# stig_rules

vuln_id: V-254838
rule_id: IS-11.02.01_rule
severity: CAT II
title: Classified Destruction ‐ Hard Drive and Storage Media
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Checks: Check #1. If used by the site are hard drive and tape degaussers periodically tested and certified as required by the manufacturer? Check #2. Are appropriate wipe products available for classified systems or spillage incidents? Check #3. Is there an approved product (such as the Whitaker Brothers Inc. Datastroyer) on‐hand to properly remove readable surfaces from optical media such as CDs or DVDs? Check #4. Is all obsolete classified equipment and media properly secured in a safe, vault or secure room until properly disposed of? (Note: This would be a CAT I finding under the appropriate "storage" vulnerability) Check #5. In the event the site has limited or no destruction equipment: Are there plans or arrangements to take classified material to NSA for proper disposal or another DoD organization who has destruction equipment and has agreed to provide support for destruction of classified? Check #6. Are there appropriate transportation and/or shipping arrangements to ensure the classified material is properly protected while in transit to the destruction facility? TACTICAL ENVIRONMENT: Applies in all environments whenever classified documents or materials are to be destroyed.

check_text:
  Checks: Check #1. If used by the site are hard drive and tape degaussers periodically tested and certified as required by the manufacturer? Check #2. Are appropriate wipe products available for classified systems or spillage incidents? Check #3. Is there an approved product (such as the Whitaker Brothers Inc. Datastroyer) on‐hand to properly remove readable surfaces from optical media such as CDs or DVDs? Check #4. Is all obsolete classified equipment and media properly secured in a safe, vault or secure room until properly disposed of? (Note: This would be a CAT I finding under the appropriate "storage" vulnerability) Check #5. In the event the site has limited or no destruction equipment: Are there plans or arrangements to take classified material to NSA for proper disposal or another DoD organization who has destruction equipment and has agreed to provide support for destruction of classified? Check #6. Are there appropriate transportation and/or shipping arrangements to ensure the classified material is properly protected while in transit to the destruction facility? TACTICAL ENVIRONMENT: Applies in all environments whenever classified documents or materials are to be destroyed.


vuln_id: V-254839
rule_id: IS-11.03.01_rule
severity: CAT III
title: Destruction of Classified and Unclassified Documents, Equipment and Media ‐ (Policy and Procedures)
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: Check to ensure there are procedures for the destruction of classified or sensitive documents, systems and media. Also check to ensure this documentation is readily available for employee reference and included in initial and recurring (annual) security training. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.

check_text:
  Check Content: Check to ensure there are procedures for the destruction of classified or sensitive documents, systems and media. Also check to ensure this documentation is readily available for employee reference and included in initial and recurring (annual) security training. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.


vuln_id: V-254840
rule_id: IS-13.02.01_rule
severity: CAT II
title: Classified Emergency Destruction Plans
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: General Requirement: Plans shall be developed to protect, remove, or destroy classified material in case of fire, natural disaster, civil disturbance, terrorist activities, or enemy action, to minimize the risk of compromise, and for the recovery of classified information, if necessary, following such events. Checks: Check #1. Check to ensure there is local site documentation for the emergency, protection, removal, and destruction of classified material and equipment. (CAT II) Check #2. Also check to ensure that these instructions are readily available to the employee population. Such plans should be posted on or near safes, exits to vaults and secure rooms or at any location where classified materials are stored. (CAT III) TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.

check_text:
  Check Content: General Requirement: Plans shall be developed to protect, remove, or destroy classified material in case of fire, natural disaster, civil disturbance, terrorist activities, or enemy action, to minimize the risk of compromise, and for the recovery of classified information, if necessary, following such events. Checks: Check #1. Check to ensure there is local site documentation for the emergency, protection, removal, and destruction of classified material and equipment. (CAT II) Check #2. Also check to ensure that these instructions are readily available to the employee population. Such plans should be posted on or near safes, exits to vaults and secure rooms or at any location where classified materials are stored. (CAT III) TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.


vuln_id: V-254841
rule_id: IS-14.02.01_rule
severity: CAT II
title: Security Incident/Spillage (Procedures/Training)
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Checks: Check #1. Check to ensure the site or organization has written procedures on reporting possible security incidents. Check #2. Check to ensure personnel within the organization have training to be able to know when to report a possible security incident and who to report it to. Check #3. Check to ensure employees know what to do when discovering classified material unsecure or out of proper control. Ask random employees if they know what to do if they discover a security incident? TACTICAL ENVIRONMENT: Classified material that is discovered not properly secured must immediately be secured and the incident reported ‐ regardless of environment.

check_text:
  Checks: Check #1. Check to ensure the site or organization has written procedures on reporting possible security incidents. Check #2. Check to ensure personnel within the organization have training to be able to know when to report a possible security incident and who to report it to. Check #3. Check to ensure employees know what to do when discovering classified material unsecure or out of proper control. Ask random employees if they know what to do if they discover a security incident? TACTICAL ENVIRONMENT: Classified material that is discovered not properly secured must immediately be secured and the incident reported ‐ regardless of environment.


vuln_id: V-354842
rule_id: IS-15.02.01_rule
severity: CAT II
title: Classification Guides
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: Check to ensure the site has all Classification Guides for the systems and programs they are responsible for and/or which are applicable to their operations. Further, such classification guides and training on the use of them should be made available to employees working with the equipment or systems to which they apply. At a minimum if a site has SIPRNet connections they should have a copy of the most recent SIPRNet Security Classification Guide. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.

check_text:
  Check Content: Check to ensure the site has all Classification Guides for the systems and programs they are responsible for and/or which are applicable to their operations. Further, such classification guides and training on the use of them should be made available to employees working with the equipment or systems to which they apply. At a minimum if a site has SIPRNet connections they should have a copy of the most recent SIPRNet Security Classification Guide. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.


vuln_id: V-254843
rule_id: IS-16.02.01_rule
severity: CAT II
title: Controlled Unclassified Information (CUI) ‐ Education and Training
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Checks: Check #1. Reviewers must check for an initial orientation on handling of CUI during new employee inprocessing Check #2. Check that Annual Refresher training includes the topic of CUI as provided in the general policy guidance. Check a sample number of individual training records and Annual Training briefing slides/materials for evidence of CUI training. Lack of either initial orientation or refresher training or both is a finding. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where training and associated documentation should be in place. Not applicable to a field/mobile environment.

check_text:
  Checks: Check #1. Reviewers must check for an initial orientation on handling of CUI during new employee inprocessing Check #2. Check that Annual Refresher training includes the topic of CUI as provided in the general policy guidance. Check a sample number of individual training records and Annual Training briefing slides/materials for evidence of CUI training. Lack of either initial orientation or refresher training or both is a finding. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where training and associated documentation should be in place. Not applicable to a field/mobile environment.


vuln_id: V-254844
rule_id: IS-16.02.02_rule
severity: CAT II
title: Controlled Unclassified Information ‐ Media Disposal
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: Check to ensure compliance with appropriate methods for disposal of the following: 1. Unclassified Hard Drives: a. When no longer needed, unclassified computer systems and hard drives may be disposed of outside the Department of Defense. In some circumstances, the equipment may be provided to nongovernment entities for reutilization. To ensure that no data or information remains on operable unclassified hard drives that are transferred or permanently removed from DoD custody, the drives must be sanitized by overwriting. b. Where overwriting is inappropriate or cannot be completely accomplished (e.g., inoperable disk) the drives are to be totally removed from service (i.e., thrown away). In this case the drives must be physically destroyed before disposal. c. The specific methods and procedures differ depending on sensitivity of data and ownership of the hard drive. To ensure DoD information is not inadvertently disclosed to unauthorized individuals, the activity security manager should coordinate with the local DAA and/or IT staff to ensure local procedures for disposal of computer hard drives appropriately address removal of U.S. Government data prior to disposal. (See Assistant Secretary of Defense for Command, Control, Communications and Intelligence Memorandum, Disposition of Unclassified DoD Computer Hard Drives, June 4, 2001 for detailed guidance.) Generally the use of Hard Drive degaussers with an appropriate strength (Coercivity of magnetic field) for the drive being erased (Oestrid rating) is recommended as part of the requirement for physical destruction. After degaussing the hard drive the physical destruction of individual platters should be accomplished to make attempted data retrieval impractical. 2. Unclassified Automated Information System (AIS) Media: a. Various types of AIS media may contain CUI and must be disposed of in accordance with guidance in the NIST Special Publication 800‐88, Guidelines for Media Sanitization. b. NSA/CSS publishes lists of products that meet specific performance criteria for sanitizing, destroying or disposing of various types of media containing sensitive or classified information. The lists are available at http://www.nsa.gov/ia/guidance/media_destruction_guidance/index.shtml or by calling (410)854‐6358. 3. Unclassified documents: a. Record copies of FOUO documents shall be disposed of in accordance with the Federal Records Act (44 U.S.C. 33 and Component records management directives. b. Non‐record FOUO documents may be destroyed by shredding or tearing into pieces and discarding the pieces in regular trash containers. c. NOTE: The guidance provided here is for FOUO paper documents and this is the least stringent standard found for any CUI document destruction. There are other types of CUI, such as DEA Sensitive material, which must be destroyed by a means approved for destruction of Confidential material. Be certain to check DoD Manual 5200.01 for specific destruction requirements for each type of CUI document. 4. Additional reviewer checks and considerations: a. Check recycle bins, regular trash, and the availability of shredders or collection containers for sensitive material. Ensure the organization knows who gets the recycling (especially if it contains CUI) and that it is disposed of properly (for instance by shredding). NOTE: If you find (i.e. in the trash) and can easily reconstruct any document marked FOUO (or other CUI document) and it contains extremely sensitive information such as PII (with SSN, etc.) ‐ this should be made a finding. b. In all cases the reviewer should recommend using at least a cross cut shredder for destruction of CUI documents. Further, while a shred‐all policy is not required, this is another recommendation that should be made. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where training and associated documentation should be in place. Not applicable to a field/mobile environment.

check_text:
  Check Content: Check to ensure compliance with appropriate methods for disposal of the following: 1. Unclassified Hard Drives: a. When no longer needed, unclassified computer systems and hard drives may be disposed of outside the Department of Defense. In some circumstances, the equipment may be provided to nongovernment entities for reutilization. To ensure that no data or information remains on operable unclassified hard drives that are transferred or permanently removed from DoD custody, the drives must be sanitized by overwriting. b. Where overwriting is inappropriate or cannot be completely accomplished (e.g., inoperable disk) the drives are to be totally removed from service (i.e., thrown away). In this case the drives must be physically destroyed before disposal. c. The specific methods and procedures differ depending on sensitivity of data and ownership of the hard drive. To ensure DoD information is not inadvertently disclosed to unauthorized individuals, the activity security manager should coordinate with the local DAA and/or IT staff to ensure local procedures for disposal of computer hard drives appropriately address removal of U.S. Government data prior to disposal. (See Assistant Secretary of Defense for Command, Control, Communications and Intelligence Memorandum, Disposition of Unclassified DoD Computer Hard Drives, June 4, 2001 for detailed guidance.) Generally the use of Hard Drive degaussers with an appropriate strength (Coercivity of magnetic field) for the drive being erased (Oestrid rating) is recommended as part of the requirement for physical destruction. After degaussing the hard drive the physical destruction of individual platters should be accomplished to make attempted data retrieval impractical. 2. Unclassified Automated Information System (AIS) Media: a. Various types of AIS media may contain CUI and must be disposed of in accordance with guidance in the NIST Special Publication 800‐88, Guidelines for Media Sanitization. b. NSA/CSS publishes lists of products that meet specific performance criteria for sanitizing, destroying or disposing of various types of media containing sensitive or classified information. The lists are available at http://www.nsa.gov/ia/guidance/media_destruction_guidance/index.shtml or by calling (410)854‐6358. 3. Unclassified documents: a. Record copies of FOUO documents shall be disposed of in accordance with the Federal Records Act (44 U.S.C. 33 and Component records management directives. b. Non‐record FOUO documents may be destroyed by shredding or tearing into pieces and discarding the pieces in regular trash containers. c. NOTE: The guidance provided here is for FOUO paper documents and this is the least stringent standard found for any CUI document destruction. There are other types of CUI, such as DEA Sensitive material, which must be destroyed by a means approved for destruction of Confidential material. Be certain to check DoD Manual 5200.01 for specific destruction requirements for each type of CUI document. 4. Additional reviewer checks and considerations: a. Check recycle bins, regular trash, and the availability of shredders or collection containers for sensitive material. Ensure the organization knows who gets the recycling (especially if it contains CUI) and that it is disposed of properly (for instance by shredding). NOTE: If you find (i.e. in the trash) and can easily reconstruct any document marked FOUO (or other CUI document) and it contains extremely sensitive information such as PII (with SSN, etc.) ‐ this should be made a finding. b. In all cases the reviewer should recommend using at least a cross cut shredder for destruction of CUI documents. Further, while a shred‐all policy is not required, this is another recommendation that should be made. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where training and associated documentation should be in place. Not applicable to a field/mobile environment.


vuln_id: V-254845
rule_id: IS-16.02.03_rule
severity: CAT II
title: Controlled Unclassified Information ‐ Handling, Storage and Access
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Checks: For most CUI and FOUO specifically check to ensure the following standards are met: Check #1. During working hours, reasonable steps shall be taken to minimize the risk of access by unauthorized personnel. This would include things like placing cover sheets on FOUO documents and allowing unescorted access to areas where CUI (documents and AIS storage media) is processed/handled to only those persons with at least a favorably adjudicated National Agency Check (NAC). Check #2. After working hours, FOUO information (documents and removable media) may be stored in unlocked containers, desks, or cabinets if Government or Government‐contract building security is provided. If such building security is not provided or is deemed inadequate, the information (documents and removable media) shall be stored in locked desks, file cabinets, bookcases, locked rooms, etc. In all cases FOUO and other CUI documents must be placed out of sight during non‐working hours. While not required, recommending implementation of a clean desk policy would be appropriate. Check #3. Unescorted access to computer rooms or areas containing major items of AIS equipment processing CUI information (servers and network components) should only be granted to persons with at least a favorable NAC. All others should be physically escorted. Access control measures such as reception personnel, guards, keyed locks, cipher locks or automated access control systems may be used to control access to such areas. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.

check_text:
  Checks: For most CUI and FOUO specifically check to ensure the following standards are met: Check #1. During working hours, reasonable steps shall be taken to minimize the risk of access by unauthorized personnel. This would include things like placing cover sheets on FOUO documents and allowing unescorted access to areas where CUI (documents and AIS storage media) is processed/handled to only those persons with at least a favorably adjudicated National Agency Check (NAC). Check #2. After working hours, FOUO information (documents and removable media) may be stored in unlocked containers, desks, or cabinets if Government or Government‐contract building security is provided. If such building security is not provided or is deemed inadequate, the information (documents and removable media) shall be stored in locked desks, file cabinets, bookcases, locked rooms, etc. In all cases FOUO and other CUI documents must be placed out of sight during non‐working hours. While not required, recommending implementation of a clean desk policy would be appropriate. Check #3. Unescorted access to computer rooms or areas containing major items of AIS equipment processing CUI information (servers and network components) should only be granted to persons with at least a favorable NAC. All others should be physically escorted. Access control measures such as reception personnel, guards, keyed locks, cipher locks or automated access control systems may be used to control access to such areas. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.


vuln_id: V-254846
rule_id: IS-16.02.04_rule
severity: CAT II
title: Controlled Unclassified Information ‐ Encryption of Data at Rest
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: Check to ensure the following standards concerning encryption of data‐at‐rest are met: In accordance with DoD policy, all unclassified DoD data that has not been approved for public release and is stored on mobile computing devices or removable storage media must be encrypted using commercially available encryption technology. This requirement includes all CUI as well as other unclassified information that has not been reviewed and approved for public release. This includes certain Personally Identifiable Information (PII). Examples of common devices requiring DAR encryption are laptops used for telework or TDY and mobile devices such as cellular phones, tablets, etc. approved for processing and storing DoD sensitive data, and CDs, thumb drives (flash media) DVDs and other removable media. See ASD(NII) Memorandum, Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and Removable Storage Media, 3 Jul 07 for detailed guidance. TACTICAL ENVIRONMENT: The check is applicable for all tactical processing environments.

check_text:
  Check Content: Check to ensure the following standards concerning encryption of data‐at‐rest are met: In accordance with DoD policy, all unclassified DoD data that has not been approved for public release and is stored on mobile computing devices or removable storage media must be encrypted using commercially available encryption technology. This requirement includes all CUI as well as other unclassified information that has not been reviewed and approved for public release. This includes certain Personally Identifiable Information (PII). Examples of common devices requiring DAR encryption are laptops used for telework or TDY and mobile devices such as cellular phones, tablets, etc. approved for processing and storing DoD sensitive data, and CDs, thumb drives (flash media) DVDs and other removable media. See ASD(NII) Memorandum, Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and Removable Storage Media, 3 Jul 07 for detailed guidance. TACTICAL ENVIRONMENT: The check is applicable for all tactical processing environments.


vuln_id: V-254847
rule_id: IS-16.02.05_rule
severity: CAT II
title: Controlled Unclassified Information ‐ Transmission by either Physical or Electronic Means
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: General Information: Standards for transmission for most types of CUI are the same as for FOUO but some variance does exist. Therefore, specific requirements for certain CUI may need to be checked against applicable references to ensure proper means for transmission are used. For most CUI and FOUO specifically check to ensure the following standards are met: 1. FOUO information and material may be transmitted via first class mail, parcel post, or, for bulk shipments, via fourth class mail. 2. Electronic transmission of FOUO information, e.g., e‐mail, shall be by approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure (PKI) or transport layer security (e.g., https). 3. Use of wireless telephones (cell phones, wireless hand held phones, Bluetooth, etc.) should be avoided when other options are available. 4. Transmission of FOUO by facsimile machine (fax) is permitted; the sender is responsible for determining that appropriate protection will be available at the receiving location prior to transmission (e.g., machine attended by a person authorized to receive FOUO; fax located in a controlled government environment). TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments. Not applicable to a field/mobile environment.

check_text:
  Check Content: General Information: Standards for transmission for most types of CUI are the same as for FOUO but some variance does exist. Therefore, specific requirements for certain CUI may need to be checked against applicable references to ensure proper means for transmission are used. For most CUI and FOUO specifically check to ensure the following standards are met: 1. FOUO information and material may be transmitted via first class mail, parcel post, or, for bulk shipments, via fourth class mail. 2. Electronic transmission of FOUO information, e.g., e‐mail, shall be by approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure (PKI) or transport layer security (e.g., https). 3. Use of wireless telephones (cell phones, wireless hand held phones, Bluetooth, etc.) should be avoided when other options are available. 4. Transmission of FOUO by facsimile machine (fax) is permitted; the sender is responsible for determining that appropriate protection will be available at the receiving location prior to transmission (e.g., machine attended by a person authorized to receive FOUO; fax located in a controlled government environment). TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments. Not applicable to a field/mobile environment.


vuln_id: V-254848
rule_id: IS-16.02.06_rule
severity: CAT II
title: Controlled Unclassified Information ‐ Web‐Sites with Appropriate Encryption
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: Check to ensure the following standards/guidance are adhered to: 1. FOUO, PII and other CUI may NOT be posted to publicly‐accessible Internet sites and may NOT be posted to sites whose access is controlled only by domain (e.g., limited to .mil and/or .gov) as such restricted access can easily be circumvented. 2. At a minimum, posting CUI to a website requires certificate‐based (e.g., common access card) or password and ID access as well as encrypted transmission using https: or similar technology. CUI other than FOUO may have additional posting restrictions. 3. See Deputy Secretary of Defense Memorandum Web Site Administration, December 7, 1998, with attached Web Site Administration Policies and Procedures, November 25, 1998 for detailed guidance. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.

check_text:
  Check Content: Check to ensure the following standards/guidance are adhered to: 1. FOUO, PII and other CUI may NOT be posted to publicly‐accessible Internet sites and may NOT be posted to sites whose access is controlled only by domain (e.g., limited to .mil and/or .gov) as such restricted access can easily be circumvented. 2. At a minimum, posting CUI to a website requires certificate‐based (e.g., common access card) or password and ID access as well as encrypted transmission using https: or similar technology. CUI other than FOUO may have additional posting restrictions. 3. See Deputy Secretary of Defense Memorandum Web Site Administration, December 7, 1998, with attached Web Site Administration Policies and Procedures, November 25, 1998 for detailed guidance. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.


vuln_id: V-254849
rule_id: IS-16.03.01_rule
severity: CAT III
title: Controlled Unclassified Information (CUI) ‐ Local Policy and Procedure
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: General Policy Guidance: All personnel of the Department of Defense are personally and individually responsible for properly protecting classified information and Controlled Unclassified Information (CUI) under their custody and control. All officials within the Department of Defense who hold command, management, or supervisory positions have specific, non‐delegable responsibility for the quality of implementation and management of the information security program within their areas of responsibility. Check: This check is specifically to ensure there are local written procedures for handling, marking, storing, destroying and transmitting Controlled Unclassified Information. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.

check_text:
  Check Content: General Policy Guidance: All personnel of the Department of Defense are personally and individually responsible for properly protecting classified information and Controlled Unclassified Information (CUI) under their custody and control. All officials within the Department of Defense who hold command, management, or supervisory positions have specific, non‐delegable responsibility for the quality of implementation and management of the information security program within their areas of responsibility. Check: This check is specifically to ensure there are local written procedures for handling, marking, storing, destroying and transmitting Controlled Unclassified Information. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.


vuln_id: V-254850
rule_id: IS-16.03.02_rule
severity: CAT III
title: Controlled Unclassified Information ‐ Marking/Labeling Media
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: General Information: This check is only for unclassified/sensitive media being used in a strictly unclassified physical environment. If all Controlled Unclassified Information (CUI) media are in a mixed environment where classified systems and media are in use, then STIG ID IS‐3.2.1. applies and this check is NA. Check to ensure the following standard is met: Regardless of media type, the requirement to identify as clearly as possible the information requiring protection remains. Therefore check to ensure that all unclassified media containing CUI is properly marked according to content. Where it is not feasible to include markings with all of the information required for classified or sensitive documents or media, an explanatory statement that provides the required information shall be included on the item or with the documentation that accompanies it. While For Official Use Only (FOUO) is the primary CUI marking used in DoD, all types of CUI markings must be considered for use as appropriate. For instance: “Law Enforcement Sensitive” is a marking sometimes applied, in addition to the marking “FOR OFFICIAL USE ONLY,” by the Department of Justice and other activities in the law enforcement community, including those within the Department of Defense. TACTICAL ENVIRONMENT: The check is applicable for all fixed tactical processing environments where CUI is developed and used. Not applicable to a field/mobile environment.

check_text:
  Check Content: General Information: This check is only for unclassified/sensitive media being used in a strictly unclassified physical environment. If all Controlled Unclassified Information (CUI) media are in a mixed environment where classified systems and media are in use, then STIG ID IS‐3.2.1. applies and this check is NA. Check to ensure the following standard is met: Regardless of media type, the requirement to identify as clearly as possible the information requiring protection remains. Therefore check to ensure that all unclassified media containing CUI is properly marked according to content. Where it is not feasible to include markings with all of the information required for classified or sensitive documents or media, an explanatory statement that provides the required information shall be included on the item or with the documentation that accompanies it. While For Official Use Only (FOUO) is the primary CUI marking used in DoD, all types of CUI markings must be considered for use as appropriate. For instance: “Law Enforcement Sensitive” is a marking sometimes applied, in addition to the marking “FOR OFFICIAL USE ONLY,” by the Department of Justice and other activities in the law enforcement community, including those within the Department of Defense. TACTICAL ENVIRONMENT: The check is applicable for all fixed tactical processing environments where CUI is developed and used. Not applicable to a field/mobile environment.


vuln_id: V-254851
rule_id: IS-17.03.01_rule
severity: CAT III
title: Classified Annual Review
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: Check #1. Check to ensure there are written procedures for the annual review and clean out of classified material. Check #2. Check to ensure there is a memorandum or some form of documentation covering results of the last clean out day. This is to validate actual completion of the requirement. TACTICAL ENVIRONMENT: This check is not applicable for fixed (established) tactical processing environments and is not applicable to a field/mobile environment. Classified documents and materials in these environments should be properly disposed of as soon as possible after it is determined there is no longer a need for them.

check_text:
  Check Content: Check #1. Check to ensure there are written procedures for the annual review and clean out of classified material. Check #2. Check to ensure there is a memorandum or some form of documentation covering results of the last clean out day. This is to validate actual completion of the requirement. TACTICAL ENVIRONMENT: This check is not applicable for fixed (established) tactical processing environments and is not applicable to a field/mobile environment. Classified documents and materials in these environments should be properly disposed of as soon as possible after it is determined there is no longer a need for them.


vuln_id: V-254852
rule_id: PE-01.03.02_rule
severity: CAT III
title: Position of Trust ‐ Local Policy Covering Employee Personal Standards of Conduct
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: Check to ensure that a local policy exists and is readily available to employees that informs them about pertinent security regulations and standards of conduct required of persons holding positions of trust, including (and especially) the requirement to report derogatory information to their local security manager. SOPs should be readily available to all employees in a common reading library or more efficiently, accessible on line in a common file or organization intranet. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.

check_text:
  Check Content: Check to ensure that a local policy exists and is readily available to employees that informs them about pertinent security regulations and standards of conduct required of persons holding positions of trust, including (and especially) the requirement to report derogatory information to their local security manager. SOPs should be readily available to all employees in a common reading library or more efficiently, accessible on line in a common file or organization intranet. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.


vuln_id: V-254854
rule_id: PE-01.03.03_rule
severity: CAT III
title: Position of Trust ‐ Training Covering Employee Standards of Conduct
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: General Information: The effectiveness of an individual in meeting security responsibilities is proportional to the degree to which the individual understands them. Thus, an integral part of the DoD security program is the indoctrination and continuous training of individuals on their security responsibilities. CHECK to ensure that Standards of Conduct and Personal Responsibilities are covered in initial, annual refresher and termination training/briefings. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.

check_text:
  Check Content: General Information: The effectiveness of an individual in meeting security responsibilities is proportional to the degree to which the individual understands them. Thus, an integral part of the DoD security program is the indoctrination and continuous training of individuals on their security responsibilities. CHECK to ensure that Standards of Conduct and Personal Responsibilities are covered in initial, annual refresher and termination training/briefings. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.


vuln_id: V-245856
rule_id: SV-245856r1008552_rule
severity: CAT II
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Validation Procedures for Security Clearance Issuance (Classified Systems and/or Physical Access Granted)

description:
  <VulnDiscussion>Failure to properly verify security clearance status could result in an unauthorized person having access to a classified information system or an authorized person being unable to perform assigned duties.

  REFERENCES:

  DOD 8570.01-M, Information Assurance Workforce Improvement Program, 19 December 2005, Incorporating Change 4, 11/10/2015

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND): Enclosure C, paragraphs 26.c.(2) (3) and 27.f.(5) (6)

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AC-1, MA-5, PE-2, PE-3, and PS-2 

  DOD 5220.22-M (NISPOM), Incorporating Change 2, 18 May 2016, Chapter 2, Section 2 and Chapter 8, Section 3, paragraph 8-302.a. Personnel Security.
   
  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information:  Enclosure 2, paragraphs 1 and 3

  DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP), April 3, 2017, Paragraphs 3.1.c., 4.1. Civilian Personnel, 4.2. Military Personnel, 4.3. Contractors, 4.4. Consultants. 4.5. Non-U.S. Citizens Employed Overseas in Support of National Security Positions. 4.6. Temporary Employees, 5A.2. Verify Eligibility, and Glossary G.2. Definitions: LAA.

  Now Cancelled: DOD 5200.2-R, Personnel Security Program, Chapter 3, para C3.4.3., Chapter 7 para C7.1.2. C7.1.3. and Appendix 9, para AP9.2. & AP9.3.6.2. 

  DODD 5230.20; Visits, Assignments, and Exchanges of Foreign Nationals Paragraph 4.4.
   
   DODD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations SPECIAL NOTE: Enclosure 3 to DODD 5230.11 establishes specific criteria for the disclosure of classified information:  Paragraphs 4.6.3., E2.1.4, Enclosure 3 and Enclosure 4.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Background Information:

  When developing an organizational program to validate security clearance information for systems access and/or physical access to SIPRNet work environments, the first thing to consider is there are various categories of personnel and associated considerations with each one. These categories include: Military employees, Government Civilian employees, Contract employees, Foreign Nationals and Local National employees under a Status of Forces (SOFA) agreement and Visitors. 

  The minimum security clearance requirement for systems access to the SIPRNet or unescorted access to the physical environment surrounding SIPRNet system information technology assets is secret.

  Generally, an organization validation of security clearance levels should come from official databases such as DISS, DCII, a service or agency data base or "high level" (major subordinate command) headquarters security office. Also note that organization manning (staffing) documents should include the required clearance level for each assigned Military and Civilian position.

  Local procedures must be developed for verifying that all personnel with access to classified information systems (logical or physical access) have the appropriate security clearance and access authorization. 

  Fixes:

  1. Ensure that organizational manning (staffing) records (*security clearance requirements for the position occupied) match the actual security clearance held by the incumbent employee (military or DOD civilian) as reflected in DISS. Review all the organization personnel security records and compare with applicable System Access Authorization Request (SAAR) forms to ensure proper validation of clearance levels. Be especially aware of ALL those who have "privileged" systems access or responsibility for systems security oversight (such as SAs, ISSM, ISSOs, Network Admin, etc.) and ensure that correct clearance and IT assurance levels have been granted.

  2. If there are contract employees with systems and/or physical access to SIPRNet, ensure there is a Statement of Work with accompanying DD 254 (Contract Security Specification) that covers security clearance requirements for each type of work being performed by contractors. Review contractor records (those physical assigned to the site or working remotely on projects for the organization) to ensure they actually have the required security clearances.

  3. Ensure that a delegation of disclosure authority letter (DDL) is on-hand in all cases where US Classified information is released/shared with Foreign National Exchange or Liaison personnel. 

  4. Ensure that a Limited Access Authorization (LAA) is on hand when system access to classified information is granted to an immigrant alien or a foreign national - not associated with or representing a foreign government. 

  5. Ensure there is an organizational procedure developed to outline methodology for validation and maintenance of required security clearances.

check_text:
  BACKGROUND: When checking how an organization validates security clearance information for either systems or physical access the first thing to consider is that there are various categories of personnel and associated considerations with each one. These categories include: Military employees, Government Civilian employees, Contract employees, Foreign Nationals, and Local National employees under a Status of Forces (SOFA) agreement and Visitors. 

  Generally, an organization validation of security clearance levels should come from official databases such as DISS, DCII, a service or agency data base or "high level" (major subordinate command) headquarters security office. Also note that organization manning (staffing) documents should include the required clearance level for each assigned Military and Civilian position. Staffing documents should be requested by inspectors for review.

  The minimum security clearance requirement for systems access to the SIPRNet or unescorted access to the physical environment surrounding SIPRNet system information technology assets is secret.

  Local procedures must be developed for verifying that all personnel with access to classified information systems (logical or physical access) have the appropriate security clearance and access authorization. Inspectors should review local procedures.

  Checks:

  Check #1. Review a sample of the organization personnel security records (from local data bases, physical files, DISS...) and compare with applicable System Access Authorization Request (SAAR) forms to ensure proper validation of clearance levels for access to the SIPRNet (both logical systems access and/or physical access to SIPRNet environments). Minimum of secret security clearance is required. Check organizational records against the DISS data base if possible. Ensure that organizational manning records (security clearance requirements for the position occupied) match the actual security clearance held by the incumbent employee (military or DOD civilian) as reflected in DISS. 

  Because it is generally not feasible to review all records it is recommended to select where possible ALL those who have privileged systems access or responsibility for oversight of systems security (such as SAs, ISSM, ISSOs, Network Admin, etc.) along with key management personnel (commander/director, ISSM, division/branch chiefs, etc.) and supplement with a random sample of those with basic "user" access to systems.

  Check #2. If there are contractor employees with classified systems access (SIPRNet) (both logical and/or physical access) - check to ensure there is a Statement of Work with accompanying DD 254 ("Classified" Contract Security Specification) that covers security clearance requirements for each type of work (or specified positions) being performed by contractors.
   
  Check #3. Check to ensure that contractor employees performing the tasks outlined in the Statement of Work and/or DD Form 254 actually have the security clearance required by the contract - minimum secret for SIPRNet access. If possible validate this in the DISS data base.

  Check #4. Check that a delegation of disclosure authority letter (DDL) is on-hand in all cases where US Classified information is released/shared with Foreign National Exchange or Liaison personnel who are either assigned to or visiting the site. The DDL will reflect the level of security clearance the FN official has and the level and type of information authorized to be shared.

  Check #5. Check to ensure that a Limited Access Authorization (LAA) is on hand when system access (or physical access) to classified information is granted to an immigrant alien or a foreign national - not associated with or representing a foreign government. 

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments and is also applicable to a field/mobile environment.


vuln_id: V-245860
rule_id: SV-245860r1138466_rule
severity: CAT III
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Out-processing Procedures for Departing or Terminated Employees (Military, Government Civilian and Contractor)

description:
  <VulnDiscussion>Failure to properly out-process through the security section allows the possibility of continued (unauthorized) access to the facility and/or the systems.

  REFERENCES:

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information Appendix to Encl 3, paragraph 3.a.(4). and Enclosure 5, paragraph 9.
   
  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5200.32 Volume 1 

  DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP), April 3, 2017, Chapter 12, paragraph 12.1.b.&f., Appendix G.2. Definitions, JPAS
   
  NIST Special Publication 800-53 (SP 800-53) Controls: AC-1, AC-2, PE-3, PS-4, and PS-5 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), 9 February 2011 Enclosure C, para 11</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure there are local procedures covering the out-processing of departing employees (Military, Government Civilian, and Contractor) and that records of departed employees on-hand reflect that out-processing was conducted. Out-processing records should be retained for a minimum of 90-days.

   Ensure that out-processing procedures and records include:
  -Removal from access to Government Information Systems, 
  - Turning in all access badges, classified and/or sensitive information,
  - Removal from automated entry control systems (AECS) and 
  - Signing of an SF 312 acknowledging a security debriefing.

  NOTE: The SF 312 is only applicable for those persons holding a security clearance.

check_text:
  Check to ensure the organization has documented out-processing procedures. 

  Review a sampling of personnel security files of departed personnel to ensure compliance. Files of departed personnel should be maintained by an organization for at least 90-days.

  Ensure the procedures and records of departed employees reviewed include:
  - Removal from access to Government Information Systems, 
  - Turning in all access badges, classified and/or sensitive information,
  - Removal from automated entry control systems (AECS) and 
  - Signing of an SF 312 acknowledging a security debriefing.

  NOTE: The SF 312 is only applicable for those persons holding a security clearance. 

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) and personnel records should be in place. Not applicable to a field/mobile environment.


vuln_id: V-245861
rule_id: SV-245861r1136806_rule
severity: CAT II
title: Intrusion Detection System (IDS) Monitoring Station Personnel - Suitability Checks
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to subject personnel who monitor the IDS alarms to a trustworthiness determination can result in the inadvertent or deliberate unauthorized access to, or release of classified material.

  REFERENCES:

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information 
  Appendix to Enclosure 3, para 2.f.(1)&(2)
   
  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  NIST Special Publication 800-53 (SP 800-53) 
  Control: PS-2 and PS-3

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), 9 February 2011 
  Encl A para 7.f. and Encl D Reference q 

  Legacy DOD 5200.2-R; Personnel Security Program 
  Paragraph C3.1.2.1.2.5. 

  Current DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP) 3 April 2017, Paragraph 4.1.a.(3)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure that IDS - protecting vaults, secure rooms, alarmed Protected Distribution Systems (PDS), or other spaces containing SIPRNet assets - is monitored by U.S. personnel who have been subject to a trustworthiness check IAW DOD Manual 5200.02.
   
  For Industrial Security (Contractor sites) ONLY:

  Minimally, SECRET-cleared central station employees shall be in attendance at the alarm monitoring station in sufficient number to monitor each alarmed area within the cleared contractor facility IAW NISPOM requirements.

  For all other DOD locations:

  Minimally monitor station personnel must be subjects of a successfully adjudicated Tier 3 investigation or an older NACLAC and ANACI that is still within scope.

check_text:
  Check that IDS - protecting vaults, secure rooms, alarmed Protected Distribution Systems (PDS), or other spaces containing SIPRNet assets - is monitored by U.S. personnel who have been subject to a trustworthiness check IAW DOD Manual 5200.02.
   
  For Industrial Security (Contractor sites) ONLY:

  Minimally, SECRET-cleared central station employees shall be in attendance at the alarm monitoring station in sufficient number to monitor each alarmed area within the cleared contractor facility IAW NISPOM requirements.

  For all other DOD locations:

  Minimally monitor station personnel must be subjects of a successfully adjudicated Tier 3 investigation or an older NACLAC and ANACI that is still within scope.

  TACTICAL ENVIRONMENT APPLICABILITY: Apply to fixed tactical environments where IDS is installed to protect SIPRNet and other DODIN (AKA: DISN) connected assets.


vuln_id: V-245862
rule_id: SV-245862r1136809_rule
severity: CAT II
title: Intrusion Detection System (IDS) Installation and Maintenance Personnel - Suitability Checks
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to subject personnel who install and maintain the IDS alarms to a trustworthiness determination can result in the inadvertent or deliberate unauthorized exposure to or release of classified material.

  REFERENCES:

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information 
  Appendix to Enclosure 3, para 2.f.(1)&(2)
   
  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  NIST Special Publication 800-53 (SP 800-53) 
  Control: PS-2 and PS-3

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), 9 February 2011 
  Encl A para 7.f. and Encl D Reference q 

  Legacy DOD 5200.2-R; Personnel Security Program 
  Paragraph C3.1.2.1.2.5. 

  Current DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP) 3 April 2017, Paragraph 4.1.a.(3)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure that installation and maintenance of physical IDS - protecting vaults, secure rooms or spaces containing SIPRNet assets - is accomplished by U.S. citizens who have been subjected to a trustworthiness determination in accordance with DOD Manual 5200.02. Minimally installation and maintenance personnel must be subjects of a successfully adjudicated Tier 3 investigation or an older NACLAC and ANACI that is still within scope.

check_text:
  Check physical IDS - protecting vaults, secure rooms or spaces containing SIPRNet assets - to ensure that installation and maintenance is accomplished by U.S. citizens who have been subjected to a trustworthiness determination in accordance with DOD Manual 5200.02. Minimally installation and maintenance personnel must be subjects of a successfully adjudicated Tier 3 investigation or an older NACLAC and ANACI that is still within scope.

  TACTICAL ENVIRONMENT APPLICABILITY: Apply to fixed tactical environments where IDS is installed to protect SIPRNet and other DODIN (AKA: DISN) connected assets.


vuln_id: V-245863
rule_id: SV-245863r1138467_rule
severity: CAT III
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Physical Security Program - Physical Security Plan (PSP) and/or Systems Security Plan (SSP) Development and Implementation with Consideration/Focus on Protection of Information System Assets in the Physical Environment

description:
  <VulnDiscussion>Failure to have a well-documented Physical Security/Systems Security program will result in an increased risk to DOD Information Systems; including personnel, equipment, media, material and documents.

  REFERENCES:

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  DOD 5200.8-R Physical Security Program Chapters 1, 2 and 3

  DOD Manual 5200.08 Volume 3, Physical Security Program: Access to DOD Installations, 2 January 2019

  NIST Special Publication 800-53 (SP 800-53) 
  Controls: PE-1 through PE-20 and PL-1 & PL-2 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), 9 February 2011 
  Encl A, para 5.a.(1), Encl C, para: 24.j., 27., 28.b., and 34.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Ensure there is a Physical Security Plan (PSP), either an organizational/site AND/OR an installation security plan in which granular security concerns and procedures at the site are addressed and considered.

  NOTE 1: If a higher level installation or base plan is used ensure that it specifically addresses security concerns/procedures for the inspected organization or site. Ideally, a local site or organization should always be included in the host installation security plan. If not, then a separately developed local (site/organization) Physical Security Plan (and/or Systems Security Plan (SSP)) is required, which integrates local security procedures for the site with the security-in-depth (SID) measures detailed in the host installation PSP. The installation level PSP will likely not address granular security concerns for computer rooms and areas hosting information systems assets at individual installation sites. Therefore the local organization(s) should still document specific protection measures covering SIPRNet and/or NIPRNet assets in a local PSP or in an SSP. 

  2. Ensure security requirements of the computer room(s) (SIPRNet and/or NIPRNet) and collateral classified open storage areas (as applicable) are addressed and that guidance is provided to counter threats during peacetime, transition to war, and in wartime.
   
  3. Ensure the plan also addresses entry/access control procedures for the facility overall and for individual computer rooms/secure rooms or other areas housing network equipment (routers/crypto/switches, etc.). Use of an AECS, guards, lock & key systems, cipher locks, etc. should be specifically and thoroughly addressed in the plan.

  4. Ensure that access control procedures cover requirements for various categories of persons expected to access the facility such as employees, visitors, vendors, facility maintenance, and foreign nationals. 

  NOTE 2: To be complete the plan should specifically address access control of vendors (i.e., vending machine deliveries), cleaning and food service personnel, cleared versus uncleared visitors, foreign national (FN) visitors, FN employees (OCONUS SOFA, liaison, exchange and REL partners). 
   
  5. Finally, ensure the plan addresses security measures and response (Emergency Planning Measures) to include application of Force Protection Conditions, anti-terrorism planning and measures, civil disturbances, natural disasters, crime and any other possible local disruptions of the mission. A thorough plan will include measures designed to detect, delay, assess and respond to intrusions and other emergency situations.

check_text:
  1. Check to ensure there is a Physical Security Plan (PSP), either an organizational/site AND/OR an installation security plan in which granular security concerns and procedures at the site are addressed and considered. 

  NOTE 1: If a higher level installation or base plan is used ensure that it specifically addresses security concerns/procedures for the inspected organization or site. Ideally, a local site or organization should always be included in the host installation security plan. If not, then a separately developed local (site/organization) Physical Security Plan (and/or Systems Security Plan (SSP)) is required, which integrates local security procedures for the site with the security-in-depth (SID) measures detailed in the host installation PSP. The installation level PSP will likely not address granular security concerns for computer rooms and areas hosting information systems assets at individual installation sites. Therefore the local organization(s) should still document specific protection measures covering SIPRNet and/or NIPRNet assets in a local PSP or in an SSP. 

  2. Check to ensure security requirements of the computer room(s) (SIPRNet and/or NIPRNet) and collateral classified open storage areas (as applicable) are addressed and that guidance is provided to counter threats during peacetime, transition to war, and in wartime. 

  3. Check to ensure the plan also addresses entry/access control procedures for the facility overall and for individual computer rooms/secure rooms or other areas housing network equipment (routers/crypto/switches, etc.). Use of an AECS, guards, lock & key systems, cipher locks, etc. should be specifically and thoroughly addressed in the plan.

  4. Check to ensure that access control procedures cover requirements for various categories of persons expected to access the facility such as employees, visitors, vendors, facility maintenance, and foreign nationals. 

  NOTE 2: To be complete the plan should specifically address access control of vendors (ie., vending machine deliveries), cleaning and food service personnel, cleared versus uncleared visitors, foreign national (FN) visitors, FN employees (OCONUS SOFA, liaison, exchange and REL partners). 

  5. Finally check to ensure the plan addresses security measures and response (Emergency Planning Measures) to include application of Force Protection Conditions, anti-terrorism planning and measures, civil disturbances, natural disasters, crime and any other possible local disruptions of the mission. A thorough plan will include measures designed to detect, delay, assess and respond to intrusions and other emergency situations.

  NOTE 3: If the plan or any of the critical elements of the plan (everything mentioned here) applicable to the specific site are missing - a finding should be written.          

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.


vuln_id: V-245864
rule_id: SV-245864r1136815_rule
severity: CAT II
title: Risk Assessment -Holistic Review (site/environment/information systems)
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to conduct a risk analysis could result in not implementing an effective countermeasure to a vulnerability or wasting resources on ineffective measures leading to a possible loss of classified, equipment, facilities, or personnel.

  REFERENCES:

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 

  NIST Special Publication 800-53 (SP 800-53) 
  Controls: PE-18(1), PL-1, PL-2, PS-1, RA-1 RA-3 

  DOD 5200.8-R Physical Security Program 
  Definitions: 1.13, 1.14., 1.15., 1.22.; Chap 1, C1.2.3. C1.2.4. and Chap 2, C2.1.3.3. 

  DOD Manual 5200.08 Volume 3, Physical Security Program: Access to DOD Installations, 
  2 January 2019

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information 
  Encl 2, para 10.; Encl 3, para 4.: Appendix to Encl 3, para 2.a. and Encl 7 para 4.c. 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), 9 February 2011 
  Encl A, para 12; Encl B, para 2.d(3), 2.g., and 3.h.; Encl C, para 3.a., 6.b.(6) and 33. 

  DOD Instruction 8510.01, Risk Management Framework (RMF) for DOD Information Technology (IT), March 13, 2014

  DOD Instruction 8500.01, "Cybersecurity," March 13, 2014
  Encl 2, paragraph 2.k., 9.q., 15.e. and Encl 3, paragraph 2. (*2.f.) & 9.b.(5)

  NIST SP 800-30, Guide for Conducting Risk Assessments

  NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Ensure there is a "Holistic" Risk Assessment (RA) for the site that includes consideration of environmental hazards, weather hazards, criminal and terrorist hazards, insider threat hazards and any other threats that could possibly impact the Confidentiality/Integrity/Availability (CIA) of the Information Technology (IT) facility and/or Information System (IS) equipment.

  2. Ensure the RA is revalidated/updated at least annually.

  3. Ensure the current site commander/director signed the risk assessment in conjunction with or in coordination with the AOs for resident system(s), signifying acceptance of any residual risk. 

  NOTE 1: While an AO signed ATO does in fact signify acceptance of risk for specific systems, this alone does not meet the requirement for a formal risk assessment, which is a very specific and separate individual document.         

  NOTE 2: Conducting a risk analysis is not just a simple paper work drill - or at least it should not be. Often organizations take a risk analysis template and simply insert their organizations information, local environmental information, etc. - but do not do a good job of actually assessing threats, countermeasures in place (or that can be applied) to come up with an acceptable level of residual risk. A good risk assessment is a team effort (security, IA, COOP, engineers, safety, management...) and should be headed by someone with at least some training in conducting risk assessments. 

  NOTE 3: Training is offered by the Defense Security Service (DSS) Academy in Linthicum, MD among others. 

  NOTE 4: The NIST SP 800-30, Guide for Conducting Risk Assessments provides a widely used format and instructions for conducting a RA. Reviewers should recommend sites use this publication as the basis for conducting their RA.

  NOTE 5: When there is a government/DOD contract with an industry partner; the government sponsor is inherently and ultimately responsible for risk based decisions. The contractor only performs mission related tasks IAW contract specifications (e.g., statement of work (SOW)), which should ideally include guidance for risk assessment and acceptance. 

  Hence, while the industry partner can prepare and coordinate the risk assessment it is the government/DOD customer who has the ultimate responsibility for accepting and coordinating risk based on their mission requirements. Therefore, the head of the contract sponsoring organization must approve/sign the risk assessment/acceptance of residual risk.

  The Authorizing Official (AO) for industry locations is the Defense Security Service (DSS) Cognizant Security Office (CSO). Each CSO appoints an AO for system related risk evaluation. 

  NOTE 6: A thorough organizational risk assessment and acceptance of residual risk should be properly coordinated with all stakeholders to ensure there are no conflicts or issues. This must include the Authorizing Official (AO), and should also include where appropriate the DISN Connection Approval Office (CAO), the Program Management Office (PMO), local law enforcement, fire/safety, Counter Intelligence (CI) Support, Federal Emergency Management Agency (FEMA) along with state and local emergency management counterparts as applicable. The government Contracting Officer and/or Contracting Officer's Representative (COR) should inherently be included for coordination with all contractor related risk assessments.

check_text:
  1. Check that there is a "Holistic" Risk Assessment (RA) for the site that includes consideration of environmental hazards, weather hazards, criminal and terrorist hazards, insider threat hazards and any other threats that could possibly impact the Confidentiality/Integrity/Availability (CIA) of the Information Technology (IT) facility and/or Information System (IS) equipment. 

  2. Check to ensure the RA is revalidated/updated at least annually.

  3. Check to ensure the current site commander/director signed the risk assessment in conjunction with or in coordination with the Authorizing Officials (AOs) for resident system(s), signifying acceptance of any residual risk. 

  NOTE 1: While an AO signed ATO does in fact signify acceptance of risk for specific systems, this alone does not meet the requirement for a formal risk assessment, which is a very specific and separate individual document.          

  NOTE 2: Conducting a risk analysis is not just a simple paper work drill - or at least it should not be. Often organizations take a risk analysis template and simply insert their organizations information, local environmental information, etc. - but do not do a good job of actually assessing threats, countermeasures in place (or that can be applied) to come up with an acceptable level of residual risk. A good risk assessment is a team effort (security, IA, COOP, engineers, safety, management...) and should be headed by someone with at least some training in conducting risk assessments. 

  NOTE 3: Training is offered by the Defense Security Service (DSS) Academy in Linthicum, MD among others. 

  NOTE 4: The NIST SP 800-30, Guide for Conducting Risk Assessments provides a widely used format and instructions for conducting a RA. Reviewers should recommend sites use this publication as the basis for conducting their RA.

  NOTE 5: Time permitting the reviewer should make recommendations for improving the risk analysis process at a site since this is a critical element in any effective security management program.

  NOTE 6: When there is a government/DOD contract with an industry partner; the government sponsor is inherently and ultimately responsible for risk based decisions. The contractor only performs mission related tasks IAW contract specifications (e.g., statement of work (SOW)), which should ideally include guidance for risk assessment and acceptance. 

  Hence, while the industry partner can prepare and coordinate the risk assessment it is the government/DOD customer who has the ultimate responsibility for accepting and coordinating risk based on their mission requirements. Therefore, the head of the contract sponsoring organization must approve/sign the risk assessment/acceptance of residual risk.

  The Authorizing Official (AO) for industry locations is the Defense Security Service (DSS) Cognizant Security Office (CSO). Each CSO appoints an AO for system related risk evaluation. 

  NOTE 7: A thorough organizational risk assessment and acceptance of residual risk should be properly coordinated with all stakeholders to ensure there are no conflicts or issues. This must include the Authorizing Official (AO), and should also include where appropriate the DISN Connection Approval Office (CAO), the Program Management Office (PMO), local law enforcement, fire/safety, Counter Intelligence (CI) Support, Federal Emergency Management Agency (FEMA) along with state and local emergency management counterparts as applicable. The government Contracting Officer and/ or Contracting Officer's Representative (COR) should inherently be included for coordination with all contractor related risk assessments.

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.


vuln_id: V-245865
rule_id: SV-245865r1138468_rule
severity: CAT II
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Physical Protection of Unclassified Key System Devices/Computer Rooms in Large Processing Facilities

description:
  <VulnDiscussion>Allowing access to systems processing sensitive information by personnel without the need-to-know could permit loss, destruction of data or equipment or a denial of service. Loss could be accidental damage or intentional theft or sabotage.

  REFERENCES:

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 

  DOD 5200.8-R Physical Security Program 
  Chapters 1, 2 and 3 

  DOD Manual 5200.08 Volume 3, Physical Security Program: Access to DOD Installations, 
  2 January 2019

  NIST Special Publication 800-53 (SP 800-53) 
  Controls: PE-2, PE-3, PE-4, PE-6 and PE-18 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), 9 February 2011 
  Encl C, para 34. 

  DODI 8500.01, Cybersecurity, March 14, 2014, Enclosure 2, paragraph 13.s.

  DOD Manual 5200.01, Volume 4, February 24, 2012
  SUBJECT: DOD Information Security Program: Controlled Unclassified Information (CUI)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Ensure that Unclassified system assets (servers, DASD, tape drives, hubs, etc.) are protected in secure locked/access controlled rooms or closets and maintained separately from general employee access.

  NOTE 1: This potential VUL concerns protection of "ONLY UNCLASSIFIED" System and Network Devices. 

  NOTE 2: While not required; the ideal situation with larger computer systems is to locate all major system components within "raised floor" computer rooms. Regardless of the location the key factor in determining acceptable compliance is if the equipment is accessible only to properly vetted persons who require unescorted access to the equipment for performance of duties. 
   
  NOTE 3: While not preferred, if space and/or size of the Information Systems (IS) assets do not allow for being housed in a separate room or closet they may be maintained in locked Information System (IS) cabinets that preclude ease of access by unauthorized individuals. 

  2. Ensure that properly managed Automated Entry Control Systems (AECS), mechanical access devices such as cipher locks, or keyed locks are being used to control access to these rooms, closets or cabinets. 

  NOTE 4: If keyed locks are used, ensure that proper key control procedures are in place.

check_text:
  1. Check to ensure that Unclassified system assets (servers, DASD, tape drives, hubs, etc.) are protected in secure locked/access controlled rooms or closets and maintained separately from general employee access.

  NOTE 1: This check concerns protection of "ONLY UNCLASSIFIED" System and Network Devices. 

  NOTE 2: While not required; the ideal situation with larger computer systems is to locate all major system components within "raised floor" computer rooms. Regardless of the location the key factor in determining acceptable security compliance is if the equipment is accessible only to properly vetted persons who require unescorted access to the equipment for performance of duties. 
   
  NOTE 3: While not preferred, if space and/or size of the Information Systems (IS) assets do not allow for being housed in a secure room or closet they may be maintained in locked Information System (IS) cabinets that preclude ease of access by unauthorized individuals. 

  2. Check to ensure that properly managed Automated Entry Control Systems (AECS), mechanical access devices such as cipher locks, or keyed locks are being used to control access to these rooms, closets or cabinets. 

  NOTE 4: If keyed locks are used check to ensure that proper key control procedures are in place. *If key control procedures are determined to be inadequate a finding under this STIG rule should be written. 

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments. Not applicable to a field/mobile environment.


vuln_id: V-245866
rule_id: SV-245866r1136821_rule
severity: CAT II
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Restricted Area and Controlled Area Designation of Areas Housing Critical Information System Components or Classified /Sensitive Technology or Data

description:
  <VulnDiscussion>Failure to designate the areas housing the critical information technology systems as a restricted or controlled access area may result in inadequate protection being assigned during emergency actions or the site having insufficient physical security protection measures in place. Further, warning signs may not be in place to advise visitors or other unauthorized persons that such areas are off-limits, resulting in inadvertent access by unauthorized persons.

  REFERENCES:

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 

  NIST Special Publication 800-53 (SP 800-53) 
  Controls: PE-2 and PE-3

  DOD 5200.8-R Physical Security Program 
  Definitions: DL1.12., and Chapter 3, para C3.2.4.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure the areas housing critical information technology systems are designated as Restricted Areas or Controlled Areas IAW host installation and/or Service, Agency or COCOM guidance. 

  Signage should be properly posted at all access points and at adequate intervals to advise those approaching of the restricted area/controlled area designation, authority and consequences for violation of access restrictions. Signs will be in English as well as in any language prevalent in the area. Signs may not be required where OPSEC countermeasures dictate.

check_text:
  Check to ensure the areas housing critical information technology systems are designated as Restricted Areas or Controlled Areas IAW host installation and/or Service, Agency or COCOM guidance. 

  Signage should be properly posted at all access points and at adequate intervals to advise those approaching of the restricted area/controlled area designation, authority and consequences for violation of access restrictions. Signs will be in English as well as in any language prevalent in the area. Signs may not be required where OPSEC countermeasures dictate.     

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments. Not applicable to a field/mobile environment.


vuln_id: V-245867
rule_id: SV-245867r1138470_rule
severity: CAT II
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Security-in-Depth (AKA: Defense-in-Depth) - Minimum Physical Barriers and Access Control Measures for Facilities or Buildings Containing DODIN (SIPRNet/NIPRNet) Connected Assets.

description:
  <VulnDiscussion>Failure to use security-in-depth can result in a facility being vulnerable to an undetected intrusion or an intrusion that cannot be responded to in a timely manner - or both.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure A, paragraph 5.a.(1).

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-2(2), PE-3, PE-6(1), and page B-6: Security-in-Depth defined.

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Enclosure 2, paragraph 13.s. and Enclosure 3, paragraph 7.         

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Enclosure 2 paragraph 12.; Enclosure 3, paragraph 3.b.(3) & paragraph 4.; Enclosure 7, paragraph 7.d.; and Glossary page 121, Security-in-Depth defined.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  DOD 5200.8-R Physical Security Program, April 9, 2007, Incorporating Change 1, May 27, 2009: Chapter 2, C2.3.1, C3.2.1 and DL1.17., Security-in-Depth defined.

  CNSSI No.7003, September 2015, Protected Distribution Systems (PDS), Section IV, paragraph 6, Section VIII, Table 1 and Table 2, and Section VI - DEFINITIONS - Controlled Access Area (CAA).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Background Information: This standard is intended to validate security-in-depth protection measures in place for facilities containing either unclassified DODIN assets (NIPRNet) or classified (SIPRNet) DODIN assets or both. The first two fixes are specifically for unclassified DODIN facilities, while fixes 3 and 4 are for facilities containing SIPRNet assets. Where both NIPRNet and SIPRNet assets are contained in a facility - the more stringent standards for SIPRNet will be used.

  Fixes:

  1. Ensure that any facility/building housing unclassified information system assets connected to the DODIN (such as end-user NIPRNet work stations) has at least one physical barrier supplemented by any type of 24/7 access control (keyed locks, reception, guards, Access Control System, Cipher Locks, etc.).

  2. Ensure that unclassified Computer Rooms containing equipment connected to the DODIN (located within a facility (building, room or area) meeting the standard in #1 above) have an additional layer of physical protection and access control. This fix is intended for rooms with key system assets such as servers, routers, DASD, etc., rather than end user workstations. 

  3. Protection of classified (SIPRNet) assets (such as end user workstations with typical office equipment that are NOT housed and operated within a facility designated as a collateral classified open storage area):

   a. Ensure that every physical access point to facilities housing DODIN end-user workstations that process or display classified information is guarded or alarmed 24/7 (minimum of alarm contacts on the doors) and that intrusion alarms are properly monitored. This is space NOT designated as a collateral classified open storage area. Normally such space should be controlled/designated as a secret controlled access area (CAA) for SIPRNet.

   b. Ensure that two forms of identification are required to gain access to a facility housing DODIN workstations that process or display classified information (e.g., key card with PIN/biometrics or two acceptable forms of picture ID presented to a guard or receptionist). 

   c. Ensure that a visitor log is maintained for facilities containing DODIN end-user workstations that process or display classified information. Automated Entry Control System (AECS) log entries may be used to meet this requirement.

  NOTE: Physical access points to facilities housing DODIN workstations in secret CAAs that process or display classified information, which are located on an access controlled military installation (or that employ another layer of physical barrier/access control) are not required to have an IDS alarm contact on the doors and need only one level of access control. For instance access control to the facility using only a swipe or proximity card (w/o PIN or biometrics) or a guard checking a single picture ID is acceptable.

  4. Where there are Information System assets stored in secure rooms (AKA: collateral classified open storage areas) that are connected to the SIPRNet - ensure that the senior agency official has determined in writing that security-in-depth exists. 

  *Note that the SAO for the Defense Security Service (DSS)/industry is the Cognizant Security Agency (CSA)/Cognizant Security Office (CSO).

check_text:
  Background Information: This set of checks is intended to validate security-in-depth protection measures in place for facilities with either Unclassified DODIN assets (NIPRNet) or Classified (SIPRNet) DODIN assets or both. Checks are specifically oriented to each (one or more) of the following 4-situations:

  1. Protection of unclassified (NIPRNet) assets (such as-end user workstations with typical office equipment - PC/laptop/thin client/multi-functional devices (MFD), printers, copiers, scanners, facsimile machine...) that are housed and operated in administrative office spaces.

  2. Protection of unclassified (NIPRNet) assets housed and operated in unclassified computer rooms. This check is intended for rooms with key system assets such as servers, routers, DASD, etc., rather than end user workstations. This high level system equipment requires an additional layer of physical protection and access control.

  3. Protection of classified (SIPRNet) assets (such as end-user workstations with typical office equipment - PC/laptop/thin client/multi-functional devices (MFD), printers, copiers, scanners, facsimile machine...) that are housed and operated in administrative office spaces NOT designated for collateral classified open storage (AKA: secure room or closed storage area). Normally such space should be controlled/designated as secret controlled access areas (CAA) for SIPRNet.

  4. Protection of classified (SIPRNet) assets housed and operated in space designated for collateral classified open storage (AKA: secure room or closed storage area). Assets in this situation may include both end-user workstations with typical office equipment as detailed above and/or Computer Rooms containing key system assets such as servers, routers, DASD, etc. So to restate, this includes any classified equipment (both end-user and key system equipment) stored and operated in space designated for and meeting collateral classified open storage standards. Where both NIPRNet and SIPRNet assets as well as end-user and system level assets are co-located in a facility - the most stringent SID standards applicable for the area will be used.

  Checks:

  1. Protection of areas containing unclassified (NIPRNet) assets (such as end user workstations):
  Check that any facility (building, room or area) housing unclassified information system assets connected to the DODIN (such as end user NIPRNet work stations) has at least one physical barrier supplemented by any type of 24/7 access control (keyed locks, reception, guards, Access Control System, Cipher Locks, etc.).

  2. Protection of unclassified (NIPRNet) assets housed and operated in unclassified computer rooms:

  Check to ensure that Unclassified Computer Rooms containing equipment connected to the DODIN (located within a facility (building, room or area) meeting the standard in #1 above) have an additional layer of physical protection and access control (beyond that for the surrounding facility or area). This check is intended for rooms with key system assets such as servers, routers, etc., rather than end user workstations. 

  3. Protection of classified (SIPRNet) assets (such as end user workstations with typical office equipment that are NOT housed and operated within a facility designated as a collateral classified open storage area):

   a. Check to ensure that every physical access point to facilities housing DODIN end-user workstations that process or display classified information is guarded or alarmed 24/7 (minimum of alarm contacts on the doors) and that intrusion alarms are properly monitored. This is space NOT designated as a collateral classified open storage area. Normally such space should be access controlled/designated as a secret controlled access area (CAA) for SIPRNet.

   b. Check that two forms of identification are required to gain access to a facility housing DODIN workstations that process or display classified information (e.g., key card with PIN/biometrics or two acceptable forms of picture ID presented to a guard or receptionist).
   
   c. Check to ensure that a visitor log is maintained for facilities containing DODIN end-user workstations that process or display classified information. Automated Entry Control System (AECS) log entries may be used to meet this requirement.

  NOTE: Physical access points to facilities housing DODIN workstations in secret CAAs that process or display classified information, which are located on an access controlled military installation (or that employ another layer of physical barrier/access control) are not required to have an IDS alarm contact on the doors and need only one level of access control. For instance access control to the facility using only a swipe or proximity card (w/o PIN or biometrics) or a guard checking a single picture ID is acceptable.

  4. Protection of classified (SIPRNet) assets housed and operated in space designated for collateral classified open storage (AKA: secure room or closed storage area):

  *Check to ensure that the senior agency official (SAO) has determined in writing that security-in-depth (SID) exists.

  Note that the SAO for the Defense Security Service (DSS)/industry is the Cognizant Security Agency (CSA)/Cognizant Security Office (CSO).

  SID Explained:
   
  SID is a determination that the security program consists of layered and complementary security controls sufficient to deter and detect unauthorized entry and movement within the facility. Examples include, but are not limited to, use of perimeter fences, employee and visitor access controls, use of an IDS, random guard patrols throughout the facility during non-working hours, closed circuit video monitoring or other safeguards that mitigate the vulnerability of open storage areas without alarms as well as for security containers (safes) during non-working hours.
   
  Specific Secure Room security standards are not covered under this check for security-in-depth as they are covered in other Rules within this STIG. 
   
  Selection of supplementary controls for secure rooms (IDS versus 4-hours guard checks) is based upon the SID in conjunction with an assessment of risk that is accepted by the SAO.
   
  Access control requirements for collateral open storage areas are established and must be IAW the DOD Manual 5200.01, V3 and as implemented by Rules in this STIG.

  An SID determination may be rendered using one of two methods:
   
  First, the SAO can issue SID approvals on a case-by-case basis. For instance the facility or organization with collateral open storage space would provide the SAO with a request for SID (IAW pre-established organizational (CC/S/A) procedures) that is subsequently approved or disapproved by the SAO.
   
  A second method would be for the CC/S/A to establish a policy (Manual, Instruction, Regulation, Circular, etc.) that provides specific criteria or requirements that when met by organizations is evidence of adequate SID for collateral open storage spaces. Criteria may be based on additional considerations such threat environments (high, medium, or low), if the space is on access controlled installations versus off-installations in public accessible space, CONUS versus OCONUS sites or other such considerations per the discretion of the SAO of the CC/S/A.
   
  Regardless of the method used by the SAO to render an SID determination, it must be properly documented and clearly apply to the collateral open storage area (AKA: secure room or closed storage area) being evaluated.

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments. Not applicable to a field/mobile environment.


vuln_id: V-245868
rule_id: SV-245868r1138472_rule
severity: CAT II
title: Visitor Control - To Facility or Organization with Information System Assets Connected to the DISN
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to identify and control visitors could result in unauthorized personnel gaining access to the facility with the intent to compromise classified information, steal equipment, or damage equipment or the facility.

  REFERENCES:

  DOD 5200.8-R Physical Security Program 
  Chap 3, para C3.3.1.4. and DL1.17. on pg 8 and DTM 09-012, 8 Dec 09, Incorporating Change 7, Effective April 17, 2017 

  DOD Manual 5200.08 Volume 3, Physical Security Program: Access to DOD Installations, 2 January 2019

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  NIST Special Publication 800-53 (SP 800-53) 
  Controls: PE-2, PE-3 and PE-8 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), 9 February 2011 
  Encl C, para 34. 

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information 
  Glossary, definition of security-in-depth and Encl 2, para 7.a and 7.b.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Review visitor control procedures and implementation and ensure they include verification of clearance/investigation status (where required for access), personal identification of visitor, registering of visitors, proper badging (using DOD issued Common Access Cards (CAC) or other authorized credentials) and escorts. 

  NOTE: Detailed audit logs of all facility visitors should be maintained for at least 90 days. Automated Entry Control System (AECS) electronic logs may be used to meet this requirement.

check_text:
  Review visitor control procedures and implementation and ensure they include verification of clearance/investigation status (where required for access), personal identification of visitor, registering of visitors, proper badging (using DOD issued Common Access Cards (CAC) or other authorized credentials) and escorts. 

  NOTE 1: Traditional Security reviewers may be able to evaluate implementation of the visitor process by reviewing how the review team was identified and badged. 

  NOTE 2: Detailed audit logs of all facility visitors should be maintained for at least 90 days. Automated Entry Control System (AECS) electronic logs may be used to meet this requirement. 

  NOTE 3: Additional interviews can be conducted with personnel handling the visitor control function.

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments. Not applicable to a field/mobile environment.


vuln_id: V-245869
rule_id: SV-245869r1136830_rule
severity: CAT II
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Sensitive Item Control - Keys, Locks and Access Cards Controlling Access to Information Systems (IS) or IS Assets Connected to the DISN

description:
  <VulnDiscussion>Lack of an adequate key/credential/access device control could result in unauthorized personnel gaining access to the facility or systems with the intent to compromise classified information, steal equipment, or damage equipment or the facility.

  REFERENCES:

  UG 2040-SHR, User's Guide on Controlling Locks, Keys, and Access Cards and Best Practices - found on the DOD Lock Program site:
  https://www.navfac.navy.mil/content/dam/navfac/Specialty%20Centers/Engineering%20and%20Expeditionary%20Warfare%20Center/DOD_Lock_Program/PDFs/UG-2040-SHR.pdf

  DOD 5200.8-R Physical Security Program 
  Chapter 2, para C2.1.4.4., C2.1.4.5., C2.1.4.8. and Chapter 3, para C3.3 and Pg 7, DL1.9 Personnel Identity Management and Protection 

  DOD Manual 5200.08 Volume 3, Physical Security Program: Access to DOD Installations, 2 January 2019

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  NIST Special Publication 800-53 (SP 800-53) 
  Controls: IA-5, SC-12, MA-5, PE-2, PE-3, PS-4, PS-5 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), 9 February 2011 
  Encl C, para 34. 

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information 
  Encl3, para 6.e.(1) (2) and Appendix to Encl 3, para 3.a.

  Satisfies: Sensitive Item Control - Keys, Locks and Access Cards</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Ensure there are written procedures for the control of sensitive items such as keys, locks, badges and smart cards. 

  2. Verify the process for controlling keys/locks and credentials is being followed and that it is effective. As a minimum, lock and key systems or access control systems (using coded access swipe/prox badges) require a key or credential inventory, issue records, and a procedure for returning the key or access control credential once the user no longer needs it. 

  3. Ensure a Key Control/Credential Officer and/or Key/Credential Custodians are appointed in writing to implement the system for controlling keys, locks and access control credentials. 

  4. Ensure the Key/Credential Control Officer conducts at least an annual inventory/reconciliation of all keys/credentials issued and on-hand.

  5. Ensure that all keys/credentials are also inventoried upon change of Key/Credential Control Officer or Key/Credential Custodian.

  NOTE:

  If the organization's Combatant Command, Service or Agency (CC/S/A) has issued guidelines for control of sensitive items, then compliance with this rule will be considered validated if following the issued guidelines.

check_text:
  1. Check to ensure there are written procedures for the control of sensitive items such as keys, locks, badges and smart cards (CAC, token, or other locally issued badge). 

  2. Check to verify the process is being followed and that it is effective. As a minimum, lock and key systems or automated entry control systems (AECS) using coded access swipe/proximity badges - require a key or credential inventory, issuance records, and procedures for returning the key or access control credential once the user no longer needs it. 

  3. Check to ensure a Key/Credential Control Officer and/or Key/Credential Custodians are appointed in writing to implement the system for controlling keys, locks and access control credentials. 

  4. Check to ensure the Key/Credential Control Officer conducts at least an annual inventory/reconciliation of all keys/credentials issued and on-hand.

  5. Check to ensure that all keys/credentials are also inventoried upon change of Key/Credential Control Officer or Key/Credential Custodian.

  NOTE FOR REVIEWERS:
  If the Combatant Command, Service or Agency (CC/S/A) has issued guidelines for control of sensitive items the inspected organization may be considered compliant if following the issued guidelines.
     
  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments. Not applicable to a field/mobile environment.


vuln_id: V-245870
rule_id: SV-245870r1138474_rule
severity: CAT III
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Physical Penetration Testing - of Facilities or Buildings Containing Information Systems (IS) Connected to the DISN

description:
  <VulnDiscussion>Failure to periodically test facility/building security where Information Systems (IS) connected to the DISN are present could lead to the unauthorized access of an individual into the facility with nefarious intentions to affect the Confidentiality, Integrity or Assurance of data or hardware on the IS.

  REFERENCES:

  DOD 5200.8-R Physical Security Program 
  Chapter 2, para C2.1.3.2. C2.1.3.4. and C2.2.4.

  DOD Manual 5200.08 Volume 3, Physical Security Program: Access to DOD Installations, 2 January 2019

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  NIST Special Publication 800-53 (SP 800-53) 
  Controls: CA-2, CA-8 and PE-3(6) and PE-6

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), 9 February 2011 
  Encl A, para 8.b., Encl C paragraphs 6.b. 12.a. 34. 

  DODI 8500.01, March 14, 2014, DOD CIO, SUBJECT: Cybersecurity
  Encl 2, para 13.s. and Encl 3, paragraphs 3.b. & 5.c.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure that procedures for a facility penetration testing process are developed that includes periodic, unannounced attempts to penetrate key computing facilities. Results of these tests should be provided to the site or organization commander/director and if applicable, the supporting base physical security specialist. Any discrepancies should be addressed and corrective action taken (i.e., update procedures or provide additional training). 

  Ensure the test is completed at least annually.

  Note: It is often a good idea for the site conducting physical penetration tests to coordinate support or this testing from supporting host installation security or an outside source. That enables the test to be conducted by someone that most site personnel might not be familiar with and will facilitate a good test using social engineering or other methodology to gain unauthorized access.

check_text:
  Check to ensure that procedures for a facility penetration testing process are developed that includes periodic, unannounced attempts to penetrate key computing facilities. Results of these tests should be provided to the site or organization commander/director and if applicable, the supporting base physical security specialist. Any discrepancies should be addressed and corrective action taken (i.e., update procedures or provide additional training). 

  If a test has not been completed within the last 12-months this should be a finding. 

  Note: It is often a good idea for the site conducting physical penetration tests to coordinate support or this testing from supporting host installation security or an outside source. That enables the test to be conducted by someone that most site personnel might not be familiar with and will facilitate a good test using social engineering or other methodology to gain unauthorized access. 

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments. Not applicable to a field/mobile environment.


vuln_id: V-245871
rule_id: SV-245871r1136836_rule
severity: CAT II
title: Security and Cybersecurity Staff Appointment, Training/Certification and Suitability
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to formally appoint security personnel and detail responsibilities, training and other requirements in the appointment notices could result in a weaken security program due to critical security and information assurance personnel not being fully aware of the scope of their duties and responsibilities or not being properly trained or meeting standards for appointment to assigned positions.

  REFERENCES:

  DOD 8570.01-M, Information Assurance Workforce Improvement Program, 19 December 2005, Incorporating Change 4, 11/10/2015
  Chap 3, para C3.2.4.4., Chap 4 para C4.2.3.6., Chap 5 para C5.1.1. and Chap 10 para C10.2.3.6. 

  DODD 8140.01 Cyberspace Workforce Management

  DODI 8140.02 Identifying-Tracking and Reporting of Cyberspace Workforce Requirements

  DODM 8140.03 Cyberspace Workforce Qualification and Management Program

  DOD Manual 5200.02, PROCEDURES FOR THE DOD PERSONNEL SECURITY PROGRAM (PSP), Effective: April 3, 2017
  Section 2, paragraph 2.10.a., h. & i. and Appendix 7A: Determination Authorities

  NIST Special Publication 800-53 (SP 800-53) 
  Controls: PM-2, PS-2, PS-3, AC-5, AC-6(5), PM-10, CA-6 and AT-3 

  DOD Manual 5200.01, Volume 1, 24 February 2012, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification 
  Encl 2, para 6.b., 7., 7.c., 8.b., 8.c., 8.d., 9. & 12.; Encl 3 para 6.a., 6.b. & 6.b.(5); and Definitions, pg 76 activity SM 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), 9 February 2011 
  Encl C, paragraphs 3.a.(1) (2)(a)(b), 4.a. through 4.e., 26.(c), & 27. and Encl A para 11.b. 

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  DODI 8500.01, March 14, 2014, SUBJECT: Cybersecurity
  Enclosure 2, paragraph 1.c., 13.c. and Enclosure 3, paragraph 13.b., 16.a.(2), 18.d.

  Satisfies: Security and Cybersecurity Staff Appointment, Training/Certification and Suitability</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Ensure there are appointment letters for all Traditional Security staff and Cybersecurity staff members including the SM, DAA, IAM, IAOs, System Administrators (SA), and Network Security Officers (NSO). 

  2. Ensure the appointments are current and appropriate authorities have made the appointments.

  3. Ensure that pertinent duties, responsibilities, training/certification and other suitability requirements for the appointed positions are contained in the appointment order. 

  4. Ensure that security staff have been properly trained and certified for the positions to which they are appointed (e.g., IAM I, II or III for ISSM/ISSO) and that they meet all applicable requirements for the positions. For instance the AO and ISSM must be US citizens.

  NOTE: DODM 8570 requirements will be met until full implementation of DODM 8140.03 requirements. Implementation dates for DOD Manual 8140.03 include a two-year timeline for personnel (civilian and military) in positions coded with cybersecurity work roles and three years for personnel (civilian and military) in positions coded with work roles in any other workforce element. The dates for required qualification would be 15 February 2025 for cybersecurity work roles and the same date in February 2026 for all Defense Cyber Workforce Framework work roles.

check_text:
  Check #1. Check to ensure there are appointment letters for all security staff members including the SM, AO, ISSM, ISSOs, System Administrators (SA), and Network Security Officers (NSO). (CAT III)

  Check #2. Check to ensure the appointments are current and an appropriate authority has made the appointments. (CAT III)

  Check #3. Check to ensure that pertinent duties, responsibilities, training/certification and other suitability requirements for the appointed positions are contained in the appointment order. (CAT III)

  Check #4. Check supporting documentation to ensure that security staff have been properly trained and certified for the positions to which they are appointed (e.g., IAM I, II or III for ISSM/ISSO) and that they meet all applicable requirements for the positions. For instance the AO and ISSM must be US Citizens. (CAT II) 

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments. Not applicable to a field/mobile environment.


vuln_id: V-245872
rule_id: SV-245872r1138483_rule
severity: CAT II
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Security Training - Information Security (INFOSEC) for ALL Employees; Military, Government Civilian and Contractor

description:
  <VulnDiscussion>Failure to provide security training to ALL employees results in a weak security program and could lead to the loss or compromise of classified or sensitive information.

  REFERENCES:

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  NIST Special Publication 800-53 (SP 800-53) 
  Controls: AT-1, AT-2, AT-3 and AT-4 

  DOD Manual 5200.01, Volume 1, 24 February 2012, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification 
  Encl 2, para 7.c., 7.d., 7.g., 9.f.; Encl 3, para 5.f.; Encl 4 para 10.c.; Encl 5, para 3.b. 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), 9 February 2011 
  Encl A, para 11; Encl B, para 4.h., 4.i., 6.m.; Encl C para 5., 7.f., 21.h.(2), 27e.(8)(d) and 31.b. 

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information 
  Enclosure 5</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Ensure initial and recurring (annual minimum) information security training is provided to each employee. 

  2. Ensure the following training topics are covered at a MINIMUM: 

  a. Classified Handling (physical (storage) security, transportation/transmission & marking of documents, equipment and media)
  b. Communications Security
  c. Computer (AKA: cybersecurity) Security requirements
  d. Counter-intelligence briefings
  e. Penalties for engaging in espionage activities
  f. Courier briefing (if applicable)
  g. Reporting of derogatory information
  h. Reporting of Security Incidents
  i. Security of Laptop computers when traveling
  j. Special access programs, NATO, COSMIC TS, etc. (as applicable)
  k. Use of personal computers for conducting official business          
  l. Concerns identified during Component self-inspections
  m. Procedures to be followed when using classified removable data storage media.
  n. Procedures to be followed if an individual believes an unauthorized disclosure of classified data has occurred on an information system or network (typically called a "data spill").   
  o. Ensure 100% of initial training and termination briefings are accomplished and at least 95% of employees have annual training. While 100% annual training is the goal, things like extended employee TDY or leave make this difficult to achieve.

  All training accomplished must be documented. Anything less will be a finding.

check_text:
  Check #1. Check that initial and recurring (minimum annually) information security is provided to each employee. 

  Check #2. Check to ensure the following training topics are covered. Some topics may not be necessary based on the organizations mission or other considerations. Reviewers should use discretion in determining if adequate training topics are covered: 

  a. Classified Handling (physical (storage) security, transportation/transmission & marking of documents, equipment and media)
  b. Communications Security
  c. Computer (AKA: cybersecurity) Security requirements
  d. Counter-intelligence briefings
  e. Penalties for engaging in espionage activities
  f. Courier briefing (if applicable)
  g. Reporting of derogatory information
  h. Reporting of Security Incidents
  i. Security of Laptop computers when traveling
  j. Special access programs, NATO, COSMIC TS, etc. (as applicable)
  k. Use of personal computers for conducting official business          
  l. Concerns identified during Component self-inspections
  m. Procedures to be followed when using classified removable data storage media.
  n. Procedures to be followed if an individual believes an unauthorized disclosure of classified data has occurred on an information system or network (typically called a "data spill"). 
     
  Check #3. Check records of employee training and ensure 100% of initial training briefings are accomplished and at least 95% of employees have completed annual training. Note that while 100% completion of annual training is the goal, employees on extended leave. TDY or other circumstances make this a difficult thing to accomplish. 

  All training accomplished must be documented. Anything less will be a finding. 

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments. Not applicable to a field/mobile environment.


vuln_id: V-245873
rule_id: SV-245873r770281_rule
severity: CAT III
title: Counter-Intelligence Program - Training, Procedures and Incident Reporting
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to establish a good working relationship with the supporting/local CI agency and lack of proper CI training for site/organization employees could result in not being informed of local threats and warnings leaving the organization vulnerable to the threat and/or a delay in reporting a possible incident involving  reportable FIE-Associated Cyberspace Contacts, Activities, Indicators, and Behaviors, which could adversely impact the Confidentiality, Integrity, or Availability (CIA) of the DISN.

  REFERENCES:

  DoDD 5240.06, Counterintelligence Awareness and Reporting (CIAR), 17 May 11, Incorporating Change 2, July 21, 2017 
  Enclosure 3 and Enclosure 4. para 4.a.

  Satisfies: Counter-Intelligence Program - Training, Procedures and  Incident Reporting</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Background Information:

  It is DoD policy that:
  a. Initial and annual CI awareness and reporting (CIAR) training on the foreign intelligence entity (FIE) threat, methods, reportable information, and reporting procedures shall be provided to DoD personnel as outlined in Enclosure 3 of DoDD 5240.06, 17 May 11 .
  b. Potential FIE threats to the DoD, its personnel, information, materiel, facilities, and
  activities, or to U.S. national security shall be reported by DoD personnel in accordance with
  Enclosure 4 of DoDD 5240.06.
  c. Failure to report FIE threats as identified in paragraph 3.a and section 5 of Enclosure 4 of
  DoDD 5240.06 may result in judicial or administrative action or both pursuant to applicable law or policy.

  Fixes:

  Ensure all assigned site/organization personnel have received both initial and annual CIAR training in accordance with DoDD 5240.06.  Further, ensure there are procedures for reporting possible threat information and that local threat assessments and warnings received are properly shared with the work force.

check_text:
  Background Information:

  It is DoD policy that:
  a. Initial and annual CI awareness and reporting (CIAR) training on the foreign intelligence entity (FIE) threat, methods, reportable information, and reporting procedures shall be provided to DoD personnel as outlined in Enclosure 3 of DoDD 5240.06, 17 May 11 .
  b. Potential FIE threats to the DoD, its personnel, information, materiel, facilities, and
  activities, or to U.S. national security shall be reported by DoD personnel in accordance with
  Enclosure 4 of DoDD 5240.06.
  c. Failure to report FIE threats as identified in paragraph 3.a and section 5 of Enclosure 4 of
  DoDD 5240.06 may result in judicial or administrative action or both pursuant to applicable law or policy.

  Checks:

  Check #1. Check to ensure all assigned site/organization personnel have received both initial and annual CIAR training in accordance with DoDD 5240.06.  

  Check #2. Check to ensure there are procedures for reporting possible threat information and that local threat assessments and warnings received are properly shared with the work force.

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments.  Not applicable to a field/mobile environment.


vuln_id: V-245740
rule_id: SV-245740r1138407_rule
severity: CAT II
title: Protected Distribution System (PDS) Monitoring - Daily (Visual) Checks
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>A PDS that is not inspected, monitored and maintained as required could result in undetected access, sabotage or tampering of the unencrypted transmission lines. This could directly lead to the loss or compromise of classified.

  REFERENCES: 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 35.c.

  32 CFR 117 and CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 4, para 3.b. and 4.a.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-4, SC-7, SC-8, IR-4, and IR-6

  CNSSI No. 7003, September 2015, Protected Distribution Systems (PDS), Section VIII, paragraphs 23.c. & 24., Section XI, paragraphs 31, 32, 33 and 34.a. (1) & (2) and Table 3. Visual Inspection Schedule.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  A PDS carrying SIPRNet cable is subject to periodic visual inspections IAW (Table 3. Visual Inspection Schedule, of CNSSI 7003). To correct this finding visual checks of PDS must be completed on a continuing basis as follows: 

  1. At least one daily inspection of the PDS line must be conducted, or more frequently if required by Table 3. 

  2. A log must be maintained of the PDS inspections. The log must contain the date of the inspection, the time of the inspection, the inspector's name, and the inspector's title. The log must be kept on record for a minimum of one year. 

  3. Person(s) must be formally appointed (in writing) to conduct the visual inspections. 

  4. The person(s) appointed to accomplish the visual inspection must be trained sufficiently to recognize physical changes in PDS including attempts at penetration and tampering.

  5. That visual PDS inspections as detailed in Table 3 are conducted 365 days a year. 

  NOTES: 

  Visual inspections are not absolutely required for portions of PDS traversing a Secret or higher CAA but may be required by the AO.

  In a tactical environment periodic visual checks are not applicable for Continuously Viewed Carriers since they are under continuous observation, 24 hours per day (including when operational). This check for visual inspections is only applicable to tactical environments where Hardened Carriers - versus Continuously Viewed Carriers - are used.

check_text:
  A PDS carrying SIPRNet cable is subject to periodic visual inspections IAW (Table 3. Visual Inspection Schedule, of CNSSI 7003). Check to ensure:
   
  1. At least one daily inspection of the PDS line is conducted or more frequently if required by Table 3. 

  2. A log is maintained of the PDS inspections. The log must contain the date of the inspection, the time of the inspection, the inspector's name, and the inspector's title. The log must be kept on record for a minimum of one year. 
   
  3. Person(s) are formally appointed (in writing) to conduct the visual inspections.  

  4. The person(s) appointed to accomplish the visual inspection are trained sufficiently to recognize physical changes in PDS including attempts at penetration and tampering. 

  5. That visual PDS inspections as detailed in Table 3 are conducted 365 days a year. 

  NOTES: 

  Visual inspections are not absolutely required for portions of PDS traversing a Secret or higher CAA but may be required by the AO.

  In a tactical environment periodic visual checks are not applicable for Continuously Viewed Carriers since they are under continuous observation, 24 hours per day (including when operational). This check for visual inspections is only applicable to tactical environments where Hardened Carriers - versus Continuously Viewed Carriers - are used.


vuln_id: V-245748
rule_id: SV-245748r1138415_rule
severity: CAT II
title: Environmental IA Controls - Emergency Power
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to have alternative power sources available can result in significant impact to mission accomplishment and information technology systems including potential loss of data and damage to the IT equipment during a commercial power service outage.

  REFERENCES:

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-11 and PE-11(1) & (2)

  NIST SP 800-12, An Introduction to Computer Security: The NIST Handbook

  NIST SP 800-100, Information Security Handbook: A Guide for Managers</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  A short-term uninterruptible power supply must be installed to facilitate an orderly shutdown of the information system and transition of the information system to longer-term alternate power (if available) in the event of a primary power source loss.
   
  Additionally, the need for additional short term or long term alternative power sources such as use of a secondary commercial power supply or use of one or more generators with sufficient capacity to meet the needs of the organization must be considered in the organizations Holistic Risk Assessment; when such alternative sources of power are actually not available.

check_text:
  Check that alternate sources of power are available for key IT system assets. Specifically check that both of the following requirements are complied with:

  A short-term uninterruptible power supply is available to facilitate an orderly shutdown of the information system and transition of the information system to longer-term alternate power (if available) in the event of a primary power source loss. (CAT II)

  The need for additional short term or long term alternative power sources such as use of a secondary commercial power supply or use of one or more generators with sufficient capacity to meet the needs of the organization have been considered in the organizations Holistic Risk Assessment; when such alternative sources of power are not available. (CAT III)

  NOTES:
   
  1. In general rule application will be for major computing centers with raised floor space. The requirement should not be applied to administrative/office space. This requirement should also not be applied to a tactical environment, unless it is a fixed computer facility supporting missions in a Theater of Operations. The standards to be applied for applicability in a tactical environment are: 1) The facility containing the computer room has been in operation over 1-year. 2) The facility is "fixed facility" - a hard building made from normal construction materials - wood, steel, brick, stone, mortar, etc.

  2. It is not necessary for the risk assessment to specifically address the need for long term alternative power if it is actually available at the site.


vuln_id: V-245800
rule_id: SV-245800r1138545_rule
severity: CAT I
title: Information Security (INFOSEC) - Vault Storage/Construction Standards
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to meet standards IAW the DOD Manual 5200.01, Volume 3, Appendix to Enclosure 3, for ensuring that there is required structural integrity of the physical perimeter surrounding a classified storage vault could result in the undetected loss or compromise of classified material.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraphs 24.j. and 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  MP-4, PE-3 and PE-5

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Appendix to Encl 3, para 1.a.(1) & (2).

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Vaults containing inspectable SIPRNet as well as other classified assets must have documented confirmation from supporting Facility Engineers to ensure each is built to the following standards:

  1. As a Class A vault (concrete poured-in-place) built to Federal Standard (FED STD) 832 and specifically check/validate the following:
   
  a. Floor and Walls. Eight inches of reinforced concrete. Walls are to extend to the underside of the roof slab above.
   
  b. Roof/True Ceiling. Monolithic reinforced-concrete slab of thickness to be determined by structural requirements, but not less than the floors and walls.
   
  c. Class 5 Vault Door and Frame and be fitted with an FF-L-2740 combination lock. The vault door and frame unit must conform to Federal Specification AA-D-600 Class 5 vault door with lock meeting Federal Specification FF-L-2740. It cannot be an armory vault door, which should have a GSA label (silver with red letters) stating that it is a "GSA Approved Armory Vault Door". AN ARMORY DOOR IS NOT APPROVED FOR CLASSIFIED STORAGE - AA&E STORAGE ONLY. The "proper" security vault door label must read: "GSA Approved Security Vault Door" (label also silver with red letters). The difference between the two doors is that armory vault doors are fitted with Federal Specification FF-L-2937 mechanical combination locks.
   
  2. As a Class B vault (GSA-approved modular vault) meeting Federal Specification AA-V-2737, Modular Vault Systems, April 25, 1990, with Amendment 2, October 30, 2006.

  Facility Engineer (FE) construction certificates or other documentation must be available to ensure construction standards are met. Often these certificates are posted on the inside of the vault near the door but can be on file elsewhere at the site.

check_text:
  For vaults containing inspectable SIPRNet as well as other classified systems assets check with supporting Facility Engineers to ensure it is properly constructed IAW one of the following two specifications:

  1. As a Class A vault (concrete poured-in-place) built to Federal Standard (FED STD) 832 and specifically check/validate the following:
   
  a. Floor and Walls. Eight inches of reinforced concrete. Walls are to extend to the underside of the roof slab above.
   
  b. Roof/True Ceiling. Monolithic reinforced-concrete slab of thickness to be determined by structural requirements, but not less than the floors and walls.
   
  c. "True" vaults must have a Class 5 Vault Door and Frame and be fitted with an FF-L-2740 combination lock. The vault door and frame unit must conform to Federal Specification AA-D-600 Class 5 vault door with lock meeting Federal Specification FF-L-2740. Ensure it is not an armory vault door, which should have a GSA label (silver with red letters) stating that it is a "GSA Approved Armory Vault Door". AN ARMORY DOOR IS NOT APPROVED FOR CLASSIFIED STORAGE - AA&E STORAGE ONLY. The "proper" security vault door label reads "GSA Approved Security Vault Door" (label also silver with red letters). The difference between the two doors is that armory vault doors are fitted with Federal Specification FF-L-2937 mechanical combination locks. Facility Engineer (FE) construction certificates or other documentation should be requested to ensure construction standards are met. Often these certificates are posted on the inside of the vault near the door.

  2. As a Class B vault (GSA-approved modular vault) meeting Federal Specification AA-V-2737, Modular Vault Systems, April 25, 1990, with Amendment 2, October 30, 2006.

  NOTE: 
  Here again, normally FE certification documentation will be posted within the vault, but it is OK if such documentation is on file elsewhere at the site.
   
  The DOD Lock Program Web Portal provides detailed specifications for vaults and ordering instructions for doors. Available through DOD Lock Program at:

  https://exwc.navfac.navy.mil/DOD-Lock-Program/
   
  TACTICAL ENVIRONMENT: This check is applicable where vaults are used to protect classified materials or systems in a tactical environment.


vuln_id: V-245802
rule_id: SV-245802r1138440_rule
severity: CAT I
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Information Security (INFOSEC) - Secure Room Storage Standards - Balanced Magnetic Switch (BMS) on Perimeter Doors

description:
  <VulnDiscussion>Failure to meet standards for ensuring that there is structural integrity of the physical perimeter surrounding a secure room (AKA: collateral classified open storage area) IAW DOD Manual 5200.01, Volume 3 could result in the undetected loss or compromise of classified material. When a physical Intrusion Detection System (IDS) is used as the supplemental protection measure (in lieu of 4-hour random checks) for secure rooms there is a requirement to place a Balanced Magnetic Switch (BMS) alarm contact on the primary ingress/egress door and any secondary/emergency exit doors. This alarm sensor is an essential part of any properly installed IDS and ensures that doors opened by force or that are left open are immediately detected. A BMS (AKA: triple biased alarm contact) is the most difficult door alarm contact to defeat and must be used in lieu of dual biased or simple alarm contacts.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraphs 24.j. and 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  MP-4, PE-3, PE-5 and PE-6

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Appendix to Enclosure 3, paragraph 2.e.(4).

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Where an IDS is used in lieu of four-hour random checks for secure rooms or collateral classified open storage areas containing SIPRNet as well as other classified systems assets, each perimeter door (primary and secondary) must be protected by a balanced magnetic switch (BMS) that meets the standards of UL 634. 

  NOTE: The alarm contact must be an actual BMS, which is defined as a "Triple Biased" alarm contact. Introduction of a foreign magnet by an intruder in an attempt to defeat the BMS will result in an alarm being sent. Simple and Dual Biased contacts are not BMS and will result in a finding.

check_text:
  Where an IDS is used in lieu of 4-hour random checks, for secure rooms or collateral classified open storage areas containing SIPRNet as well as other classified systems assets, each perimeter door (primary and secondary) shall be protected by a balanced magnetic switch (BMS) that meets the standards of UL 634. 

  NOTE: Ensure the alarm contact is an actual BMS, which is defined as a "Triple Biased" alarm contact. Introduction of a foreign magnet by an intruder in an attempt to defeat the BMS will result in an alarm being sent. 

  If used, Simple and Dual Biased contacts are not BMS and will result in a CAT II finding. 

  No alarm contacts on all doors is a CAT I finding.
                 
  TACTICAL ENVIRONMENT: This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245803
rule_id: SV-245803r1136676_rule
severity: CAT I
title: Information Security (INFOSEC) - Secure Room Storage Standards - Interior Motion Detection
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to meet standards for ensuring that there is structural integrity of the physical perimeter surrounding a secure room (AKA: collateral classified open storage area) IAW DOD Manual 5200.01, Volume 3 could result in the undetected loss or compromise of classified material. Motion detection located interior to secure rooms provides the most complete/overarching coverage of any Intrusion Detection System (IDS) alarm sensor. While most sensors like BMS alarm contacts, glass break detectors, etc. are only able to detect potential intrusion at specific locations, use of motion detection provides a capability to protect large areas with "blanket coverage" generally using fewer sensors.

  Principles and considerations for "ideal" employment of motion sensors are:

  - Consolidate critical assets in specific areas versus throughout a large room or facility. For instance rather than having classified servers and equipment in multiple locations in a five-story facility (entirely designated for classified open storage) consolidate classified assets on a single floor or even an area on that floor. That might allow for reducing the space designated as classified open storage (AKA: secure room) and reduce costs and simplify protection of assets. 

  - Conversely some would argue that dispersing assets over a larger area enhances security by not putting all critical assets in one place. This is true to an extent - especially if we are considering redundant assets for COOP / disaster recovery but most often the reason for dispersing classified assets over large comes down to lack of foresight and planning.

  - Cover avenues of approach in layers so you can detect initial breeches of secured space and subsequent movement within. This approach is actually very good if you have a timely response force available and you are protecting a large facility.

  - Cover perimeter access points such as doors, windows, and openings greater than 96 sq. inches. Use of point sensors (BMS, vibration, etc., are probably best in these situations but supplementation by motion can be extremely effective.

  - Cover areas that cannot be directly observed by employees from within or directly outside the protected space. For instance in a secure room/area this might include areas above suspended ceilings, below raised floors, behind major pieces of equipment or other things that cause significant obstruction of visual observation (especially along avenues of approach or along perimeter walls).

  - Cover large open areas by careful placement of motion detection. Combinations of 360-degree and wall-mounted detectors considering equipment racks, walls, avenues of approach, etc. can effectively cover larger areas with fewer sensors.

  - Complete coverage of large areas and all avenues of approach is ideal but often funds are limited and sensors cannot be employed to provide blanket coverage. In such instances there are two approaches that can be used:

    * One is to cover the most critical assets directly (e.g., classified DODIN servers, routers, DASD and other major IT technology).

    * Second approach is to conduct an assessment of the space to determine the most effective employment of limited sensors considering both avenues of approach and the actual location of critical assets in the space.  

  NOTE: The second approach can be incorporated under the process of conducting a risk assessment and in conjunction with a determination and approval of security-in-depth countermeasures from the Senior Agency Official (SAO). This risk-based approach is based directly on requirements from the DOD Manual 5200.01, V3 and is in line with the current direction DOD is taking with regard to management of risk. 

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraphs 24.j. and 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  MP-4, PE-3, PE-5 and PE-6

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Appendix to Enclosure 3, paragraph 1.b.(4)(a) and 2.e.(3) & (5).

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Compliance with the following two considerations is required where an IDS is used in lieu of four-hour random checks for secure rooms or collateral classified open storage areas containing SIPRNet as well as other classified systems assets:

  1. Where IDS is being used BUT there is NO RISK ASSESSMENT approved by the Component Authorizing Official (AO) and/or a SECURITY-IN-DEPTH DETERMINATION *IN WRITING by the CC/S/A Senior Agency Official (SAO) (Security/INFOSEC) that specifically addresses the secure room or open storage space OR the risk assessment does not specifically provide for a detailed evaluation of the need for motion sensor employment, including a thorough assessment of the most effective and efficient methods for employment of motion detection:

  Secure rooms or areas where classified SIPRNet equipment and/or associated media is stored in the open must be protected with interior motion detection sensors; e.g., ultrasonic and passive infrared when the specific area containing the classified material is closed or not under continuous observation and control of a cleared employee. 

  Use of dual technology is authorized when one technology transmits an alarm condition independently from the other technology. A failed detector shall cause an immediate and continuous alarm condition.

  Employment of motion detectors need not cover 100 percent of the entire secure room space (although that is recommended) but shall minimally (directly) cover any SIPRNet assets (equipment or media) that are accessible (not stored within a GSA-approved container [safe]) within the secure room or area. 

  2. At a minimum, all SIPRNet connected equipment must be directly covered by motion sensors OR motion sensors must be employed in the secure room space as "specifically detailed" in the risk assessment, which is approved by the Component Authorizing Official (AO).

  Unless adequately detailed in the risk assessment, motion detectors placed to cover only doors that are protected with BMS alarm contacts are not sufficient to meet this requirement/check.

check_text:
  The following applies where IDS is used in lieu of 4-hour random checks, for secure rooms or collateral classified open storage areas containing SIPRNet as well as other classified systems assets:

  Checks:
  1. Check at sites where IDS is being used and:

    - There is NO RISK ASSESSMENT approved by the Component Authorizing Official (AO) or

    - The risk assessment does not specifically provide a detailed evaluation of the need for motion sensor employment, including a thorough assessment of the most effective and efficient methods for employment of motion detection and/or

    - There is NO SECURITY-IN-DEPTH DETERMINATION *IN WRITING by the CC/S/A Senior Agency Official (SAO)(Security/INFOSEC) that considers factors contained in the risk assessment and specifically focuses on the collateral classified secure room/open storage space:

  Check to ensure that secure rooms or areas where classified SIPRNet equipment and/or associated media is stored in the open is protected with interior motion detection sensors; e.g., ultrasonic and passive infrared, during times when the specific area containing the classified material is closed or not under continuous observation and control by a cleared employee. 

  Use of dual technology sensors is authorized when one technology transmits an alarm condition independently from the other technology. A failed detector shall cause an immediate and continuous alarm condition. 

  Employment of motion detectors need not cover 100% of the entire secure room space (although that is recommended) but shall minimally (directly) cover any SIPRNet assets (equipment or media) that are accessible (not stored within a GSA approved container (safe)) within the secure room or area.

  2. Where a proper risk assessment signed by the AO, which specifically considers both the number and employment (positioning) of motion sensors in the secure room space and a supporting Security-in-Depth Determination signed by the SAO are both available:

  Check that motion sensors are either employed to directly cover all areas within the secure room containing SIPRNet assets OR that motion sensors are employed in the secure room space as specifically detailed in the risk assessment.

  NOTE: Unless adequately detailed and justified in the risk assessment, motion detectors placed to cover only doors that are protected with BMS alarm contacts are not sufficient to meet this requirement/check. 

  TACTICAL ENVIRONMENT: This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245804
rule_id: SV-245804r1136679_rule
severity: CAT I
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Information Security (INFOSEC) - Secure Room Storage Standards - Four (4) Hour Random Checks in Lieu of Using Intrusion Detection System (IDS)

description:
  <VulnDiscussion>Failure to meet standards for ensuring that there is structural integrity of the physical perimeter surrounding a secure room (AKA: collateral classified open storage area) IAW DOD Manual 5200.01, Volume 3 could result in the undetected loss or compromise of classified material.

  Using a physical intrusion detection system enables immediate detection of attempted and/or actual intrusion into a secure room space. This is often the best supplemental protective measure (vice using 4-hour random checks) due to providing capability for immediate detection, and for immediate response to assess and counter the threat to the secure room space. Use of 4-hour checks may be adequate if supported by a risk assessment, but will not provide the immediate detection and response capability of a properly installed IDS. It is required that a risk assessment be conducted to determine which of the two intrusion detection methods (use of IDS OR 4-hour random checks) is appropriate for any particular location. If the risk assessment results in a determination that use of 4-hour random checks is the most cost efficient supplemental control (vice IDS) to protect SIPRNet as well as other classified systems assets contained in secure rooms, the manner in which the checks are conducted can greatly impact the effectiveness of the checks. Thorough physical checks conducted on a frequent basis can reduce the time between an attempted or actual intrusion and time of discovery - during random checks. 

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraphs 24.j. and 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  MP-4, PE-3, PE-5 and PE-6

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Enclosure 3, paragraph 3.b.(3)(a) and 4.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Background:

  This requirement is concerned with using random checks as the required supplemental control of secure room/collateral classified open storage area space (containing SIPRNet as well as other classified systems assets) instead of IDS. 

  Fixes:

  1. Use of random checks in lieu of IDS must be supported by a valid risk assessment (addressing each secure room or area) that specifically considers the threat, vulnerabilities, security-in-depth countermeasures, acceptability of risk, potential cost savings, procedural requirements, and potential cost of additional manpower associated with random checks of the secure areas as an alternative to IDS. 

  2. The frequency of random checks must not exceed four hours when the secure area space is not attended. 

  3. Checks must be conducted by guards/employees who are cleared to at least the Secret level. 

  4. Checks must be conducted of each door (primary and all secondary), each window, and each opening exceeding 96 square inches (which are required to be protected with bars, expanded metal grills, or commercial metal sounds baffles) to ensure they are properly secured. Additionally, all traversable space surrounding the exterior of the Secure Room must be viewed by the checker by walking around the entire perimeter. 

  5. Checks must be supported by written procedures/instructions for the checkers and results of checks must be recorded. 

  6. Locally developed checklists or the Standard Form (SF) 701 must be used to document checks. Completed checklists should be maintained on-hand for at least 90 days as an audit trail or indefinitely if discrepancies were noted during any checks.

  It is important to note that random checks are an allowable alternative to IDS *ONLY* if supported by a valid risk assessment AND security-in-depth countermeasures as determined in writing by the CC/S/A senior agency official (SAO)(INFOSEC). Not meeting this requirement will result in a finding. 

  Use of IDS and risk analysis are each covered as separate checks elsewhere in this document.  

  This particular requirement (random checks of secure rooms) is Not Applicable (NA) if IDS is used.

  In summary, this requirement is intended to implement and validate that random checks not exceeding four hours are being used AND are supported by a valid risk assessment along with security-in-depth countermeasures.

check_text:
  Background:

  This check is concerned with using random checks as the required supplemental control of secure room/collateral classified open storage area space (containing SIPRNet as well as other classified systems assets) - instead of IDS. 

  Checks:

  Check #1. Use of random checks in lieu of IDS must be supported by a valid risk assessment (addressing each secure room or area) that specifically considers the threat, vulnerabilities, security-in-depth countermeasures, acceptability of risk, potential cost savings, procedural requirements, and potential cost of additional manpower associated with random checks of the secure areas - as an alternative to IDS. 

  Check #2. The frequency of random checks shall not exceed 4-hours when the secure area space is not attended. 

  Check #3. Checks must be conducted by guards/employees who are cleared to at least the Secret level. 

  Check #4. Checks will be conducted of each door (primary and all secondary), each window, and each opening exceeding 96 square inches (which are required to be protected with either bars, expanded metal grills, commercial metal sounds baffles) to ensure they are properly secured. Additionally all traversable space surrounding the exterior of the Secure Room should be viewed by the checker by walking around the entire perimeter. 

  Check #5. Checks must be supported by written procedures/instructions for the checkers and results of checks must be recorded. 

  Check #6. Locally developed checklists or the Standard Form (SF) 701 must be used to document checks. Completed checklists should be maintained on-hand for at least 90-days as an audit trail or indefinitely if discrepancies were noted during any checks.

  It is important to note that random checks are an allowable alternative to IDS *ONLY* if supported by a valid risk assessment AND security-in-depth countermeasures as determined in writing by the C/S/A senior security official. Otherwise this is a finding. 

  Use of IDS and risk analysis are each covered as separate checks elsewhere in this document.  

  This particular check (random checks of secure rooms) is Not Applicable (NA) if IDS is used. 

  In summary this check must validate that random checks not exceeding 4-hours are being used AND that it is supported by a valid risk assessment along with security-in-depth countermeasures.              

  TACTICAL ENVIRONMENT: This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245805
rule_id: SV-245805r1136682_rule
severity: CAT I
title: Vault/Secure Room Storage Standards - IDS Transmission Line Security
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to meet standards for ensuring integrity of the intrusion detection system signal transmission supporting a secure room (AKA: collateral classified open storage area) containing SIPRNet assets as well as other classified systems assets could result in the undetected loss or compromise of classified material.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  MP-4, PE-3, PE-5 and PE-6

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Appendix to Enclosure 3, paragraph 2.d.(1) and (2).

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Explanation of requirement:

  Transmission lines used to carry IDS sensor alarm signals between secure rooms or areas containing SIPRNet as well as other classified systems assets and IDS monitoring equipment shall have line supervision.

  If all portions of an IDS transmission line (protecting SIPRNet assets as well as other classified systems) are run within secret or higher secure area space or secret or higher controlled access area (CAA) spaces, it will not require line supervision. 
   
  Fix:

  Class I or Class II line supervision must be used IAW DOD Manual 5200.01 for protection of IDS transmission line signals, with the exception of portions of the transmission line running entirely through spaces or areas where unescorted access is controlled to at least the Secret level. 

  In summary, if portions of the transmission line run through spaces or areas where unescorted access is not controlled to at least the Secret level, this requires line supervision. 

  Verification of line supervision can be obtained by viewing IDS specifications from the vendor or by conducting a controlled test of a transmission line/signal.

check_text:
  Explanation of requirement:

  Transmission lines used to carry IDS sensor alarm signals between secure rooms or areas containing SIPRNet as well as other classified systems assets and IDS monitoring equipment, shall have line supervision.

  If all portions of an IDS transmission line (protecting SIPRNet as well as other classified systems assets) are run within secret or higher secure area space or secret or higher controlled access area (CAA) spaces it will not require line supervision. 
   
  Check:

  Check that Class I or Class II line supervision is being used IAW DOD Manual 5200.01, with the exception of portions of the transmission line running entirely through spaces or areas where unescorted access is controlled to at least the Secret level. 

  In summary, if portions of the transmission line run through spaces or areas where unescorted access is not controlled to at least the Secret level - it will require line supervision. 

  The check and verification of line supervision can be obtained by viewing IDS specifications from the vendor, or by conducting a controlled test of a transmission line/signal.

  TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245806
rule_id: SV-245806r1136685_rule
severity: CAT I
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Vault/Secure Room Storage Standards - IDS Access/Secure Control Units Must be Located within the Secure Room Space

description:
  <VulnDiscussion>Failure to ensure that IDS Access and Secure Control Units used to activate and deactivate alarms (primarily motion detectors) within vaults or secure rooms protecting SIPRNet as well as other classified assets are not located within the confines of the vault or secure room near the primary ingress/egress door could result in the observation of the access/secure code by an unauthorized person. Further the control units would be more exposed with a greater possibility of tampering outside the more highly protected space of a secure room/collateral classified open storage area. This could result in the undetected breach of secure room space and the loss or compromise of classified information or materials.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  PE-3, PE-5 and PE-6

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Appendix to Enclosure 3, paragraph 2.e.(2).

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  No capability must exist to allow for changing the access/secure status of the IDS from a location outside the protected area (secure room or vault). Alarm sensor control units must be located inside the secure area and should be located near the primary entrance for ease of accessing and securing alarm sensors in the space. Only assigned personnel with proper security clearances and need-to-know should initiate changes in access and secure status.

check_text:
  Requirement Explanation:

  Alarm sensor control units must be located inside the secure area and should be located near the primary entrance for ease of accessing and securing alarm sensors in the space. 

  Only assigned personnel with proper security clearances and need-to-know should initiate changes in access and secure status.

  Check:

  Check to ensure that no capability exists to allow changing the access/secure status of the IDS from a location outside the protected area (secure room or vault). 
               
  TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245808
rule_id: SV-245808r1136691_rule
severity: CAT I
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Vault/Secure Room Storage Standards - Access Control During Working Hours Using Visual Control OR Automated Entry Control System (AECS) with PIN / Biometrics

description:
  <VulnDiscussion>Failure to properly monitor and control collateral classified open storage area access doors during working hours (while the FF-L-2740 combination lock is not secured) could result in an undetected perimeter breach and limited or no capability to immediately notify response forces. Ultimately this could result in the undetected loss or compromise of classified material.

  Entrances to secure rooms or areas (and/or vaults that are opened for access) must be under visual control at all times during duty hours to prevent entry by unauthorized personnel . This may be accomplished by several methods (e.g., employee work station, guard, continuously monitored CCTV). 

  An automated entry control system (AECS) may be used to control admittance during working hours instead of visual control, if it meets certain criteria * and if the room or area is continuously occupied by at least one properly cleared person.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraphs 24.j. and 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: MP-4, PE-2, PE-3, PE-5 and PE-6

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Enclosure 3, paragraph 12 and Appendix to Enclosure 3, paragraphs 3.a. and 3.c.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  *If use of visual control methods is the primary means to control access during duty hours, use the following three fixes to comply with requirements:

  1. All possible primary or secondary entrances to vaults or secure rooms must be continuously monitored by cleared employees or guards (inside or outside the room or area) or by CCTV, whenever the FF-L-2740 combination lock is disengaged for daytime or other routine access.   

  2. If CCTV is used it must send real time images to a continuously manned monitoring station. 

  3. Access to a continuously (visually) monitored vault, secure room or collateral classified open storage area must be controlled by an Automated Entry Control System (AECS) using coded cards or badges (biometrics or PIN are not required) or by electric, mechanical or electro-mechanical access control devices to limit access during duty hours. 

  **If use of an Automated Entry Control System (AECS) is used to control access (without use of any authorized visual control methods), use the following seven fixes to comply with requirements:

  1. The vault, secure room or area must be continuously occupied by at least one properly cleared employee during working hours (when the FF-L-2740 combination lock is not engaged).

  2. The AECS must identify individuals and authenticate the person's authority to enter the area through the use of a coded identification (ID) badge or card. 

  3. In addition to the swipe or proximity card or badge a personal identification number (PIN) must be used. This is required WHEN VISUAL (MONITORING) CONTROLS of the entrance ARE NOT USED during working hours. 

  4. The PINs must be separately entered into the system by each individual using a keypad device and consist of four or more digits, randomly selected, with no known or logical association with the individuals.
   
  5. There must be a procedure in place to cover changing PINs when it is believed they have been compromised or subjected to compromise. 

  6. Biometrics Devices, which identify an individual requesting access by some unique personal characteristic, such as Fingerprinting, Hand Geometry, Handwriting, Retina scans, or Voice recognition may be used in conjunction with an ID badge or card in lieu of a PIN. 

  7. VERY IMPORTANT: Electric, mechanical or electro-mechanical access control devices such as Cipher locks MUST NOT BE USED to control access to secure rooms or areas that are not under continuous visual control during working hours. Generally these locks do not provide the means for individual access codes and do not report to a central server or system monitor. Therefore they are permissible ONLY for access control to secure rooms and spaces when the entrance is under continuous visual control.

check_text:
  Background Information and Requirements Summary: 

  1. The FF-L-2740 combination lock securing the primary access door for vaults and secure rooms (AKA: collateral classified open storage areas) may be opened at the beginning of normal duty hours and left unlocked for frequent employee access only if the entrance is properly monitored and controlled. The combination lock will be secured at the end of normal duty hours and interior motion alarms (if used) activated. 

  2. Entrances to vaults, secure rooms or collateral classified open storage areas must be under visual control at all times during duty hours to prevent entry by unauthorized personnel.

  3. An automated access control system (AECS) may be used to monitor and control admittance during working hours instead of visual control, if it consists of a swipe or proximity coded card and reader, supplemented by the use of a Personal Identification Number (PIN) or by use of Biometric readers (fingerprints, retina scanner, etc.).  Additionally, the secure room or classified storage area must be occupied by cleared employees OR under direct visual control from just outside the room or area. Use of an Automated Entry Control System (AECS) alone may not be used to meet this standard. Use of an AECS to control and monitor access requires the room or area be occupied by at least one properly cleared person.

  4. Visual monitoring or control of secure room access points may be accomplished by several methods (e.g., employee work station, guard, "continuously monitored" CCTV). Employee monitoring may be conducted by cleared employees within the secure room space, who can observe all entrances or employees located just outside the secure room adjacent to an entrance may also "actively" monitor access. If CCTV is used to monitor, the CCTV cameras must cover all potential entrances and send real time images back to a continuously manned monitoring station.

  5. Regardless of the visual method used to monitor daytime access, a locking system for access control must still be used on the entrance to the secure area. The use of automated entry control systems,(AECS with coded ID cards or badges) is encouraged. Supplementing the coded (swipe or proximity) cards or badges with a PIN or biometrics is not required if the entrances are properly monitored by visual means. 

  6. Access to secure areas may also be controlled by electric, mechanical or electro-mechanical access control devices to limit access during duty hours, but only if the entrance is also under continuous visual control. 

  7. IMPORTANT NOTE: Electrically actuated locks (e.g., cypher, proximity card and magnetic strip card locks) do not afford by themselves the required degree of protection for classified information and must not be used as a substitute for the combination locks meeting Federal Specification FF-L-2740. 

  CHECKS:

  *If f visual control methods are the primary means to monitor and control access during duty hours, use the following three checks to evaluate:
   
  Check #1. Check to ensure that all possible primary or secondary entrances to vaults or secure rooms are continuously monitored by cleared employees or guards (inside or outside the room or area) or by CCTV, whenever the FF-L-2740 combination lock is disengaged for daytime or other routine access.   (CAT I)

  Check #2. Check to ensure that if CCTV is used it sends real time images to a continuously manned monitoring station. (CAT I)

  Check #3. If CCTV is used to visually monitor the secure room or area and / or guards or other personnel are not physically controlling access: Check to ensure that access to a continuously (visually) monitored vault, secure room or collateral classified open storage area is controlled either by an Automated Entry Control System (AECS) using coded cards or badges (biometrics or PIN are not required) or by electric, mechanical or electro-mechanical access control devices to limit access during duty hours. (CAT I)

  NOTE: Electric, mechanical or electro-mechanical access control devices may not be used to control access when the entrance(s) to the vault, secure room or area are not under continuous visual monitoring either directly by cleared employees at the entrance(s) or via CCTV. If using CCTV it must also be continuously monitored and recorded at an occupied monitoring station.

  **If an Automated Entry Control System (AECS) is used to control access (without use of any authorized visual control methods), use the following seven checks to evaluate:

  CHECKS:

  Check #1. Check to ensure the vault, secure room or area is continuously occupied by at least one properly cleared employee during working hours (when the FF-L-2740 combination lock is not engaged. (CAT I)

  Check #2. Check to ensure the AECS identifies individuals and authenticates the person's authority to enter the area through the use of a coded identification (ID) badge or card. (CAT I)

  Check #3. Check to ensure that in addition to the swipe or proximity card or badge - that a personal identification number (PIN) is used. This is required WHEN VISUAL (MONITORING) of the entrance IS NOT USED during working hours. (CAT II - when an AECS card and reader is used w/o PIN or biometrics) 

  Check #4. Check the PINs are separately entered into the system by each individual using a keypad device and consist of four or more digits, randomly selected, with no known or logical association with the individuals. (CAT II -only when an AECS with card and PIN is used) 

  Check #5. Check to ensure there is a procedure to cover changing PINs when it is believed they have been compromised or subjected to compromise. (CAT III) 

  Check #6. Biometrics Devices, which identify an individual requesting access by some unique personal characteristic, such as Fingerprinting, Hand Geometry, Handwriting, Retina scans, or Voice recognition may be used in conjunction with an ID badge or card in lieu of a PIN. (CAT II - when an AECS card and reader is used w/o PIN or biometrics)

  Check #7. VERY IMPORTANT: Check to ensure that electric, mechanical or electro-mechanical access control devices such as Cipher locks ARE NOT USED to control access to vaults, secure rooms or areas when entrances are not under continuous visual control during working hours. Generally these locks do not provide the means for individual access codes and do not report to a central server or system monitor. Therefore they are permissible ONLY for access control to vault, secure rooms and spaces when the entrance is under continuous visual control. (CAT I)

  TACTICAL ENVIRONMENT: These checks are applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245809
rule_id: SV-245809r1138546_rule
severity: CAT I
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Vault/Secure Room Storage Standards - Automated Entry Control System (AECS) and Intrusion Detection System (IDS) Head-End Equipment Protection: The physical location (room or area) containing AECS and IDS head-end equipment (server and/or work station/monitoring equipment) where authorization, personal identification or verification data is input, stored, or recorded and/or where system status/alarms are monitored must be physically protected.

description:
  <VulnDiscussion>Inadequate physical protection of Intrusion Detection System or Automated Entry Control System servers, data base storage drives, or monitoring work stations could result in unauthorized access to core system devices providing protection for classified vaults, secure rooms and collateral classified open storage areas. This could result in the loss of confidentiality, integrity or availability of system functionality or data. The impact of this would be possible undetected and unauthorized access to classified processing spaces; resulting in the loss or compromise of classified information or sensitive information such as personal data (PII) of persons issued access control cards or badges.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraphs 24.j. and 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: MP-4, PE-1, PE-2, PE-3, PE-6, PE-8 and PE-9.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Appendix to Enclosure 3, paragraphs 2.f.(2), 3.a(5). and 3.a.(6).

  DOD 5220.22-M (NISPOM), Incorporating Change 2, 18 May 2016, paragraphs 5-313. e. and 5-313 h.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. The physical location containing the primary IDS "head-end" equipment (server and/or work station/monitoring equipment) must be located in a continuously occupied location (e.g., guard monitoring station for alarms and CCTV). 

  2. The continuously occupied space must limit unescorted access to only those employees responsible for monitoring or controlling the IDS and/or AECS. Automated entry control system card/badge readers or cipher locks should be used to fulfill this requirement. 

  3. If not co-located with the IDS "head-end" equipment; the physical location containing the primary AECS "head-end" equipment must be located in a continuously occupied location OR protected minimally within a room with a BMS alarm contact on each door, window or opening and with interior motion detection sensors that are activated at the end of each duty day. 

  4. AECS system card readers with coded access cards or badges (not cipher locks or keyed locks) must be used to secure the doors to rooms protecting AECS "head-end" equipment that are not located within a continuously occupied location. 

  5. Alarms from sensors in the room protecting AECS "head-end" equipment must be monitored at the primary IDS monitoring location.  

  6. A secondary or supplemental AECS server/workstation or IDS data/monitoring workstation might not be located in a 24/7 occupied work space. In instances when AECS or IDS secondary head-end equipment is not continuously attended by employees responsible for monitoring or controlling it - it must be protected minimally within a room with a BMS alarm contact on each door, window or opening and interior motion detection sensors are installed and activated at the end of each duty day. 

  7. AECS system card readers with coded access cards or badges (not cipher locks or keyed locks) must be used to secure the doors to rooms protecting secondary IDS or AECS "head-end" equipment that are not located within a continuously occupied location. 

  8. Alarms from sensors in the room protecting secondary IDS or AECS "head-end" equipment must be monitored at the primary IDS monitoring location. 

  9. If 4-hour checks are used in lieu of IDS for vaults, secure rooms or collateral classified open storage areas; then 4-hour checks of the room or area used to house the (secondary) IDS and/or (primary/secondary) ACS "head-end" equipment may also be used. The use of 4-hour checks in lieu of IDS to protect (secondary) IDS and/or (primary/secondary) AECS "head-end" equipment must be based on a documented risk assessment. 

  10. If used, random checks (not to exceed 4-hours) of the room or area used to house the IDS or AECS "head-end" equipment must be documented and maintained on file for a minimum of 90 days.

check_text:
  Requirements Summary:

  Protection must be established and maintained for all component devices or equipment that constitute the automated entry control system (AECS) and/or the intrusion detection system (IDS) used to protect a vault, secure room or collateral classified open storage area, which contains SIPRNet as well as other classified systems assets. 

  In particular the physical location (room or area) containing AECS and IDS "head-end" equipment (server and/or work station/monitoring equipment) where authorization, personal identification or verification data is input, stored, or recorded and/or where system status/alarms are monitored must be protected.

  CHECKS: 

  Check #1. Check to ensure the physical location containing the primary IDS "head-end" equipment (server and/or work station/monitoring equipment) is in a continuously occupied location (e.g., guard monitoring station - for alarms and CCTV). (CAT I)

  Check #2. Check to ensure the continuously occupied space limits unescorted access to only those employees responsible for monitoring or controlling the IDS and/or AECS. Automated entry control system card/badge readers or cipher locks may be used to fulfill this requirement. (CAT II)

  Check #3. If not co-located with the IDS "head-end" equipment; check to ensure the physical location containing the primary AECS "head-end" equipment is in a continuously occupied location OR protected minimally within a room with a BMS alarm contact on each door, window or opening and with interior motion detection sensors that are activated at the end of each duty day. (CAT II)

  Check #4. Check to ensure that AECS system card readers with coded access cards or badges (not cipher locks or keyed locks) are used to secure the doors to rooms protecting AECS "head-end" equipment that are not located within a continuously occupied location. (CAT II)

  Check #5. Check to ensure that alarms from sensors in the room protecting AECS "head-end" equipment are monitored at the primary IDS monitoring location. (CAT II) 

  Check #6. A secondary or supplemental AECS server/workstation or IDS data/monitoring workstation might not be located in a 24/7 occupied work space. In instances when AECS or IDS secondary head-end equipment is not continuously attended by employees responsible for monitoring or controlling it - Check to ensure it is protected minimally within a room with a BMS alarm contact on each door, window or opening and interior motion detection sensors are installed and activated at the end of each duty day. (CAT I)

  Check #7. Check to ensure that AECS system card readers with coded access cards or badges (not cipher locks or keyed locks) are used to secure the doors to rooms protecting secondary IDS or AECS "head-end" equipment that are not located within a continuously occupied location. (CAT II)

  Check #8. Check to ensure that alarms from sensors in the room protecting secondary IDS or AECS "head-end" equipment are monitored at the primary IDS monitoring location. (CAT I)

  Check #9. If 4-hour checks are used in lieu of IDS for vaults, secure rooms or collateral classified open storage areas; then 4-hour checks of the room or area used to house the (secondary) IDS and/or (primary/secondary) AECS "head-end" equipment may also be used in lieu of an IDS. Check to ensure the use of 4-hour checks in lieu of IDS to protect (secondary) IDS and/or (primary/secondary) AECS "head-end" equipment is based on a documented risk assessment. (CAT II)

  Check #10. If used, check to ensure that random checks (not to exceed 4-hours) of the room or area used to house the IDS or AECS "head-end" equipment are documented and maintained on file for a minimum of 90 days. (CAT II)

  TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245810
rule_id: SV-245810r1136696_rule
severity: CAT II
title: Information Security (INFOSEC) - Secure Room Storage Standards - Structural Integrity Checks
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to ensure that there is structural integrity of the physical perimeter surrounding a secure room (AKA: collateral classified open storage area) IAW DOD Manual 5200.01, Volume 3 could result in the undetected loss or compromise of classified material.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraphs 24.j. and 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-3.(1) & (2), PE-6 (4).

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Glossary, Part II, Definitions: Security-in-Depth

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  BACKGROUND: This fix is concerned with ensuring there is periodic visual validation of structural integrity of secure room/collateral classified open storage area perimeters containing SIPRNet assets and associated media. It ensures that any breach or attempted breach of the walls, true floors, and true ceilings of a secure area (portions that are not readily visible) are discovered in a timely manner.

  In requirement #1 there are three different situations covered and each requires a different level of physical/visual validation for structural integrity. 
   
  Requirement #1. Structural integrity of secure rooms or spaces containing SIPRNet equipment must be validated in each situation as follows: 
   
  Situation #1 (No structural integrity checks required): If interior IDS (motion detection) is properly employed (directly covering all SIPRNet assets) within the secure room or collateral classified open storage space where classified SIPRNet assets are located AND under raised floor spaces (if applicable) AND above suspended ceiling spaces (if applicable), then no physical check for structural integrity is required. This is contingent upon the interior motion sensors being activated when the room is closed or unattended and the sensors working properly as determined by required checks of sensor functionality.
   
  Situation #2 (Checks required IAW written guidance from AO): If motion sensors are properly employed ONLY within the secure room space where classified assets are located, then a visual check of spaces below raised floors, above suspended ceilings, and anywhere else the perimeter of the secure area cannot be readily observed must be conducted IAW AO written guidance. The goal is to visually inspect all walls, true floor, and true ceiling perimeters for signs of breach or attempted breach.
   
  Situation #3 (Checks required IAW written guidance from AO): When random checks (not exceeding four hours) of secure rooms or open storage spaces are used in lieu of IDS, then the checks specified in situation #2 for above suspended ceilings and below raised floors must be conducted IAW AO written guidance. The increased frequency of checks is due to the significant vulnerability of the SIPRNet assets to undetected attack from portions of the perimeter that cannot be readily observed. NOTE: Physical inspection of the perimeter walls, floor, and ceiling can be greatly expedited and may be conducted without ladders or other equipment where there are no false/suspended ceilings and/or raised floors within or surrounding the secure room or area.
   
  NOTE: If the entire perimeter of the secure room or area is surrounded by a secret or top secret (TS) Controlled Access Area (CAA), the frequency of structural integrity checks may be reduced to once every two weeks. This is due to the increased security-in-depth provided by the CAA. A secret or TS CAA is an area where unescorted access is granted only to individuals who have a secret or higher security clearance. All others are escorted by cleared employees. The DOD does not provide specific physical security requirements for a CAA but allows each CC/S/A Senior Agency Official (SAO) for Information Security the authority to establish such standards. All the Services have established standards for CAAs within their Protected Distribution System (PDS) implementing guidelines. Minimally, all require some form of access control methodology (AECS/guards/reception, etc.) be in place to ensure only properly vetted and cleared personnel have unescorted access to a CAA.

  Requirement #2. There must be written procedures developed for the checks and the checks must be documented and maintained on file for a minimum of 90 days. Where discrepancies (holes in perimeter or other signs of successful or attempted access) are noted, these checks will be maintained indefinitely or until an inquiry determines the cause of the discrepancy.

check_text:
  BACKGROUND: In spite of all physical security defensive devices deployed, the possibility of an intrusion always exists. The highest fence can be scaled, the densest wall can be breached, and the stoutest lock can be compromised. Even highly sophisticated alarm systems can be contravened by a knowledgeable professional. It is therefore necessary to institute a system of checks to physically inspect secure room perimeters to check for signs of attempted intrusions and ensure that structural integrity of the perimeter is maintained. 

  This requirement is concerned with ensuring there is periodic visual validation of structural integrity of secure room/collateral classified open storage area perimeters containing SIPRNet assets and associated media. It ensures that any breach or attempted breach of the walls, true floors, and true ceilings of a secure area (portions that are not readily visible) are discovered in a timely manner.
   
  In Check #1 there are three different situations covered and each requires a different inspection frequency for physical/visual validation of structural integrity. 
   
  Check #1. Check to ensure that structural integrity of secure rooms or spaces containing SIPRNet equipment is validated as follows: 
   
  Situation #1 (No structural integrity checks required): If interior IDS (motion detection) is properly employed (i.e., directly covering all SIPRNet assets) within the secure room or collateral classified open storage space where classified SIPRNet assets are located AND under raised floor spaces (if applicable) AND above suspended ceiling spaces (if applicable), then no physical check for structural integrity is required. This is contingent upon the interior motion sensors being activated when the room is closed or unattended and the sensors working properly as determined by required checks of sensor functionality.
   
  Situation #2 (Checks required IAW approved written guidance from AO): If motion sensors are properly employed ONLY within the secure room space where classified assets are located, then a visual check of spaces below raised floors, above suspended ceilings, and anywhere else the perimeter of the secure area cannot be readily observed must be conducted IAW AO written guidance. The goal is to visually inspect all walls, true floor, and true ceiling perimeters for signs of breach or attempted breach.
   
  Situation #3 (Checks required IAW written guidance from AO): When random checks (not exceeding four hours) of secure rooms or open storage spaces are used in lieu of IDS, then the checks specified in situation #2 for above suspended ceilings and below raised floors must be conducted IAW AO written guidance. The increased frequency of checks is due to the significant vulnerability of the SIPRNet assets to undetected attack from portions of the perimeter that cannot be readily observed. NOTE: Physical inspection of the perimeter walls, floor, and ceiling can be greatly expedited and may be conducted without ladders or other equipment where there are no false/suspended ceilings and/or raised floors within or surrounding the secure room or area.
   
  NOTE: If the entire perimeter of the secure room or area containing SIPRNet assets is surrounded by a secret or top secret (TS) Controlled Access Area (CAA), the frequency of structural integrity checks may be reduced to once every two weeks. This is due to the increased security-in-depth provided by the CAA. A secret or TS CAA is an area where unescorted access is granted only to individuals who have a secret or higher security clearance. All others are escorted by cleared employees. The DOD does not provide specific physical security requirements for a CAA but allows each CC/S/A Senior Agency Official (SAO) for Information Security the authority to establish such standards. All the Services have established standards for CAAs within their Protected Distribution System (PDS) implementing guidelines. Minimally, all require some form of access control methodology (AECS/guards/reception, etc.) be in place to ensure only properly vetted and cleared personnel have unescorted access to a CAA.

  Check #2. Check to ensure there are written procedures developed for the checks and that the checks are documented and maintained on file for a minimum of 90 days. Where discrepancies (holes in perimeter or other signs of successful or attempted access) are noted, these checks will be maintained indefinitely or until an inquiry determines the cause of the discrepancy.
   
  TACTICAL ENVIRONMENT: This check is applicable where secure rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short-term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245811
rule_id: SV-245811r1136699_rule
severity: CAT II
title: Vault/Secure Room Storage Standards - IDS Performance Verification
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to test IDS functionality on a periodic basis could result in undetected alarm sensor or other system failure. This in-turn could result in an undetected intrusion into a secure room (AKA: collateral classified open storage area) and the undetected loss or compromise of classified material.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraphs 24.j. and 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: MP-4, PE-5, PE-6(1), PE-8 and MA-6.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Appendix to Enclosure 3, paragraphs 2.c. and 2.e.(7).

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  Testing and alarm verification procedures for specific sensors and other IDS equipment may be obtained from the Electronic Security Center (ESS), U.S. Army Engineering and Support Center, Huntsville, AL 35816:

  ESS Question? AskESSMCX@usace.army.mil</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Conduct verification of IDS functionality where IDS is used as a supplemental control for vaults or secure rooms/areas containing SIPRNet as well as other classified systems assets. 

  Following are the required fixes: 

  Fix #1. Ensure that checks of ALL individual alarm sensors (BMS, motion, glass break, etc.) are conducted at least semi-annually. 

  Fix #2. Ensure that valid tests IAW best practices using government or industry standards and tools are used to conduct the checks. 

  Fix #3. Ensure that written procedures are developed for tests of each sensor type in use at a site. 

  Fix #4. Ensure that results of testing are maintained on file for at least one year.

check_text:
  This check is concerned with verification of IDS functionality where IDS is used as a supplemental control for vaults or secure rooms/areas containing SIPRNet as well as other classified systems assets. 

  Following are the required checks: 

  Check #1. Checks of ALL individual alarm sensors (BMS, motion, glass break, etc.) will be conducted at least semi-annually. 

  Check #2. Valid tests IAW best practices using government or industry standards and tools will be used to conduct the checks. 

  Check #3. Written procedures will be developed for tests of each sensor type in use at a site. 

  Check #4. Results of testing will be maintained on file for at least 1-year. 

  TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245812
rule_id: SV-245812r1136701_rule
severity: CAT II
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Vault/Secure Room Storage Standards - Masking of IDS Sensors Displayed at the Intrusion Detection System (IDS) Monitoring Station

description:
  <VulnDiscussion>Failure to meet standards for the display of masked alarm sensors at the IDS monitoring station could result in the location with masked or inactive sensors not being properly supervised. This could result in an undetected breach of a secure room perimeter and the undetected loss or compromise of classified material.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: MP-4, PE-3, PE-5, PE-6(1)

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Appendix to Enclosure 3, paragraphs 2d.(5) and (6).

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Shunting or masking of any secure room IDS internal zone or sensor must be appropriately logged or recorded in the system archive. A shunted or masked internal zone or sensor must be displayed as such at the monitor station throughout the period the condition exists whenever there is a system (IDS) survey of zones or sensors.

check_text:
  Shunting or masking of any secure room IDS internal zone or sensor must be appropriately logged or recorded in the system archive. A shunted or masked internal zone or sensor must be displayed as such at the monitor station throughout the period the condition exists whenever there is a system (IDS) survey of zones or sensors.

  TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245813
rule_id: SV-245813r1136703_rule
severity: CAT II
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Vault/Secure Room Storage Standards - IDS Alarm Monitoring Indicators, both audible and visual (Alarm Status) must be displayed for each sensor or alarmed zone at the monitoring station.

description:
  <VulnDiscussion>Failure to meet standards for the display of audible and visual alarm indicators at the IDS monitoring station could result in an a sensor going into alarm state and not being immediately detected. This could result in an undetected or delayed discovery of a secure room perimeter breach and the loss or compromise of classified material.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: MP-4, PE-3, PE-5, PE-6(1)

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Appendix to Enclosure 3, paragraphs 2.b.(2)(b).

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure that all alarm activations provide both a visual and audible indicator at the primary monitoring station.

check_text:
  Check that all alarm activations provide both visual and audible indicators at the primary monitoring station.
      
  TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245814
rule_id: SV-245814r1138475_rule
severity: CAT II
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Vault/Secure Room Storage Standards - Intrusion Detection System (IDS) / Automated Entry Control System (AECS) Primary and Emergency Power Supply

description:
  <VulnDiscussion>Failure to meet standards for ensuring that there is an adequate commercial and back-up power sources for IDS/AECS with uninterrupted failover to emergency power could result in a malfunction of the physical alarm and access control system. This could result in the undetected breach of classified open storage / secure rooms or vaults containing SIPRNet assets and undetected loss or compromise of classified material.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: MP-4, PE-3, PE-5, PE-6(1)

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Appendix to Enclosure 3, paragraphs 2.d.(7)(a) and (b).

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Fixes - Primary Power:

  Fix #1. Ensure primary power for all Intrusion Detection System (IDS) equipment and Automated Entry Control system (AECS) equipment as well as other classified systems are either commercial AC or DC power. 

  Fix #2. Ensure that in the event of commercial power failure at either the secure room/area or monitor station, the equipment changes power sources without causing an intrusion alarm indication. An Uninterrupted Power Supply (UPS) will be required for this to occur.  

  Fixes - Emergency (Backup) Power:

  Fix #1. Ensure that emergency power consists of a protected independent backup power source that provides a minimum of 8-hours operating battery and/or generator power. When batteries are used for emergency power, they shall be maintained at full charge by automatic charging circuits. The manufacturer's periodic maintenance schedule shall be followed and results documented.

  Fix #2. Power Source and Failure Indication: Ensure that an illuminated indication exists at the Power Control Unit (PCU) of the power source in use (AC or DC). 

  Fix #3. Ensure equipment at the IDS/AECS monitor station indicates a failure in power source, a change in power source, and the location of the failure or change.

check_text:
  Primary Power Checks:

  Check #1. Check to ensure primary power for all Intrusion Detection System (IDS) equipment and Automated Entry Control system (AECS) equipment as well as other classified systems assets are either commercial AC or DC power. 

  Check #2. Check to ensure that in the event of commercial power failure at either the secure room/area or monitor station, the equipment changes power sources without causing an intrusion alarm indication. An Uninterrupted Power Supply (UPS) will be required for this to occur.  

  Emergency (Backup) Power Checks:

  Check #1. Check to ensure that emergency power consists of a protected independent backup power source that provides a minimum of 8-hours operating battery and/or generator power. When batteries are used for emergency power, they shall be maintained at full charge by automatic charging circuits. The manufacturer's periodic maintenance schedule shall be followed and results documented.

  Check #2. Power Source and Failure Indication: Check to ensure that an illuminated indication exists at the Power Control Unit (PCU) of the power source in use (AC or DC). 

  Check #3. Check to ensure equipment at the IDS/AECS monitor station indicates a failure in power source, a change in power source, and the location of the failure or change.                     

  TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245815
rule_id: SV-245815r1138476_rule
severity: CAT II
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Vault/Secure Room Storage Standards - Intrusion Detection System and Automated Entry Control System (IDS/AECS) Component Tamper Protection

description:
  <VulnDiscussion>Failure to tamper protect IDS/AECS component enclosures and access points external to protected vaults/secure rooms space could result in the undetected modification or disabling of IDS/AECS system components. This could lead to the undetected breach of secure space containing SIPRNet assets and result in the undetected loss or compromise of classified information or materials.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: MP-4, PE-3, PE-5, PE-6(1)

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Appendix to Enclosure 3, paragraphs 2.d.(8 and 3.a.(5)(b).

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Requirements Summary:

  Protection must be established and maintained for all component devices or equipment that constitute the Automated Entry Control System (AECS) and/or the Intrusion Detection System (IDS) used to protect a vault, secure room, or collateral classified open storage area, which contains SIPRNet assets.

  If access to a junction box or controller will enable an unauthorized modification, then alarmed tamper protection, which is normally provided by a pressure sensitive switch, must be used. 

  Fixes:

  1. IDS/AECS components located both outside and inside the secure area must have tamper protection resulting in an alarm signal sent to the primary IDS Monitoring Station. Normally this is provided by a pressure sensitive switch, which automatically sends an alarm signal when the protective enclosure covering component equipment is opened. 

  2. ALL IDS/AECS ancillary equipment such as card readers, keypads, communication or interface devices for vaults, secure rooms, or collateral classified open storage areas containing SIPRNet as well as other classified systems assets must have tamper resistant enclosures and be securely fastened to the wall or other permanent structure. Control panels and AECS devices located within a Secret or TS Controlled Access Area (CAA) need only a minimal degree of physical security protection sufficient to preclude unauthorized access to the mechanism.

check_text:
  Requirements Summary:

  Protection must be established and maintained for all component devices or equipment that constitute the Automated Entry Control System (AECS) and/or the Intrusion Detection System (IDS) used to protect a vault, secure room or collateral classified open storage area, which contains SIPRNet assets.

  If access to a junction box or controller will enable an unauthorized modification, then alarmed tamper protection, which is normally provided by a pressure sensitive switch must be used. 

  CHECKS:

  1. Check to ensure that IDS/AECS components located both outside and inside the secure area have tamper protection resulting in an alarm signal sent to the primary IDS Monitoring Station. Normally this is provided by a pressure sensitive switch, which automatically sends an alarm signal when the protective enclosure covering component equipment is opened. 

  2. Check to ensure that ALL IDS/AECS ancillary equipment such as card readers, keypads, communication or interface devices for vaults, secure rooms, or collateral classified open storage areas containing SIPRNet as well as other classified systems assets have tamper resistant enclosures and are securely fastened to the wall or other permanent structure. Control panels and AECS devices located within a Secret or TS Controlled Access Area (CAA) need only a minimal degree of physical security protection sufficient to preclude unauthorized access to the mechanism. 
              
  TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245816
rule_id: SV-245816r1138491_rule
severity: CAT II
title: Vault/Secure Room Storage Standards - Primary IDS Monitoring Location Outside the Monitored Space
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to locate the alarm monitoring station at an external location; at a safe distance from the space being monitored, to ensure that it is not involved in any surprise attack of the alarmed space could result in a perimeter breach and the loss or compromise of classified material with limited or no capability to immediately notify response forces.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: MP-4, PE-3, PE-5, PE-6(1)

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Appendix to Enclosure 3, paragraph 2.d.(6).

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure that primary monitoring of alarms for secure rooms or spaces containing SIPRNet equipment is located outside of the protected space.

check_text:
  Check to ensure that primary monitoring of alarms for secure rooms or spaces containing SIPRNet equipment is located outside of the protected space. It is allowable to monitor alarms within the protected space if this is only used for supplemental/secondary monitoring. Ideally alarms will be monitored from the same location that police/guards or other response forces are contacted and dispatched, although this is not required if there are procedures and means for the monitoring station personnel to notify security response forces in a timely manner.

  TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245817
rule_id: SV-245817r1138478_rule
severity: CAT II
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Vault/Secure Room Storage Standards - Automated Entry Control System (AECS) Records Maintenance, which includes documented procedures for granting and removal of access.

description:
  <VulnDiscussion>Failure to document procedures for removal of access and inadequate maintenance of access records for both active and removed persons could result in unauthorized persons having unescorted access to vaults, secure rooms or collateral classified open storage areas where classified information is processed and stored. 

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-1, PE-2, PE-3, PE-6 and PE-8.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Appendix to Enclosure 3, paragraph 3.a(4) and (7)

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Ensure there is a documented procedure for removal of persons from the Automated Entry Control System.

  2. Ensure that records reflecting active assignment of ID badge/card, PIN, level of access, and similar system-related records are accurately maintained. 

  3. Ensure that records concerning personnel removed from the system are retained for a minimum of 90 days.

check_text:
  Requirements Summary:

  A procedure must be established for removal of an individual's authorization to enter the secure room area upon reassignment, transfer, or termination, or when the individual's access is suspended, revoked, or downgraded to a level lower than the former access level. Records shall also be accurately maintained reflecting active assignment of ID badge/card, PIN, level of access, and similar system-related records. Records concerning personnel removed from the system shall be retained for a minimum of 90 days.

  CHECKS:

  Check #1. Check to ensure that records reflecting active assignment of ID badge/card, PIN, level of access, and similar system-related records are accurately maintained. (CAT II)

  Check #2. Check to ensure there is a documented procedure for removal of persons from the Automated Entry Control System. (CAT III)

  Check #3. Check to ensure that records concerning personnel removed from the system are retained for a minimum of 90 days. (CAT III)

  TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245818
rule_id: SV-245818r1138479_rule
severity: CAT II
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Vault/Secure Room Storage Standards - Automated Entry Control System (AECS) Transmission Line Security: 
  AECS Transmission lines traversing an uncontrolled area (not within at least a Secret Controlled Access Area (CAA) ) shall use line supervision OR Electrical, mechanical, or electromechanical access control devices, which do not constitute an AECS that are used to control access during duty hours must have all electrical components, that traverse outside minimally a Secret Controlled Access Area (CAA), secured within conduit.

description:
  <VulnDiscussion>Persons not vetted to at least the same level of classification residing on the information systems being protected by the AECS or other access control system components could gain access to the unprotected transmission line and tamper with it to facilitate surreptitious access to the secure space. Proper line supervision and/or physical protection within conduit will enable detection of line tampering. Such failure to meet standards for line supervision and physical protection could result in the loss or compromise of classified material.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-3, PE-4, and PE-6.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Appendix to Enclosure 3, paragraphs 3.a.(5)(d) and 3.c.(4).

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Where Automated Entry Control Systems (AECS)protect SIPRNet assets in Secure Rooms, Vaults, or secret/TS CAAs: Ensure that transmission lines used to carry access authorizations, personal identification data, or verification data between devices or equipment, which are located outside "minimally" a Secret Controlled Access Area (CAA) have line supervision. 

  2. Where electrical, mechanical, or electromechanical access control devices, which do not constitute an AECS are used to control access during duty hours (while under direct continuous visual observation and control of a cleared employee or via CCTV) they must have all electrical components, including wiring, or mechanical links (cables, rods, and so on) accessible only from inside the area, or, if they traverse outside a controlled area "minimally" a Secret Controlled Access Area (CAA), they must be physically secured within conduit to preclude surreptitious manipulation of components.

check_text:
  1. Where Automated Entry Control Systems (AECS)protect SIPRNet assets in Secure Rooms, Vaults, or secret/TS CAAs: Ensure that transmission lines used to carry access authorizations, personal identification data, or verification data between devices or equipment, which are located outside "minimally" a Secret Controlled Access Area (CAA) have line supervision.

  2. Electrical, mechanical, or electromechanical access control devices, which do not constitute an AECS that are used to control access during duty hours (while under direct continuous visual observation and control of a cleared employee or via CCTV) must have all electrical components, including wiring, or mechanical links (cables, rods, and so on) accessible only from inside the area, or, if they traverse outside a controlled area "minimally" a Secret Controlled Access Area (CAA), they must be physically secured within conduit to preclude surreptitious manipulation of components.
                      
  TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245819
rule_id: SV-245819r1138480_rule
severity: CAT II
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Vault/Secure Room Storage Standards - Automated Entry Control System (AECS) Door Locks: Electric Strikes and/or Magnetic Locking devices used in access control systems shall be heavy duty, industrial grade and be configured to fail secure in the event of a total loss of power (primary and backup).

description:
  <VulnDiscussion>There are a variety of locking mechanisms that may be used to secure both primary and secondary doors for vaults and classified open storage areas (secure rooms). While the primary access door is to be secured with an appropriate combination lock when closed; during working hours an AECS using electric strikes or magnetic locks, electrical, mechanical, or electromechanical access control devices, or standard keyed locks may be used to facilitate frequent access to the secured space by employees vetted for unescorted access. Where electrically actuated locks are used, locking mechanisms must be properly configured and controlled to ensure they fail only in a secure state during partial or total loss of power (primary and backup). Failure to provide for these considerations could result in the loss or compromise of classified material.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-3, and PE-6.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Appendix to Enclosure 3, paragraph 3.a.(5)(e).

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Vault/Secure Room Storage Standards - Automated Entry Control System (AECS) Door Locks. Ensure the following configuration and control considerations are used as appropriate for the type of locks being used in access control systems protecting SIPRNet assets:

  1. Electric Strikes and/or Magnetic Locking devices used in access control systems shall be heavy duty, industrial grade. 

  2. Backup batteries and/or emergency power generators should be connected to (AECS) components; however, the total loss of power should be planned for. 

  3. When used on secure rooms, vaults, or areas protecting SIPRNet equipment; electric strikes on doors will be set to fail secure in the event of power disruption. 

  4. On the primary ingress/egress door to secure rooms (which contains the combination lock) the strike may be set to fail open to facilitate access to the room in emergencies only if the door is under continuous visual observation when the combination lock is not secure. In this instance the combination lock will be immediately secured and subsequently opened as required to allow access to the room. 

  5. As an alternative the strike on the primary access door (under continuous visual control) may be set to fail secure and configured to allow for opening of the strike lock with a key. 

  6. Keys for such locks will be strictly controlled, inventoried periodically and not issued to individuals for retention. 

  7. KEYS TO SECURE ROOMS WILL NOT BE REMOVED FROM THE SITE.

  8. When Magnetic Locks (Mag locks) are used on primary access doors the total loss of ALL power (primary and backup) will cause the lock to fail open. Therefore doors with mag locks installed must be under continuous visual observation when the combination lock is open. 

  9. Where Mag locks are used on primary access doors and upon a total power failure - the combination lock will be immediately secured and subsequently opened as required to allow access to the room.
   
  10. Secondary doors not used for access (emergency egress only) should use standard locking door latches rather than electric strikes or mag locks. 

  11. Access hardware on the side of the door that is external to the room must be removed to prevent use of secondary doors for routine ingress. 

  12. In the event a mag lock is used on a secondary door, the door must be configured to be locked during a power disruption. This can be accomplished with internal sliding deadbolt locks or supplemental door latches. Any secondary door secured with Mag Locks must be under CONTINUOUS visual observation when the interior deadbolt locks are not engaged. Deadbolt locks must not be engaged while the room is occupied - for life safety, but will be secured upon closing the secure room or area. 

  Always be sure to coordinate door locking and emergency egress considerations with supporting facility risk management(fire/safety) personnel.

check_text:
  Vault/Secure Room Storage Standards - Automated Entry Control System (AECS) Door Lock Standards for Areas Containing SIPRNet Assets. 

  Check to ensure the following configuration and control considerations are used according to the types of locking mechanisms being used, as specified in each check:

  Check #1. Electric Strikes and/or Magnetic Locking devices used in access control systems shall be heavy duty, industrial grade. 

  Check #2. Backup batteries and/or emergency power generators should be connected to AECS components; however, the total loss of power (primary and emergency) should also be planned for. 

  Check #3. When used on secure rooms, vaults or areas protecting SIPRNet equipment, electric strikes on doors will be set to fail secure in the event of power disruption. 

  Check #4. On the primary ingress/egress door to secure rooms (which contains the combination lock) the strike may be set to fail open to facilitate access to the room in emergencies only if the door is under continuous visual observation when the combination lock is not secure. In this instance the combination lock will be immediately secured and subsequently opened as required to allow access to the room. 

  Check #5. As an alternative the strike on the primary access door (only those under continuous visual control) may be set to fail secure and configured to allow for opening of the strike lock with a key. 

  Check #6. Keys for locks as discussed in check 5 will be strictly controlled, inventoried periodically and not issued to individuals for personal retention. 

  Check #7. KEYS TO SECURE ROOMS WILL NOT BE REMOVED FROM THE SITE. 

  Check #8. When Magnetic Locks (Mag locks) are used on primary access doors the total loss of ALL power (primary and backup) will cause the lock to fail open. Therefore doors with mag locks installed MUST BE UNDER CONTINUOUS VISUAL OBSERVATION WHEN THE COMBINATION LOCK IS OPEN.

  Check #9. Where Mag locks are used on primary access doors and upon a total power failure - the combination lock will be immediately secured and subsequently opened as required to allow access to the room. 

  Check #10. Secondary doors not used for access (emergency egress only) should use standard locking door latches rather than electric strikes or mag locks. 

  Check #11. Access hardware on the side of the secondary door that is external to the room must be removed to prevent use of secondary doors for routine ingress. 

  Check #12. In the event a mag lock or electric strike is used on a secondary door, the door must be configured to be locked during a power disruption. This can be accomplished with internal sliding deadbolt locks or lockable door latches. Electric strikes on secondary doors should be set to fail secure. Any secondary door secured with Mag Locks must be under CONTINUOUS visual observation when the interior deadbolt locks are not engaged. Deadbolt locks must not be engaged while the room is occupied - for life safety, but will be secured upon closing the secure room or area.
                
  TACTICAL ENVIRONMENT: This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245820
rule_id: SV-245820r1138481_rule
severity: CAT II
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Information Security (INFOSEC) - Secure Room Storage Standards - Perimeter Construction using Proper Permanent Construction Materials for True Ceiling, Walls and Floors.

description:
  <VulnDiscussion>Failure to meet standards for ensuring that there is structural integrity of the physical Perimeter surrounding a secure room (AKA: collateral classified open storage area) could result in a lack of structural integrity and the undetected loss or compromise of classified material. Permanent construction materials; while not impenetrable, provide physical evidence of an attempted or actual intrusion into a secure room space. Construction materials and application techniques that are not permanent in nature can potentially be removed to allow for access to secure room space and then replaced by an intruder upon egress from the area. This effectively negates the detection capability afforded by permanent construction techniques and materials. Examples of non-permanent material would be modular walls that can be removed and replaced with ease or plywood board (or other materials) applied with screws or nails that can be removed from outside the secure room space and then replaced using common tools.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: MP-3, PE-3, PE-4, and PE-5.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Enclosure 3, paragraphs 3.a.(3) and 3.b.(1), (2) &(3); Appendix to Enclosure 3, paragraph 1.b.(1), (2) & (5).

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Secure rooms or areas (*containing inspectable SIPRNet assets) must have walls, floor, and roof construction made of permanent construction materials; i.e., plaster, gypsum wallboard, metal panels, hardboard, wood, plywood, or other materials offering resistance to, and evidence of unauthorized entry into the area. 

  2. Materials such as plywood must be attached in a manner so as not to enable easy removal of screws or nails to gain ingress and then replace upon egress. 

  3. The "True" ceiling shall be constructed of plaster, gypsum, wallboard material, hardware or any other acceptable material.

check_text:
  For secure rooms or areas (*containing inspectable SIPRNet assets) check:

  1. That walls, floor, and roof construction of secure rooms are made of permanent construction materials; i.e., plaster, gypsum wallboard, metal panels, hardboard, wood, plywood, or other materials offering resistance to, and evidence of unauthorized entry into the area. Materials such as plywood must be attached in a manner so as not to enable easy removal of screws or nails to gain ingress and then replace upon egress. 

  2. The "True" ceiling shall be constructed of plaster, gypsum, wallboard material, hardware or any other acceptable material. 

  TACTICAL ENVIRONMENT: This check is applicable where vaults or secure rooms are used to protect classified materials or systems. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245821
rule_id: SV-245821r1138482_rule
severity: CAT III
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Vault/Secure Room Storage Standards - Automated Entry Control System (AECS) Keypad Device Protection: Keypad devices designed or installed in a manner that an unauthorized person in the immediate vicinity cannot observe the selection of input numbers.

description:
  <VulnDiscussion>If someone were to successfully observe an authorized user's selection of numbers for their PIN at an entrance to a classified storage area or unclassified but sensitive computer room it could result in an unauthorized person being able to use that same PIN to gain access. Where purely electronic (cipher type) locks are used without an access card or badge this could lead to direct access by an unauthorized person. Where coded AECS cards and badges are used the risk is diminished significantly as the coded badge associated with the PIN would need to be lost/stolen and subsequently recovered by someone with unauthorized knowledge of the PIN for them to be able to successfully gain access to the secured area.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Control: PE-3.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Appendix to Enclosure 3, paragraph 3.a.(5)(c).

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure that keypad devices (cipher locks or PIN pads for card readers) are designed or installed in such a manner that an unauthorized person in the immediate vicinity cannot observe the selection of input numbers. During initial, annual refresher training and when key cards with PINs are issued advise persons using the keypad devices of the risk of someone overseeing their PIN and encourage them to use appropriate caution to shield their selection of numbers.

check_text:
  Requirements Summary:
  Keypad devices (cipher locks or PIN pads for card readers) shall be designed or installed in such a manner that an unauthorized person in the immediate vicinity cannot observe the selection of input numbers.

  CHECKS:
  Check to ensure that all keypad devices are properly shielded and/or that persons using these devices have been advised by site security and are aware of the risk of having someone in the vicinity view their PIN as it is entered and that they are exercising due care to shield entry of their PIN. 

  Verification of employee awareness can be obtained by observing SOPs or employee training records reflecting a warning or requirement to shield entry of PINs. 

  TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245822
rule_id: SV-245822r1138443_rule
severity: CAT II
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Marking Classified - Equipment, Documents or Media: In a classified operating environment, all unclassified items must be marked in addition to all classified items.

description:
  <VulnDiscussion>Failure to properly mark classified material could result in the loss or compromise of classified information.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure A, paragraph 6.a. and Enclosure C, paragraphs 21.h.(7) & 29.a. 

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AC-16 and MP-3.

  DOD Manual 5200.01, Volume 2, 24 February 2012, SUBJECT: DOD Information Security Program: Marking of Classified Information; Enclosure 2, paragraph 4.b.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  Satisfies: Marking Classified - Equipment, Documents or Media</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure all equipment, media, and documents in the areas housing SIPRNet assets contain proper classification markings. In a classified operating environment, all unclassified items must be marked in addition to all classified items. For instance, in areas where any classified equipment such as servers, client workstations, printers, routers, crypto, etc. are being used, all classified equipment, media, and documents must be properly marked with classification levels and handling caveats. All unclassified equipment (servers, client workstations, printers, routers, crypto, etc.), media, and documents must also be properly marked as unclassified and with handling caveats, such as CUI, when appropriate. This total marking of all assets in a classified environment eliminates the assumption that anything not marked is unclassified. Hence, all equipment, media, and documents within SCIFs, Vaults, Secure Rooms and classified Controlled Access Areas (CAAs) must be marked with classification levels and handling caveats.

  SPECIAL NOTE FOR MONITORS: Monitors connected to SIPRNet/NIPRNet are inert items of equipment in that they do not store or retain classified data. As long as the monitor border displays the classification level alerting personnel using the system of the protection requirements, there is no need to place a classification sticker on the monitor.
       
  If a classification banner is displayed on an active monitor screen, then the physical monitor is not required to have a SF-710 (unclassified) or SF-707 (secret) sticker.

  Typically, most monitor screens connected to the DISN do have classification banners displayed, so placement of SF stickers on monitors is not an issue.

  Also, consider that many workstations are using KVM switches to share monitor screens between NIPRNet and SIPRNet. Hence, the single monitor will be unclassified or classified depending on the network it is connected to at a particular moment, making placement of physical classification labels impractical.

check_text:
  Check to ensure all equipment/media/documents in the areas housing SIPRNet assets contain proper classification markings. 

  In a classified operating environment, all unclassified items must be marked in addition to all classified items. For instance, in areas where any classified equipment such as servers, client workstations, printers, routers, crypto, etc. are being used, all classified equipment, media, and documents must be properly marked with classification levels and handling caveats. All unclassified equipment (servers, client workstations, printers, routers, crypto, etc.), media, and documents must also be properly marked as unclassified and with handling caveats, such as CUI, when appropriate. This total marking of all assets in a classified environment eliminates the assumption that anything not marked is unclassified. Hence, all equipment, media, and documents within SCIFs, Vaults, Secure Rooms and classified Controlled Access Areas (CAAs) must be marked with classification levels and handling caveats.

  SPECIAL NOTE FOR MONITORS: Monitors connected to SIPRNet/NIPRNet are inert items of equipment in that they do not store or retain classified data. As long as the monitor border displays the classification level alerting personnel using the system of the protection requirements there is no need to place a classification sticker on the monitor. 
       
  If a classification banner is displayed on an active monitor screen then the physical monitor is not required to have a SF-710 (unclassified) or SF-707 (secret) sticker.

  Typically, most monitor screens connected to the DISN do have classification banners displayed, so placement of SF stickers on monitors is not an issue.

  Also, consider that many workstations are using KVM switches to share monitor screens between NIPRNet and SIPRNet. Hence, the single monitor will be unclassified or classified depending on the network it is connected to at a particular moment, making placement of physical classification labels impractical. 

  TACTICAL ENVIRONMENT: This check is applicable in a tactical environment if classified documents or media are created or extracted from the SIPRNet. The only exception will be for urgent (short-term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used. All deployed SIPRNet equipment should already contain applicable classification markings/labels.


vuln_id: V-245823
rule_id: SV-245823r1138444_rule
severity: CAT III
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Marking Classified - Local or Enclave Classified Marking Procedures must be developed to ensure employees are familiar with appropriate organization Security Classification Guides (SCG), how to obtain guidance for marking classified documents, media and equipment, and where associated forms, classified cover sheets, labels, stamps, wrapping material for classified shipment, etc. can be obtained.

description:
  <VulnDiscussion>Failure to properly mark classified material could result in the loss or compromise of classified information.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraphs 21.a. and 21.g.(1). 

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Control: MP-1, MP-3, & AC-16.

  DOD Manual 5200.01, Volume 1, 24 February 2012, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification; Enclosure 2, paragraph 9.

  DOD Manual 5200.01, Volume 2, 24 February 2012, SUBJECT: DOD Information Security Program: Marking of Classified Information; paragraph 5.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure the local site/enclave security manager has developed written procedures on proper marking of classified documents / media/ equipment. These procedures should primarily involve guidance for employees concerning what to mark, how to mark items, where classified labels, stamps and other marking tools and supplies are located, etc. Reference to DOD or component marking guides should be in the local procedures with information on how/where to obtain copies.

check_text:
  Check to ensure the local site/enclave security manager has developed written procedures on proper marking of classified documents / media/ equipment. These procedures should primarily involve guidance for employees concerning what to mark, how to mark items, where classified labels, stamps and other marking tools and supplies are located, etc. Reference to DOD or component marking guides should be in the local procedures with information on how/where to obtain copies.
                  
  TACTICAL ENVIRONMENT: This check is applicable in a tactical environment if classified documents or media are created/extracted from the SIPRNet. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used. All deployed SIPRNet equipment should already contain applicable classification markings/labels.


vuln_id: V-245824
rule_id: SV-245824r1138446_rule
severity: CAT III
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Classified Working Papers are properly marked, destroyed when no longer needed, or treated as a finished document after 180 days.

description:
  <VulnDiscussion>Failure to properly mark or handle classified documents can lead to the loss or compromise of classified or sensitive information.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure A, paragraph 6.a. and Enclosure C, paragraph 21.h.(7).

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Control: MP-3 & PE-5(3).

  DOD Manual 5200.01, Volume 2, 24 February 2012, SUBJECT: DOD Information Security Program: Marking of Classified Information; Enclosure 3, paragraph 13 and figure 11.

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information; Enclosure 2, paragraph 13.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure that all Working Papers, documents and/or computer media comply with the following guidance:
   
  Working papers are documents and material accumulated or created in the preparation of finished documents and material. Working papers are marked in the same manner as a finished document at the same classification level when released by the originator outside the originating activity, retained more than 180 days from date of origin (30 days for SAPs), or filed permanently. 

  Working papers containing classified information shall be:
   - Dated when created
   - Marked Top and Bottom with the highest classification of any information contained in the document                           - Annotated "WORKING PAPER"
            
  If any Automated Information System (AIS) hard drives or media are found to contain working papers or documents, the automated documents must be marked and handled in the same manner as hard copy documents. If an entire AIS media storage device (tapes, diskettes, flash drives, CDs, DVDs, etc.) contains classified documents or data that are being treated as a working documents - then each individual working document on the media should be marked and handled as detailed above AND the media itself should be marked with the highest classification level, dated and marked "Working Documents".

check_text:
  Check any Working Papers, documents and/or Computer Media (CD, tape, flash drive, etc.)for compliance with the following guidance: 
   
  Working papers are documents and material (includes computer media) accumulated or created in the preparation of finished documents and material. Working papers are marked in the same manner as a finished document at the same classification level when released by the originator outside the originating activity, retained more than 180 days from date of origin (30 days for SAPs), or filed permanently. 

  Working papers containing classified information shall be:
   - Dated when created
   - Marked Top and Bottom with the highest classification of any information contained in the document
   - Annotated "WORKING PAPER"

  If any Automated Information System (AIS) hard drives or media are found to contain working papers or documents, the automated documents must be marked and handled in the same manner as hard copy documents. If an entire AIS media storage device (tapes, diskettes, flash drives, CDs, DVDs, etc.) contains classified documents or data that are being treated as a working documents - then each individual working document on the media should be marked and handled as detailed above AND the media itself should be marked with the highest classification level, dated and marked "Working Documents". 

  TACTICAL ENVIRONMENT APPLICABILITY: If classified working documents are found in a tactical environment they should be marked and handled according to the aforementioned guidance.


vuln_id: V-245825
rule_id: SV-245825r1138447_rule
severity: CAT I
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Storage/Handling of Classified Documents, Media, Equipment - must be under continuous personal protection and control of an authorized (cleared) individual OR guarded or stored in an approved locked security container (safe), vault, secure room, collateral classified open storage area or SCIF.

description:
  <VulnDiscussion>Failure to store classified in an approved container OR to properly protect classified when removed from storage can lead to the loss or compromise of classified or sensitive information.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraphs 15.b.(1), 21.d., 24.j., and 34.c.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Control: MP-4.

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information; Enclosure 2, paragraphs 2 & 8 and Enclosure 3, paragraph 3.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  Satisfies: Storage/Handling of Classified Documents, Media, Equipment</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Primary Requirements for Control of Classified Material:
  Classified documents, information system (IS) equipment and removable media must be:

  1. Under the direct personal control and observation of an authorized person, who possesses a security clearance and need-to know equal to or greater than the classified information or material being controlled. The properly cleared employee(s) must be able to clearly see and control the classified material. The employee(s) must be specifically aware the classified material is in their area AND that they are responsible for ensuring it is protected.

  or

  2. Guarded by a trained professional security official who possesses a security clearance equal to or greater than the classified information or material being controlled. 

  or

  3. Stored in a locked security container (GSA approved safe), vault, secure room, collateral classified open storage area or SCIF with protection equal to or exceeding the highest classification of the material/equipment. 

  Secondary Requirements:

  Actions to enhance protection of classified materials:

  1. Site security personnel must conduct initial and annual training to indoctrinate and remind employees of procedures and requirements to maintain positive control of classified materials removed from approved storage. 

  2. Site security personnel must develop written procedures for protection and storage of classified materials and make the procedures readily available to each employee via electronic means, such as in space on an organizational intranet, shared folders or other means available. 

  3. Site security personnel must conduct regular checks of their areas of responsibility and constantly be observant to ensure that classified materials (documents media, and equipment) that have been removed from approved storage are under the continuous personal observation and control of cleared persons. 

  Tertiary Requirements:

  Required Actions upon discovery of classified material not in secure storage or under continuous observation and control of a cleared employee:

  1. Site security personnel, security reviewers/inspectors, employees or anyone making discovery of classified material not in secure storage or under continuous observation and control of a cleared employee must immediately take control and properly secure any classified materials not under proper control when not in approved storage. Second they must report the discovery to their supervisory chain and/or site security officials. 
   
  2. Site security personnel must initiate a preliminary inquiry if appropriate to determine the cause of the improperly secure material and to determine if any material was lost or compromised (security incident). 

  3. Site security personnel must develop written procedures for response to incidents of classified materials found not in secure storage or under continuous observation and control of a cleared employee and make the procedures readily available to each employee via electronic means, such as in space on an organizational intranet, shared folders or other means available. 

  4. Site security personnel must conduct remedial training action subsequent to incidents of classified materials found not in secure storage or under continuous observation and control of a cleared employee to remind employees of procedures and requirements to maintain positive control of classified materials removed from approved storage. 

  5. Site managers/supervisors must discipline employees, as appropriate who do not comply with appropriate requirements to maintain positive control of classified material they have removed from secure storage.

check_text:
  1. In areas containing SIPRNet assets - Check to ensure that classified documents, information system (IS) equipment and removable media that is not under the direct personal control and observation of an authorized person is guarded or stored in a locked security container (GSA approved safe), vault, secure room, collateral classified open storage area or SCIF with protection equal to or exceeding the highest classification of the material/equipment. (CAT I)

  2. Check to ensure that site security personnel develop written procedures for response to incidents of classified materials found not in secure storage or under continuous observation and control of a cleared employee and make the procedures readily available to each employee via electronic means, such as in space on an organizational intranet, shared folders or other means available. (CAT III)

  Procedures for response to classified materials discovered that are not in proper storage or under proper control of a cleared person must include the following:

   a. Site security personnel, security reviewers/inspectors, employees or anyone making discovery of classified material not in secure storage or under continuous observation and control of a cleared employee immediately take control and properly secure the classified materials not under proper control when not in approved storage. Second they must report the discovery to their supervisory chain and/or site security officials. (CAT III)

   b. Site security personnel must initiate a preliminary inquiry if appropriate to determine the cause of the improperly secure material and to determine if any material was lost or compromised (security incident). (CAT III)

   c. Site security personnel must conduct remedial training action subsequent to incidents of classified materials found not in secure storage or under continuous observation and control of a cleared employee to remind employees of procedures and requirements to maintain positive control of classified materials removed from approved storage. (CAT III)

   d. Site managers/supervisors must discipline employees, as appropriate who do not comply with appropriate requirements to maintain positive control of classified material they have removed from secure storage. (CAT III)

  3. Check to ensure that's site security personnel conduct initial and annual training to indoctrinate and remind employees of procedures and requirements to maintain positive control of classified materials removed from approved storage and measures to take upon discovery of classified material not in proper storage or under proper control of a cleared person. (CAT II)

  Suggested methodology for reviewers:
  During the review/walk-around be observant for classified materials (documents media, and equipment) that have been removed from approved storage. Specifically look to determine if employees are maintaining positive control of the material. Unless a properly cleared employee is able to clearly see and control the material - this will be a finding.

  The employee(s) must be specifically aware the classified material is in their area AND that they are responsible for ensuring it is controlled/protected. Just having cleared employee(s) "in the area" of the classified material or assuming other cleared employees in the area are responsible for the classified material is not sufficient control.

  An example of a possible finding is when someone working on a classified system departs their work space (cube environment) for lunch or other type of break and does not ask another cleared employee to take control of their classified equipment, documents or media OR does not place the classified hard drive, classified documents and classified media in approved storage.

  TACTICAL ENVIRONMENT: This check is applicable in a tactical environment.

  The only exception will be where there is a lack of permanent storage solutions for urgent (short term) tactical operations or other contingency situations. Primarily this involves field/mobile environments where fixed facilities and equipment are not yet present or incapable of being used. However, all classified equipment, documents or media not properly stored in a safe, vault or secure room must still be under the continuous observation and control of an appropriately cleared person.


vuln_id: V-245826
rule_id: SV-245826r1138448_rule
severity: CAT III
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Non-Disclosure Agreement - Standard Form 312: no person may have access to classified information unless that person has a security clearance in accordance with DODM 5200.02 and has signed a Standard Form (SF) 312, Classified Information Non-Disclosure Agreement (NDA), and access is essential to the accomplishment of a lawful and authorized Government function (i.e., has a need to know).

description:
  <VulnDiscussion>Failure to verify clearance and need-to-know and execute a nondisclosure agreement (NDA) before granting access to classified can result in unauthorized personnel having access to classified information.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 11.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Control: PS-3., PS-6. & PS-6.(2).

  DOD Manual 5200.01, Volume 1, 24 February 2012, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification, Enclosure 3, paragraph 11.b.(1).

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information; Enclosure 2, paragraph 3.

  32 CFR 117 and 32 CFR 2001 and 2033 as well as DOD Manual 5220.32 Volume 1

  DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP), 3 April 2017, paragraphs 4.10.g.(2)(b), 8.1.b., and 12.1.c.

  ISSO Notice 2022-01: Digital Signatures of Standard Form (SF) 312 Classified Nondisclosure Agreement dated May 9, 2022</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  All assigned personnel granted access to classified information must have a signed NDA on record. The execution of an NDA must be annotated in the DISS and a signed hard copy MAY also be available locally. 

  Personnel who transfer from other units or organizations will not necessarily have a signed hard-copy NDA on file locally since they are only required to sign the NDA once, but it MUST be reflected in DISS. 

  If an NDA is not annotated in DISS and a hard copy is not on hand locally, a new SF 312 must be executed and annotated in DISS.

  For individuals without an SF 312 or other approved NDA form on file (either hard copy or in DISS), immediately remove access to classified information systems (i.e., SIPRNet) pending proper execution of an NDA (SF 312) and annotation in DISS.

check_text:
  The check is to review a sample of Personnel Security Records (minimum of 10 percent assigned military and civilian employees) to ensure SF 312s have been signed by persons granted access to classified information systems. The now outdated SF 189 or SF 189A, if found, are still valid NDAs. The execution of an NDA should also be annotated in the Defense Information System for Security (DISS). If a paper copy is found but the form is not in DISS OR if it is annotated in DISS and a paper copy is not on hand, this is not a finding. 

  TACTICAL ENVIRONMENT: This check is applicable in a tactical environment. Anyone with access to classified information must have signed an NDA. Paper copies of the signed NDA will likely not be available in a tactical area of operations; however, system access to DISS should be possible if the theater of operations has been well established.


vuln_id: V-245827
rule_id: SV-245827r1138449_rule
severity: CAT III
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Handling of Classified Documents, Media, Equipment - Written Procedures and Training for when classified material/equipment is removed from a security container and/or secure room.

description:
  <VulnDiscussion>Failure to develop procedures and to train employees on protection of classified when removed from storage could lead to the loss or compromise of classified or sensitive information due to a lack of employee knowledge of requirements.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Control: MP-1.

  DOD Manual 5200.01, Volume 1, 24 February 2012, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification, Enclosure 2, paragraphs 9. c., d., f., j., & k. and 12.a.

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information; Enclosure 2, paragraphs 14 & 15; Enclosure 5, paragraphs 3.a.(2), 3.c.(2)(a) & (b), 3.d.(4), and 7.a. and Enclosure 7, paragraph 10.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  Satisfies: Handling of Classified Documents, Media, Equipment - Written Procedures and Training</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  There must be written procedures for handling classified material/equipment when removed from approved storage (security container and/or secure room, vault, collateral classified open storage area or SCIF). 

  The procedures must be readily available to each employee via electronic means, such as in space on an organizational intranet, shared folders or other means available 

  Training logs (initial and annual refresher) must reflect that all employees granted access to classified are briefed on proper handling procedures e.g., use of cover sheets, maintaining positive control of the material, marking/labeling, access by vendors, determining clearance and need-to-know before release, reproduction, etc.

check_text:
  1. Check there are written procedures for handling classified material/equipment when removed from a security container and/or secure room. These procedures must thoroughly cover all aspects of protection and storage of classified materials and be made readily available to each employee via electronic means, such as in space on an organizational intranet, shared folders or other means available. (CAT III)

  2. Check training logs (initial and annual refresher) that all employees granted access to classified are briefed on proper handling procedures e.g., use of cover sheets, maintaining positive control of the material, marking/labeling, access by vendors, determining clearance and need-to-know before release, reproduction, etc. (CAT III) 

  TACTICAL ENVIRONMENT: The check is applicable for fixed tactical classified processing environments. Not applicable to a field/mobile environment.


vuln_id: V-245828
rule_id: SV-245828r1138450_rule
severity: CAT III
title: Handling of Classified - Use of Cover Sheets on Documents Removed from Secure Storage
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to protect readable classified information printed from classified systems such as SIPRNet when removed from secure storage can lead to the loss or compromise of classified or sensitive information.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Control: MP-1 and MP-5.

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information; Enclosure 2, paragraph 8.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure classified handling procedures address use of cover sheets on classified documents printed from systems such as SIPRNet, when the documents are removed from secure storage.

  Address use of cover sheets during initial and annual refresher security training.

  Periodically check areas for use of cover sheets.

  While not required by regulation it is good security practice to use document cover sheets in a SCIF, Secret or TS vault or secure room to prevent inadvertent access to classified information by persons without need-to-know and uncleared visitors to such classified areas.

check_text:
  During the review/walk-around be observant for classified documents without cover sheets. Unless an employee is specifically working on the document - a cover sheet must be placed on it to ensure classified information is not inadvertently exposed. If the document without a cover sheet is located in a SCIF, Secret or TS vault or secure room - this should not be written as a finding; however, highly recommend use of cover sheets as a best security practice for enforcement of need-to-know. If the document w/o cover sheet is found in a Secret Controlled Access Area (CAA) or below, this should be made a finding.  

  TACTICAL ENVIRONMENT: The check is applicable for fixed tactical classified processing environments. It is assumed the type of equipment referenced will be in a fixed environment. Not applicable to a field/mobile environment.


vuln_id: V-245829
rule_id: SV-245829r1138452_rule
severity: CAT I
title: Classified Monitors/Displays (Physical Control of Classified Monitors From Unauthorized Viewing)
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to limit access to unauthorized personnel to information displayed on classified monitors/displays can result in the loss or compromise of classified information, including NOFORN information.

  REFERENCES:

  National Disclosure Policy - 1 (NDP-l) 

  National Security Directive 42, "National Policy for the Security of National Security Telecommunications and Information Systems" 

  DODD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations SPECIAL NOTE: Enclosure 3 to DODD 5230.11 establishes specific criteria for the disclosure of classified information.

  Use guidance on sharing information with REL Partners on SIPRNET at http://www.ssc.smil.mil/ - follow Policy/Guidance&Documentation link and then SIPRNet Information Sharing.

  DODD 5230.20; Visits, Assignments, and Exchanges of Foreign Nationals

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl A, para 7.b.(1) & (2) and Encl C, para 27.f. and 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  PE-5, PE-18, PS-3(1), PS-6, PS-6(2), MA-5

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Enclosure 3, paragraph 11.                  

  DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP), 3 April 2017, Section 6., paragraphs 6.1. and 6.2.b.&c.

  Originating DOD Manual 5200.01, Volume 1, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification, Encl 2, para 9.j.(1) and Encl 3, para 5.b., 7.b.(5), 12.e.

  DOD Manual 5200.01, Volume 2, 24 February 2012, SUBJECT: DOD Information Security Program: Marking of Classified Information; Enclosure 3, paragraph 18.a.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 2, para 14.a & b.;Encl 3, para 5; Encl 4, para 2.c. ;Appendix to Encl 4, para 1.f. and Encl 7.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  REQUIREMENTS FOR BOTH US ONLY CLASSIFIED (SIPRNet) ENVIRONMENTS WITHOUT FN PRESENCE AND ENVIRONMENTS WITH FN PRESENCE:

  1. All classified information system processing locations must have physical and procedural controls to ensure that no unauthorized viewing of monitor screens is possible or occurring. This includes viewing by uncleared persons and/or those w/o need-to-know. It also includes REL partners or other FN who may have been granted liberal physical access to areas where US ONLY classified is processed. This is the primary purpose for this STIG Rule requirement.

  2. Classified monitor screens must not be visible or capable of being observed from outside the secure space (e.g., from common hallways or through doors or windows).
   
  3. There must be a visitor/escort control procedure in place (that it is actually being used) for announcing unauthorized/uncleared personnel in the area and that uncleared persons and/or those without the need-to-know (to include FN) are continuously escorted when they are in the immediate vicinity of US classified workstations and components.
   
  REQUIREMENTS ONLY FOR CLASSIFIED (SIPRNet) ENVIRONMENTS WITH FN PRESENCE:

  4. There must be local written procedures AND adequate documented proof of training (annually minimum) covering rules for interaction between US and FN employees. All US and FN employees must be equally aware of the rules and procedures. BOTH must be provided with applicable written guidance and training in this area.

  5. U.S.-only workstations must be "grouped" together in a U.S.-controlled workstation space when workstations are located in workspaces physically accessible by foreign nationals (such as combined operations centers).
   
  6. If the grouping of U.S.-only workstations at a site is not operationally possible, the following steps must be taken:

    a. The U.S. command or agency must authorize an exception at the site, in writing, stating operational reasons for exception, and maintain the record of exception. This exception must be approved by the appropriate CC/S/A level of command, which is normally a 3 or 4 star Flag Officer level.
   
    b. Develop, publish, and maintain site specific written procedures on security measures to safeguard U.S.-only classified workstations. (in conjunction with written procedures under requirement #4)
   
    c. U.S. personnel must be briefed, trained (annually minimum) and enforce security measures. (in conjunction with training under requirement #4)

  NOTE: Requirement #6 is an allowable alternative to Requirement #5 and one or the other must be conducted.

  7. If a foreign national is permitted to view a US Only screen, U.S. personnel must first ensure:

    a. Information is releasable in accordance with CC/S/A guidance and is consistent with National Disclosure Policy (NDP)-1; DODD 5230.11; DODD 5230.20; DOD Manual 5200.01; and CJCSI 5221.01.

    b. The organization Foreign Disclosure Officer, Foreign Contact Officer, or Security Manager must be consulted to ensure the foreign national has a security clearance granted by his or her government at a level equal to that of the classified information involved, and a Delegation of Disclosure Letter (DDL) has been issued to the specific FN partner to support the release of US classified information or material, and that there is an official need-to-know.

check_text:
  BACKGROUND NOTE: This requirement includes both situations where there is primarily a US Classified processing environment (no routine Foreign National (FN) presence) AND also contains guidance to be used for environments where FN are employed or present. It is arranged first by GUIDELINES FOR SITES WITHOUT A FN PRESENCE followed by GUIDELINES FOR ENVIRONMENTS WITH FN PRESENCE.
   
  Following a lengthy discussion of the guidelines and considerations, the specific checks for this requirement are found, along with the default severity level applicable to each check.

  Finally, guidance for applicability to tactical environments is provided.

  GUIDELINES FOR SITES WITHOUT A FN PRESENCE:

  The following physical controls should be used (individually or collectively) as a guide to evaluate compliance and can be recommended for site use; however, any method or combination of methods clearly being used successfully by the site under review may be acceptable.

  POSSIBLE SOLUTIONS:
  1. The best physical control solution is to locate all US Only classified terminals (open SIPRNet) in areas where only persons with at least a secret (or higher) security clearance have unescorted access. This type of area is commonly known as a secret Controlled Access Area (CAA). Placement of classified terminals in more highly controlled spaces like in secret or top secret (TS) vaults or secure rooms or SCIFs meets the access control requirements of a secret or TS CAA in addition to providing superior physical security of the location. Such additional physical security protection may be appropriate depending on organization mission and need to continually maintain classified information processing equipment within an open storage environment.
   
  2. Regardless of the type of environment in which classified work stations/monitors are located, ensuring that uncleared persons or those without need-to-know do not have easy access or inadvertent visibility to the classified monitor screens can be accomplished by placing (grouping together) the classified work stations in the back of such rooms/areas or behind partitions. This ensures uncleared visitors have limited opportunity to walk by a classified monitor and inadvertently be exposed to classified data.

  3. If isolation (grouping in controlled space) of the terminals is not practical, a privacy filter should be placed on each classified (SIPRNET) monitor to prevent ease of observation by any unauthorized individual simply passing by. This is a good idea even if other physical controls of classified work stations are used. The use of the privacy filters is an excellent alternative solution where physical separation or repositioning of monitors in rooms is not possible due to space limitations.

  4. Classified monitor screens should not be placed facing doorways or windows through which public or unrestricted viewing of the monitor is possible. If space limitations do not allow for such placement then ensuring doors are closed or that windows are covered by screens or blinds during classified processing can be used - but only if this procedure is part of documented security procedures and security training.
   
  5. Finally a solution for areas where work stations (cubes) are used is to place doors or the less costly cube screens across the openings for use when classified work is being conducted.

  ABSOLUTE REQUIREMENTS:
  While the "possible solutions" cover a range of suggest compliance possibilities the following covers an absolute requirement for which there can be no exception:

  1. When uncleared visitors need to enter CAAs, secure rooms, vaults or SCIFs where classified work stations are located there must be a procedure to ensure their presence is announced before entering. This will allow time for screens and classified material to be covered from view.
   
  2. All uncleared visitors must be under continuous escort by a properly cleared employee while within the CAA/secure room/vault/or SCIF. 

  GUIDELINES FOR ENVIRONMENTS WITH FN PRESENCE:
   
  Environments where FN are present (may even be embedded as US DOD employees) require even more diligence and additional considerations for protection of US Only classified (SIPRNet) terminal screens/workstation screens and monitors. This is because while sharing of certain specific classified information may be permitted, there is always the possibility that US Only or NOFORN information may also be present within the physical environment or accessible on visible/unprotected workstation screens.

  Foreign Nationals, even if they are embedded partners in US DOD operations, are not afforded access to any and all US classified information. This erroneous assumption is prevalent in many CC/S/A operation centers where FN liaison and exchange personnel are routinely present. Release of US classified information can only be made to FN partners if specifically compliant with National Disclosure Policy, has been determined releasable to the Foreign National's host country and a Delegation of Disclosure Letter (DDL) has been issued to the specific FN partner to support the release of US classified information or material.

  *Where FN are present (regardless of their authorized physical and systems access or security clearance) - US Only work stations and network equipment must be under strict US control at all times.
   
  This process involves a combination of physical control measures AND employee awareness. Reviewers must use a flexible approach with an understanding of the synergistic relationship of physical controls and employee awareness to properly evaluate compliance.

  REGULATORY STANDARD FOR ENVIRONMENTS WITH FN PRESENCE: This relationship of physical protective measures with employee awareness gained through procedures and training is based on the following excerpt from CJCSI 6510-01F: 
  In areas where there is the potential for Foreign National Access to U.S.-Only Workstations and Network Equipment, CC/S/As shall:

  1. Maintain strict U.S. control of U.S.-only workstations and network equipment at all times. This includes network equipment such as printers, copiers, and faxes.

  2. Group U.S.-only workstations together in a U.S.-controlled workstation space when workstations are located in workspaces physically accessible by foreign nationals (such as combined operations centers).

  3. If the grouping of U.S.-only workstations at a site is not operationally possible, the following steps shall be taken:

    a. The U.S. command or agency shall authorize an exception at the site, in writing, stating operational reasons for exception, and maintain the record of exception. NOTE: this exception must be approved by the appropriate CC/S/A level of command, which is normally a 3 or 4 star Flag Officer.

    b. Develop, publish, and maintain specific site written procedures on security measures to safeguard U.S.-only classified workstations.

    c. Ensure that U.S. personnel are briefed and enforce security measures.
    
  4. Announce presence. If a foreign national is permitted access to U.S.-controlled workstation space, the individual must be announced, must wear a badge clearly identifying him or her as a foreign national, and must be escorted at all times. In addition, a warning light must be activated if available and screens must be covered or blanked.

  5. If the foreign national is permitted to view the screen, U.S. personnel must ensure:

    a. Information is releasable in accordance with CC/S/A guidance and shall be consistent with National Disclosure Policy (NDP)-1; DODD 5230.11; DODD 5230.20; DOD Manual 5200.01; and CJCSI 5221.01.

    b. Check with organization security office to ensure foreign national has security clearances granted by his or her government at a level equal to that of the classified information involved and an official need-to-know.

  POSSIBLE SOLUTIONS:
  The following physical controls should be used (individually or collectively) as a guide to evaluate compliance and can be recommended for site use; however, any method or combination of methods clearly being used successfully by the site under review may be acceptable:

  1. The "best physical control solution" is to locate all US Only terminals in areas where the FN do not have easy access or visibility to the monitor screens. This can be accomplished by placing them in the back of rooms/areas or behind partitions. Normally if US Only SIPRNet PCs are placed in the back of a room or within the secure space the REL/FN work stations would then be placed near the front of the area to reduce the frequency of FN officers passing by US Only SIPRNet (or other US Only classified) work stations. When FN employees need to enter areas where US Only work stations are located there should be a procedure to ensure their presence is announced before entering. This will allow time for screens and classified material not releasable to FN to be covered from view.

  2. If isolation of the terminals is not practical, a privacy filter should be placed on each US Only classified (SIPRNET) monitor to prevent ease of observation by any unauthorized individual. This is a good idea even if physical separation of US Only and REL/FN work stations is used. The use of the privacy filters is the best alternative "physical control solution" where physical separation in rooms is not possible due to space limitations and/or the impeding of interaction between US personnel and FN partners.
   
  3. Another acceptable physical security alternative solution for areas where work stations (cubes) are used is to place doors or the less costly cube screens across the openings for when classified work (especially on the US Only cubes) is being performed.

  4. Finally, in addition to any physical separation, obscuration or other control measures in place (or lack thereof) written local policy/procedures and initial/recurring training are absolutely necessary to ensure that all US personnel are:

    a. Aware of REL/FN Officers presence in common work areas when working on non-releasable applications/sites on the SIPRNet and

    b. Aware of exactly what classified or sensitive information is not releasable.

  ABSOLUTE REQUIREMENTS:
  While the "possible solutions" cover a range of suggest compliance possibilities the following covers an absolute requirement for which there can be no exception:

  1. When uncleared visitors need to enter CAAs, secure rooms, vaults or SCIFs where classified work stations are located there must be a procedure to ensure their presence is announced before entering. This will allow time for screens and classified material to be covered from view.
   
  2. All uncleared visitors must be under continuous escort by a properly cleared employee while within the CAA/secure room/vault/or SCIF.
   
  3. Announce presence of Foreign Nationals (FN). If a foreign national is permitted access to U.S.-controlled workstation space, the individual must be announced, must wear a badge clearly identifying him or her as a foreign national, and must be escorted at all times. In addition, a warning light must be activated if available and screens must be covered or blanked.

  4. If the foreign national is permitted to view a US Only screen, U.S. personnel must ensure:

    a. Information is releasable in accordance with CC/S/A guidance and is consistent with National Disclosure Policy (NDP)-1; DODD 5230.11; DODD 5230.20; DOD Manual 5200.01; and CJCSI 5221.01.

    b. A check with the organization security office is conducted to ensure the foreign national has security clearances granted by his or her government at a level equal to that of the classified information involved, that an appropriate DDL is on-hand to validate the security clearance and release of US classified information, and that there is an official need-to-know.

  CHECKS FOR *BOTH* US ONLY CLASSIFIED (SIPRNet) ENVIRONMENTS WITHOUT FN PRESENCE AND ENVIRONMENTS WITH FN PRESENCE:

  1. CHECK all classified monitor locations to ensure that no unauthorized viewing is possible or occurring. This includes viewing by uncleared persons and/or those w/o need-to-know. It also includes REL partners or other FN who may have been granted liberal physical access to areas where US ONLY classified is processed. This check is the primary action for reviewers under this requirement. (CAT I)

  2. CHECK/validate that classified monitors cannot be observed from outside the secure space (e.g., from common hallways or through doors or windows). (CAT I)

  3. CHECK access control procedures and observe actual escort procedures. Ensure there is a process (and that it is actually being used) for announcing unauthorized/uncleared personnel in the area and that uncleared persons and/or those without the need-to-know (to include FN) are continuously escorted when they are in the immediate vicinity of US classified workstations and components. (CAT I)

  CHECKS *ONLY FOR* CLASSIFIED (SIPRNet) ENVIRONMENTS WITH *FN PRESENCE*:

  4. CHECK to ensure there are local written procedures AND adequate documented proof of training (annually minimum) covering rules for interaction between US and FN employees. All US and FN employees must be equally aware of the rules and procedures. BOTH must be provided with applicable written guidance and training in this area. (CAT II)

  5. CHECK that U.S.-only workstations are "grouped" together in a U.S.-controlled workstation space when workstations are located in workspaces physically accessible by foreign nationals (such as combined operations centers). (CAT II)

  6. CHECK that If the grouping of U.S.-only workstations at a site is not operationally possible, the following steps have been taken:

    a. The U.S. command or agency has authorized an exception at the site, in writing, stating operational reasons for exception, and maintain the record of exception. This exception must be approved by the appropriate CC/S/A level of command, which is normally a 3 or 4 star Flag Officer level. (CAT II)

    b. Develop, publish, and maintain site specific written procedures on security measures to safeguard U.S.-only classified workstations. (in conjunction with written procedures required for CHECK #4) (CAT II)

    c. Ensure that U.S. personnel are briefed, trained (annually minimum) and enforce security measures. (in conjunction with training required for CHECK #4) (CAT II)

  NOTE: CHECK #6 is an allowable alternative to CHECK #5 and one or the other must be conducted.

  7. CHECK that if a foreign national is permitted to view a US Only screen, U.S. personnel have ensured:

    a. Information is releasable in accordance with CC/S/A guidance and is consistent with National Disclosure Policy (NDP)-1; DODD 5230.11; DODD 5230.20; DOD Manual 5200.01; and CJCSI 5221.01. (CAT I)

    b. The organization Foreign Disclosure Officer, Foreign Contact Officer, or Security Manager was consulted to ensure the foreign national has a security clearance granted by his or her government at a level equal to that of the classified information involved, and a Delegation of Disclosure Letter (DDL) has been issued to the specific FN partner to support the release of US classified information or material, and that there is an official need-to-know. (CAT I)

  TACTICAL ENVIRONMENT:
   
  1. This check is applicable for all classified processing environments including a field/mobile environment. Commanders in such environments may use whatever means available or feasible to control unauthorized physical access to classified monitors.
   
  2. This check is applicable where REL Partners or other FN allies are employed within fixed facilities located in a theater of operations (tactical environment) with physical access to US Classified or Sensitive Systems.

  3. Wherever classified systems/with screens/monitors are used, uncleared persons must always be escorted when permitted in the physical processing environment.


vuln_id: V-245830
rule_id: SV-245830r1138453_rule
severity: CAT I
title: Monitor Screens - Disable Access by CAC or Token Removal, or Lock Computer via Ctrl/Alt/Del
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>The DOD Common Access Cards (CAC) a "smart" card, is the standard identification for active-duty military personnel, Selected Reserve, DOD civilian employees, and eligible contractor personnel. It is also the principal card used to enable physical access to buildings and controlled spaces, and it provides access to defense computer networks and systems. 
   
  The card, which is the property of the U.S. Government, is required to be in the personal custody of the member at all times.

  System Access Tokens are also used on the SIPRNet and the cards along with a Personal identity Number (PIN) can be used to access classified information on the SIPRNet in lieu of a logon ID and password.

  CAC and SIPRNet tokens are very important components for providing both physical and logical access control to DISN assets and must therefore be strictly controlled.

  Physically co-locating REL Partners or other FN - who have limited access to the SIPRNet or other US Classified systems - near US personnel in a collateral classified (Secret or higher) open storage area or in a Secret or higher Controlled Access Area (CAA) that processes classified material is permissible for operational efficiency and coordination.
   
  Failure to limit access to information systems is especially important in mixed US/FN environments.  This is particularly important on US Only classified terminals when not personally and physically attended by US personnel. The failure to properly disable information workstations and monitor screens when unattended can result in FN personnel having unauthorized access to classified information, which can result in the loss or compromise of classified information, including NOFORN information. 

  Appropriate but simple physical and procedural security measures must be put in place to ensure that unauthorized persons to include FN partners do not have unauthorized access to information not approved for release to them. Control of CACs, SIPRNet tokens and locking of computer work stations when unattended is an important aspect of proper procedural security measure implementation.

  REFERENCES:

  National Disclosure Policy - 1 (NDP-l) 

  National Security Directive 42, "National Policy for the Security of National Security Telecommunications and Information Systems 

  DODD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations SPECIAL NOTE: Enclosure 3 to DODD 5230.11 establishes specific criteria for the disclosure of classified information.

  Use guidance on sharing information with REL Partners on SIPRNET at http://www.ssc.smil.mil/ - follow Policy/Guidance&Documentation link and then SIPRNet Information Sharing.

  Homeland Security Presidential Directive-12 (HSPD-12), "Policy for a Common Identification Standard for Federal Employees and Contractors," 27 August 2004 

  DOD Manual 1000.13, Volume 1, SUBJECT: DOD Identification (ID) Cards: ID Card Life-Cycle, 
  January 23, 2014

  DOD Manual 1000.13, Volume 2, SUBJECT: DOD Identification (ID) Cards: Benefits for Members of the Uniformed Services, Their Dependents, and Other Eligible Individuals, January 23, 2014

  UNDER SECRETARY OF DEFENSE (Intelligence), Directive-Type Memorandum (DTM) 09-012, "Interim Policy Guidance for DOD Physical Access Control", December 8, 2009, Incorporating Change 6, Effective November 20, 2015

  DODI 1000.13, SUBJECT: Identification (ID) Cards for Members of the Uniformed Services, Their Dependents, and Other Eligible Individuals, January 23, 2014 

  DODI 8520.02 , SUBJECT: Public Key Infrastructure (PKI) and Public Key (PK) Enabling, May 24, 2011 

  DODD 5230.20; Visits, Assignments, and Exchanges of Foreign Nationals

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 26.d., 27.d.(e) and 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  IA-2, IA-4, PL-4, PS-6, PS-8, AC-3, AC-11, SC-28

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Enclosure 3, 
  paragraph 8.                  

  DOD Manual 5200.01, Volume 1, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification, Encl 2, para 9.j.(1) and Encl 3, para 5.b., 7.b.(5), 12.e.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 3, para 5; Encl 4, para 2.c. ;Appendix to Encl 4, para 1.f. and Encl 7.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume1 

  Satisfies: Monitor Screens - Disable Access by CAC or Token Removal, or Lock Computer via Ctrl/Alt/Del</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. SIPRNet servers and/or work station hard drives/monitors/keyboards must be disabled (locked) by CAC or Token Removal, or where CACs or tokens are not used the Computer must be locked via Ctrl/Alt/Del - when not personally and physically attended by properly vetted and cleared US personnel.

  2. NIPRNet servers and/or work station hard drives/monitors/keyboards must be disabled (locked) by CAC or Token Removal, or where CACs or tokens are not used the Computer must be locked via Ctrl/Alt/Del - when not personally and physically attended by properly vetted US personnel.

  3. CACs and other tokens must not be left unattended and must be in the physical custody of the person to whom they were issued.

check_text:
  Check to ensure:

  1. SIPRNet servers and/or work station hard drives/monitors/keyboards are disabled (locked) by CAC or Token Removal, or where CACs or tokens are not used the Computer must be locked via Ctrl/Alt/Del - when not personally and physically attended by properly vetted and cleared US personnel. (CAT I)

  2. NIPRNet servers and/or work station hard drives/monitors/keyboards (*used by system administrators with privileged access) are disabled (locked) by CAC or Token Removal, or where CACs or tokens are not used the Computer must be locked via Ctrl/Alt/Del - when not personally and physically attended by properly vetted US personnel. (CAT I)

  3. NIPRNet work station hard drives/monitors/keyboards (*used by general users or individuals without privileged systems access) are disabled (locked) by CAC or Token Removal, or where CACs or tokens are not used the Computer must be locked via Ctrl/Alt/Del - when not personally and physically attended by properly vetted US personnel. (CAT II)

  4. CACs and other tokens are not left unattended and are in the physical custody of the person to whom they were issued. (CAT II)

  TACTICAL ENVIRONMENT: This check is applicable to all environments (including a field/mobile tactical environment) where information system assets are connected to the DISN.


vuln_id: V-245831
rule_id: SV-245831r1136751_rule
severity: CAT III
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Classified Monitors/Displays (Procedures for Obscuration of Classified Monitors) - protection from uncleared persons or those without a need-to-know.

description:
  <VulnDiscussion>Failure to develop procedures and training for employees to cover responsibilities and methods for limiting the access of unauthorized personnel to classified information reflected on information system monitors and displays can result in the loss or compromise of classified information.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  PE-1, PS-1, PE-5, PS-3(1) & (2) and PS-6(2).

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Enclosure 3, paragraph 7.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information, Enclosure 2 paragraph 14.a.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure there are written procedures for employees to follow to keep classified monitors from being viewed by unauthorized persons. Procedures should include when to cover or turn-off classified monitors - such as when visitors are announced, importance of maintaining monitor positioning for privacy, pulling of window shades, blinds, etc. Procedures must be tailored to the physical environment and mission operations of the organization.

check_text:
  Check to ensure there are written procedures for employees to follow to keep classified monitors from being viewed by unauthorized persons. Procedures should include when to cover or turn-off classified monitors - such as when visitors are announced, importance of maintaining monitor positioning for privacy, pulling of window shades, blinds, etc. Procedures must be tailored to the physical environment and mission operations of the organization. 

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments. Not applicable to a field/mobile environment.


vuln_id: V-245832
rule_id: SV-245832r1138456_rule
severity: CAT II
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  End-of-Day Checks - Organizations that process or store classified information must establish a system of security checks at the close of each duty and/or business day to ensure that any area where classified information is used or stored is secure. SF 701, Activity Security Checklist, shall be used to record such checks.

description:
  <VulnDiscussion>Failure to have written guidance to provide guidance for end-of-day (EOD) checks could lead to such checks not being properly conducted. If EOD checks are not properly conducted the loss or improper storage of classified material might not be promptly discovered. This could result in a longer duration of the security deficiency before corrective action is taken and make discovery of factual information concerning what caused the security incident and assigning responsibility and remedial actions more difficult. Ultimately the failure to perform consistent EOD checks can lead to the loss or compromise of classified or sensitive information.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-1, PE-3(2), MP-4 

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Enclosure 3, paragraph 7.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information, Enclosure 2, paragraph 9. 

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure that areas where classified information is processed or stored have an established system of security checks implemented at the close of each duty and/or business day to ensure that any area where classified information is used or stored is secure. SF 701, "Activity Security Checklist," must be used to record these checks. 

  In addition to the SF 701, the responsible site or organization should have a written procedure to outline the end-of-day check process and to guide checkers with their duties. For instance the procedure should include instructions on how to handle any classified information that is found outside of proper storage.

  An integral part of the security check system must incorporate the securing of all vaults, secure rooms, and containers used for storing classified material. SF 702, "Security Container Check Sheet," must be used to record each opening, closing, and verification checks of these storage mediums. 

  Area verification checks will be recorded on the SF 701 upon completion of end-of-day checks. Following are recommended end-of-day checks, which should be included on the SF 701, but ultimately the checks must be tailored to fit the physical configuration and mission of the site:                           
  a. Activation of Intrusion Detection System (IDS) alarm sensors where applicable.
  b. All classified material has been properly stored.                           
  c. Removal of CAC Cards and SIPRNet tokens from workstations.
  d. All windows, doors or other openings are properly secured.                     
  e. Verification of lock box closure for SIPRNet wall jacks and PDS lines, where applicable.
  f. Additional checks such as turning off of coffee pots and lights, power-off of printers/MFDs, securing of STE keys, etc. can be identified and accomplished as part of the check.
  g. The SF 701, Activity Security Checklist shall be used to record these checks, to include after hours, weekend and holiday activities.

  Results of end-of-day checks (SF 701 forms) should be retained for at least 30 days (or otherwise as required by Component records management schedules) after completion of the monthly form to ensure availability for audits and resolution of subsequent discovery of security incidents or discrepancies. While 24/7 operational areas storing classified materials do not necessarily require end-of-day (EOD) checks it is highly recommended that a system of checks be instituted (similar to EOD checks) upon each change of shift. Such checks jointly conducted by incoming and outgoing supervisors can be used to verify the integrity of safes and classified equipment/materials under their control and can be used to narrow the window of time for a preliminary inquiry should a security incident occur.

check_text:
  Organizations that process or store classified information must establish a system of security checks at the close of each duty and/or business day to ensure that any area where classified information is used or stored is secure. SF 701, "Activity Security Checklist," shall be used to record such checks. An integral part of the security check system shall be the securing of all vaults, secure rooms, and containers used for storing classified material. SF 702, "Security Container Check Sheet," shall be used to record each opening, closing, and verification checks of these storage mediums. Area verification checks will be recorded on the SF 701 upon completion of end-of-day checks. Recommended end-of-day checks, which should be included on the SF 701 are:                           
  a. Activation of Intrusion Detection System (IDS) alarm sensors where applicable.
  b. All classified material has been properly stored. 
  c. Removal of CAC Cards and SIPRNet tokens from workstations.
  d. All windows, doors or other openings are properly secured.                     
  e. Verification of lock box closure for SIPRNet wall jacks and PDS lines, where applicable.
  f. Additional checks such as turning off of coffee pots and lights, power-off of printers/MFDs, securing of STE keys, etc. can be identified and accomplished as part of the check.
  g. The SF 701, Activity Security Checklist shall be used to record these checks, to include after hours, weekend and holiday activities.                        

  Results of end-of-day checks (SF 701 forms) should be retained for at least 30 days after completion of the monthly form (or otherwise as required by Component records management schedules) to ensure availability for audits and resolution of subsequent discovery of security incidents or discrepancies.

  TACTICAL ENVIRONMENT: This check is applicable in a fixed operational facility in a tactical environment if classified equipment is used or documents or media are created/extracted from the SIPRNet. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245833
rule_id: SV-245833r1136757_rule
severity: CAT I
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Classified Reproduction - SIPRNet Connected Classified Multi-Functional Devices (MFD) located in Space Not Approved for Collateral Classified Open Storage.

description:
  <VulnDiscussion>Classified Multi-Functional Devices (MFD) include printers, copiers, scanners and facsimile capabilities and contain hard drives that maintain classified data or images. Failure to locate these devices in spaces approved for classified open storage could enable uncleared persons to access classified information, either from unsanitized hard drives or from printed/copied material that is left unattended on the machine for any period of time.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: MP-1, MP-4, PE-1, PE-5.

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Enclosure 3, paragraph 7.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Enclosure 2 paragraph 14.&15., Enclosure 3 and Enclosure 7, paragraph 6.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5200.32 Volume 1

  NIST Special Publication 800-88, Revision 1, Guidelines for Media Sanitization, December 2014

  NSA/CSS Policy Manual 9-12, 15 December 2014, Subject: NSA/CSS Storage Device Sanitization Manual</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This Potential Vulnerability covers multi-functional devices (MFD) (connected to the SIPRNet) that are used for printing, copying or other reproduction of classified DOCUMENTS. 
   
  1. Unless the MFD can be properly purged of all classified data or images after each use for classified - it must be housed in an area approved for open storage of classified material. Most current copiers, printers, scanners and facsimile machines or multi-functional devices (MFD) contain hard drives that collect and store images and data. 

  Therefore these machines must be maintained in space approved for open storage of classified (secret or higher for SIPRNet).  

  NOTE: Clearing of hard drives (such as by overwriting) is not adequate to sanitize a classified hard drive (magnetic or solid state) so that it can be deemed unclassified and left unattended in an area not approved for classified open storage. This is regardless of the number of times the drive is over-written. A hard drive (magnetic or solid state) can only be sanitized (made unclassified) by degaussing and/or physical destruction, thereby rending the drive no longer usable. 
   
  2. If not maintained within a secret or higher collateral classified open storage area and hard drives (non-volatile memory) ARE NOT present:
   
  MFD (or individual copiers, scanners, printers or facsimile machines) must be properly purged (AKA: sanitized) of classified data or images after each period of reproducing classified and be maintained in space where access is controlled to at least the level of the classified material authorized to be copied on the machine. This type of area is referred to as a Controlled Access Area (CAA) - at least a secret CAA or TS CAA for SIPRNet connections. 
  Sanitizing a MFD means it can be considered and treated as an unclassified device.
   
  NOTE: Hard drives with non-volatile memory cannot be sanitized by current overwriting/clearing procedures and must be destroyed to be considered sanitized/unclassified. Hence MFD with non-volatile memory cannot be sanitized for reuse.
   
  Only those MFD with entirely volatile memory can be sanitized and reused with removal of power from the device. It is important to note that powering down the machine will be a necessary part of this procedure to ensure that volatile memory is totally erased and sanitized so that it can be considered to be an unclassified device. Documented procedures must be on-hand for this process.

  3. If not maintained within a secret or higher collateral classified open storage area and hard drives (non-volatile memory) ARE present:
   
  MFD (or individual copiers, scanners, printers or facsimile machines) with hard drives (non-volatile memory) must be located and operated in a secret or higher CAA and the hard drive must be promptly removed after each use (or otherwise when unattended by cleared employees) and stored in a GSA approved safe. 
   
  It is important to note that powering down the machine will still be a necessary part of this procedure to ensure that volatile memory is totally erased and sanitized so that it can be considered to be an unclassified device. There must be documented procedures on-hand for this process. 

  NOTE: Despite the mitigations in 2 and 3 above, there is still a concern that the procedure will not be accomplished promptly or successfully each time and that the risk for printed or copied classified documents to be left unattended for periods of time in the MFD machines still exists. Therefore vulnerability still exists and must be considered as a potential finding.

check_text:
  This set of checks covers multi-functional devices (MFD) (connected to the SIPRNet) that are used for printing, copying or other reproduction of classified DOCUMENTS. 

  Checks: 
   
  1. Unless the MFD can be properly purged and sanitized (made unclassified) of all classified data or images after each use for classified - it must be housed in an area approved for open storage of classified material. 

  Most current copiers, printers, scanners and facsimile machines or multi-functional devices (MFD) contain hard drives that collect and store images and data. 

  Therefore check to ensure that such machines are maintained in space approved for open storage of classified (secret or higher for SIPRNet). 

  NOTE that to be properly sanitized means that the MFD can be treated as an unclassified piece of equipment once a successful purge of data or images is completed. (CAT I) 

  2. If not maintained within a secret or higher collateral classified open storage area: 

  Check that MFD (or individual copiers, scanners, printers or facsimile machines) do not have hard drives containing non-volatile memory in the device and that the volatile memory is purged/sanitized of all classified data or images after each use.

  Additionally check that these MFD are maintained in space where access is controlled to at least the level of the classified material authorized to be copied on the machine. This type of area is referred to as a Controlled Access Area (CAA) - at least a secret CAA or TS CAA for SIPRNet connections.
   
  ONLY those MFD with entirely volatile memory can be sanitized and reused upon removal of power from the device. 

  Check to ensure that powering down the machine is a part of the MFD sanitization procedure to ensure that volatile memory is totally erased and sanitized so that it can be considered to be an unclassified device. Documented procedures must be on-hand for this process.
   
  NOTE: Sanitizing a MFD means it can be considered and treated as an unclassified device. Hard drives with non-volatile memory cannot be sanitized by current overwriting/clearing procedures and must be destroyed (degaussing and/or physical destruction) to be considered sanitized/unclassified. Hence MFD with non-volatile memory cannot be sanitized for reuse. Only MFD with volatile memory can be sanitized for reuse. 

  Only if ALL of the sub-checks listed under check 2 are compliant is it a CAT II finding. Otherwise if ANY of the sub-checks are not compliant it remains a CAT I finding. (CAT II)

  3. If not maintained within a secret or higher collateral classified open storage area and hard drives with non-volatile memory are present: 

  Check to ensure MFD (or individual copiers, scanners, printers or facsimile machines) are located in a secret or higher CAA and the hard drive is promptly removed after each use and stored in a GSA approved safe. 

  Check to ensure that powering down the machine is a required part of this procedure to ensure that volatile memory is totally erased and sanitized so that it can be considered to be an unclassified device.  

  Check that documented procedures are on hand to support this process. 

  Only if ALL of the sub-checks listed under check 3 are compliant is it a CAT II finding. Otherwise if ANY of the sub-checks are not compliant it remains a CAT I finding. 
  (CAT II)

  EXPLANATION for CAT II FINDINGS: Despite the mitigations in checks 2 and 3 above, there is still a concern that the mitigation procedure will not be accomplished promptly or successfully each time and there is a risk for printed or copied classified documents to be left unattended for periods of time in the networked MFD machines, especially when printed from a remote workstation location. Therefore, since a potential vulnerability still exists it is still considered as a CAT II finding.

  TACTICAL ENVIRONMENT: This check is applicable in a fixed operational facility in a tactical environment if classified equipment is used or documents or media are created/extracted from the SIPRNet. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245834
rule_id: SV-245834r1136759_rule
severity: CAT II
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Classified Reproduction - Following guidance for System to Media Transfer of Data from systems connected specifically to the SIPRNet In-Accordance-With (IAW) US CYBERCOM CTO 10-133A.

description:
  <VulnDiscussion>Failure to follow guidance for disabling removable media drives on devices connected to the SIPRNet or, if approved by the local AO, failure to follow US CYBERCOM procedures for using removable media on SIPRNet could result in the loss or compromise of classified information.

  REFERENCES:

  USCYBERCOM Communications Tasking Order (CTO) 10-133

  CTO 10-004A; CTO 09-002; CTO 10-084A & CTO 10-133A 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure A, paragraph 6 and Enclosure C, paragraph 21.h.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: MP-2, MP-4, SI-12.

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Enclosure 3, paragraph 7.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Enclosure 2 paragraph 15., Enclosure 3 and Enclosure 7.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  NIST Special Publication 800-88, Revision 1, Guidelines for Media Sanitization, December 2014

  NSA/CSS Policy Manual 9-12, 15 December 2014, Subject: NSA/CSS Storage Device Sanitization Manual

  CNSSP 26, National Policy on Reducing the Risk of Removable Media</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  General guidance to consider: Paper copies, electronic files, and other material containing classified information shall be reproduced only when necessary for accomplishing the organizations mission or for complying with applicable statutes or Directives. Personnel reproducing classified information must be knowledgeable of the procedures for classified reproduction and aware of the risks involved with the specific reproduction equipment and media being used and the appropriate countermeasures they are required to take. Reproduced material is to be placed under the same accountability and control requirements as applied to the original material. Classified material is to be reproduced only on approved and when applicable, properly
  accredited systems. 

  This check concerns ONLY reproduction and/or transfer of classified data using all forms of removable media on SIPRNet connected devices or systems. 

  Ensure that US CYBERCOM Communications Tasking Order (CTO) 10-133A is being complied with as follows: 

  1. Ensure that the write capability for all possible removable media is disabled as a default setting on all SIPRNet connected machines. 

  2. Ensure that write settings are only allowed when specifically approved by using the HBSS Device Control Module (DCM). 

  3. Ensure the system AO has specifically approved all persons authorized to transfer data from SIPRNet connected system components. 

  4. Ensure the ISSM maintains a list of all persons authorized by the AO to transfer data from the SIPRNet. 

  5. Ensure there are written procedures approved by the AO for use of removable media on SIPRNet.

check_text:
  General guidance: Paper copies, electronic files, and other material containing classified information shall be reproduced only when necessary for accomplishing the organizations mission or for complying with applicable statutes or Directives. Personnel reproducing classified information must be knowledgeable of the procedures for classified reproduction and aware of the risks involved with the specific reproduction equipment and media being used and the appropriate countermeasures they are required to take. Reproduced material is to be placed under the same accountability and control requirements as applied to the original material. Classified material is to be reproduced only on approved and when applicable, properly
  accredited systems. 

  This check concerns ONLY reproduction and/or transfer of classified data using all forms of removable media on SIPRNet connected devices or systems. 

  Check to ensure that US CYBERCOM Communications Tasking Order (CTO) 10-133A is being complied with as follows: 

  1. Ensure that the write capability for all possible removable media is disabled as a default setting on all SIPRNet connected machines. 

  2. Ensure that write settings are only allowed when specifically approved by using the HBSS Device Control Module (DCM). 

  3. Ensure the system AO has specifically approved all persons authorized to transfer data from SIPRNet connected system components. 

  4. Ensure the ISSM maintains a list of all persons authorized by the AO to transfer data from the SIPRNet. 

  5. Ensure there are written procedures approved by the AO for use of removable media on SIPRNet. 

  NOTE: Coordination with Technical Reviewers may be required to determine all of the information outlined above.
    
  TACTICAL ENVIRONMENT: This check is applicable in a fixed operational facility in a tactical environment if classified equipment is used or documents or media are created/extracted from the SIPRNet. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245835
rule_id: SV-245835r1138458_rule
severity: CAT III
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Classified Reproduction - Written Procedures for SIPRNet Connected Classified Multi-Functional Devices (MFD) located in Space Not Approved for Collateral Classified Open Storage. NOTE: This vulnerability concerns only PROCEDURES for the reproduction (printing, copying, scanning, faxing) of classified documents on Multi-Functional Devices (MFD) connected to the DODIN.

description:
  <VulnDiscussion>Lack of or improper reproduction procedures for classified material could result in the loss or compromise of classified information.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: MP-1, MP-4, PE-1,PE-5.

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Enclosure 3, paragraph 7.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Enclosure 2 paragraphs 14.&15.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Classified Reproduction - Document Copying using Multi-Functional Device (MFD) machines (ie., printer, copier, fax, scanner) connected to SIPRNet. This STIG Check concerns ONLY PROCEDURES for the reproduction of classified DOCUMENTS on Multi-Functional Devices (MFD) connected to the DODIN.

  General guidance: Paper copies, electronic files, and other material containing classified information shall be reproduced only when necessary for accomplishing the organization's mission or for complying with applicable statutes or Directives. Personnel reproducing classified information must be knowledgeable of the procedures for classified reproduction and aware of the risks involved with the specific reproduction equipment being used and the appropriate countermeasures they are required to take.  Reproduced material is to be placed under the same accountability and control requirements as applied to the original material.   

  Classified material is to be reproduced only on approved and, when applicable, properly accredited systems. 

  Ensure:
   
  1. Procedures for the proper reproduction of classified documents are posted on or near the MFD approved for classified reproduction. This is especially true when the MFD is capable of directly making copies of documents on the machine. The procedures must alert users when the particular MFD is approved for classified reproduction.
   
  2. Other MFD (used as copiers) in the organization that are not approved for classified document reproduction must also be marked to alert users of the prohibition against making classified copies. 
   
  3. Procedures posted near the MFD must contain steps for users to take after printing, copying, scanning or faxing classified documents. Steps must include double checking of the MFD for missed pages, counting original and copied pages, purging of images (if applicable), use of cover sheets, and general protection/control guidelines for reproduced documents. 

  NOTE: Most MFD contain both hard drives (non-volatile memory) and volatile memory and cannot be properly sanitized of classified data or images to make the MFD unclassified. Therefore, most (if not all) classified MFD should be housed and operated within space approved for collateral classified open storage. If not maintained in spaces approved for classified open storage all MFD with non-volatile memory that is used for classified reproduction must be under the continuous observation and control of a cleared person AT ALL TIMES.

check_text:
  Classified Reproduction - Document Copying using Multi-Functional Device (MFD) machines (i.e., printer, copier, fax, scanner) connected to SIPRNet. This Check concerns ONLY PROCEDURES for the reproduction of classified DOCUMENTS on Multi-Functional Devices (MFD) connected to the DODIN.

  General guidance: Paper copies, electronic files, and other material containing classified information shall be reproduced only when necessary for accomplishing the organization's mission or for complying with applicable statutes or Directives. Personnel reproducing classified information must be knowledgeable of the procedures for classified reproduction and aware of the risks involved with the specific reproduction equipment being used and the appropriate countermeasures they are required to take. Reproduced material is to be placed under the same accountability and control requirements as applied to the original material.   

  Classified material is to be reproduced only on approved and, when applicable, properly accredited systems. 

  Check to ensure:
   
  Check #1. Procedures for the proper reproduction of classified documents are posted on or near the MFD approved for classified reproduction. This is especially true when the MFD is capable of directly making copies of documents on the machine. The procedures must alert users when the particular MFD is approved for classified reproduction.
   
  Check #2. Other MFD (used as copiers) in the organization that are not approved for classified document reproduction must also be marked to alert users of the prohibition against making classified copies. 
   
  Check #3. Procedures posted near the MFD must contain steps for users to take after printing, copying, scanning or faxing classified documents. Steps must include double checking of the MFD for missed pages, counting original and copied pages, purging or clearing of images from the MFD (if applicable), use of cover sheets, and general protection/control guidelines for reproduced documents. 

  NOTE: Most MFD contain both hard drives (non-volatile memory) and volatile memory and cannot be properly sanitized of classified data or images to make the MFD unclassified. Therefore, most (if not all) classified MFD should be housed and operated within space approved for collateral classified open storage. If not maintained in spaces approved for classified open storage all MFD with non-volatile memory that is used for classified reproduction must be under the continuous observation and control of a cleared person AT ALL TIMES. A violation of this is a Category 1 Severity level finding and is covered under STIG ID: IS-10.01.01.

  TACTICAL ENVIRONMENT: This check is applicable in a fixed operational facility in a tactical environment if classified equipment is used or documents or media are created/extracted from the SIPRNet. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245836
rule_id: SV-245836r1138492_rule
severity: CAT I
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Destruction of Classified Documents Printed from the SIPRNet Using Approved Devices on NSA Evaluated Products Lists (EPL).

description:
  <VulnDiscussion>Failure to properly destroy classified material can lead to the loss or compromise of classified or sensitive information.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 29.h.(1) & 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: MP-1, MP-6, PE-1.

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Enclosure 3 paragraphs 17, 18, & 19.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  https://www.nsa.gov/Resources/Media-Destruction-Guidance</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  General Guidance: Classified documents and paper material identified for destruction shall be destroyed completely, to prevent anyone from reconstructing the classified information. Effective January 1, 2011, only equipment listed on an evaluated products list (EPL) issued by NSA may be used to destroy classified information.

  1. Unless determined otherwise by NSA, whenever an EPL is revised, equipment removed from the EPL may be utilized for destruction of classified information for up to 6 years
  from the date of its removal from the EPL.

  2. In all cases, if any such previously approved equipment needs to be replaced or otherwise requires a rebuild or replacement of a critical assembly (e.g., shredder blade assembly), the unit must be replaced with one listed on the appropriate EPL.

  The EPLs and further guidance may be obtained by calling (410) 854-6358 or at
   https://www.nsa.gov/Resources/Media-Destruction-Guidance/

  Fixes:

  1. Only crosscut shredders listed on an EPL for High Security Crosscut Paper Shredders can be used to destroy classified material. 

  2. Only pulverizers, disintegrators and pulping (wet process) devices listed on an EPL can be used to destroy classified water-soluble material. 

  3. Burn bags (if used to store classified paper awaiting destruction at a central destruction facility) must be sealed and safeguard in a safe or vault or area approved for classified open storage until actually destroyed.

check_text:
  General Guidance: Classified documents and paper material identified for destruction shall be destroyed completely, to prevent anyone from reconstructing the classified information. Effective January 1, 2011, only equipment listed on an evaluated products list (EPL) issued by NSA may be used to destroy classified information.

  In all cases, if any such previously approved equipment needs to be replaced or otherwise requires a rebuild or replacement of a critical assembly (e.g., shredder blade assembly), the unit must be replaced with one listed on the appropriate EPL.

  The EPLs and further guidance may be obtained by calling (410) 854-6358 or at: https://www.nsa.gov/Resources/Media-Destruction-Guidance

  Checks: 

  Check #1. Check that only crosscut shredders listed on an EPL for High Security Crosscut Paper Shredders are used to destroy classified material. 

  Check #2. Check that only pulverizers, disintegrators and pulping (wet process) devices listed on an EPL are used to destroy classified water-soluble material. 

  Check #3. Check to ensure that burn bags (if used to store classified paper awaiting destruction at a central destruction facility) are sealed and safeguard in a safe or vault or area approved for classified open storage until actually destroyed. 

  NOTE: Recommend that reviewers check shredded material, no matter how new or old the shredder appears to be. Look to determine if it is readily apparent the shred material is "not within specifications" due to lack of maintenance, bad teeth, etc., This discovery can result in a finding.

  TACTICAL ENVIRONMENT: Applies in all environments whenever classified documents are to be destroyed.


vuln_id: V-245837
rule_id: SV-245837r1136765_rule
severity: CAT I
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Classified Material Destruction - Improper Disposal of Automated Information System (AIS) Hard Drives and Storage Media

description:
  <VulnDiscussion>Failure to properly destroy classified material can lead to the loss or compromise of classified or sensitive information.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraphs 21.h.(9); 28; 29b.,d.(1)&(2).h.(1)&(2) and para 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: MP-1, MP-6, PE-1.

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014, Enclosure 3, paragraph 9.b.(8) & (9) 

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Enclosure 2, paragraph 14 & 14(d); Enclosure 3 paragraphs 17, 18, & 19; Enclosure 5, paragraph 3.d.(3); Enclosure 7, paragraph 6.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  NIST SP 800-88, Guidelines for Media Sanitization

  NSA/CSA Policy Manual 9-12, NSA/CSS Storage Device Declassification Manual

  NSA/CSS product lists for sanitization, destroying or disposing of various types of media containing sensitive or classified information:

  https://www.nsa.gov/Resources/Media-Destruction-Guidance</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  For CLASSIFIED automated information system (AIS) data processing and/or storage equipment such as hard drives and media:

  CLASSIFIED automated information system (AIS) data processing/storage devices such as system hard drives and media must be properly sanitized using approved NSA guidelines (purged of all classified data so that recovery using known laboratory attack is not possible) before such equipment or media is disposed of or placed in use (and/or stored) in a lower classification environment or an unclassified environment. 

  NOTE 1: Clearing procedures using overwrite software is not sufficient to dispose of classified equipment or media (for instance by release to property disposal, vendors, or placement in trash) or to re-use it in an unclassified or lesser classification environment other than its original classification level. Clearing will only enable the equipment or media to be re-used within the original classified environment. 

  NOTE 2: NSA guidance for classified equipment can be found in the NSA/CSA Policy Manual 9-12, NSA/CSS Storage Device Declassification Manual. Sanitization and disposal must also be IAW Enclosure 3 and Enclosure 7 of Volume 3 of DOD Manual 5200.01, which provides additional clarifying guidance for the DOD. Some important excerpts from this guidance pertaining to classified equipment and storage media follows:
  Classified IT storage media (e.g., hard drives) cannot be declassified by overwriting.
  Sanitization (which may destroy the usefulness of the media) or physical destruction is required for disposal.

  NOTE 3: The specific methods and procedures for sanitization of classified hard drives or storage media differ depending on sensitivity of data, type of hard drive or storage media (magnetic, solid state, etc...) and ownership of the hard drive or storage media. To ensure DOD information is not inadvertently disclosed to unauthorized individuals, the activity security manager should coordinate with the local Authorizing Official (AO) and/or IT staff to ensure local procedures for disposal of computer hard drives appropriately address removal of U.S. Government data prior to disposal.

check_text:
  For CLASSIFIED automated information system (AIS) data processing and/or storage equipment such as hard drives and media:

  Check to ensure data processing or storage devices are properly sanitized (purged of all classified data so that recovery using known laboratory attack is not possible) in accordance with current NSA guidance before such equipment or media is disposed of or placed in use (and/or stored) in a lower classification environment or an unclassified environment. 

  NOTE 1: Clearing procedures using overwrite software is not sufficient to dispose of classified equipment or media (for instance by release to property disposal, vendors, or placement in trash) or to re-use it in an unclassified or lesser classification environment other than its original classification level. Clearing will only enable the equipment or media to be re-used within the original classified environment. 

  NOTE 2: NSA guidance can be found in the NSA/CSA Policy Manual 9-12, NSA/CSS Storage Device Declassification Manual. Be certain to also read and apply specific guidance for the DOD from Enclosure 3 and Enclosure 7 of Volume 3 of DOD Manual 5200.01. Important excerpts from this guidance pertaining to disposal of classified equipment and storage media follow:

  Classified IT storage media (e.g., hard drives) cannot be declassified by overwriting.

  Sanitization (which may destroy the usefulness of the media) or physical destruction is required for disposal.

  NOTE 3: The specific methods and procedures for sanitization of classified hard drives or storage media differ depending on sensitivity of data, type of hard drive or storage media (magnetic, solid state, etc...) and ownership of the hard drive or storage media. To ensure DOD information is not inadvertently disclosed to unauthorized individuals, the activity security manager should coordinate with the local Authorizing Official (AO) and/or IT staff to ensure local procedures for disposal of computer hard drives appropriately address removal of U.S. Government data prior to disposal.

  TACTICAL ENVIRONMENT: Applies in all environments whenever classified documents or materials are to be destroyed.


vuln_id: V-245838
rule_id: SV-245838r1156687_rule
severity: CAT II
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Classified Destruction - Hard Drive and Storage Media Sanitization Devices and Plans are not Available for disposal of Automated Information System (AIS) Equipment On-Hand

description:
  <VulnDiscussion>Failure to properly destroy classified material can lead to the loss or compromise of classified or
  sensitive information.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraphs 21.h.(9); 28; 29b.,d.(1)&(2).h.(1)&(2) and para 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: MP-1, MP-6, PE-1.

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014, Enclosure 3, paragraph 9.b.(8) & (9) 

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Enclosure 2, paragraph 14 & 14(d); Enclosure 3 paragraphs 17, 18, & 19; Enclosure 5, paragraph 3.d.(3); Enclosure 7, paragraph 6.

  Assistant Secretary of Defense for Command, Control, Communications and Intelligence Memorandum, "Disposition of Unclassified DOD Computer Hard Drives," June 4, 2001

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  NIST SP 800-88, Guidelines for Media Sanitization

  NSA/CSA Policy Manual 9-12, dated 4 Dec 2020 Storage Device Sanitization and Destruction Manual

  https://www.nsa.gov/Resources/Media-destruction-Guidance</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure there is equipment and/or plans for the destruction of classified or sensitive systems and media used by the site or organization. 

  Considerations:

  1. If used by the site are hard drive and tape degaussers periodically tested and certified as required by the manufacturer?

  2. Are appropriate wipe products available for classified systems or spillage incidents?
   
  3. Is there an approved product (such as the Whitaker Brothers Inc. Datastroyer) on-hand to properly remove readable surfaces from optical media such as CDs or DVDs?
   
  4. Is all obsolete classified equipment and media properly secured in a safe, vault or secure room until properly disposed of? 

  5. In the event the site has limited or no destruction equipment are there plans or arrangements to take classified material to NSA for proper disposal or another DOD organization who has destruction equipment and has agreed to provide support for destruction of classified?

  6. Are there appropriate transportation and/or shipping arrangements to ensure the classified material is properly protected while in transit to the destruction facility?

check_text:
  Check to ensure there is equipment and/or plans for the destruction of classified or sensitive systems and media used by the site or organization. Lack of appropriate equipment to properly sanitize the classified media used or lack of plans for disposal and/or proper protection in transit to a disposal facility will result in a finding. 

  Checks:

  Check #1. If used by the site are hard drive and tape degaussers periodically tested and certified as required by the manufacturer?

  Check #2. Are appropriate wipe products available for classified systems or spillage incidents?
   
  Check #3. Is there an approved product (such as the Whitaker Brothers Inc. Datastroyer) on-hand to properly remove readable surfaces from optical media such as CDs or DVDs?
   
  Check #4. Is all obsolete classified equipment and media properly secured in a safe, vault or secure room until properly disposed of? (Note: This would be a CAT I finding under the appropriate "storage" vulnerability)
   
  Check #5. In the event the site has limited or no destruction equipment: Are there plans or arrangements to take classified material to NSA for proper disposal or another DOD organization who has destruction equipment and has agreed to provide support for destruction of classified?

  Check #6. Are there appropriate transportation and/or shipping arrangements to ensure the classified material is properly protected while in transit to the destruction facility? 

  TACTICAL ENVIRONMENT: Applies in all environments whenever classified documents or materials are to be destroyed.


vuln_id: V-245839
rule_id: SV-245839r1136769_rule
severity: CAT III
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Destruction of Classified and Unclassified Documents, Equipment and Media - Availability of Local Policy and Procedures

description:
  <VulnDiscussion>Lack of plans and procedures to properly destroy classified and/or sensitive material can lead to the loss or compromise of classified or sensitive information.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraphs 21.h.(9); 28; 29b.,d.(1)(2).h.(1)(2) and para 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: MP-1, MP-6, PE-1.

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014, Enclosure 3, paragraph 9.b.(8) (9) 

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Enclosure 2, paragraph 14 14(d); Enclosure 3 paragraphs 17, 18, 19; Enclosure 5, paragraph 3.d.(3); Enclosure 7, paragraph 6.

  Assistant Secretary of Defense for Command, Control, Communications and Intelligence Memorandum, Disposition of Unclassified DOD Computer Hard Drives, June 4, 2001

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  NIST SP 800-88, Guidelines for Media Sanitization

  NSA/CSA Policy Manual 9-12, NSA/CSS Storage Device Declassification Manual

  https://www.nsa.gov/Resources/Media-Destruction-Guidance

  Satisfies: Destruction of Classified and Unclassified Documents, Equipment and Media - Policy/Procedure</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure there are procedures for the destruction of classified or sensitive documents, systems and media. Also check to ensure this documentation is readily available for employee reference and included in initial and recurring (annual) security training.

check_text:
  Check to ensure there are procedures for the destruction of classified or sensitive documents, systems and media. Also check to ensure this documentation is readily available for employee reference and included in initial and recurring (annual) security training. 

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.


vuln_id: V-245840
rule_id: SV-245840r1136771_rule
severity: CAT II
title: Classified Emergency Destruction Plans - Develop and Make Available
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to develop emergency procedures can lead to the loss or compromise of classified or sensitive information during emergency situations.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 32.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: CP-4, PL-1 & RA-1.

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014, Enclosure 3, paragraph 9.b.(8) (9) 

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Enclosure 2, paragraph 10.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  NIST SP 800-88, Guidelines for Media Sanitization

  NSA/CSA Policy Manual 9-12, NSA/CSS Storage Device Declassification Manual

  https://www.nsa.gov/Resources/Media-Destruction-Guidance</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  General Requirement: Plans shall be developed to protect, remove, or destroy classified material in case of fire, natural disaster, civil disturbance, terrorist activities, or enemy action, to minimize the risk of compromise, and for the recovery of classified information, if necessary, following such events.  

  Ensure there is local site documentation for the emergency, protection, removal, and destruction of classified material and equipment. 

  Also ensure that these instructions are readily available to the employee population. Such plans should be posted on or near safes, exits to vaults and secure rooms or at any location where classified materials are stored.

check_text:
  General Requirement: Plans shall be developed to protect, remove, or destroy classified material in case of fire, natural disaster, civil disturbance, terrorist activities, or enemy action, to minimize the risk of compromise, and for the recovery of classified information, if necessary, following such events.

  Checks: 

  Check #1. Check to ensure there is local site documentation for the emergency, protection, removal, and destruction of classified material and equipment. (CAT II)

  Check #2. Also check to ensure that these instructions are readily available to the employee population. Such plans should be posted on or near safes, exits to vaults and secure rooms or at any location where classified materials are stored. (CAT III)

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.


vuln_id: V-245841
rule_id: SV-245841r1138462_rule
severity: CAT II
title: Security Incident/Spillage - Lack of Procedures or Training for Handling and Reporting
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to report possible security compromise can result in the impact of the loss or compromise of classified information not to be evaluated, responsibility affixed, or a plan of action developed to prevent recurrence of future incidents.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraphs 6.k.(1), 9.c., 18.k.(e), 26.s.(6), 29. and 31.c.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AT-1, AT-2, AU-2, AU-7, AU-11, IR-1, IR-2, IR-4, IR-5, IR-6, IR-7, IR-8 and IR-9.

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014, Enclosure 3, paragraph 7.g. and 19.d.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Enclosure 6, Appendix 1 to Encl 6, Appendix 2 to Encl 6 and Enclosure 7, paragraph 5. 

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  CNSSP No. 18, National Policy on Classified Information Spillage

  CNSSI 1001, National Instruction on Classified Information Spillage</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  General requirement:
  Anyone finding classified information out of proper control shall, if possible, take custody of and safeguard the material and immediately notify the appropriate security authorities. Secure communications should be used for notification whenever possible. Every civilian employee and Active, Reserve, and National Guard Military member of the Department of Defense, and every DOD contractor or employee of a contractor working with classified material, as provided by the terms of the contract, who becomes aware of the loss or potential compromise of classified information shall immediately report it to the head of his or her local activity and to the activity security manager. Prompt reporting of security incidents ensures incidents are properly investigated and necessary actions are taken to negate or minimize the adverse effects of an actual loss or unauthorized disclosure of classified information and to preclude recurrence through a properly tailored, and up-to-date security education and awareness program. In cases where compromise has been ruled out and there is no adverse effect on national security, a common sense approach to the early resolution of an incident at the lowest appropriate level is encouraged. All security incidents involving classified information shall involve a security inquiry, a security investigation, or both.

  Fixes: 

  1. Ensure the site or organization has written procedures on reporting possible security incidents. 

  2. Ensure personnel within the organization have training to be able to know when to report a possible security incident and who to report it to. 

  3. Ensure employees know what to do when discovering classified material unsecure or out of proper control. Verify by asking random employees if they know what to do if they discover a security incident.

check_text:
  General requirement:

  Anyone finding classified information out of proper control shall, if possible, take custody of and safeguard the material and immediately notify the appropriate security authorities. Secure communications should be used for notification whenever possible. Every civilian employee and Active, Reserve, and National Guard Military member of the Department of Defense, and every DOD contractor or employee of a contractor working with classified material, as provided by the terms of the contract, who becomes aware of the loss or potential compromise of classified information shall immediately report it to the head of his or her local activity and to the activity security manager. Prompt reporting of security incidents ensures incidents are properly investigated and necessary actions are taken to negate or minimize the adverse effects of an actual loss or unauthorized disclosure of classified information and to preclude recurrence through a properly tailored, and up-to-date security education and awareness program. In cases where compromise has been ruled out and there is no adverse effect on national security, a common sense approach to the early resolution of an incident at the lowest appropriate level is encouraged. All security incidents involving classified information shall involve a security inquiry, a security investigation, or both.

  Reviewer Checks:

  Check #1. Check to ensure the site or organization has written procedures on reporting possible security incidents. 

  Check #2. Check to ensure personnel within the organization have training to be able to know when to report a possible security incident and who to report it to. 

  Check #3. Check to ensure employees know what to do when discovering classified material unsecure or out of proper control. Ask random employees if they know what to do if they discover a security incident?

  TACTICAL ENVIRONMENT: Classified material that is discovered not properly secured must immediately be secured and the incident reported - regardless of environment.


vuln_id: V-245842
rule_id: SV-245842r1138463_rule
severity: CAT II
title: Classification Guides Must be Available for Programs and Systems for an Organization or Site
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to have proper classification guidance available for Information Systems and/or associated programs run on them can result in the misclassification of information and ultimately lead to the loss or compromise of classified or sensitive information.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraph 6.c. and paragraph 26.e.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Control: AC-3, IA-5, MP-5, MP-6, PE-2, PS-3, PS-6.

  DOD Manual 5200.01, Volume 1, 24 February 2012, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification, Enclosure 2, paragraph 9.h.; Enclosure 4; Enclosure 5 and Enclosure 6.

  DOD Manual 5200.01, Volume 2, 24 February 2012, SUBJECT: DOD Information Security Program: Marking of Classified Information; Enclosure 3, paragraph 2.a.

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information; Enclosure 6, paragraphs 4, 51 and Glossary.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure the site has all Classification Guides for the programs and systems they are responsible for and/or which are applicable to their operations. Further, such classification guides and training on the use of them should be made available to employees working with the equipment or systems to which they apply. At a minimum if a site has SIPRNet connections they should have a copy of the most recent SIPRNet Security Classification Guide.

check_text:
  Check to ensure the site has all Classification Guides for the systems and programs they are responsible for and/or which are applicable to their operations. Further, such classification guides and training on the use of them should be made available to employees working with the equipment or systems to which they apply. At a minimum if a site has SIPRNet connections they should have a copy of the most recent SIPRNet Security Classification Guide.

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.


vuln_id: V-245843
rule_id: SV-245843r822908_rule
severity: CAT II
title: Controlled Unclassified Information (CUI) - Employee Education and Training
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to handle CUI in an approved manner can result in the loss or compromise of sensitive information.

  REFERENCES:

  Executive Order 13556, Controlled Unclassified Information (CUI)

  The Information Security Oversight Office (ISOO): https://www.archives.gov/cui

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure A, Paragraph 11, Enclosure B, paragraph 4.h & 6.m., and Enclosure C, paragraph 5.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AT-1, AT-2, AT-3 and AT-4.

  DoD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DoD Information Security Program: Protection of Classified Information; Enclosure 5.

  DoD Manual 5200.01, Volume 4, SUBJECT: DoD Information Security Program: Controlled Unclassified Information (CUI); Enclosure 4.

  DoD 5220.22-M (NISPOM), Incorporating Change 2, 18 May 2016, Chapter 3.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  General Policy Guidance:  At a minimum, DoD civilians, military members and on-site support contractors with access to CUI shall receive both initial and annual refresher training that reinforces the policies, principles, and procedures covered in CUI policy. Refresher training shall also address the threat and the techniques foreign intelligence activities use while attempting to obtain controlled unclassified DoD information and advise personnel of penalties for unauthorized disclosures. The importance of unclassified information, its potential sensitivity, and the requirement to have all information reviewed and approved for release prior to public disclosure or Web posting shall be reiterated. Refresher training shall also address relevant changes in CUI policy or procedures and issues or concerns identified during DoD Component oversight reviews.                                

  Fix:

  Ensure an initial orientation on handling of CUI is included during new employee in-processing and that Annual Refresher training includes the topic of CUI as provided in the general policy guidance.  Ensure that all initial and refresher training is documented.

check_text:
  General Policy Guidance:  At a minimum, DoD civilians, military members and on-site support contractors with access to CUI shall receive both initial and annual refresher training that reinforces the policies, principles, and procedures covered in CUI policy. Refresher training shall also address the threat and the techniques foreign intelligence activities use while attempting to obtain controlled unclassified DoD information and advise personnel of penalties for unauthorized disclosures. The importance of unclassified information, its potential sensitivity, and the requirement to have all information reviewed and approved for release prior to public disclosure or Web posting shall be reiterated. Refresher training shall also address relevant changes in CUI policy or procedures and issues or concerns identified during DoD Component oversight reviews.                                

  Checks:

  Check #1. Reviewers must check for an initial orientation on handling of CUI during new employee in-processing 

  Check #2. Check that Annual Refresher training includes the topic of CUI as provided in the general policy guidance.  Check a sample number of individual training records and Annual Training briefing slides/materials for evidence of CUI training.   

  Lack of either initial orientation or refresher training or both is a finding.                                    

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where training and associated documentation should be in place.  Not applicable to a field/mobile environment.


vuln_id: V-245844
rule_id: SV-245844r1138494_rule
severity: CAT II
title: Controlled Unclassified Information - Document, Hard Drive and Media Disposal
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to handle CUI in an approved manner can result in the loss or compromise of sensitive information.

  REFERENCES:

  Assistant Secretary of Defense for Command, Control, Communications and Intelligence Memorandum: "Disposition of Unclassified DOD Hard Drives, 4 June 2001."

  44 USC Chapter 33 - Disposal of Records, dated 01/03/2012

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraphs 21.h.(9); 28.a.&c.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: MP-6 and SI-12.

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014, paragraph 3.h.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Enclosure 3 paragraphs 17, 18, & 19; Enclosure 7, paragraph 6.

  DODI 5200.48 Controlled Unclassified Information (CUI)

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  NIST SP 800-88, Guidelines for Media Sanitization

  NSA/CSS product lists for sanitization, destroying or disposing of various types of media containing sensitive or classified information:
  https://www.nsa.gov/Resources/Media-Destruction-Guidance

  The Information Security Oversight Office (ISOO): https://www.archives.gov/cui

  Satisfies: Controlled Unclassified Information - Document, Hard Drive and Media Disposal</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure compliance with appropriate methods for disposal of the following: 

  1. Unclassified Hard Drives: 

  a. When no longer needed, unclassified computer systems and hard drives may be disposed of outside the Department of Defense (DOD). In some circumstances, the equipment may be provided to nongovernment entities for reutilization. To ensure that no data or information remains on operable unclassified hard drives that are transferred or permanently removed from DOD custody, the drives must be sanitized by overwriting. 

  b. Where overwriting is inappropriate or cannot be completely accomplished (e.g., inoperable disk) the drives are to be totally removed from service (i.e., thrown away). In this case the drives must be physically destroyed before disposal. 

  c. The specific methods and procedures differ depending on sensitivity of data and ownership of the hard drive. To ensure DOD information is not inadvertently disclosed to unauthorized individuals, the activity security manager should coordinate with the local DAA and/or IT staff to ensure local procedures for disposal of computer hard drives appropriately address removal of U.S. Government data prior to disposal. Generally the use of hard drive degaussers with an appropriate strength (Coercivity of magnetic field) for the drive being erased (Oestrid rating) is recommended as part of the requirement for physical destruction. After degaussing the hard drive the physical destruction of individual platters should be accomplished to make attempted data retrieval impractical.

  2. Unclassified Automated Information System (AIS) Media:

  a. Various types of AIS media may contain CUI and must be disposed of in accordance with guidance in the NIST Special Publication 800-88, Guidelines for Media Sanitization. 

  b. NSA/CSS publishes lists of products that meet specific performance criteria for sanitizing, destroying or disposing of various types of media containing sensitive or classified information. The lists are available at https://www.nsa.gov/Resources/Media-Destruction-Guidance.

  3. Unclassified documents:

  a. Record copies of CUI documents shall be disposed of in accordance with the Federal Records Act (44 U.S.C. 33 and Component records management directives. 

  b. Nonrecord CUI documents may be destroyed by shredding. 

  c. NOTE: The guidance provided here is for CUI paper documents and this is the least stringent standard found for any CUI document destruction. There are other types of CUI, such as DEA Sensitive material, which must be destroyed by a means approved for destruction of Confidential material. Be certain to check DOD Manual 5200.01 for specific destruction requirements for each type of CUI document. 

  4. Additional considerations:

  a. Periodically inspect recycle bins, regular trash, and the availability of shredders or collection containers for sensitive material. Ensure it is known who gets the recycling (especially if it contains CUI) and that it is disposed of properly. NOTE: If you find (e.g., in the trash) and can easily reconstruct any document marked CUI (or other CUI document) and it contains extremely sensitive information such as PII (with SSN, etc.), this should be investigated and corrective actions taken immediately. 

  b. While not required it is highly recommended using at least a cross-cut shredder for destruction of CUI documents. Further, while a shred-all policy is also not required, this is another strong recommendation.

check_text:
  Check to ensure compliance with appropriate methods for disposal of the following: 

  1. Unclassified Hard Drives: 

  a. When no longer needed, unclassified computer systems and hard drives may be disposed of outside the Department of Defense (DOD). In some circumstances, the equipment may be provided to nongovernment entities for reutilization. To ensure that no data or information remains on operable unclassified hard drives that are transferred or permanently removed from DOD custody, the drives must be sanitized by overwriting. 

  b. Where overwriting is inappropriate or cannot be completely accomplished (e.g., inoperable disk) the drives are to be totally removed from service (i.e., thrown away). In this case the drives must be physically destroyed before disposal. 

  c. The specific methods and procedures differ depending on sensitivity of data and ownership of the hard drive. To ensure DOD information is not inadvertently disclosed to unauthorized individuals, the activity security manager should coordinate with the local DAA and/or IT staff to ensure local procedures for disposal of computer hard drives appropriately address removal of U.S. Government data prior to disposal. Generally the use of hard drive degaussers with an appropriate strength (coercivity of magnetic field) for the drive being erased (Oestrid rating) is recommended as part of the requirement for physical destruction. After degaussing the hard drive, the physical destruction of individual platters should be accomplished to make attempted data retrieval impractical.

  2. Unclassified Automated Information System (AIS) Media:

  a. Various types of AIS media may contain CUI and must be disposed of in accordance with guidance in the NIST Special Publication 800-88, Guidelines for Media Sanitization. 

  b. NSA/CSS publishes lists of products that meet specific performance criteria for sanitizing, destroying, or disposing of various types of media containing sensitive or classified information. The lists are available at https://www.nsa.gov/Resources/Media-Destruction-Guidance.

  3. Unclassified documents:

  a. Record copies of CUI documents shall be disposed of in accordance with the Federal Records Act (44 U.S.C. 33 and Component records management directives. 

  b. Nonrecord CUI documents may be destroyed by shredding. 

  c. NOTE: The guidance provided here is for CUI paper documents and this is the least stringent standard found for any CUI document destruction. There are other types of CUI, such as DEA Sensitive material, which must be destroyed by a means approved for destruction of Confidential material. Be certain to check DOD Manual 5200.01 for specific destruction requirements for each type of CUI document. 

  4. Additional reviewer checks and considerations:

  a. Check recycle bins, regular trash, and the availability of shredders or collection containers for sensitive material. Ensure the organization knows who gets the recycling (especially if it contains CUI) and that it is disposed of properly (for instance by shredding). NOTE: If you find (e.g., in the trash) and can easily reconstruct any document marked CUI (or other CUI document) and it contains extremely sensitive information such as PII (with SSN, etc.), this should be made a finding. 

  b. In all cases the reviewer should recommend using at least a cross cut shredder for destruction of CUI documents. Further, while a shred-all policy is not required, this is another recommendation that should be made.
   
  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where training and associated documentation should be in place. Not applicable to a field/mobile environment.


vuln_id: V-245845
rule_id: SV-245845r1136783_rule
severity: CAT II
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Controlled Unclassified Information - Handling, Storage and Controlling Access to Areas where CUI is Processed or Maintained

description:
  <VulnDiscussion>Failure to handle CUI in an approved manner can result in the loss or compromise of sensitive information.

  REFERENCES:

  Executive Order 13556, Controlled Unclassified Information (CUI)

  The Information Security Oversight Office (ISOO): https://www.archives.gov/cui

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND); Enclosure C, paragraph 25.d.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: MP-4 and PE-3.

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information; Enclosure 7, paragraph 13.f.

  DODI 5200.48 Controlled Unclassified Information (CUI)

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  General Guidance: 

  Standards of protection for most types of CUI are the same as for FOUO but some variance does exist. Therefore, specific requirements for certain CUI may need to be checked against applicable references to ensure proper protection is afforded. The fixes are applicable to all forms of CUI: documents, AIS hard drives and storage media.

  Fixes applicable for FOUO:

  For most CUI and FOUO specifically ensure the following standards are met: 

  1. During working hours, reasonable steps shall be taken to minimize the risk of access by unauthorized personnel. This would include things like placing cover sheets on FOUO documents and allowing unescorted access to areas where CUI (documents and AIS storage media) is processed/handled to only those persons with at least a favorably adjudicated National Agency Check (NAC). 

  2. After working hours, FOUO information (documents and AIS storage media) may be stored in unlocked containers, desks, or cabinets if Government or Government-contract building security is provided. If such building security is not provided or is deemed inadequate, the information (documents and AIS storage media) shall be stored in locked desks, file cabinets, bookcases, locked rooms, etc. In all cases FOUO and other CUI must be placed out of sight during non-working hours. While not required, implementation of a clean desk policy would be a good idea. 

  3. Unescorted access to computer rooms or areas containing major items of AIS equipment processing CUI information (servers and network components) should only be granted to persons with at least a favorable NAC. All others should be physically escorted. Access control measures such as reception personnel, guards, keyed locks, cipher locks or automated access control systems may be used to control access to such areas.

check_text:
  General Guidance: 

  Standards of protection for most types of CUI are the same as for FOUO but some variance does exist. Therefore, specific requirements for certain CUI may need to be checked against applicable references to ensure proper protection is afforded. The checks are applicable to all forms of CUI: documents, AIS hard drives and storage media.

  Checks:

  For most CUI and FOUO specifically check to ensure the following standards are met: 

  Check #1. During working hours, reasonable steps shall be taken to minimize the risk of access by unauthorized personnel. This would include things like placing cover sheets on FOUO documents and allowing unescorted access to areas where CUI (documents and AIS storage media) is processed/handled to only those persons with at least a favorably adjudicated National Agency Check (NAC). 

  Check #2. After working hours, FOUO information (documents and removable media) may be stored in unlocked containers, desks, or cabinets if Government or Government-contract building security is provided. If such building security is not provided or is deemed inadequate, the information (documents and removable media) shall be stored in locked desks, file cabinets, bookcases, locked rooms, etc. In all cases FOUO and other CUI documents must be placed out of sight during non-working hours. While not required, recommending implementation of a clean desk policy would be appropriate.

  Check #3. Unescorted access to computer rooms or areas containing major items of AIS equipment processing CUI information (servers and network components) should only be granted to persons with at least a favorable NAC. All others should be physically escorted. Access control measures such as reception personnel, guards, keyed locks, cipher locks or automated access control systems may be used to control access to such areas.          

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.


vuln_id: V-245846
rule_id: SV-245846r1136786_rule
severity: CAT II
title: Controlled Unclassified Information - Encryption of Data at Rest
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to handle CUI in an approved manner can result in the loss or compromise of sensitive information.

  REFERENCES:

  Executive Order 13556, Controlled Unclassified Information (CUI)

  The Information Security Oversight Office (ISOO): https://www.archives.gov/cui

  DOD CIO Memorandum, Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and Removable Storage Media, 3 July 2007

  NIST FIPS 140-2, Security Requirements for Cryptographic Modules

  NSTISSI No. 11, National Policy Governing the Acquisition of Information Assurance (IA) and IA-Enabled Information Technology (IT) Products

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND); Enclosure A, paragraphs 6.b., 13.b.(2), 13.b.(3) and Enclosure C, paragraphs 21.f. and 21.g.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: MP-5, PL-2 and SC-28.

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information; Enclosure 7, paragraphs 8. and 9.a.

  DOD Instruction 8420.01, Commercial Wireless Local Area Network (WLAN) Devices, Systems, and Technologies, 3 November 2017, paragraphs 1.2.b., 1.2.h., 3.2.a., 3.2.a.(3), and 3.8.d.

  NSA, Commercial Solutions for Classified Data at Rest Capability Package, current edition</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure the following standards concerning encryption of data-at-rest are met: 

  In accordance with DOD policy, all unclassified DOD data that has not been approved for public release and is stored on mobile computing devices or removable storage media must be encrypted using commercially available encryption technology. This requirement includes all CUI as well as other unclassified information that has not been reviewed and approved for public release. This includes certain Personally Identifiable Information (PII). Examples of common devices requiring DAR encryption are laptops used for telework or TDY and mobile devices such as cellular phones, tablets, etc. approved for processing and storing DOD sensitive data, and CDs, thumb drives (flash media) DVDs and other removable media.

  See ASD(NII) Memorandum, Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and Removable Storage Media, 3 Jul 07 for detailed guidance.

check_text:
  Check to ensure the following standards concerning encryption of data-at-rest are met: 

  In accordance with DOD policy, all unclassified DOD data that has not been approved for public release and is stored on mobile computing devices or removable storage media must be encrypted using commercially available encryption technology. This requirement includes all CUI as well as other unclassified information that has not been reviewed and approved for public release. This includes certain Personally Identifiable Information (PII). Examples of common devices requiring DAR encryption are laptops used for telework or TDY and mobile devices such as cellular phones, tablets, etc. approved for processing and storing DOD sensitive data, and CDs, thumb drives (flash media) DVDs and other removable media.

  See ASD(NII) Memorandum, Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and Removable Storage Media, 3 Jul 07 for detailed guidance.
              
  TACTICAL ENVIRONMENT: The check is applicable for all tactical processing environments.


vuln_id: V-245847
rule_id: SV-245847r917355_rule
severity: CAT II
title: Controlled Unclassified Information - Transmission by either Physical or Electronic Means
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to handle/transmit CUI in an approved manner can result in the loss or compromise of sensitive information.

  REFERENCES:

  Executive Order 13556, Controlled Unclassified Information (CUI)

  The Information Security Oversight Office (ISOO): https://www.archives.gov/cui

  NIST FIPS 140-2, Security Requirements for Cryptographic Modules

  DODI 8520.2, "Public Key Infrastructure (PKI) and Public Key Enabling (PKE)"

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND); Enclosure A, paragraphs 13.a., 13.b.(2)(3), and Enclosure C, paragraphs 22.d,, 25.a.,d.,e.,f., 26.j.(2), and 35.a. 

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AC-17, AC-20, IA-2, SC-8, SC-9, and SC-23.

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information; Enclosure 7, paragraph 13.

  DODI 5200.48 Controlled Unclassified Information (CUI)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  General Information:

  Standards for transmission for most types of CUI are the same as for FOUO but some variance does exist. Therefore, specific requirements for certain CUI may need to be checked against applicable references to ensure proper means for transmission are used. 

  For most CUI and FOUO specifically ensure the following standards are met: 

  1. FOUO information and material may be transmitted via first class mail, parcel post, or, for bulk shipments, via fourth class mail. 

  2. Electronic transmission of FOUO information, e.g., email, shall be by approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure (PKI) or transport layer security (e.g., https). 

  3. Use of wireless telephones (cellphones, wireless hand-held phones, Bluetooth, etc.) should be avoided when other options are available. 

  4. Transmission of FOUO by facsimile machine (fax) is permitted; the sender is responsible for determining that appropriate protection will be available at the receiving location prior to transmission (e.g., machine attended by a person authorized to receive FOUO; fax located in a controlled government environment).

check_text:
  General Information:

  Standards for transmission for most types of CUI are the same as for FOUO but some variance does exist. Therefore, specific requirements for certain CUI may need to be checked against applicable references to ensure proper means for transmission are used. 

  For most CUI and FOUO specifically check to ensure the following standards are met: 

  1. FOUO information and material may be transmitted via first class mail, parcel post, or, for bulk shipments, via fourth class mail. 

  2. Electronic transmission of FOUO information, e.g., email, shall be by approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure (PKI) or transport layer security (e.g., https). 

  3. Use of wireless telephones (cellphones, wireless hand-held phones, Bluetooth, etc.) should be avoided when other options are available. 

  4. Transmission of FOUO by facsimile machine (fax) is permitted; the sender is responsible for determining that appropriate protection will be available at the receiving location prior to transmission (e.g., machine attended by a person authorized to receive FOUO; fax located in a controlled government environment).   

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments. Not applicable to a field/mobile environment.


vuln_id: V-245848
rule_id: SV-245848r1138465_rule
severity: CAT II
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Controlled Unclassified Information - Posting Only on Web-Sites with Appropriate Encryption; not on Publicly Accessible Web-Sites.

description:
  <VulnDiscussion>Failure to handle CUI in an approved manner can result in the loss or compromise of sensitive information.

  REFERENCES:

  Executive Order 13556, Controlled Unclassified Information (CUI)

  The Information Security Oversight Office (ISOO): https://www.archives.gov/cui

  Deputy Secretary of Defense Memorandum, "WEB Site Administration" 7 Dec 98, with attached "WEB Site Administration Policies and Procedures", 25 Nov 98.

  DOD 5400.7-R, DOD Freedom of Information Act Program, Sep 98.

  DOD 5400-11-R, Department of Defense Privacy Program, 14 May 07.

  DODD 5230.09, 22 Aug 08, Clearance of DOD Information for Public Release

  DODI 5230.29, 8 Jan 09, Security and Policy Review of DOD Information for Public Release.

  PL 104-191, 21 Aug 96, Health Insurance Portability and Accountability Act of 1996

  NIST FIPS 140-2, Security Requirements for Cryptographic Modules

  DODI 8520.2, "Public Key Infrastructure (PKI) and Public Key Enabling (PKE)"

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND); Enclosure A, paragraph 7.a. and Enclosure C, paragraph 26.i. 

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AC-14, AC-17, IA-8 and SC-7.

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information; Enclosure 7, paragraph 13.f..

  DODI 5200.48 Controlled Unclassified Information (CUI)

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure the following standards/guidance are adhered to: 

  1. FOUO, PII and other CUI may NOT be posted to publicly accessible Internet sites and may NOT be posted to sites whose access is controlled only by domain (e.g., limited to .mil and/or .gov) as such restricted access can easily be circumvented. 

  2. At a minimum, posting CUI to a website requires certificate-based (e.g., common access card) or password and ID access as well as encrypted transmission using https: or similar technology. CUI other than FOUO may have additional posting restrictions. 

  3. See Deputy Secretary of Defense Memorandum Web Site Administration, December 7, 1998, with attached Web Site Administration Policies and Procedures, November 25, 1998 for detailed guidance.

check_text:
  Check to ensure the following standards/guidance are adhered to: 

  1. FOUO, PII and other CUI may NOT be posted to publicly-accessible Internet sites and may NOT be posted to sites whose access is controlled only by domain (e.g., limited to .mil and/or .gov) as such restricted access can easily be circumvented. 

  2. At a minimum, posting CUI to a website requires certificate-based (e.g., common access card) or password and ID access as well as encrypted transmission using https: or similar technology. CUI other than FOUO may have additional posting restrictions. 

  3. See Deputy Secretary of Defense Memorandum Web Site Administration, December 7, 1998, with attached Web Site Administration Policies and Procedures, November 25, 1998 for detailed guidance. 

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.


vuln_id: V-245849
rule_id: SV-245849r1136791_rule
severity: CAT III
title: Controlled Unclassified Information (CUI) - Local Policy and Procedure
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to handle CUI in an approved manner can result in the loss or compromise of sensitive information.

  REFERENCES:

  Executive Order 13556, Controlled Unclassified Information (CUI)

  The Information Security Oversight Office (ISOO): https://www.archives.gov/cui

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND); Enclosure C, paragraph 25.d.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-1, PL-1 and SI-1.

  DODI 5200.48 Controlled Unclassified Information (CUI)

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  General Policy Guidance: All personnel of the Department of Defense are personally and individually responsible for properly protecting classified information and Controlled Unclassified Information (CUI) under their custody and control. All officials within the Department of Defense who hold command, management, or supervisory positions have specific, non-delegable responsibility for the quality of implementation and management of the information security program within their areas of responsibility. 

  Fix:
  Ensure there are local written procedures for handling, marking, storing, destroying and transmitting Controlled Unclassified Information.

check_text:
  General Policy Guidance: All personnel of the Department of Defense are personally and individually responsible for properly protecting classified information and Controlled Unclassified Information (CUI) under their custody and control. All officials within the Department of Defense who hold command, management, or supervisory positions have specific, non-delegable responsibility for the quality of implementation and management of the information security program within their areas of responsibility. 

  Check:
  This check is specifically to ensure there are local written procedures for handling, marking, storing, destroying and transmitting Controlled Unclassified Information. 

  TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environment.


vuln_id: V-245850
rule_id: SV-245850r1136792_rule
severity: CAT III
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
title:
  Controlled Unclassified Information - Marking/Labeling Media within Unclassified Environments (Not Mixed with Classified)

description:
  <VulnDiscussion>Failure to mark CUI in an approved manner can result in the loss or compromise of sensitive information.

  REFERENCES:

  Executive Order 13556, Controlled Unclassified Information (CUI)

  The Information Security Oversight Office (ISOO): https://www.archives.gov/cui

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND); Enclosure A, paragraph 6.a.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: MP-3.

  DODI 5200.48 Controlled Unclassified Information (CUI)

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  General Information:

  This fix is only for unclassified/sensitive media being used in a strictly unclassified physical environment. If all Controlled Unclassified Information (CUI) media are in a mixed environment where classified systems and media are in use, then STIG ID IS-03.02.01. applies and this potential vulnerability is NA. 

  Ensure the following standard is met: 

  Regardless of media type, the requirement to identify as clearly as possible the information requiring protection remains. Therefore ensure that all unclassified media containing CUI is properly marked according to content. Where it is not feasible to include markings with all of the information required for classified or sensitive documents or media, an explanatory statement that provides the required information shall be included on the item or with the documentation that accompanies it. 

  While For Official Use Only (FOUO) is the primary CUI marking used in DOD, all types of CUI markings must be considered for use as appropriate. For instance: "Law Enforcement Sensitive" is a marking sometimes applied, in addition to the marking "FOR OFFICIAL USE ONLY," by the Department of Justice and other activities in the law enforcement community, including those within the Department of Defense.

check_text:
  General Information:

  This check is only for unclassified/sensitive media being used in a strictly unclassified physical environment. If all Controlled Unclassified Information (CUI) media are in a mixed environment where classified systems and media are in use, then STIG ID IS-03.02.01. applies and this check is NA. 

  Check to ensure the following standard is met: 

  Regardless of media type, the requirement to identify as clearly as possible the information requiring protection remains. Therefore check to ensure that all unclassified media containing CUI is properly marked according to content. Where it is not feasible to include markings with all of the information required for classified or sensitive documents or media, an explanatory statement that provides the required information shall be included on the item or with the documentation that accompanies it. 

  While For Official Use Only (FOUO) is the primary CUI marking used in DOD, all types of CUI markings must be considered for use as appropriate. For instance: "Law Enforcement Sensitive" is a marking sometimes applied, in addition to the marking "FOR OFFICIAL USE ONLY," by the Department of Justice and other activities in the law enforcement community, including those within the Department of Defense. 

  TACTICAL ENVIRONMENT: The check is applicable for all fixed tactical processing environments where CUI is developed and used. Not applicable to a field/mobile environment.


vuln_id: V-245851
rule_id: SV-245851r1136793_rule
severity: CAT III
title: Classified Annual Review
created_at: 2026-02-02 23:35:55
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to conduct the annual review and clean out day can result in an excessive amount of classified (including IS storage media) being on hand and therefore being harder to account for, resulting in the possibility of loss or compromise of classified or sensitive information.

  REFERENCES:

  DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information; Enclosure 3, paragraph 17.b.

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND); Enclosure C, paragraph 34.a.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PS-1.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Ensure there are written procedures for the annual review and clean out of classified material. 

  2. Ensure the memorandum for the annual clean-out includes the number of security containers checked and the amount of classified material destroyed.

check_text:
  Check #1. Check to ensure there are written procedures for the annual review and clean out of classified material. 

  Check #2. Check to ensure there is a memorandum or some form of documentation covering results of the last clean out day. This is to validate actual completion of the requirement.

  TACTICAL ENVIRONMENT: This check is not applicable for fixed (established) tactical processing environments and is not applicable to a field/mobile environment. Classified documents and materials in these environments should be properly disposed of as soon as possible after it is determined there is no longer a need for them.


