BY ORDER OF THE AIR FORCE INSTRUCTION 21-201 …

1 DEPARTMENT OF THE AIR FORCE HEADQUARTERS UNITED STATES AIR FORCE WASHINGTON DC AFI21-201_AFGM2017-01 8 November 2017 MEMORANDUM FOR DISTRIBUTION C MAJCOMs/FOAs/DRUs FROM: HQ AF/A4 1030 Air FORCE Pentagon Washington, DC 20330 SUBJECT: Air FORCE Guidance Memorandum to AFI 21-201 , Munitions Management By ORDER of the Secretary of the Air FORCE , this Guidance Memorandum immediately implements changes to AFI 21-201 , Munitions Management, 3 Jun 2015. Compliance with this memorandum is mandatory. To the extent its directions are inconsistent with other Air FORCE publications, the information herein prevails, in accordance with AFI 33-360, Publications and Forms Management.

2 This Guidance Memorandum supersedes AFI21-20_AFGM2016-01 dated 19 Oct 2016. This Guidance Memorandum incorporates several changes regarding proper identification, cross-referencing, and validation of Combat Ammunition System (CAS)-managed Nuclear Weapons Related Materials (NWRM) during packaging operations, and incorporates new Maintenance Cyber Discipline policy. In advance of a rewrite of AFI 21-201 , the following items are updated to provide guidance changes that are effective immediately. (Add) Maintenance Cyber Discipline (Add) For the purpose of this AFI, Electronic Tools (eTools) are portable electronic devices ( laptop computer, hand held device, to include the Munitions Integrated Tablet (MIT) and other associated AIT devices) that are certified to inter-operate on Air FORCE (AF)

3 Networks, are mission critical because they are the primary method for viewing electronic technical publications, and are used to exchange data with approved Maintenance Information Systems (MIS) and Accountable Property System(s) of Record (APSR) at the point of use. Note: eTools do not include electronic devices and test equipment issued and configuration managed by a system Program Manager (PM). Certain munitions field test sets, however, send and/or receive data either directly or indirectly through network systems and are also susceptible to the effects of poor cyber discipline.

4 (Add) Improper procurement of eTools, and improper sustainment and use of eTools and field test sets pose a significant cyber risk to AF systems. Protocols have been identified as a critical element in mitigating emerging cyber threats. The guidance below establishes requirements for developing and implementing daily/periodic cyber mitigation processes. The intent is to reduce cyber risk and assigns responsibilities that provide the best possible opportunity for success for achieving mission assurance in cyber threat environments.

5 (Add) Variations in eTools functionality across AF weapon systems must be approved by the applicable system Program Manager (PM) IAW AFI 63-101/20-101, Integrated Life Cycle Management. This is done to ensure the program s product support strategy identifies and supports interrelationships and integration with programs and processes both inside and outside the program s current Program Executive Officer (PEO) portfolio. Additionally, this ensures the program s product support strategy aligns to Air FORCE enterprise priorities.

6 (Add) MAJCOMs/ANG will develop and implement guidance that ensures eTools standardization, management, and configuration control IAW 17-series publications. eTools are procured IAW AFI 63-138, Acquisition of Services, and sustained IAW AFI 63-101/20-101. (Add) MAJCOMs/ANG will coordinate with their Chief Information Officer (CIO)/A6 or equivalent to publish eTool sustainment and support guidance. In addition, MAJCOMs will validate functional Air FORCE Specialty Code (AFSC) specific support is adequately allocated to ensure assigned units remain compliant with requirements directed in AFI 17-100, Air FORCE Information Technology (IT) Service Management, AFI 17-120, Management of Cyberspace Support Activities, AFMAN 17-1201, User Responsibilities and Guidance for Information Systems, AFMAN 17-1203, Information Technology (IT) Asset Management (ITAM)

7 , AFMAN 17-1301, Computer Security (COMPUSEC), and AFMAN 17-1302-O, Communications Security (COMSEC) Operations. (Add) MAJCOMs/ANG will provide standardized guidance on the use, storage, content update, security and cyber hygiene processes necessary to support the approved use of all assigned eTool devices. When required, this guidance will also supplement and enforce cyber hygiene processes for field test set operations. (Add) MAJCOMs/ANG, in coordination with their supporting Lead Commands, will develop and implement assigned Mission Design Series (MDS) specific cyber threat mitigation strategies.

8 These strategies must be directly linked to supporting publication and technical ORDER references, and monitored to ensure the most current cyber threat mitigation capabilities are sustained in the deployed or in-garrison Mission Generation environments. MAJCOMs/ANG will ensure, as a minimum, the processes include contingency eTool comm-out/cyber-out bare base operating procedures. (Add) Unit Commanders will ensure eTools are used for official and authorized purposes only, IAW 17-series publications and locally developed procedures as needed.

9 (T-1). (Add) Assigned eTool users will not install, download or access any unauthorized files or software on any eTool or munitions field test set. (T-1). (Add) Users will not use, access or insert unauthorized external media devices to any eTool or munitions field test set. (T-1). (Add) Unit Commanders will establish procedures that prohibit the introduction of government or personal cellular/personal communications systems and/or radio frequency (RF), infrared (IR) wireless devices, or other devices such as cell phones, tablets or any devices that have photographic or audio recording capabilities into areas ( , rooms, offices, etc.)

10 Where classified information is stored processed or discussed IAW AFMAN 17-1301. (Add) Coordinate waiver requests with the applicable MAJCOM/ANG (Add) Ensure adherence to TEMPEST requirements IAW DoDD , Use of Commercial Wireless Devices, Services, and Technologies in the Department of Defense (DoD) Global Information Grid (GIG). (Add) Obtain written approval from both the AF Certified TEMPEST Technical Authority (CTTA) IAW AFI 16-1404, Air FORCE Information Security Program, and National Institute of Standards and Technology Special Publication (NIST SP) 800-53A Revision 4, Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Security Assessment Plans.