STIGQter: STIG Summary: Traditional Security Checklist Version: 1 Release: 3 Benchmark Date: 15 Jun 2020: STIGQter: STIG Summary: Traditional Security Checklist Version: 1 Release: 3 Benchmark Date: 15 Jun 2020:SV-42680r3_rule
V-32343
Validation Procedures for Clearance Issuance and Access Granted
PE-03.02.01
CAT II
10
Background Information:
When developing an organizational program to validate security clearance information for systems access and/or physical access to SIPRNet work environments, the first thing to consider is there are various categories of personnel and associated considerations with each one. These categories include: Military employees, Government Civilian employees, Contract employees, Foreign Nationals and Local National employees under a Status of Forces (SOFA) agreement and Visitors.
The minimum security clearance requirement for systems access to the SIPRNet or unescorted access to the physical environment surrounding SIPRNet system information technology assets is secret.
Generally, an organization validation of security clearance levels should come from official databases such as JPAS, DCII, a service or agency data base or “high level” (major subordinate command) headquarters security office. Also note that organization manning (staffing) documents should include the required clearance level for each assigned Military and Civilian position.
Local procedures must be developed for verifying that all personnel with access to classified information systems (logical or physical access) have the appropriate security clearance and access authorization.
Fixes:
1. Ensure that organizational manning (staffing) records (*security clearance requirements for the position occupied) match the actual security clearance held by the incumbent employee (military or DoD civilian) as reflected in JPAS. Review all the organization personnel security records and compare with applicable System Access Authorization Request (SAAR) forms to ensure proper validation of clearance levels. Be especially aware of ALL those who have "privileged" systems access or responsibility for systems security oversight (such as SAs, ISSM, ISSOs, Network Admin, etc.) and ensure that correct clearance and IT assurance levels have been granted.
2. If there are contract employees with systems and/or physical access to SIPRNet, ensure there is a Statement of Work with accompanying DD 254 (Contract Security Specification) that covers security clearance requirements for each type of work being performed by contractors. Review contractor records (those physical assigned to the site or working remotely on projects for the organization) to ensure they actually have the required security clearances.
3. Ensure that a delegation of disclosure authority letter (DDL) is on-hand in all cases where US Classified information is released/shared with Foreign National Exchange or Liaison personnel.
4. Ensure that a Limited Access Authorization (LAA) is on hand when system access to classified information is granted to an immigrant alien or a foreign national - not associated with or representing a foreign government.
5. Ensure there is an organizational procedure developed to outline methodology for validation and maintenance of required security clearances.
Background Information:
When checking how an organization validates security clearance information for either systems or physical access the first thing to consider is that there are various categories of personnel and associated considerations with each one. These categories include: Military employees, Government Civilian employees, Contract employees, Foreign Nationals and Local National employees under a Status of Forces (SOFA) agreement and Visitors.
Generally, an organization validation of security clearance levels should come from official databases such as JPAS, DCII, a service or agency data base or “high level” (major subordinate command) headquarters security office. Also note that organization manning (staffing) documents should include the required clearance level for each assigned Military and Civilian position. Staffing documents should be requested by inspectors for review.
The minimum security clearance requirement for systems access to the SIPRNet or unescorted access to the physical environment surrounding SIPRNet system information technology assets is secret.
Local procedures must be developed for verifying that all personnel with access to classified information systems (logical or physical access) have the appropriate security clearance and access authorization. Inspectors should review local procedures.
Checks:
Check #1. Review a sample of the organization personnel security records (from local data bases, physical files, JPAS…) and compare with applicable System Access Authorization Request (SAAR) forms to ensure proper validation of clearance levels for access to the SIPRNet (both logical systems access and/or physical access to SIPRNet environments). Minimum of secret security clearance is required. Check organizational records against the JPAS data base if possible. Ensure that organizational manning records (security clearance requirements for the position occupied) match the actual security clearance held by the incumbent employee (military or DoD civilian) as reflected in JPAS.
Because it is generally not feasible to review all records it is recommended to select where possible ALL those who have "privileged" systems access or responsibility for oversight of systems security (such as SAs, ISSM, ISSOs, Network Admin, etc.) along with key management personnel (commander/director, ISSM, division/branch chiefs, etc.) and supplement with a random sample of those with basic "user" access to systems.
Check #2. If there are contractor employees with classified systems access (SIPRNet) (both logical and/or physical access) - check to ensure there is a Statement of Work with accompanying DD 254 ("Classified" Contract Security Specification) that covers security clearance requirements for each type of work (or specified positions) being performed by contractors.
Check #3. Check to ensure that contractor employees performing the tasks outlined in the Statement of Work and/or DD Form 254 actually have the security clearance required by the contract – minimum secret for SIPRNet access. If possible validate this in the JPAS data base.
Check #4. Check that a delegation of disclosure authority letter (DDL) is on-hand in all cases where US Classified information is released/shared with Foreign National Exchange or Liaison personnel who are either assigned to or visiting the site. The DDL will reflect the level of security clearance the FN official has and the level and type of information authorized to be shared.
Check #5. Check to ensure that a Limited Access Authorization (LAA) is on hand when system access (or physical access) to classified information is granted to an immigrant alien or a foreign national - not associated with or representing a foreign government.
TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments and is also applicable to a field/mobile environment.
V-32343
False
PE-03.02.01
Background Information:
When checking how an organization validates security clearance information for either systems or physical access the first thing to consider is that there are various categories of personnel and associated considerations with each one. These categories include: Military employees, Government Civilian employees, Contract employees, Foreign Nationals and Local National employees under a Status of Forces (SOFA) agreement and Visitors.
Generally, an organization validation of security clearance levels should come from official databases such as JPAS, DCII, a service or agency data base or “high level” (major subordinate command) headquarters security office. Also note that organization manning (staffing) documents should include the required clearance level for each assigned Military and Civilian position. Staffing documents should be requested by inspectors for review.
The minimum security clearance requirement for systems access to the SIPRNet or unescorted access to the physical environment surrounding SIPRNet system information technology assets is secret.
Local procedures must be developed for verifying that all personnel with access to classified information systems (logical or physical access) have the appropriate security clearance and access authorization. Inspectors should review local procedures.
Checks:
Check #1. Review a sample of the organization personnel security records (from local data bases, physical files, JPAS…) and compare with applicable System Access Authorization Request (SAAR) forms to ensure proper validation of clearance levels for access to the SIPRNet (both logical systems access and/or physical access to SIPRNet environments). Minimum of secret security clearance is required. Check organizational records against the JPAS data base if possible. Ensure that organizational manning records (security clearance requirements for the position occupied) match the actual security clearance held by the incumbent employee (military or DoD civilian) as reflected in JPAS.
Because it is generally not feasible to review all records it is recommended to select where possible ALL those who have "privileged" systems access or responsibility for oversight of systems security (such as SAs, ISSM, ISSOs, Network Admin, etc.) along with key management personnel (commander/director, ISSM, division/branch chiefs, etc.) and supplement with a random sample of those with basic "user" access to systems.
Check #2. If there are contractor employees with classified systems access (SIPRNet) (both logical and/or physical access) - check to ensure there is a Statement of Work with accompanying DD 254 ("Classified" Contract Security Specification) that covers security clearance requirements for each type of work (or specified positions) being performed by contractors.
Check #3. Check to ensure that contractor employees performing the tasks outlined in the Statement of Work and/or DD Form 254 actually have the security clearance required by the contract – minimum secret for SIPRNet access. If possible validate this in the JPAS data base.
Check #4. Check that a delegation of disclosure authority letter (DDL) is on-hand in all cases where US Classified information is released/shared with Foreign National Exchange or Liaison personnel who are either assigned to or visiting the site. The DDL will reflect the level of security clearance the FN official has and the level and type of information authorized to be shared.
Check #5. Check to ensure that a Limited Access Authorization (LAA) is on hand when system access (or physical access) to classified information is granted to an immigrant alien or a foreign national - not associated with or representing a foreign government.
TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments and is also applicable to a field/mobile environment.
M
Security Manager
2506