II positions are responsible for the design, development, implementation, and/or integration of a DoD IA architecture, system, or system component for use within the NE.  Incumbents ensure that IA related IS will be functional and secure within the NE.  IASAE Level II position requirements are listed in Table C10.T4.

IASAE Level II
Attribute
Level
Experience
Usually has at least 5 years of IASAE experience.
System Environment
NE IASAE.
Knowledge
Applies knowledge of IA policy, procedures, and workforce structure to design, develop, and implement a secure NE.
Supervision
- For IA issues, typically reports to an IASAE
Level III, IAM, or DAA.
- May report to other senior IASAE for network
operational requirements.
Other
- Relies on experience and judgment to plan
and accomplish goals.
- LN opportunities are extremely limited and
must meet requirements of Table E3.T1. of Reference (bc).

IA Baseline Certification
Within 6 months of assignment to position.

C10.4.2.  Table C10.T5. lists the specific functions associated with the IASAE Level II
position.  Positions responsible for performing any of these functions, regardless of the incumbent's occupational title (Engineer, Scientist, Computer Specialist, ISSO, IAO, ISSM, manager, pilot, infantry officer, etc.) shall be identified as part of the IA workforce and must comply with the requirements in Tables C10.T4. and C10.T1.

## Table C10.T5.  Iasae Level Ii Functions


IASAE-II.1.  Identify information protection needs for the NE.

IASAE-II.2.  Define NE security requirements in accordance with applicable IA requirements
(e.g., References (bc) and (ut) and organizational security policies).

IASAE-II.3.  Provide system related input on IA security requirements to be included in
statements of work and other appropriate procurement documents.

IASAE-II.4.   Design security architectures for use within the NE.

IASAE-II.5.   Design and develop IA or IA-enabled products for use within a NE.

IASAE-II.6.   Integrate and/or implement CDS for use within a CE or NE.

IASAE-II.7.  Develop and implement security designs for new or existing network system(s).
Ensure that the design of hardware, operating systems, and software applications adequately address IA security requirements for the NE.

IASAE-II.8.  Design, develop, and implement network security measures that provide
confidentiality, integrity, availability, authentication, and non-repudiation.

IASAE-II.9.   Design, develop, and implement specific IA countermeasures for the NE.

IASAE-II.10. Develop interface specifications for the NE.

IASAE-II.11. Develop approaches to mitigate NE vulnerabilities and recommend changes to
network or network system components as needed.

IASAE-II.12. Ensure that network system(s) designs support the incorporation of DoD-directed
IA vulnerability solutions, e.g., IAVAs.

IASAE-II.13. Develop IA architectures and designs for DoD IS with medium integrity and
availability requirements, to include MAC II systems as defined in References (bc) and (h), systems with a medium Level-of-Concern for availability or integrity in accordance with Reference (vu), and other DAA designated systems.

IASAE-II.14. Develop IA architectures and designs for systems processing SCI that will operate
at Protection Level 1 or 2 as defined in Reference (vu).

IASAE-II.15. Assess threats to and vulnerabilities of the NE.

IASAE-II.16. Identify, assess, and recommend IA or IA-enabled products for use within an NE;
ensure recommended products are in compliance with the DoD evaluation and validation requirements of References (bc) and (h).

IASAE-II.17. Ensure that the implementation of security designs properly mitigate identified
threats.

IASAE-II.18. Assess the effectiveness of information protection measures used by the NE.

IASAE-II.19. Evaluate security architectures and designs and provide input as to the adequacy
of security designs and architectures proposed or provided in response to requirements contained in acquisition documents.

IASAE-II.20. Ensure security deficiencies identified during security/certification testing have
been mitigated, corrected, or a risk acceptance has been obtained by the appropriate DAA or authorized representative.

IASAE-II.21. Provide input to IA C&A process activities and related documentation (e.g.,
system life-cycle support plans, concept of operations, operational procedures, and maintenance training materials).

IASAE-II.22. Participate in an IS risk assessment during the C&A process and design security
countermeasures to mitigate identified risks.

IASAE-II.23. Provide engineering support to security/certification test and evaluation activities.

IASAE-II.24. Document system security design features and provide input to implementation
plans and standard operating procedures.

IASAE-II.25. Recognize a possible security violation and take appropriate action to report the
incident.

IASAE-II.26. Implement and/or integrate security measures for use in network system(s) and
ensure that system designs incorporate security configuration guidelines.

IASAE-II.27. Ensure the implementation of NE IA policies into system architectures.

IASAE-II.28. Ensure the implementation of subordinate CE IA policies is integrated into the NE
system architecture.

IASAE-II.29. Obtain and maintain IA baseline certification appropriate to position.

## C10.5.  Iasae Level Iii

C10.5.1.  IASAE Level III positions are responsible for the design, development, implementation, and/or integration of a DoD IA architecture, system, or system component for use within CE, NE, and enclave environments.  They ensure that the architecture and design of DoD IS are functional and secure.  This may include designs for program of record systems and special purpose environments with platform IT interconnectivity.  Incumbents may also be responsible for system or network designs that encompass multiple CE and/or NE to include those with differing data protection/classification requirements.  IASAE Level III position requirements are listed in Table C10.T6.

IASAE Level III
Attribute
Level
Experience
Usually has at least 10 years of IASAE experience.
System Environment
Enclave Environment IASAE.
Knowledge
Applies knowledge of IA policy, procedures, and workforce structure to design, develop, and implement a secure enclave environment.
Supervision
- Typically reports to a DAA for IA issues.
- May report to other senior managers for enclave
operational requirements.
Other
- Must be a U.S. Citizen. - Relies on extensive experience and judgment to
plan and accomplish enclave security related goals.
- May also serve in a management/oversight
capacity for an enclave(s).
IA Baseline Certification
Within 6 months of assignment to position.

C10.5.2.  Table C10.T7. lists the specific functions associated with the IASAE Level III
position.  Positions responsible for performing any of these functions, regardless of the incumbents' occupational title (Chief Engineer, Engineer, Scientist, Computer Specialist, ISSO, IAO, ISSM, manager, pilot, infantry officer, etc) shall be identified as part of the IA workforce and must comply with the requirements in Tables C10.T6. and C10.T1.

## Table C10.T7.  Iasae Level Iii Functions


IASAE-III.1.  Identify information protection needs for the enclave environment.

IASAE-III.2.  Define enclave security requirements in accordance with applicable IA policies
(e.g., References (bc) and (vu) and organizational security policies).

IASAE-III.3.  Provide input on IA security requirements to be included in statements of work
and other appropriate procurement documents.

IASAE-III.4.  Support Program Managers responsible for the acquisition of DoD IS to ensure
IA architecture and systems engineering requirements are properly addressed throughout the acquisition life-cycle.

IASAE-III.5.  Design security architectures for use within the enclave environment.

IASAE-III.6.  Design and develop IA or IA-enabled products for use within the enclave.

IASAE-III.7.  Design and develop CDS for use within CE, NE, or enclave environments.

IASAE-III.8.  Develop and implement security designs for new or existing enclave system(s).
Ensure that the design of hardware, operating systems, and software applications adequately address IA security requirements for the enclave.

IASAE-III.9.  Design, develop, and implement security measures that provide confidentiality,
integrity, availability, authentication, and non-repudiation for the enclave environment.

IASAE-III.10. Design, develop, and implement specific IA countermeasures for the enclave.

IASAE-III.11. Develop interface specifications for use within the enclave environment.

IASAE-III.12. Develop approaches to mitigate enclave vulnerabilities and recommend changes
to system or system components as needed.

IASAE-III.13. Ensure that enclave system(s) and network(s) designs support the incorporation
of DoD-directed IA vulnerability solutions, e.g., IAVAs.

IASAE-III.14. Develop IA architectures and designs for DoD IS with high integrity and
availability requirements, to include MAC I systems as defined in References (bc) and (h), systems with a high Level-of-Concern for availability or integrity in
accordance with Reference (vu), and other DAA designated systems.

IASAE-III.15. Develop IA architectures and designs for systems and networks with multilevel
security requirements or requirements for the processing of multiple classification levels of data (e.g., UNCLASSIFIED, SECRET, and TOP SECRET).

IASAE-III.16. Develop IA architectures and designs for systems processing SCI that will
operate at Protection Level 3, 4, or 5 as defined in Reference (vu).

IASAE-III.17. Develop IA architectures and designs for DoD IS to include automated IS
applications, enclaves (which include networks), and special purpose environments with platform IT interconnectivity, e.g., weapons systems, sensors, medical technologies, or distribution systems.

IASAE-III.18. Ensure that acquired or developed system(s) and network(s) employ Information
Systems Security Engineering and are consistent with DoD Component level IA architecture.

IASAE-III.19. Assess threats to and vulnerabilities of the enclave.

IASAE-III.20. Identify, assess, and recommend IA or IA-enabled products for use within an
enclave and ensure recommended products are in compliance with the DoD evaluation and validation requirements of References (bc) and (h).

IASAE-III.21. Ensure that the implementation of security designs properly mitigate identified
threats.

IASAE-III.22. Assess the effectiveness of information protection measures utilized by the
enclave.

IASAE-III.23. Evaluate security architectures and designs and provide input as to the adequacy
of security designs and architectures proposed or provided in response to requirements contained in acquisition documents.

IASAE-III.24. Ensure security deficiencies identified during security/certification testing have
been mitigated, corrected, or a risk acceptance has been obtained by the appropriate DAA or authorized representative.

IASAE-III.25. Provide input to IA C&A process activities and related documentation (e.g.,
system life-cycle support plans, concept of operations, operational procedures, and maintenance training materials).

IASAE-III.26. Participate in an IS risk assessment during the C&A process and design security
countermeasures to mitigate identified risks.

IASAE-III.27. Provide engineering support to security/certification test and evaluation activities.

IASAE-III.28. Document system security design features and provide input to implementation
plans and standard operating procedures.

IASAE-III.29. Recognize a possible security violation and take appropriate action to report the
incident.

IASAE-III.30. Implement and/or integrate security measures for use in the enclave and ensure
that enclave designs incorporate security configuration guidelines.

IASAE-III.31. Ensure the implementation of enclave IA policies into system architectures.

IASAE-III.32. Ensure the implementation of subordinate CE and NE IA policies are integrated
into the enclave system architecture.

IASAE-III.33. Oversee and provide technical guidance to IASAE Level I and II personnel.

IASAE-III.34. Obtain and maintain IA baseline certification appropriate to position.

## C11. Chapter 11 Computer Network Defense-Service Provider (Cnd-Sp) Specialty C11.1.  Introduction

C11.1.1.  This chapter provides detailed guidelines and CND-SP functions for each level within the CND-SP specialty.  The requirements of this Manual apply to CND-SP established and accredited in accordance with Reference (ih).


C11.1.2.  The functions associated with this specialty are intended to be baseline DoD
requirements.  Each CND-SP is expected to have additional requirements reflecting its operating policy, specific organizational mission, and technical operating environment. The requirements of this Manual do not exempt individuals from meeting their own organization's standards and requirements.



## C11.2.  Cnd-Sp Specialty Description

C11.2.1.  This specialty is comprised of the following:

C11.2.1.1.  CND-SP Analyst (CND-A) C11.2.1.2.  CND-SP Infrastructure Support (CND-IS) C11.2.1.3.  CND-SP Incident Responder (CND-IR) C11.2.1.4.  CND-SP Auditor (CND-AU) C11.2.1.5.  CND-SP Manager (CND-SPM)

C11.2.2.  Personnel assigned to accredited CND-SPs will normally occupy a position corresponding to a single CND-SP specialty.  In cases where personnel perform functions corresponding to multiple CND-SP specialties, their position should be designated based on the CND-SP specialty that most closely aligns to the position's primary responsibility and functions.



C11.2.3.  The following are CND-SP specialty training requirements:

C11.2.3.1.  Participation in initial formal training (classroom, distributive, government, or
blended) before or immediately upon assignment of Computer Network Defense (CND) responsibilities.  Training does not need to result in the award of a military category code (e.g., Military Occupational Specialty, Navy Enlisted Specialty Code, and/or Air Force Specialty Code), but must be sufficient to meet minimum certification standards outlined here and in Appendices 2 and 3.

C11.2.3.2.  Completion of an on-the-job skills practical evaluation to meet functional
requirements listed in this chapter (except CND-SPM).

C11.2.3.3.  Completion of sustainment training/continuing education as required to
maintain certification status.  For planning purposes the standard is normally a minimum of 20 to 40 hours annually, or 120 hours over 3 years.

C11.2.4.  The following are CND technical specialty certification requirements:

C11.2.4.1.  The certification program for CND-SP specialty positions must include the
functions identified for that level.  All CND-SP specialty personnel must be certified based on their primary CND position.

C11.2.4.1.1.  Within 6 months of assignment to an accredited CND-SP position, all
CND-SP specialty military and Government civilian personnel must achieve the appropriate CND certification unless a waiver is granted in accordance with paragraphs C11.2.4.2. or C11.2.4.3.

C11.2.4.1.2.  DoD employees or contractors performing CND functions on the
effective date of this Manual have up to 4 years to comply with these requirements, based on DoD Component plans to meet the implementation milestones established in Chapter 9.

C11.2.4.1.3.  The qualification period for new hires begins the date they start in the
position (i.e., they must obtain the appropriate certification within 6 months of being assigned CND functions).

C11.2.4.2.  USSTRATCOM may waive the certification requirement under severe
operational or personnel constraints. The waiver will be documented by the USSTRATCOM using a memorandum for the record stating the reason for the waiver and the plan to rectify the constraint.  Waivers will not extend beyond 6 months, must include an expiration date, and be documented in the individual's CND training record. Consecutive waivers for personnel are not authorized except as noted in paragraph C11.2.4.3. Waivers must be a management review item in accordance with Reference (bc).

C11.2.4.3.  CND-SP specialty personnel must be fully trained and certified prior to
deployment to a combat environment.  USSTRATCOM may approve a waiver for certified CND-SP billets without attaining the appropriate CND-SP specific certification while deployed to a combat environment (however, CND-SP specialty personnel must have the appropriate baseline IAT or IAM Certification).  USSTRATCOM may grant an Interim Waiver limited to the period of the deployment.  The interim waiver places an individual in a suspense status, which must be time limited and include an expiration date not to exceed 6 months following the date of return from combat status.

C11.2.4.4.  Personnel in CND-SP specialty positions must maintain certifications, as
required by the certification provider, to retain the CND-SP position.

C11.2.4.5.  Personnel who are not appropriately certified within 6 months of assignment to a position or who fail to maintain their certification status shall not be permitted to execute the responsibilities of the position.  The DoD Components will develop programs to address remedial training and conditions for individuals to attain or return to certified status.


C11.2.4.6.  The DoD Components must document and maintain the certification status of their CND-SP specialty personnel as long as they are assigned to those duties. Identification and tracking requirements are addressed in Chapter 7.


C11.2.4.7.  To support the GIG infrastructure security requirements, certification standards apply equally to DoD civilian, military, including those staffed by LNs (with conditional privileged access according to Reference (bc)), and contractor personnel.


C11.2.4.7.1.  New contract language must specify certification requirements.

Existing contracts must be modified, at an appropriate time during the phased implementation, to specify certification requirements.


C11.2.4.7.2.  In addition to the baseline CND certification requirement for their level, privileged users must obtain CE certifications as required by their employing organization to ensure they can effectively apply CND requirements to those systems.



C11.2.4.7.2.1.  New hire civilian personnel must agree as a "condition of
employment" that they will obtain and maintain the appropriate certification for the position.

C11.2.4.7.2.2.  All personnel must agree to release their certification
qualification(s) to the Department of Defense.

C11.2.4.8.  CND-SP specialty training requirements are summarized in Table C11.T1.


| CND-A, CND-IS, CND-IR, CND-AU,    | Civilian, Military, Contractor*    |
|-----------------------------------|------------------------------------|
| (Including Civilian or Contractor | CND-SPM                            |
| LNs)                              |                                    |
| Initial Training **               | Yes                                |
|                                   |                                    |
| IA Baseline Certification         | Yes                                |
| (from approved list)              | (within 6 months)                  |
|                                   |                                    |
| Initial OJT Evaluation            |                                    |
| Yes                               |                                    |
| (except CND-SPM)                  |                                    |
|                                   |                                    |
| CE/OS Certificate                 |                                    |
| Yes                               |                                    |
| (except CND-SPM)                  |                                    |
|                                   |                                    |
| Maintain Certification Status     |                                    |
| Yes                               |                                    |
| (as required by certification)    |                                    |
| Continuous Education or           | Yes                                |
| Sustainment Training              | As Required by Certification       |



(e.g., (ISC)2 requires 120 hours triennially
for the CISSP )

Background Investigation
As required by CND level and Reference
(bc)

Sign Privileged Access Statement
Yes
*Contractor specialty, level, and certification requirements to be specified in the contract **Classroom, Distributive, Blended, Government, or Commercial Provider


C11.3.  CND-A

C11.3.1.  CNDA personnel use data collected from a variety of CND tools (including intrusion detection system alerts, firewall and network traffic logs, and host system logs) to analyze events that occur within their environment.  Individuals within CND-SPs who collect and analyze event information or perform threat or target analysis duties within the CND-SP shall be considered CND-As.  CND-A position requirements are listed in Table C11.T2.



CND-A
Attribute
Level
Experience
Recommended at least 2 years of experience in CND technology or a related field.
System Environment
Works on a specific number of CND systems but analyzes events within the NE or enclave.
Knowledge
Significant knowledge of particular CND tools, tactics, techniques, and procedures which support their analysis of event information.
Supervision
Works under supervision and typically reports to a CND-SPM.
Other
Actions are usually authorized and controlled by policies and established procedures. Within 6 months of assignment to position and mandatory for unsupervised privileged access.
IAT-I or II IA Baseline Certification, CND IA Baseline Certification, and CE/OS Certificate


C11.3.2.  Table C11.T3. lists the specific functions associated with the CND-A position.

Personnel performing these functions as their primary CND responsibilities, regardless of their occupational title within the CND-SP organization, shall be identified as part of the CND-A specialty and must comply with the requirements in Tables C11.T2. and C11.T3.

| CND-A.1.                                                                          | Mastery of IAT Level I and IAT Level II CE and/or NE knowledge and skills       |
|-----------------------------------------------------------------------------------|---------------------------------------------------------------------------------|
| with applicable certification.                                                    |                                                                                 |
| CND-A.2.                                                                          | Receive and analyze network alerts from various sources within the NE or        |
| enclave and determine possible causes of such alerts.                             |                                                                                 |
| CND-A.3.                                                                          | Coordinate with enclave CND staff to validate network alerts.                   |
| CND-A.4.                                                                          | Perform analysis of log files from a variety of sources within the NE or        |
| enclave, to include individual host logs, network traffic logs, firewall logs,    |                                                                                 |
| and intrusion detection system logs.                                              |                                                                                 |
| CND-A.5.                                                                          | Characterize and analyze network traffic to identify anomalous activity and     |
| potential threats to network resources.                                           |                                                                                 |
| CND-A.6.                                                                          | Monitor external data sources (e.g. CND vendor sites, Computer Emergency        |
| Response Teams, SANS, Security Focus) to maintain currency of CND threat          |                                                                                 |
| condition and determine which security issues may have an impact on the NE        |                                                                                 |
| or enclave.                                                                       |                                                                                 |
| CND-A.7.                                                                          | Assist in the construction of signatures which can be implemented on CND        |
| network  tools  in  response  to  new  or  observed  threats  within  the  NE  or |                                                                                 |
| enclave.                                                                          |                                                                                 |
| CND-A.8.                                                                          | Perform  event  correlation  using  information  gathered  from  a  variety  of |
| sources within the NE or enclave to gain situational awareness and determine      |                                                                                 |
| the effectiveness of an observed attack.                                          |                                                                                 |
| CND-A.9.                                                                          | Notify CND managers, CND incident responders, and other CND-SP team             |
| members  of  suspected  CND  incidents  and  articulate  the  event's  history,   |                                                                                 |
| status, and potential impact for further action.                                  |                                                                                 |

## C11.4.  Cnd-Is


C11.4.1.  CND-IS personnel test, implement, deploy, maintain, and administer the infrastructure systems which are required to effectively manage the CND-SP network and resources. This may include, but is not limited to routers, firewalls, intrusion detection/prevention systems, and other CND tools as deployed within the NE or enclave. Individuals within CND-SPs who maintain these infrastructure devices shall be considered CND-IS. CND-IS position requirements are listed in Table C11.T4.



CND-IS
Attribute
Level
Experience
Recommended at least 4 years of experience in supporting CND and/or network systems and technology.
System Environment
Manages a number of specific CND tools/systems within the NE or enclave.
Knowledge
Significant knowledge of particular networking technologies, operating systems, and CND tools,

tactics, techniques, and procedures which are part of the systems they support.
Supervision
Works under supervision and typically reports to a
CND-SPM.
Other
Actions are usually authorized and controlled by policies and established procedures.
IAT-I or II IA Baseline Certification, CND IA Baseline Certification, and CE/OS Certificate
Within 6 months of assignment to position and mandatory for unsupervised privileged access. (Note CND-IS personnel supporting multiple systems must obtain the operating system certification for each system prior to getting full unsupervised privileged access.  However, they
may begin performing CND-IS duties on systems
for which they do have OS certifications.)


C11.4.2.  Table C11.T5. lists the specific functions associated with the CND-IS position.

Personnel performing these functions as their primary CND responsibilities, regardless of their occupational title within the CND-SP organization, shall be identified as part of the CND-IS specialty and must comply with the requirements in Tables C11.T4. and C11.T5.



## Table C11.T5.  Cnd-Is Functions

| CND-IS.1.                                                                          | Mastery of the appropriate IAT Level I and IAT Level II CE and/or NE            |
|------------------------------------------------------------------------------------|---------------------------------------------------------------------------------|
| knowledge and skills with applicable certification.                                |                                                                                 |
| CND-IS.2.                                                                          | Create, edit, and manage changes to network access control lists on specialized |
| CND systems (e.g., firewalls and intrusion prevention systems).                    |                                                                                 |
| CND-IS.3.                                                                          | Perform system administration on specialized CND applications and systems       |
| (e.g., anti-virus, or Audit/Remediation) to include installation, configuration,   |                                                                                 |
| maintenance, and backup/restore.                                                   |                                                                                 |
| CND-IS.4.                                                                          | Implement C&A requirements for specialized CND systems within the NE or         |
| enclave, and document and maintain records for them.                               |                                                                                 |
| CND-IS.5.                                                                          | Coordinate with the CND-A to manage and administer the updating of rules and    |
| signatures (e.g., IDS/IPS, anti-virus, and content blacklists) for specialized CND |                                                                                 |
| applications.                                                                      |                                                                                 |
| CND-IS.6.                                                                          | Identify potential conflicts with implementation of any CND tools within the    |
| CND-SP area of responsibility (e.g., tool/signature testing and optimization).     |                                                                                 |
| CND-IS.7.                                                                          | Administer CND test bed and test and evaluate new CND applications,             |
| rules/signatures, access controls, and configurations of CND-SP managed            |                                                                                 |
| platforms.                                                                         |                                                                                 |


C11.5.  CND-IR

C11.5.1.  CND-IR personnel investigate and analyze all response activities related to cyber incidents within the NE or Enclave.  These tasks include, but are not limited to: creating and



maintaining incident tracking information; planning, coordinating, and directing recovery activities; and incident analysis tasks, including examining all available information and supporting evidence or artifacts related to an incident or event. Individuals within CND-SPs
who perform any of the incident management and incident response tasks shall be considered CND-IRs.  CND-IR position requirements are listed in Table C11.T6.


## Table C11.T6.  Cnd-Ir Position Requirement

CND-IR
Attribute
Level

Experience
Recommended at least 5 years of experience in CND technology or a related field.

System Environment
Works on a wide variety of systems within the NE
or enclave as CND incidents dictate.
Knowledge
Significant knowledge of particular CND tools, tactics, techniques, and procedures which support the tracking, management, analysis, and resolution of incidents.

Supervision
Works under supervision and typically reports to a CND-SPM.

Other
Actions are usually authorized and controlled by policies and established procedures. Within 6 months of assignment to position and mandatory for unsupervised privileged access.
IAT-I, II, or III IA Baseline Certification, CND IA Baseline Certification, and CE/OS Certificate


C11.5.2.  Table C11.T7. lists the specific functions associated with the CND-IR position.

Personnel performing these functions as their primary CND responsibilities, regardless of their occupational title within the CND-SP organization, shall be identified as part of the CND-IR specialty and must comply with the requirements in Tables C11.T.6. and C11.T7.



## Table C11.T7.  Cnd-Ir Functions



| CND-IR.1.                                                                       | Mastery of the appropriate IAT Level I, IAT Level II, or IAT Level III CE, NE,    |
|---------------------------------------------------------------------------------|-----------------------------------------------------------------------------------|
| or enclave knowledge and skills with applicable certification.                  |                                                                                   |
| CND-IR.2.                                                                       | Collect and analyze intrusion artifacts (e.g., source code, malware, and trojans) |
| and use discovered data to enable mitigation potential CND incidents within the |                                                                                   |
| enclave.                                                                        |                                                                                   |
| CND-IR.3.                                                                       | Perform initial, forensically sound collection of images and inspect to discern   |
| possible mitigation/remediation on enclave systems.                             |                                                                                   |
| CND-IR.4.                                                                       | Coordinate with and provide expert technical support to enclave CND technicians   |
| to resolve CND incidents.                                                       |                                                                                   |
| CND-IR.5.                                                                                 | Track and document CND incidents from initial detection through final            |
|-------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------|
| resolution.                                                                               |                                                                                  |
| CND-IR.6.                                                                                 | Perform CND incident triage to include determining scope, urgency, and potential |
| impact; identify the specific vulnerability and make recommendations which                |                                                                                  |
| enable expeditious remediation.                                                           |                                                                                  |
| CND-IR.7.                                                                                 | Correlate incident data and perform CND trend analysis and reporting.            |
| CND-IR.8.                                                                                 | Coordinate with intelligence analysts to correlate threat assessment data.       |
| CND-IR.9.                                                                                 | Serve as technical experts and liaisons to law enforcement personnel and explain |
| incident details, provide testimony, etc.                                                 |                                                                                  |
| CND-IR.10. Perform real-time CND Incident Handling (e.g., forensic collections, intrusion |                                                                                  |
| correlation/tracking, threat analysis, and direct system remediation) tasks to            |                                                                                  |
| support deployable Incident Response Teams (IRT).                                         |                                                                                  |
| CND-IR.11. Maintain deployable CND toolkit (e.g., specialized CND software/hardware) to   |                                                                                  |
| support IRT missions.                                                                     |                                                                                  |
| CND-IR.12. Write and publish CND guidance and reports on incident findings to appropriate |                                                                                  |
| constituencies.                                                                           |                                                                                  |


C11.6.  CND-AU

C11.6.1.  CND-AU personnel perform assessments of systems and networks within the NE or enclave and identify where those systems/networks deviate from acceptable configurations, enclave policy, or local policy.  CND-AUs achieve this through passive evaluations (compliance audits) and active evaluations (penetration tests and/or vulnerability assessments).  Individuals within CND-SPs who perform compliance and audit related tasks shall be considered CND-AUs.

CND-AU position requirements are listed in Table C11.T8.



CND-AU
Attribute
Level
Experience
Recommended at least 2 years of experience in CND technology or a related field.
System Environment
Works on a specific number of CND systems but does compliance testing on portions of the NE or enclave.
Knowledge
Significant knowledge of particular CND tools, tactics, techniques, and procedures which support their compliance tests.
Supervision
Works under supervision and typically reports to a CND Manager.
Other
Actions are usually authorized and controlled by policies and established procedures. Within 6 months of assignment to position and mandatory for unsupervised privileged access.
IAT-I, II, or III IA Baseline Certification,
CND IA Baseline Certification, and CE/OS Certificate


C11.6.2.  Table C11.T9. lists the specific functions associated with the CND-AU position.

Personnel performing these functions as their primary CND responsibilities, regardless of their occupational title within the CND-SP organization, shall be identified as part of the CND-AU specialty and must comply with the requirements in the Tables C11.T8. and C11.T9.



| CND-AU.1.                                                      | Mastery of the appropriate IAT Level I, IAT Level II, or IAT Level III CE, NE,    |
|----------------------------------------------------------------|-----------------------------------------------------------------------------------|
| or enclave knowledge and skills with applicable certification. |                                                                                   |
| CND-AU.2.                                                      | Maintain knowledge of applicable CND policies, regulations, and compliance        |
| documents specifically related to CND auditing.                |                                                                                   |
| CND-AU.3.                                                      | Perform CND vulnerability assessments within the enclave.                         |
| CND-AU.4.                                                      | Perform CND risk assessments within the enclave.                                  |
| CND-AU.5.                                                      | Conduct authorized penetration testing of enclave network assets.                 |
| CND-AU.6.                                                      | Analyze site/enclave CND policies and configurations and evaluate compliance      |
| with regulations and enclave directives.                       |                                                                                   |
| CND-AU.7.                                                      | Prepare audit reports that identify technical and procedural findings and provide |
| recommended remediation strategies/solutions.                  |                                                                                   |
| CND-AU.8.                                                      | Maintain deployable CND audit toolkit (e.g., specialized CND                      |
| software/hardware) to support CND audit missions.              |                                                                                   |

## C11.7.  Cnd-Spm

C11.7.1.  CND-SPMs oversee the CND-SP operations within their organization.  CND-SPMs are responsible for producing guidance for their NE or enclave, assisting with risk assessments and risk management for organizations within their NE or enclave, and are responsible for managing the technical classifications within their organization.  CND-SPM position requirements are listed in Table C11.T10.



CND-SPM
Attribute
Level
Experience
Recommended at least 4 years of experience in CND management or a related field.
System Environment
Manages technicians who are responsible for all CND duties across the entire NE or enclave.
Knowledge
Significant knowledge of the capabilities and limitations of particular CND tools, tactics, techniques, and procedures which are employed by the technicians within the NE or enclave.
Supervision
Supervises technicians within the organization; reports to a senior CND Manager or to USSTRATCOM.

Other
Actions are usually authorized and controlled by policies and established procedures. Within 6 months of assignment to position and mandatory for unsupervised privileged access.
IAM-I or II IA Baseline Certification and CND IA Baseline Certification


C11.7.2.  Table C11.T11. lists the specific functions associated with the CND-SPM position.

Personnel performing these functions as their primary CND responsibilities, regardless of their occupational title within the CND-SP organization, shall be identified as part of the CND-SPM
specialty and must comply with the requirements in Tables C11.T10. and C11.T11.



## Table C11.T11.  Cnd-Spm Functions

CND-SPM.1.  Mastery of the appropriate IAM Level I or IAM Level II CE and/or NE
knowledge and skills with applicable certification.
CND-SPM.2.  Implement and enforce CND policies and procedures reflecting applicable laws,
policies, procedures, and regulations (e.g., Reference (ih)).
CND-SPM.3.  Manage the publishing of CND guidance (e.g., IAVAs and TCNOs) for the
enclave constituency.
CND-SPM.4.  Provide incident reports, summaries, and other situational awareness information
to higher headquarters.
CND-SPM.5.  Manage an incident (e.g., coordinate documentation, work efforts, resource
utilization within the organization) from inception to final remediation and after action reporting.
CND-SPM.6.  Manage threat or target analysis of CND information and production of threat or
target information within the network or enclave environment.
CND-SPM.7.  Manage the monitoring of external CND data sources to maintain enclave
situational awareness.
CND-SPM.8.  Interface with external organizations (e.g., public affairs, law enforcement,
Command or Component Inspector General) to ensure appropriate and accurate dissemination of incident and other CND information.
CND-SPM.9.  Lead risk analysis and management activities for the network or enclave
environment.
CND-SPM.10.Track compliance audit findings, incident after-action reports, and
recommendations to ensure appropriate mitigation actions are taken.

## Ap1.  Appendix 1 Definitions



## Ap1.  Definitions

AP1.1.  Authorized User.  As defined in Reference (ab), any appropriately cleared
individual required to access a DoD IS to carry out or assist in a lawful and authorized governmental function.  Authorized users include: DoD employees, contractors, and guest researchers.

AP1.2.  Categories, Specialties, Levels, and Functions. As defined in Reference (ab),
the structure for identifying all DoD Information Assurance (IA) positions and personnel.

AP1.2.1.  Categories, Specialties.  The DoD IA workforce is split into two major
categories of Technical and Management.  Management refers to personnel performing any IAM functions described in Chapters 4 or 5. Specialties are a category of the DoD IA Workforce performing advanced and/or specialized functions.  Specialties may perform functions at various levels.  A specialty may also require the mastery of a specified Technical or Management level.

AP1.2.2.  Levels.  Each of the IA workforce categories has three levels (Technical or
Management Level I, II, and III).  The management category also includes the Designated Accrediting Authority (DAA) position.

AP1.2.3.  Functions.  High level tasks required to successfully perform IA for an
information system.  The function indicates the tasks that an employee performs or occupational requirements to successfully perform as part of the IA Workforce.  For the purposes of this Manual the IA functions have been associated with a category and level.  These functions provide a means to distinguish between different levels of work.  The functional level approach also encourages a broader, more integrated means of identifying what an employee must know to perform the tasks that comprise an IA position across all of the DoD Components.

AP1.3.  Certification.  Recognition given to individuals who have met predetermined
qualifications set by an agency of government, industry, or profession.  Certification provides verification of individuals' knowledge and experience through evaluation and approval, based on a set of standards for a specific profession or occupation's functional job levels.  Each certification is designed to stand on its own, and represents an individual's mastery of a particular set of knowledge and skills.

AP1.4. Computing Environment (CE).  Per Reference (hc), local area network(s) server host
and its operating system, peripherals, and applications.

AP1.5.  Contractor. Per the Defense Acquisition University Glossary, "an entity in private
industry which enters into contracts with the government to provide goods or services."  For DoD IA purposes, an entity is a private sector employee performing IA functions in support of a

DoD IS.  Private sector employees performing IA functions must meet the same standards for system access or management as government IA employees.


AP1.6.  Defense Civilian Personnel Data System (DCPDS).  DCPDS is a human resources transaction IS supporting civilian personnel operations in the Department of Defense.  DCPDS is designed to support appropriated fund, non-appropriated fund, and LN human resources operations.



AP1.6.1.  The Corporate Management Information System (CMIS) consolidates DoD
employee and position data for all DoD civilian employees from all DCPDS databases to provide a corporate level data query and reporting capability.

AP1.6.2.  DCPDS and CMIS support strategic DoD civilian workforce planning, trend
analysis, mobilization, and contingency planning.
AP1.7.  Designated Accrediting Authority (DAA).  As defined in Reference (bc). AP1.8.  DoD Information System (IS).  As defined in References (ab) and (bc), includes automated IS (AIS) applications, enclaves, outsourced IT based processes, and platform IT interconnections.



AP1.8.1.  An AIS application performs clearly defined functions for which there are
readily identifiable security considerations and needs addressed as part of the acquisition.  An AIS application may be a single software application (e.g., Integrated Consumable Items Support); multiple software applications related to a single mission (e.g., payroll or personnel); or a combination of software and hardware performing a specific support function across a range of missions (e.g., Global Command and Control System, Defense Messaging System ).  AIS applications are deployed to enclaves for operations and have their operational security needs assumed by the enclave.

AP1.8.2.   Note:  An AIS application is analogous to a "major application," as defined in
OMB A-130 (Reference (nm)). However, to avoid confusion with the DoD acquisition category called "Major Automated Information System", this term (AIS) is not used in this Manual.


## Ap1.9.  Duty.


AP1.9.1.  Primary. An IA position with primary duties focused on IA functions.  The
position may have other duties assigned, but the main effort focuses on IA functions.  The position would normally require at least 25 to 40(+) hours per week devoted to IA functions.

AP1.9.2.  Additional. A position requiring a significant portion of the incumbent's
attention and energies to be focused on IA functions, but in which IA functions are not the primary responsibility.  The position would normally require 15 to 24 hours, out of a 40(+) hour week, devoted to IA functions.

AP1.9.3.  Embedded.  A position with IA functions identified as an integral part of other major assigned duties.  These positions normally require up to 14 hours, out of a 40(+) hour week be devoted to IA related functions.



AP1.10.  Eligible DoD Contractors. An employee or individual under contract or
subcontractor the Department of Defense, designated as providing services or support to the Department that requires logical and/or physical access to the Department's assets.

AP1.11.  Enclave.  As defined in Reference (hc) a collection of CE connected by one or more
internal networks under the control of a single authority and security policy, including personnel and physical security.  Enclaves provide standard IA capabilities such as boundary defense, incident detection and response, and key management, and also deliver common applications such as office automation and electronic mail. Enclaves are analogous to general support
systems, as defined in OMB A-130 (Reference (nm)).  Enclaves may be specific to an
organization or a mission and the CE may be organized by physical proximity or by function, independent of location.  Examples of enclaves include local area networks and the applications they host, backbone networks, and data processing centers.

AP1.12.  Foreign National.  Individuals who are non-U.S. citizens including U.S. military
personnel, DoD civilian employees, and contractors.

AP1.13.  General Schedule (GS)/Pay Band.  The Office of Personnel Management's basic
classification and compensation system for white collar occupations in the federal government, as established by Reference (yx).

AP1.13.1.  Job Series.  A subgroup of an occupational group or job family that includes
all classes of positions at the various levels in a particular kind of work, such as the GS-2210 series. Positions within a series are similar in subject matter, basic knowledge and skill requirements.

AP1.13.2. Parenthetical Specialty.  A subset of work within a series distinguishing
positions on the basis of specialized technical requirements.  For example, the 2210 series has officially designated parenthetical specialties agencies must include in the official position titles. "INFOSEC" is the parenthetical specialty used in DCPDS for 2210 employees performing security (IA) functions.

AP1.13.3.  Position Specialty Code.  A unique DoD civilian workforce code to support
effective management of the IA workforce.  The position specialty code identifies a DoD civilian position, or person with IA functions, regardless of OPM job series.

AP1.14.  Information Assurance (IA).  Per Reference (hc), measures that protect and defend
information and ISs by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation.  These measures include providing for restoration of IS by incorporating protection, detection, and reaction capabilities.


AP1.15.  Information Assurance Workforce.  The IA workforce focuses on the operation and
management of IA capabilities for DoD systems and networks.  The workforce ensures adequate security measures and established IA policies and procedures are applied to all ISs and networks.
The IA workforce includes anyone with privileged access and IA managers who perform any of the responsibilities or functions described in Chapters 3-5, 10 or 11. The DoD IA Workforce includes but is not limited to all individuals performing any of the IA functions described in this Manual.  Additionally the IA workforce categories, specialties and their /functions will be expanded to include for example system architecture and engineering, and computer network defense, certification and accreditation, and vulnerability assessment as changes to this Manual. These individuals are considered to have significant "security responsibilities" and must receive specialized training and be reported per Reference (cd) and this Manual.

AP1.16.  Information Assurance Vulnerability Alert (IAVA).  The comprehensive
distribution process for notifying the Components about vulnerability alerts and countermeasures
information as established in Reference (ih).

AP1.17.  Information Assurance Vulnerability Management (IAVM).  The IAVM process
provides positive control of the vulnerability notification process for DoD network assets.  The IAVM requires Components receipt acknowledgement and provides specific time parameters for implementing appropriate countermeasures, depending on the criticality of the vulnerability.

AP1.18.  Information Operations Condition (INFOCON).  A comprehensive defense posture
and response based on the status of ISs, military operations, and intelligence assessments of adversary capabilities and intent.

AP1.19.  Local National Employee.  Per Reference (ab) civilians or contractors, whether
paid from appropriated or non-appropriated funds, employed or used by the U.S. Forces in a foreign country who are nationals or non-U.S. residents of that country.

AP1.20.  Network Environment (Computer).  The constituent element of an enclave
responsible for connecting CE by providing short haul data transport capabilities, such as local or campus area networks, or long haul data transport capabilities, such as operational, metropolitan, or wide area and backbone networks that provides for the application of IA controls.

AP1.21.  Network Operations.  An organizational and procedural framework intended to
provide DoD IS and computer network owners the means to manage their systems and networks. This framework allows IS and computer network owners to effectively execute their mission priorities, support DoD missions, and maintain the IS and computer networks.  The framework integrates the mission areas of network management, information dissemination management, and information assurance.

AP1.22.  Privileged Access.  An authorized user who has access to system control,
monitoring, administration, criminal investigation, or compliance functions.  Privileged access typically provides access to the following system controls:

AP1.22.1.  Access to the control functions of the information system/network,
administration of user accounts, etc.

AP1.22.2.  Access to change control parameters (e.g., routing tables, path priorities,
addresses) of routers, multiplexers, and other key information system/network equipment or software.

AP1.22.3.  Ability and authority to control and change program files, and other users'
access to data.

AP1.22.4.  Direct access to operating system level functions (also called unmediated
access) that would permit system controls to be bypassed or changed.

AP1.22.5.  Access and authority for installing, configuring, monitoring, or
troubleshooting the security monitoring functions of information systems/networks (e.g., network/system analyzers; intrusion detection software; firewalls) or in performance of cyber/network defense operations.

AP1.23.  Red Team.  An independent and focused threat based effort by a multi-disciplinary,
opposing force using active and passive capabilities; based on formal; time bounded tasking to expose and exploit information operations vulnerabilities of friendly forces as a means to improve readiness of U.S. units, organizations, and facilities.

AP1.24.  Supporting IA Infrastructures.  Collections of interrelated processes, systems, and
networks providing a continuous flow of information assurance services throughout the Department of Defense (e.g., the key management infrastructure or the incident detection and response infrastructure).

AP1.25.  Training.

AP1.25.1.  Resident. Instructor led classroom instruction based on specific
performance criteria.

AP1.25.2.  Distributive.  Computer based training (CBT) via website, computer disc,
or other electronic media.

AP1.25.3.  On the job training (OJT).  Supervised hands on training, based on specific
performance criteria that must be demonstrated to a qualified supervisor.

AP1.25.4.  Blended:  A combination of instructor led classroom training and
distributed media.  This may also include instructor led classroom training using distributed multi-media.

AP1.26.  Waivers.


AP1.26.1.  DAAs may waive the IAT or IAM certification requirement(s) under severe operational or personnel constraints. The waiver must be documented by the DAA using a memorandum for the record stating the reason for the waiver and the plan to rectify the constraint.  Waivers must be time limited, not to exceed six months, and include an expiration date.  Uncertified IAT Level Is are not authorized unsupervised privileged access until fully qualified per Chapter 3.


AP1.26.2.  Waivers for IAT Level I certification requirements are not authorized for personnel deployed to a combat theatre of operations.  The DAA may approve a waiver for certified IAT-Is to fill level IAT-II or  IAT-III billets while deployed in a combat environment without attaining the appropriate certification.  The DAA may grant an interim waiver limited to the period of the deployment.  The interim waiver places an individual in a suspense status and must be time limited and include an expiration date not to exceed six months following date of return from combat status.   The DAA may also authorize waivers for certified IAM-Is or IAM
IIs to fill higher management positions in combat zones.

## Appendix 2 Ap2.  Ia Workforce Levels, Functions, And Certification Approval Process Ap2.1.  Certification Criteria

AP2.1.1.  The list of certifications posted on the DISA IASE website
(http://iase.disa.mil/eta/iawip/) is approved for the DoD IA workforce as of the publication date of Change 3 to this Manual.



AP2.1.2.  The list of certifications map to the IA categories, specialties and levels to which
they apply.



AP2.1.2.1.  IA personnel must obtain and maintain a certification corresponding to the
highest level function(s) they perform.  Certifications held by an IA workforce member on the "change date" to this Manual remain valid for as long as member remains in that position and keeps their certification status up to date according to individual certification provider standards.

AP2.1.2.2.  Individuals performing IAT functions must hold, at a minimum, an IAT
Level I certification, before gaining privileged access to any DoD system.

AP2.1.2.3.  Individuals performing functions in multiple categories or specialties must
hold certifications appropriate to the functions performed in each category or specialty.

AP2.1.3.  Commercial, vendor specific, or component developed equivalent certifications
approved for the DoD IA workforce requirement must align to the IA category or specialty functional requirements.  For validity, certifications must be accredited and maintain accreditation through the American National Standards Institute (ANSI) under the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 17024, "Conformity Assessment - General Requirements for Bodies Operating Certification of Persons," April 2003 ISO/ISEC 17024 Standard, Reference (zy).  ANSI is the only personnel certification accreditation body in the United States to meet ISO/IEC 17011:2004, "Conformity assessment - General requirements for accreditation bodies accrediting conformity assessment bodies" (Reference (zy)), which represents the highest nationally accepted practices for accreditation bodies. Certifications that receive ANSI accreditation also must be approved by the IA WIPAC for inclusion into this Manual as a baseline certification.

## Ap2.2.  Certification Review Process

AP2.2.1.  The Office of the DoD CIO will charter and chair the IA WIPAC to maintain the workforce categories, levels, functions, and certifications.  The IA WIPAC must meet periodically to approve, remove and assign certifications to the appropriate IA workforce levels.



All changes to the approved IA baseline certification list will be made or vetted by the IA WIPAC.  The DISA IASE website will be updated to reflect the IA WIPAC's changes.

AP2.2.2.  The list of approved IA baseline certifications must be reviewed at least annually to ensure continued applicability to the Department of Defense.  Certifications may be government or commercially granted, but all IA baseline certifications must be accredited through ANSI to the requirements of Reference (zy) prior to being considered by the IA WIPAC for addition to the approved IA baseline certification list.

## Ap3.  Appendix 3 Ia Workforce Requirements And Certifications

AP3.1  Table AP3.T1 consolidates IA workforce requirements described in this Manual. Requirements for each category are discussed and described in more depth in the preceding chapters of this Manual.



IAT I-III
IAM I-III
Initial Training
Yes*
Yes**
Yes**
Yes*
Yes
Yes
(IA Certification)
(within 6 months)
(IA Certification)
(within 6 months)
IA Baseline Certification (from approved list)
Yes
No
No
Yes
(for initial position)
Initial OJT Evaluation
Yes
No
No
Yes
CE/OS Certificate
Yes
Yes
Maintain Certification Status
(as required by
certification)
(as required by
certification)
Yes
Yes
(as required by
certification)
(as required by
certification)
Continuous Education or Sustainment Training
As required by IA
Background Investigation
As required by IA
level and Reference
level and
Reference (bc)
(bc)
Yes
n/a
n/a
Yes
Sign Privileged Access Statement
IAM I: Usually an
entry level
management
Experience
IAT I: Normally
has 0 to 5 or more
years of experience
in IA technology or
position with 0 to 5
a related field.
or more years of
management
experience.
IAM II: Usually
has at least five
IAT II: Normally
has at least 3 years
in IA technology or
years of
a related area.
management
experience.
| CND-A,                | CND-IS,        |
|-----------------------|----------------|
|                       |                |
| CND-IR, CND-AU        | and            |
| IASAE I-III           |                |
| CND-SPM               |                |
| Yes                   |                |
| (IA                   | Certification) |
| (within 6             | months)        |
| (CND Certification)   |                |
| (within 6 months)     |                |
| (except               | CND-SPM)       |
| (except               | CND-SPM)       |
| Yes                   |                |
| (as required          | by             |
| certification)        |                |
| (as required          | by             |
| certification)        |                |
| Yes                   |                |
| (as required          | by             |
| certification)        |                |
| (as required          | by             |
| certification)        |                |
| As required by        | IA             |
| level and             | Reference      |
| As required by CND-SP |                |
| level and Reference ( | b              |
| c                     |                |
| )                     |                |
| (                     | b              |
| c                     |                |
| )                     |                |
| Recommended years     | of             |
| experience in         | CND            |
| IASAE I: Usually      | an             |
| entry level           | IASAE          |
| position with 0       | or             |
| more years of         | IASAE          |
| experience.           |                |
| CND-IR: at least      | 5              |
| CND-AU: at least      | 2              |
| IASAE II:             | Usually        |
| at least 4 years      | of             |
| IASAE experience.     | experience     |
| CND and/or            | network        |
| systems and           | technology     |
| IAM III:            | Usually          |                      | CND-SPM:   |     |
|---------------------|------------------|----------------------|------------|-----|
| has at least        | 10               |                      |            |     |
| IASAE III:          | Usually          |                      |            |     |
| has at least 10     | years            | Recommended at least | 4          |     |
| years               | of               |                      |            |     |
|                     |                  |                      |            |     |
|                     |                  |                      |            |     |
|                     |                  |                      |            |     |
| IAT III:            | Normally         |                      |            |     |
| has at least        | seven            |                      |            |     |
| years of experience |                  |                      |            |     |
| in                  | IA technology or |                      |            |     |
| of                  | IASAE            |                      |            |     |
| experience.         |                  |                      |            |     |
| years of experience | in               |                      |            |     |
| CND management or   | a                |                      |            |     |
| a                   | related          | area.                |            |     |
| management          |                  |                      |            |     |
| experience.         |                  | related              | field      |     |

*Classroom, distributive, blended, government or commercial provider


AP3.2.  The approved IA baseline certifications table on the DISA IASE website (http://iase.disa.mil/eta/iawip/) provides a list of DoD approved certifications aligned to each category and level of the IA Workforce. Personnel performing IA functions must obtain one of the certifications required for their positions category or specialty and level.  DoD Components may choose any approved certification to meet the certification requirements for the associated level for which the certification has been approved.


AP3.2.1.  The IASE website lists the names of the organizations that own each certification.
These may be commercial, government, or other entities whose certification meets the requirements for the IA functional level(s) represented by the cell.


AP3.2.2.  A certification may apply to more than one level.

AP3.2.3.  Most IA levels within a category or specialty have more than one approved
certification.


AP3.2.4.  An individual needs to obtain only one of the "approved certifications" for his or her IA category or specialty and level to meet the minimum requirement.  For example, an individual in an IAT Level II position could obtain any one of the four certifications listed in the corresponding cell.


AP3.2.4.1.  Higher level IAT certifications satisfy lower level requirements.

Certifications listed in Level II or III cells can be used to qualify for Level I.  However, Level I certifications cannot be used for Level II or III unless the certification is also listed in the Level II or III cell. For example:


AP3.2.4.1.1.  The A+ or Network+ certification qualify only for Technical Level I
and cannot be used for Technical Level II positions.

AP3.2.4.1.2.  The System Security Certified Practitioner (SSCP) certification
qualifies for both Technical Level I and Technical Level II. If the individual holding this certification moved from an IAT Level I to an IAT Level II position, he or she would not have to take a new certification.


AP3.2.5.  Higher-level IAM certifications satisfy lower level requirements.  Certifications listed in Level II or III cells can be used to qualify for Level I.  However, Level I certifications cannot be used for Level II or III unless the certification is also listed in the Level II or III cell.


AP3.2.6.  Operating System Requirement.  IATs and designated CND-SPs must also obtain certifications required to implement the IA requirements for their specific operating system environment (e.g., Microsoft Operating Systems Administrator Certification), unless the operating system certification is also on the list of approved DoD IA baseline certifications.


AP3.2.7.  All IA workforce personnel must maintain their certifications as required by their

certification providers to retain their DoD IA workforce position.

AP3.2.8.  Changes to the approved IA baseline certification list will be made by the IA
WIPAC in accordance with AP2.2.1.  The DISA IASE website will be updated to reflect these changes.

AP3.3.  The approved IA baseline certification table on the DISA IASE website
(http://iase.disa.mil/eta/iawip/) provides a list of DoD approved certifications for personnel performing IA functions that meet baseline requirements. DoD Components may choose any of the approved certifications to meet the applicable certification requirements for each associated level.

## Appendix 4 Ap4.  Sample Statement Of Acceptance Of Responsibilities

# <Is Name>

## Information System Privileged Access Agreement And Acknowledgment Of Responsibilities


Date:


1.  I understand there are two DoD Information Systems (IS), classified (SIPRNET) and unclassified (NIPRNET), and that I have the necessary clearance for privileged access to <IS
NAME> [specify which IS the privileges are for].  I will not introduce or process data or software for the IS that I have not been specifically authorized to handle.



2.  I understand the need to protect all passwords and other authenticators at the highest level of data they secure.  I will not share any password(s), account(s), or other authenticators with other coworkers or other personnel not authorized to access the < IS NAME>.  As a privileged user, I understand the need to protect the root password and/or authenticators at the highest level of data it secures.  I will NOT share the root password and/or authenticators with coworkers who are not authorized <IS NAME > access.

3.  I understand that I am responsible for all actions taken under my account(s), root, or otherwise.  I will not attempt to "hack" the network or any connected information systems, or gain access to data to which I do not have authorized access.

4.  I understand my responsibility to appropriately protect and label all output generated under my account (including printed materials, magnetic tapes, floppy disks, and downloaded hard disk files).

5.  I will immediately report any indication of computer network intrusion, unexplained degradation or interruption of network services, or the actual or possible compromise of data or file access controls to the appropriate <IS NAME > Information Assurance Management (IAM) or senior Information Assurance Technical (IAT) Level representatives.  I will NOT install, modify, or remove any hardware or software (e.g., freeware/shareware and security tools) without written permission and approval from the <IS NAME > IAM or senior IAT Level representatives.

6.  I will not install any unauthorized software (e.g., games, entertainment software) or hardware (e.g., sniffers).

7.  I will not add/remove any users' names to the Domain Administrators, Local Administrator, or Power Users group without the prior approval and direction of the <IS NAME > IAM/or senior IAT Level representatives.


8.  I will not introduce any unauthorized code, Trojan horse programs, malicious code, or viruses into the <IS NAME > local area networks.


9.  I understand that I am prohibited from the following while using the DoD IS:

a.  Introducing Classified and/or Controlled Unclassified Information (CUI) into a NIPRNet environment.



b.  Accessing, storing, processing, displaying, distributing, transmitting, or viewing material
that is abusive, harassing, defamatory, vulgar, pornographic, profane, or racist; that promotes hate crimes, or is subversive or objectionable by nature, including material encouraging criminal activity, or violation of local, state, federal, national, or international law.



c.  Storing, accessing, processing, or distributing Classified, Proprietary, CUI, For Official
Use Only (FOUO), or Privacy Act protected information in violation of established security and information release policies.

d.  Obtaining, installing, copying, pasting, transferring, or using software or other materials obtained in violation of the appropriate vendor's patent, copyright, trade secret, or license agreement.


e.  Knowingly writing, coding, compiling, storing, transmitting, or transferring malicious software code, to include viruses, logic bombs, worms, and macro viruses.



f.  Engaging in prohibited political activity.

g.  Using the system for personal financial gain such as advertising or solicitation of services
or sale of personal property (e.g., eBay), or stock trading (i.e., issuing buy, hold, and/or sell directions to an online broker).

h.  Fundraising activities, either for profit or non-profit, unless the activity is specifically
approved by the organization (e.g., organization social event fund raisers and charitable fund raisers, without approval).

i.  Gambling, wagering, or placing of any bets.

j.  Writing, forwarding, or participating in chain letters. k.  Posting personal home pages.
l.  Any other actions prohibited by DoD 5500.7-R (Reference (aaz)) or any other DoD
issuances.


10.  Personal encryption of electronic communications is strictly prohibited and can result in the immediate termination of access.


11.  I understand that if I am in doubt as to any of my roles or responsibilities I will contact the <IS NAME > IAT Level III Supervisor for clarification.


12.  I understand that all information processed on the <IS NAME> is subject to monitoring.

This includes email and browsing the web.



13.  I will not allow any user who is not cleared access to the network or any other connected system without prior approval or specific guidance from the <IS NAME> IAM.

14.  I will use the special access or privileges granted to me ONLY to perform authorized tasks or mission related functions.


15.  I will not use any <DOD/Components> owned information system to violate software copyright by making illegal copies of software.


16.  I will ONLY use my PRIVILEGED USER account for official administrative actions.  This account will NOT be used for day to day network communications.


17.  I understand that failure to comply with the above requirements will be reported and may result in the following actions:


a.  Revocation of IS privileged access. b.  Counseling.
c. Adverse actions pursuant to the Uniform Code of Military Justice and/or criminal prosecution.



d.  Disciplinary action, discharge or loss of employment. e.  Revocation of Security Clearance.
18.  I will obtain and maintain required certification(s), according to DoD 8570.01-M and the certification provider, to retain privileged system access.


YOUR IAT Level III Supervisor is



INFORMATION SYSTEM NAME


IAT/IASAE/CND's NAME



IAT/IASAE/CND's SIGNATURE



Date


IAM  LEVEL I NAME


IAM  LEVEL I SIGNATURE


Date


(Level I or II Managers with privileged access will have signatures of the IAM Level II or III responsible for their IS functions).