Presentation on theme: "What’s the path to a SSP? Information System Profile Contractor: Lockheed Martin, Missiles and Fire Control Address: 1701 W. Marshall Dr. Grand Prairie,"— Presentation transcript:
1 What’s the path to a SSP?Information System Profile Contractor: Lockheed Martin, Missiles and Fire Control Address: 1701 W. Marshall Dr. Grand Prairie, Texas Cage Code: IS Number: 240 This IS Profile is associated with ODAA Unique Identifier:
3 What are the Requirements needed to start a new Classified Program?
4 Contract Instrument DD254 The Federal Acquisition Regulation (FAR) requires that a DD Form 254 be incorporated in each classified contract. The DD Form 254 provides to the contractor (or a subcontractor) the security requirements and the classification guidance that would be necessary to perform on a classified contract.Invitation for Bid (IBF), Independent Research and Development (IRAD), Request for Proposal (RFP), Request for Quotation.
6 Certification and Accrediation Security classification guide or other relevant security docs (Required prior to beginning a IS profile)Identify classification and handling caveatsIdentify IS USER required training based on classification and handling caveatsCOMSEC: information includes accountable or non-accountable COMSEC information and controlled cryptographic items (CCI).Closed area/ Safe training required
7 IT/Tech Apps“White board” meeting to discuss computing system requirementsEngineering and program requirementsUnclassified and Classified systemsAllocate, Build and pre-Certify systems based upon ODAA technical baseline settings.
8 Why the Defense Security Service denies (DSS) an Interim Approval to Operate (IATO) Missing or incomplete Unique Identifier (UID)ISSM did not sign the IS Security Package Submission and Certification StatementMissing Hardware List / Software List / Configuration DiagramPhysical Security not adequately explainedNo signed DSS Form 147 (Record of Controlled Area) if the system is in a Closed AreaNo Certification Test Guide or NISP Tool Results were providedMissing letter from Government Contracting Activity (GCA) if any variances are neededMissing MOA when requiredIdentification and Authentication not adequately addressedAny unique issues that would require denial of the IATO
11 Any unique issues that would require denial of the IATO Special ProceduresOther Special procedures: N/A Yes If yes, describe: Other Comments or Additional Information:Classified media may be utilized at the same or higher classification and or handling caveat,contact the ISSM for specific details. Hard drives and other media will be destroyed bysending it to the NSA or by returning it as classified back to the data owner. Overwritingof hard drives is NOT an approved method of Sanitization.Temporarily inactive drives or infrequent use of the hard drives is not uncommon. Theseprocedures pertain to drives not used for a Week or longer. In lieu of conducting Weeklyonline audits of the hard drive, the drives will be placed in Bag and the opening sealed withTamper Proof Seals. Each week, the Bags will be inspected to ensure usage has not takenplace. If or when a Seal is broken, an entry will be made in the Seal Log identifying the reason. When the drives are used, the anti-virus definitions will be updated, work conducted, then anon-line audit of the drive completed and then the drive will be bagged and seal placed overthe opening. The action will be recorded in the Maintenance and or Seal Logs as appropriateand in the weekly record audit.The ASTi / Telestra 4 hardware has a BIOS password length limitation of 7 characters. It willaccept upper/lower case and special characters, but does not enforce any complexity requirements.
12 Missing Hardware List / Software List / Configuration Diagram
13 No signed DSS Form 147 (Record of Controlled Area) if the system is in a Closed Area
14 No Certification Test Guide or NISP Tool Results were provided
15 No Certification Test Guide or NISP Tool Results were provided
16 No Certification Test Guide or NISP Tool Results were provided
17 Missing MOA when required MOU RequirementsWhen information systems accredited by different DAAs are to be interconnected,an MOU is required to be completed and signed by the DAAs for the systemsinvolved. MOUs are created to describe the security responsibilities and otherinformation as agreed upon by two or more designated approving authorities or DAAs.Contractor-to-Contractor system interconnections do not require an MOU when DSSis the DAA for all systems involved.
18 Missing letter from GCA if any variances are needed A signed copy of the customers Risk Acceptance Letter on Government letterhead.stating they are willing to assume the residual risk for the alternate trusted download procedures.Note that Risk Acceptance Letter's must be updated when the plan is reaccredited every three years.For special purpose systems not part of a larger system the facility needs to explain the need to theGCA and get risk acceptance letter to include GCA security guidance since the system won't meetNISPOM requirements.Operating system must be NISPOM compliant, or have a Risk Acceptance Letter from the GCA.
19 Identification and Authentication not adequately addressed
20 Any unique issues that would require denial of the IATO