DEFENSE INFORMATION SYSTEMS NETWORK (DISN) …

1 A Combat Support Agency DEFENSE INFORMATION SYSTEMS NETWORK (DISN) CONNECTION PROCESS GUIDE (CPG) Version September 2016 DEFENSE INFORMATION SYSTEMS Agency Risk Management Executive (RME) Risk Adjudication and Connection Division (RE4) Post Office Box 549 Fort Meade, Maryland 20755-0549 DISN CPG September 2016 This page intentionally left blank. DISN CONNECTION PROCESS GUIDE DISN CPG i September 2016 EXECUTIVE SUMMARY This DEFENSE INFORMATION SYSTEMS NETWORK (DISN) Connection Process Guide (CPG) (ref am) uses the INFORMATION contained in references (a) through (an) to implement the requirement identified in Department of DEFENSE Instruction (DoDI) Cybersecurity (ref a) for the Director, DEFENSE INFORMATION SYSTEMS Agency (DISA), to oversee and maintain the connection approval process.

2 CJCSI DEFENSE INFORMATION system NETWORK (DISN): Responsibilities (ref b) states that all connections to the DISN shall be in accordance with this DISN CPG. The goal of the DISN CPG is to provide a transparent, user-friendly, and agile process that will help the warfighter and DoD Components, as defined in directive DoDD , Management of the Department of DEFENSE INFORMATION Enterprise (ref c) efficiently obtain their necessary DISN connection approvals while ensuring DISA effectively tracks and manages DISN connections.

3 There are numerous key DoD policies either recently released or currently under revision that affect or will affect the DISN CPG. The recently released DoDI Risk Management Framework (RMF) for DoD INFORMATION Technology (IT), Change 1 (ref d) requires the transition from the DoD INFORMATION Assurance Certification and Accreditation Process (DIACAP) to the DoD RMF. Another key policy is the extensively revised DoDI , Ports, Protocols, and Services Management (PPSM) (ref e) and DoDI , Mission Partner Environment (MPE) INFORMATION Sharing Capability Implementation for the DoD (ref f), DoDI , Cross Domain (CD) Policy (ref ad), DoDI , Cybersecurity Activities Support to DoD INFORMATION NETWORK Operations (ref k).

4 Another new DoD policy on the horizon impacting the DISN CPG is the draft: DoDI , DoD INFORMATION NETWORK Transport; As new policies become official, the Risk Adjudication and Connection Division will continue to update the DISN CPG accordingly. However, until then, the DISN CPG will only reference current signed policy. This Release of the DISN CPG: Incorporates comments received from the Joint Staff J6 and the Unified Cross Domain Services Management Office (UCDSMO) Reflects DISA s reorganization Adds detailed NIPRNet Federated Gateway connection approval flow diagram Updates references Removed the content of Appendix G, DODIN Waiver Process, pending DoD CIO announcement of an updated process.

5 Please send DISN CPG Version improvement comments directly to the Connection Approval Office at or This guide is approved for public release and is available on the Internet from the DISA website at The instructions in this guide are effective immediately. DISN CONNECTION PROCESS GUIDE DISN CPG ii September 2016 SIGNATURE PAGE FOR KEY OFFICIALS Approved by: Matthew A. Hein Chief, Risk Adjudication and Connection Division Date DISN CONNECTION PROCESS GUIDE DISN CPG iii September 2016 REVISION HISTORY This document will be reviewed and updated as needed (minimum semiannually).

6 Critical and Substantive changes will be reflected in the revision history table. History will be populated starting with the Version release. Version Date Comments May 2010 Baseline document released based on stakeholder input and extensive reformatting. April 2011 Administrative changes to incorporate current policy and correct errors. May 2011 Updated telephone numbers due to DISA BRAC relocation to Ft. Meade, MD. June 2012 Major document layout changes. Document divided into Customer Type/Connection Type sections for ease of use.

7 Several process updates. E-mail address updates due to DEFENSE Enterprise E-mail (DEE) migration. Private IP (Layer 2/3 VPN) registration in system NETWORK Approval Process (SNAP) was added. Included several Frequently Asked Questions (FAQs) into appendices. September 2012 Incorporated DEFENSE Security/Cybersecurity Authorization Working Group (DSAWG} clarifications in several areas. Includes updated Cross Domain Solutions (CDS) process flow chart. Updated NIPR e-mail addresses due to Enterprise e-mail changes.)

8 October 2012 Added DAA/AO Appointment letter statement in Sections 3-6. Updated SIPR e-mail addresses due to Enterprise e-mail changes. January 2013 Changed document title to DISN CPG. Added footer and header section titles. Updated NSC NIPR mailboxes. Added content to Executive Summary. Added new content and updated current processes resulting on SIPRNet Global INFORMATION Grid (GIG) Interconnection Approval Process (GIAP) system (SGS) release on 3 Jan 13. May 2013 Updated Section to reflect CAP Policy.

9 Added VPN Registration (Private IP) Process Guide. Added Section CDS Repeatable Accreditation . Updated Customer Connection Process Charts. November 2013 Added preliminary questions to answer regarding respective enclave/ system before submitting a DoD CIO temporary exception to policy request. Defined Type Accredited SYSTEMS . Changed 1st Validation Official title to DISN Classified IP Lead. Includes the process for Notification of Discontinued or Cancelled Circuits. Finally updated Appendix D Remote Compliance Monitoring.

10 Revised Appendix D (Scan Section). Updated the Vulnerability Scanning Section, scan types, and the DISN CONNECTION PROCESS GUIDE DISN CPG iv September 2016 FAQs. Changed Figure 1 title to DISN Connection Overview. Changed the Review and Issue/ATC block in Figure 1 to Connection Approval Process. Changed GIG to DODIN throughout the entire document. Changed Telecommunications Service Order (TSO) to In-Effect Report (IER) November 2014 Provided connection approval requirement INFORMATION related to the DIACAP to RMF transition.