Yes, post this contact information with the publicly accessible BSP.

Richard A. Parker, Captain S.C. USN
Deputy Executive Director Information Technology Policy, Plans, and Assessment
Defense Logistics Agency
8725 J.J. Kingman Rd.
Fort Belvoir, VA 22060

Vendor Partner:

Yes, post this contact information with the publicly accessible BSP.

Glenda Turner Booz-Allen and Hamilton, Inc.
3190 Fairview Park Drive
Falls Church, VA 22042
Telephone: 703-289-5279
Fax: 703-289-5813
E-mail: turner_glenda@bah.com

• DoD Directive 5200.28, Security Requirements for Automated Information Security Systems (AISS) mandates the accreditation of all AIS to include stand-alone personal computers, connected systems and networks.
• DoD Instruction 5200.40, DoD Information Technology Security Certification and Accreditation Process, (DoDI 5200.40) established a four-phase process, required activities and general criteria to accomplish a certification and accreditation process leading to an approval to operate based on acceptable residual risk. The DITSCAP requires that all information system and network owners address security from a single system or network perspective, and to do so across the system's life cycle.
• DoD Chief Information Officer Guidance and Policy Memorandum No. 6-8510, DoD Global Information Grid (GIG) Information Assurance (IA), dated June 16, 2000 directed that DoD develop an enterprise-wide IA architectural overlay to implement a defense-in-depth strategy across the Global Information Grid (GIG). The DOD GIG IA Defense-In-Depth strategy specifically addresses internetworked risk, and requires information system and network owners to integrate information enterprise and security solutions into the local computing environment, the network enclave and its boundaries, the wide area network, and supporting enterprise security services. The Defense in Depth strategy incorporates both technical and non-technical means to afford multiple protections at different layers within information systems and their supporting communications networks.
• The Chairman's Readiness System includes information assurance readiness in the Command, Control, Communications, and Computers (C4) portion of its Joint Monthly Readiness Reports (JMRRs). The JMRRs provide the DOD leadership a current, macro-level assessment of the military’s readiness to execute the National Military Strategy (NMS). The DLA is required to address the IA checklist items contained in CJCSI 6510.04 (available only in the .mil domain) in the JMRR assessment.

• Control Number - a unique identifier.
• Control Name - a brief title phrase that describes the subject area or focus of the control.
• Control Description - several sentences or a paragraph that describe the security condition or state that the control is intended to achieve.
• Metrics - an assessment or rating that serves as an indicator of compliance with the control. In assessing and rating individual controls DLA generally defines the four readiness "C-Levels" with progress toward full compliance with each control as follows:
  • C1 - The security control has been fully implemented and the security profile achieved by the control is being actively maintained. Full compliance indicates that only minor IA deficiencies with a negligible impact on mission capabilities may be expected.
  • C2 - The IT organization is in the process of deploying or implementing the security control. This level of compliance indicates that some IA deficiencies with a limited impact on mission capabilities may be expected.
  • C3 - The IT organization is aware of the control and is in a planning phase for compliance. This level of compliance indicates that significant IA deficiencies preventing the performance of some portions of required missions may be expected.
  • C4 - No awareness of the control or progress toward compliance is evident. This level of compliance indicates that major IA deficiencies that preclude satisfactory mission accomplishment may be expected.

An example of a McDiD control is provided below:

McDiD controls address the actions and conditions required for policy compliance, for certification and accreditation leading to an approval to operate, and for readiness sustainment on an agency-wide basis. Local supplementation of the master list is expressly encouraged where unique or special conditions warrant additional scrutiny to assure an adequate level of security is attained and maintained for a DLA site, system or network.

• McDiD for DLA Information Technology Sites
• McDiD for DLA Production Systems, both contemporary and legacy
• McDiD for DLA Emerging Systems
  

The sources of McDiD controls are depicted below:

The McDiD for DLA IT Sites addresses physical and environmental security, IT site configuration management, computer emergency/incident response and network defense, IA technology requirements for enclave boundary protection (e.g., separation of internal and external services, DLA defense in depth architecture for e-mail), IA technology requirements for standard intranet computing environments (e.g., virus protection, vulnerability assessments, and Public Key Infrastructure), enclave security management, continuity of operations planning, and IA program and budget.

The McDiD for Production Systems focuses on application-level security safeguards that can be implemented in a post-deployment phase and presume that the system will be hosted at a DLA site, thus inheriting the security of IT site implemented controls. The controls address system management, configuration management, security architecture, security management and continuity of operations planning.

The McDiD for Emerging Systems is designed to address security across the system life cycle. It includes:

• Security controls for the program manager and program office (e.g. personnel security requirements and rules, information release rules, program OPSEC);
• Requirements for the system security architecture (e.g., compliance with the DLA technical architecture, policy based access, single sign-on, use of public key technologies);
• Security controls for the development process (e.g., an automated library for system software objects managed and maintained in such as way as to protect privileged programs and to prevent or minimize the introduction of malicious or unauthorized code);
• Security controls for the transition to production (e.g. limitations on application developers' ability to change production code, physical and/or logical isolation of systems that provide unregulated access to the Internet); and
• Security controls for any new enclave or computing environment established to support the system, whether for design, development, testing, or production (e.g., firewalls, routers, virus protection).

For DLA IT Sites and production systems, the C&A process is initiated by the performance of a security self-assessment using the McDiD controls appropriate to the class of SSAA to be developed as part of the DITSCAP's Phase 1 (Definition). The self-assessment provides a preliminary indication of the information security posture of the site, system or network and facilitates the negotiation among the key players needed to produce the SSAA. More importantly, the McDiD self-assessment highlights those areas requiring corrective action, which are aggregated in an executable Plan of Action and Milestones (POAM). Successful completion of the POAM during the conduct of DITSCAP's Phase 2 (Verification) positions the site or system program manager for the conduct of DITSCAP Phase 3 (Validation) by the CA. The McDiD controls are continuously refreshed and re-evaluated as a normal part of the SSAA reviews that are integral to the Verification and Validation phases. At the conclusion of Phase 3, the DLA CA provides the DAA with a summary of the McDiD control ratings, the SSAA and other supporting documentation, and a recommendation regarding approval to operate. While DLA sets the enterprise standard as a C1 rating in all controls, the actual rating profile may vary based on the DAA's acceptance of residual risk in those areas where a full compliance solution is not feasible based on the assessed level of vulnerability or resources required. To ensure the McDiD process remains current and comprehensive, DLA ISSMs/ISSOs and CAs are required to provide comments and recommendations for improvements to the C&A process. The DLA Headquarters Information Assurance Division also conducts quarterly security reviews with agency elements to maintain the momentum and focus on information system security. Following the approval to operate, within DLA the McDiD controls will be used to support a required annual re-assessment during the DITSCAP Post-accreditation (Phase 4) in the years between required re-validations.

For emerging systems, the C&A process is tailored to the system's adopted life cycle model. The Definition and Post-accreditation phases are fixed; however, Verification and Validation may iterate according to the number of new enclaves or computing environments established and the number of major software releases scheduled prior to Full Operating Capability (e.g., an evolutionary design scheme).

To implement the McDiD process, DLA developed a comprehensive set of training materials and hosted a series of workshops or seminars with its operating and staff elements. Further information regarding the training materials can be obtained by contacting the POCs on the first page. These initiatives focused on the SSAA development process, and in addition to reviewing the master McDiD control lists, included a number of exercises to identify the local controls necessary to adequately address unique operating environment, system, or site requirements. The thrust of the DLA effort is to hold to an absolute minimum the administrative burdens associated with the C&A process on its operating and staff elements. Wherever possible, enterprise-wide approved text for portions of the SSAA, such as the threat assessment, has been provided for the use of the individual site, system or network managers. In all other areas worksheets and templates have been developed at the enterprise level to ensure a unity of vision and purpose across the agency. To facilitate the flow of information, and support information system security as a function of electronic business, DLA is in the process of establishing an online Comprehensive Information Assurance Knowledge-base (CIAK) that is available in the DLA domain for DLA subscribers only. CIAK will provide DLA elements with a single web site for policy analysis, guidance, reference and research materials, training materials, assistance, announcements and information. CIAK also will serve as the repository and interactive workspace for the development, submission, processing, review and exchange of SSAAs and all other documentation related to the C&A process.

DLA Library

IA Technical Framework Forum

National Defense University Library

CIAK - Comprehensive Information Assurance Knowledge-base

C&A - Certification and Accreditation

DAA - Designated Approving Authority

DLA - Defense Logistics Agency

DITSCAP - DoD Information Technology Security Certification and Accreditation Process

GIG - Global Information Grid

Legacy System - Information systems within DLA currently in operation that are scheduled for replacement/retirement, and for which no further program resources will be allocated for improvement or expansion.

McDiD - Metrics and Controls for Defense-in-Depth Production System - Information Systems within DLA that have achieved full-operational capability and are currently deployed for operational use.

SSAA - System Security Authorization Agreement

SOW - Statement of Work