DOD INFORMATION ASSURANCE CERTIFICATION …

1 DOCUMENT 173-11 DATA SCIENCES GROUP DOD INFORMATION ASSURANCE CERTIFICATION AND accreditation process (DIACAP) SURVEY AND DECISION TREE DISTRIBUTION A: APPROVED FOR PUBLIC RELEASE DISTRIBUTION IS UNLIMITED WHITE SANDS MISSILE RANGE REAGAN TEST SITE YUMA PROVING GROUND DUGWAY PROVING GROUND ABERDEEN TEST CENTER ELECTRONIC PROVING GROUND NAVAL AIR WARFARE CENTER WEAPONS DIVISION, PT. MUGU NAVAL AIR WARFARE CENTER WEAPONS DIVISION, CHINA LAKE NAVAL AIR WARFARE CENTER AIRCRAFT DIVISION, PATUXENT RIVER NAVAL UNDERSEA WARFARE CENTER DIVISION, NEWPORT PACIFIC MISSILE RANGE FACILITY NAVAL UNDERSEA WARFARE CENTER DIVISION, KEYPORT 30TH SPACE WING 45TH SPACE WING AIR FORCE FLIGHT TEST CENTER AIR ARMAMENT CENTER ARNOLD ENGINEERING DEVELOPMENT CENTER BARRY M.

2 GOLDWATER RANGE NATIONAL AERONAUTICS AND SPACE ADMINISTRATION Report Documentation PageForm ApprovedOMB No. 0704-0188 Public reporting burden for the collection of INFORMATION is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering andmaintaining the data needed, and completing and reviewing the collection of INFORMATION . Send comments regarding this burden estimate or any other aspect of this collection of INFORMATION ,including suggestions for reducing this burden, to Washington Headquarters Services, Directorate for INFORMATION Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, ArlingtonVA 22202-4302.

3 Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to a penalty for failing to comply with a collection of INFORMATION if itdoes not display a currently valid OMB control number. 1. REPORT DATE JUL 2011 2. REPORT TYPE 3. DATES COVERED 00-04-2009 to 00-01-2011 4. TITLE AND SUBTITLE DoD INFORMATION ASSURANCE CERTIFICATION and accreditation ProcessSurvey and Decision Tree 5a. CONTRACT NUMBER 5b. GRANT NUMBER 5c. PROGRAM ELEMENT NUMBER 6. AUTHOR(S) 5d. PROJECT NUMBER 5e. TASK NUMBER DS-002 5f. WORK UNIT NUMBER 7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) Range Commanders Council,1510 Headquarters Avenue,White SandsMissile Range,NM,88002 8.

4 PERFORMING ORGANIZATIONREPORT NUMBER 173-11 9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES) 10. SPONSOR/MONITOR S ACRONYM(S) 11. SPONSOR/MONITOR S REPORT NUMBER(S) 12. DISTRIBUTION/AVAILABILITY STATEMENT Approved for public release; distribution unlimited 13. SUPPLEMENTARY NOTES 14. ABSTRACT Puts forth "common" IA practices to include a decision tree for interpretation and implementation of IA. 15. SUBJECT TERMS DIACAP; Data Sciences Group; INFORMATION ASSURANCE ; IA 16. SECURITY CLASSIFICATION OF: 17. LIMITATION OF ABSTRACT Same asReport (SAR) 18. NUMBEROF PAGES 31 19a. NAME OFRESPONSIBLE PERSON a. REPORT unclassified b. ABSTRACT unclassified c. THIS PAGE unclassified Standard Form 298 (Rev.)

5 8-98) Prescribed by ANSI Std Z39-18 This page intentionally left blank. RCC DOCUMENT 173-11 DIACAP SURVEY AND DECISION TREE July 2011 Prepared by DATA SCIENCES GROUP (DATA PROTECTION COMMITTEE) Published by Secretariat Range Commanders Council Army White Sands Missile Range New Mexico 88002-5110 This page intentionally left blank. DIACAP Survey and Decision Tree, RCC Document 173-11, July 2011 iii TABLE OF CONTENTS PREFACE ..v ACRONYMS .. vii CHAPTER 1: 1- 1 Survey .. 1- 1 Decision Tree .. 1- 1 CHAPTER 2: SURVEY AND BEST PRACTICES .. 2- 1 Methodology .. 2- 1 Lessons 2- 1 Best Practices .. 2- 2 CHAPTER 3: DECISION TREE AND RECOMMENDATIONS.

6 3- 1 Decision Tree .. 3- 1 Recommendations .. 3- 1 CHAPTER 4: REFERENCES .. 4- 1 4- 1 DoD .. 4- 2 Navy .. 4- 4 Air Force .. 4- 4 Army .. 4- 4 Range Specific .. 4- 5 Other: Web Links .. 4- 5 Other: RCC 4- 5 APPENDIX A: DIACAP BACKGROUND INFORMATION .. A-1 DIACAP Survey and Decision Tree, RCC Document 173-11, July 2011 iv This page intentionally left blank. DIACAP Survey and Decision Tree, RCC Document 173-11, July 2011 v PREFACE This document presents the results of efforts undertaken by the Range Commanders Council (RCC) Data Sciences Group (DSG) for completion of Task DS-02, DoD INFORMATION ASSURANCE CERTIFICATION and accreditation process (DIACAP) Survey and Decision Tree.

7 The intent of this document is to ensure synergy across the armed forces to allow INFORMATION ASSURANCE (IA) continuity by using the best range practices to support the warfighter. The INFORMATION contained herein will assist those responsible for oversight of INFORMATION systems with planning and execution of DIACAP. This document is aimed at addressing any impacts on Range activities in a proactive manner. For development of this document, the RCC gives special recognition to: Task Lead: Mr. Jim Bulloch Member, Data Sciences Group (DSG) Pacific Missile Range Facility (PMRF) Code N65-4, PO Box 128 Kekaha, HI 96752-0128 Phone: (808) 335-4186 DSN (315) 421-6290 Fax: (808) 335-4980 DSN (315) 421-6980 E-mail Please direct any questions to: Secretariat, Range Commanders Council ATTN: TEDT-WS-RCC 1510 Headquarters Avenue White Sands Missile Range, NM 88002-5110 Phone: (575) 678-1107 DSN 258-1107 Fax: (575) 678-7519 DSN 258-7519 E-mail: us DIACAP Survey and Decision Tree, RCC Document 173-11, July 2011 vi This page intentionally left blank.

8 DIACAP Survey and Decision Tree, RCC Document 173-11, July 2011 vii ACRONYMS ALTD Alternate Tag and Data APMS Army Portfolio Management Solution ATO authorization to operate C&A CERTIFICATION and accreditation CA Certifying Authority CARS Cyber Asset Reduction and Security CIO Chief INFORMATION Officer CVC Compliance and Validation CERTIFICATION DAA designated accrediting authority DATO denial of authorization to operate DIACAP DoD INFORMATION ASSURANCE CERTIFICATION and accreditation process DIP DIACAP Implementation Plan DITPR DoD INFORMATION Technology Profile Registry DITSCAP DoD INFORMATION Technology Security CERTIFICATION and accreditation process DoD Department of Defense DODI Department of Defense Instruction DPC

9 Data Protection Committee DSG Data Sciences Group EITDR Enterprise INFORMATION Technology Data Repository eMASS enterprise Mission ASSURANCE Support Service FISMA Federal INFORMATION Security Management Act GIG Global INFORMATION Grid IA INFORMATION ASSURANCE IAC INFORMATION ASSURANCE Control IATO interim authorization to operate IATT interim authorization to test IG Inspector General IT INFORMATION technology IV&V independent verification and validation KS Knowledge Service NIST National Institute of Standards and Technology NMCI Navy/Marine Corps Internet PIA Privacy Impact Assessment PIT Platform IT PMRF Pacific Missile Range Facility POA&M Plan of Action and Milestones RDDAA Research and Development Designated Accrediting Authority RDT&E research, development, test, and evaluation SECNAV Secretary of the Navy SIP System Identification Profile USAF United States Air Force DIACAP Survey and Decision Tree, RCC Document 173-11, July 2011 viii This page intentionally left blank.

10 DIACAP Survey and Decision Tree, RCC Document 173-11, July 2011 1- 1 CHAPTER 1 INTRODUCTION Survey The Data Sciences Group (DSG) conducted a survey of Range Commanders Council (RCC) member ranges asking a series of key questions about common INFORMATION ASSURANCE (IA) practices, identification of possible exemptions, and successful strategies and tools for tracking range IA programs. Ranges were also asked to provide notional "common" IA practices in a test mission environment to include a decision tree for interpretation and implementation of IA. Nine member ranges participated in the survey. The results from the survey are provided in Chapter 3 of this document.