# stig_rules

vuln_id: V-245746
rule_id: SV-245746r1138413_rule
severity: CAT III
title: Environmental IA Controls - Emergency Lighting and Exits - Documentation and Testing
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Lack of automatic emergency lighting can cause injury and/or death to employees and emergency responders. Lack of automatic emergency lighting can cause a disruption in service.

  REFERENCES:

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1  
    
  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-1, PE-12 and PE-12(1)

  NIST SP 800-12, An Introduction to Computer Security: The NIST Handbook

  NIST SP 800-100 Information Security Handbook: A Guide for Managers</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Emergency Lighting and Exit documentation and testing.
   
  1. There must be written procedures for emergency exit.

  2. Evacuation routes must be posted in the facility for employee reference.
   
  3. The emergency exit plan must be rehearsed on a periodic basis.
   
  4. Emergency lighting must be tested on a periodic basis.

check_text:
  Review Emergency Lighting and Exit documentation and testing. Check to ensure:

  1. There are written procedures for emergency exit.

  2. Evacuation routes are posted within the facility for employee reference.

  3. The plan is rehearsed on a periodic basis.
   
  4. Emergency lighting is tested on a periodic basis.
   
  NOTES: This requirement should not be applied to a tactical environment, unless it is a fixed computer facility supporting missions in a Theater of Operations. The considerations to be applied for applicability in a tactical environment are: 

  1) The facility containing the computer room has been in operation over one year. 
  2) The facility is "fixed facility" - a hard building made from normal construction materials - wood, steel, brick, stone, mortar, etc.


vuln_id: V-245747
rule_id: SV-245747r1138414_rule
severity: CAT III
title: Environmental IA Controls - Voltage Control (power)
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to use automatic voltage control can result in damage to the IT equipment creating a service outage.

  REFERENCES:

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-9(2)

  NIST SP 800-12, An Introduction to Computer Security: The NIST Handbook

  NIST SP 800-100 Information Security Handbook: A Guide for Managers</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  An Information Technology (IT) area voltage control unit must be installed and used for all key IT assets.

check_text:
  Check there is an IT area voltage control unit and that it is being utilized for all key IT assets.
    
  NOTES: This requirement should not be applied to a tactical environment, unless it is a fixed computer facility supporting missions in a Theater of Operations. The standards to be applied for applicability in a tactical environment are:

  1) The facility containing the computer room has been in operation over one year. 
  2) The facility is "fixed facility" - a hard building made from normal construction materials - wood, steel, brick, stone, mortar, etc.


vuln_id: V-245749
rule_id: SV-245749r1138416_rule
severity: CAT III
title: Environmental IA Controls - Training
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>If employees have not received training on the environmental controls they will not be able to respond to a fluctuation of environmental conditions, which could damage equipment and ultimately disrupt operations.

  REFERENCES:

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AT-3(1)

  NIST SP 800-12, An Introduction to Computer Security: The NIST Handbook

  NIST SP 800-100, Information Security Handbook: A Guide for Managers</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. All required personnel involved with Information Technology (IT) area/computer rooms must receive initial and periodic (minimum annually) environmental control training (specifically regarding humidity/temperature controls).
   
  2. Training records must be updated to reflect this special training.

check_text:
  Check training records to ensure that all required personnel have received their initial and periodic (minimum annually) environmental control training (specifically humidity/temperature). 

  Ask personnel how they respond to an environmental alarm.
   
  NOTES: This requirement should not be applied to a tactical environment, unless it is a fixed computer facility supporting missions in a Theater of Operations. The standards to be applied for applicability in a tactical environment are:

  1) The facility containing the computer room has been in operation for more than one year. 

  2) The facility is "fixed facility" - a hard building made from normal construction materials - wood, steel, brick, stone, mortar, etc.


vuln_id: V-245750
rule_id: SV-245750r1138484_rule
severity: CAT III
title: Environmental IA Controls - Temperature
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Lack of temperature controls can lead to fluctuations in temperature which could be potentially harmful to personnel or equipment operation.

  REFERENCES:

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-14 and PE-14(1) & (2)

  NIST SP 800-12, An Introduction to Computer Security: The NIST Handbook

  NIST SP 800-100, Information Security Handbook: A Guide for Managers</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure that temperature controls have been installed as follows: 
   
  Automatic controls are preferred and should be installed where personnel are not available 24/7 on site to respond to and correct anomalies and situations.
   
  Otherwise it is permissible for alarms to be used when temperatures fluctuate, requiring manual employee intervention. Note that use of alarms with manual intervention should also be supported by specific assessment within the organizational holistic risk assessment.

check_text:
  Check to see if temperature controls have been installed. Automatic controls are preferred and should be installed where personnel are not available 24/7 on site to respond to and correct anomalies and situations. Otherwise it is permissible for alarms to be used when temperatures fluctuate, requiring manual employee intervention. 

  NOTES: 
   
  1. In general such an area will be in raised floor space. The requirement should not be applied to administrative/office space. This requirement should also not be applied to a tactical environment, unless it is a fixed computer facility supporting missions in a Theater of Operations. The standards to be applied for applicability in a tactical environment are: 1) The facility containing the computer room has been in operation over 1-year. 2) The facility is "fixed facility" - a hard building made from normal construction materials - wood, steel, brick, stone, mortar, etc.

  2. Use of alarms with manual intervention should be supported by specific assessment within the organizational holistic risk assessment.


vuln_id: V-245751
rule_id: SV-245751r1138418_rule
severity: CAT III
title: Environmental IA Controls - Humidity
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Fluctuations in humidity can be potentially harmful to personnel or equipment causing the loss of services or productivity.

  REFERENCES:

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-14 and PE-14(1) & (2)

  NIST SP 800-12, An Introduction to Computer Security: The NIST Handbook

  NIST SP 800-100, Information Security Handbook: A Guide for Managers</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure that humidity controls have been installed in Information Technology (IT) areas (Computer Rooms) to protect personnel and equipment operation, as follows:
   
  Automatic controls are preferred and should be installed where personnel are not available 24/7 on site to respond to and correct anomalies and situations.
   
  Otherwise it is permissible for alarms to be used when humidity levels fluctuate, requiring manual employee intervention. Adjustments to humidity control systems can be made manually. Note that use of alarms with manual intervention should also be supported by specific assessment within the organizational holistic risk assessment.

check_text:
  Check to see if humidity controls have been installed in all IT areas. Automatic controls are preferred and should be installed where personnel are not available 24/7 on site to respond to and correct anomalies and situations. Otherwise it is permissible for alarms to be used when humidity levels fluctuate, requiring manual employee intervention.
   
  NOTES:

  1. In general such an area will be in raised floor space. The requirement should not be applied to administrative/office space. This requirement should also not be applied to a tactical environment, unless it is a fixed computer facility supporting missions in a Theater of Operations. The standards to be applied for applicability in a tactical environment are: 1) The facility containing the computer room has been in operation over 1-year. 2) The facility is "fixed facility" - a hard building made from normal construction materials - wood, steel, brick, stone, mortar, etc.

  2. Use of alarms with manual intervention should be supported by specific assessment within the organizational holistic risk assessment.


vuln_id: V-245752
rule_id: SV-245752r1138419_rule
severity: CAT III
title: Environmental IA Controls - Fire Inspections/Discrepancies
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to conduct fire inspections and correct any discrepancies could result in hazardous situations leading to a possible fire and loss of service.

  REFERENCES:

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-13(4)

  NIST SP 800-12, An Introduction to Computer Security: The NIST Handbook

  NIST SP 800-100, Information Security Handbook: A Guide for Managers</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Periodic fire marshal inspections of (IT) computing facilities must be conducted (minimum annually) and  discrepancies noted during the inspections must be promptly addressed.

check_text:
  Check fire marshal inspection reports and documentation that verifies discrepancies are addressed and corrected.

  Inspections must be conducted on at least an annual basis.

  NOTES:

  1. In general this should be applied to major IT equipment areas (generally computer rooms with raised floor space containing servers and communications equipment). The requirement should not be applied to administrative/office space. 
   
  2. Also, this requirement should not be applied to a tactical environment, unless it is a fixed computer facility supporting missions in a Theater of Operations. The standards to be applied for applicability in a tactical environment are: 1) The facility containing the computer room has been in operation over 1-year. 2) The facility is "fixed facility" - a hard building made from normal construction materials - wood, steel, brick, stone, mortar, etc.

  3. Even if there is no finding the reviewer should note in the report the date the last fire marshal or similar inspection was conducted with a summary of results. This information could be useful during subsequent inspections.


vuln_id: V-245753
rule_id: SV-245753r1138420_rule
severity: CAT III
title: Environmental IA Controls - Fire Detection and Suppression
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to provide adequate fire detection and suppression could result in the loss of or damage to data, equipment, facilities, or personnel.

  REFERENCES:

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-13 and PE-13(1), (2), (3) and (4)

  NIST SP 800-12, An Introduction to Computer Security: The NIST Handbook

  NIST SP 800-100, Information Security Handbook: A Guide for Managers</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  An adequate fire detection and suppression system must be installed and must be periodically tested. The following considerations must be incorporated into the system:

  1. A fully automatic fire detection and suppression system must be installed for information system areas that automatically activates when it detects heat, smoke, or particles.
   
  2. A servicing fire department must receive an automatic notification of any activation of the smoke detection or fire suppression system.
   
  3. Periodic testing of the fire detection and suppression system must be conducted.
   
  4. The fire detection and suppression system(s) must be supported by an independent or alternate (backup) energy source.

check_text:
  1. Check to ensure a fully automatic fire detection and suppression system is installed for information system areas that automatically activates when it detects heat, smoke, or particles. 

  2. Check that a servicing fire department receives an automatic notification of any activation of the smoke detection or fire suppression system.
   
  3. Check for periodic fire detection and suppression test logs. 

  4. Check the fire detection and suppression system(s) are supported by an independent or alternate (backup) energy source.

  NOTES: This check applies primarily to facilities containing concentrations of information system resources including, for example, data centers, server rooms, and mainframe computer rooms. Fire suppression and detection devices/systems include, for example, sprinkler systems, handheld fire extinguishers, fixed fire hoses, and smoke detectors.


vuln_id: V-245754
rule_id: SV-245754r1138421_rule
severity: CAT II
title: TEMPEST Countermeasures
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to implement required TEMPEST countermeasures could leave the system(s) vulnerable to a TEMPEST attack.

  REFERENCES: 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND)

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AC-18, PE-19(1), and SC-8

  Committee on National Security Systems Policy 300, "National Policy on Control of Compromising Emanations," April 2004, as amended 
                
  Committee on National Security Systems Instruction 7000, "TEMPEST Countermeasures for Facilities," May 2004, as amended

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Where TEMPEST is required to be considered a Certified TEMPEST Technical Authority (CTTA) must evaluate Emanation Security concerns and recommended countermeasures from this evaluation must be properly applied.

  2. Where TEMPEST is required an assessment of TEMPEST risk and applicability of countermeasures must be included in the site risk assessment and the supporting CTTA must be consulted.

  NOTE: TEMPEST countermeasures are required based on the geographical location and classification level processed. TEMPEST considerations apply to all OCONUS locations and select CONUS locations.

check_text:
  1. Determine if TEMPEST countermeasures are required based on the geographical location and classification level processed. TEMPEST considerations apply to all OCONUS locations and select CONUS locations. 

  2. If required, ask to see a TEMPEST assessment. Verify the TEMPEST assessment was conducted by a Certified TEMPEST Technical Authority (CTTA). 

  3. Determine through inspection and/or interview if any required TEMPEST countermeasures are implemented. 
   
  4. TEMPEST countermeasures may or may not be feasible in a tactical environment. This can only be determined through a proper Risk Assessment, which is coordinated with a supporting CTTA for matters concerning emanations security.
   
  5. Where required (OCONUS in particular) check to ensure an assessment of TEMPEST risk and applicability of countermeasures is included in a risk assessment and that the supporting CTTA was consulted. This process may be conducted by the Major US Combatant Command for Theater level operations rather than by individual units or location based commands. The key element to determine if this requirement is met is that any possible risk resulting from Emanations is properly considered and documented.

  NOTES: Where TEMPEST must be considered and although there is no finding, the reviewer should note in the report if a CTTA has conducted a TEMPEST review, the date it was completed and countermeasures recommended. Further note in the report if specific consideration for TEMPEST was provided for in the site risk assessment.


vuln_id: V-245755
rule_id: SV-245755r1138422_rule
severity: CAT II
title: TEMPEST - Red/Black separation (Processors)
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to maintain proper separation could result in detectable emanations of classified information.

  REFERENCES: 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND)

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1
   
  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-19 & PE-19(1)

  Committee on National Security Systems Policy 300, "National Policy on Control of Compromising Emanations," April 2004, as amended 

  Committee on National Security Systems Instruction 7000, "TEMPEST Countermeasures for Facilities," May 2004, as amended  

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014
                    
  CNSSAM TEMPEST/ 1-13, 17 January 2014, RED/BLACK Installation Guidance</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  A separation distance of 1 meter (39 inches) shall be provided between RED equipment and:

  1. BLACK wirelines that connect to RF transmitters; and

  2. BLACK equipment with lines that connect to RF transmitters.

  A separation distance of 30 cm (12 inches) shall be provided between RED Equipment and BLACK wirelines that directly leave the inspectable space. 

  NOTES:
   
  1. This requirement is applicable in a tactical environment. 

  2. The supporting CTTA should always be contacted for specific separation requirements, which may be greater than the distance reflected in this check.

  3. Inspectable Space is the three dimensional space surrounding equipment that processes classified and/or sensitive information within which TEMPEST exploitation is not considered practical or where legal authority to identify and remove a potential TEMPEST exploitation exists and is exercised. CTTAs have the authority to define the inspectable space.

check_text:
  Check for minimum separation between any RED processor and BLACK equipment IAW the following guidance:

  A separation distance of 1 meter (39 inches) shall be provided between RED equipment and:

  1. BLACK wirelines that connect to RF transmitters; and

  2. BLACK equipment with lines that connect to RF transmitters.

  A separation distance of 30 cm (12 inches) shall be provided between RED Equipment and BLACK wirelines that directly leave the inspectable space. 

  NOTES: 
   
  1. This requirement is applicable in a tactical environment. 
   
  2. The supporting Certified TEMPEST Technical Authority (CTTA) should always be contacted for specific separation requirements, which may be greater than the distance reflected in this check.

  3. Inspectable Space is the three dimensional space surrounding equipment that processes classified and/or sensitive information within which TEMPEST exploitation is not considered practical or where legal authority to identify and remove a potential TEMPEST exploitation exists and is exercised. CTTAs have the authority to define the inspectable space.


vuln_id: V-245756
rule_id: SV-245756r1138423_rule
severity: CAT II
title: TEMPEST - Red/Black Separation (Cables)
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to maintain proper separation could result in detectable emanations of classified information.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND)

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-19 & PE-19(1)

  Committee on National Security Systems Policy 300, "National Policy on Control of Compromising Emanations," April 2004, as amended 

  Committee on National Security Systems Instruction 7000, "TEMPEST Countermeasures for Facilities," May 2004, as amended  

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 

  CNSSAM TEMPEST/ 1-13, 17 January 2014, RED/BLACK Installation Guidance</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Unless separated by a metal distribution system such as conduit or enclosed cable tray, a minimum separation distance of 5 cm (2 inches) or ( 15 cm (6 inches) for parallel cable lengths over 30 meters (98.4 feet)) shall be provided between any RED wire line and BLACK wire lines that exit the inspectable space or are connected to an RF transmitter, or BLACK power lines, or a digital switch (such as a computerized telephone switch or network router) that is contained within the inspectable space.

  NOTES: 

  1. This requirement is applicable in a tactical environment. 
   
  2. The supporting CTTA should always be contacted for specific separation requirements, which may be greater than the distance reflected in this check.

  3. Inspectable Space is the three dimensional space surrounding equipment that processes classified and/or sensitive information within which TEMPEST exploitation is not considered practical or where legal authority to identify and remove a potential TEMPEST exploitation exists and is exercised. CTTAs have the authority to define the inspectable space.

check_text:
  Check that unless separated by a metal distribution system such as conduit or enclosed cable tray, a minimum separation distance of 5 cm (2 inches) or (15 cm (6 inches) for parallel cable lengths over 30 meters (98.4 feet)) is provided between any RED wire line and BLACK wire lines that exit the inspectable space or are connected to an RF transmitter, or BLACK power lines, or a digital switch (such as a computerized telephone switch or network router) that is contained within the inspectable space.

  NOTES: 

  1. This requirement is applicable in a tactical environment.
   
  2. The supporting CTTA should always be contacted for specific separation requirements, which may be greater than the distance reflected in this check.

  3. Inspectable Space is the three dimensional space surrounding equipment that processes classified and/or sensitive information within which TEMPEST exploitation is not considered practical or where legal authority to identify and remove a potential TEMPEST exploitation exists and is exercised. CTTAs have the authority to define the inspectable space.


vuln_id: V-245757
rule_id: SV-245757r1138486_rule
severity: CAT II
title: Foreign National System Access - Identification as FN in Email Address
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Unauthorized access by foreign nationals to Information Systems can result in, among other things, security incidents, compromise of the system, or the introduction of a virus.

  REFERENCES:

  National Disclosure Policy - 1 (NDP-l) 

  National Security Directive 42, "National Policy for the Security of National Security Telecommunications and Information Systems 

  DODD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations. SPECIAL NOTE: Enclosure 3 to DODD 5230.11 establishes specific criteria for the disclosure of classified information.

  Use guidance on sharing information with REL Partners on SIPRNET at http://www.ssc.smil.mil/. Follow Policy/Guidance&Documentation link and then SIPRNet Information Sharing.

  DODD 5230.20; Visits, Assignments, and Exchanges of Foreign Nationals 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, Section 27, paragraph (1)

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AC-1, AC-2, CA-1, and IA-4(4)

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014, Enclosure 3, paragraph 11.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Foreign Nationals (including those foreign nationals serving in the US military) granted e-mail privileges on DOD systems must be clearly identified as such in their e-mail addresses IAW DODI 8500.01, SUBJECT: Cybersecurity and CJCSI 6510.01F.

check_text:
  When organizations grant foreign national access to U.S. DOD systems check to ensure foreign nationals (including those foreign nationals serving in the US military) granted e-mail privileges on DOD systems are clearly identified as such in their e-mail addresses IAW DODI 8500.01, SUBJECT: Cybersecurity and CJCSI 6510.01F.
   
  TACTICAL ENVIRONMENT: This check is applicable where LN/FN are employed in a tactical environment with access to U.S. or Coalition Forces Systems.


vuln_id: V-245758
rule_id: SV-245758r917321_rule
severity: CAT III
title: Foreign National System Access - Local Access Control Procedures
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Unauthorized access by foreign nationals to Information Systems can result in, among other things, security incidents, compromise of the system, or the introduction of a virus.

  REFERENCES:

  National Disclosure Policy - 1 (NDP-l) 

  National Security Directive 42, "National Policy for the Security of National Security Telecommunications and Information Systems 

  DODD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations SPECIAL NOTE: Enclosure 3 to DODD 5230.11 establishes specific criteria for the disclosure of classified information 

  Use guidance on sharing information with REL Partners on SIPRNET at http://www.ssc.smil.mil/ - follow Policy/Guidance&Documentation link and then SIPRNet Information Sharing...

  DODD 5230.20; Visits, Assignments, and Exchanges of Foreign Nationals 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND)

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AC-1, AC-2, AC-3, AC-24, PS-4, PS-5, CA-1, MA-5(4) and IA-4(4)

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014, Enclosure 3, paragraph 11. 
                   
  DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP), 3 April 2017

  DOD 8570.01-M, Information Assurance Workforce Improvement Program 

  DODD 8140.01 Cyberspace Workforce Management 

  DODI 8140.02 Identifying-Tracking and Reporting of Cyberspace Workforce Requirements 

  DODM 8140.03 Cyberspace Workforce Qualification and Management System</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Local written procedures to guide system administrators must be developed when granting foreign nationals access to U.S. DOD systems 

  NOTE: There are numerous categories of foreign military and civilian personnel, which should be addressed, as applicable to the site or organization and include the following:

  - Foreign Liaison Officers (FLO) 
  - Foreign Exchange Officers 
  -REL Partners - Coalition Partners 
  - Foreign Nationals/Local Nationals (FN/LN) employed by DOD Organizations Overseas under SOFA 
  - Foreign Nationals employed by Government contractors 
  - Foreign Nationals or immigrant aliens not affiliated with or representing their Country of citizenship, who may be granted a Limited Access Authorization (LAA) for access to US Classified.
   
  2. Local procedures must cover all possible foreign national encounters applicable to the site and ensure guidance is correct and follows regulatory standards.
   
  3. System Access Authorization Request (SAAR) forms used by the site must clearly indicate the applicant for systems access is a foreign national.

  NOTE: DODM 8570 requirements will be met until full implementation of DODM 8140.03 requirements. Implementation dates for DOD Manual 8140.03 include a two-year timeline for personnel (civilian and military) in positions coded with cybersecurity work roles and three years for personnel (civilian and military) in positions coded with work roles in any other workforce element. The dates for required qualification would be 15 February 2025 for cybersecurity work roles and the same date in February 2026 for all Defense Cyber Workforce Framework work roles.

check_text:
  1. When organizations grant foreign nationals access to U.S. DOD systems check to ensure there are written procedures to guide system administrators. 

  There are numerous categories of foreign military and civilian personnel, which should be addressed, as applicable to the site or organization and include the following:

  - Foreign Liaison Officers (FLO)
  - Foreign Exchange Officers 
  - REL Partners
  - Coalition Partners
  - Foreign Nationals/Local Nationals (FN/LN) employed by DOD Organizations Overseas under SOFA       
  - Foreign Nationals employed by Government contractors       
  - Foreign Nationals or immigrant aliens not affiliated with or representing their Country of citizenship, who may be granted a Limited Access Authorization (LAA) for access to US Classified.

  2. Reviewers must validate that local procedures adequately cover all possible foreign national encounters applicable to the site and ensure guidance is correct and follows regulatory standards. 

  3. Reviewers must ensure system access request forms used clearly indicate that the applicant for systems access is a foreign national. 

  TACTICAL ENVIRONMENT: This check is applicable where LN/FN are employed in a tactical environment with access to US or Coalition Forces Systems.


vuln_id: V-245759
rule_id: SV-245759r917322_rule
severity: CAT I
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Foreign National (FN) Systems Access - Local Nationals Overseas System Access -  (SIPRNet or Other Classified System or Classified Network being Reviewed)

description:
  <VulnDiscussion>Failure to subject foreign nationals to background checks could result in the loss or compromise of classified or sensitive information by foreign sources.

  REFERENCES:

  National Disclosure Policy - 1 (NDP-l) 

  National Security Directive 42, "National Policy for the Security of National Security Telecommunications and Information Systems 

  DODD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations SPECIAL NOTE: Enclosure 3 to DODD 5230.11 establishes specific criteria for the disclosure of classified information 

  Use guidance on sharing information with REL Partners on SIPRNET at http://www.ssc.smil.mil/ - follow Policy/Guidance & Documentation link and then SIPRNet Information Sharing...

  DODD 5230.20; Visits, Assignments, and Exchanges of Foreign Nationals 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl C, para 26.c. (2) & (3)

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AC-1, AC-2, AC-3, AC-24, CA-1, PS-4, PS-5, PM-9, MA-5(4) and IA-4(4)

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014, Enclosure 3, paragraph 11.
                    
  DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP), 3 April 2017

  DOD 8570.01-M, Information Assurance Workforce Improvement Program, para C.3.2.4.8.2, C.8.2.7 & AP1.19

  DODD 8140.01 Cyberspace Workforce Management 

  DODI 8140.02 Identifying-Tracking and Reporting of Cyberspace Workforce Requirements 

  DODM 8140.03 Cyberspace Workforce Qualification and Management System</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  All local foreign nationals (FN) hired by DOD organizations overseas must not have access to classified systems and information unless:

  1. Permitted by National Disclosure Policy and the applicable SOFA - AND 

  2. A proper background investigation/personnel vetting/security clearance adjudication has been successfully completed for each FN granted systems access IAW the SOFA and all applicable DOD guidance. 

  3. Security Clearance and access levels MUST ONLY be provided ONLY to the minimum necessary for mission accomplishment.
   
  4. A Delegation of Disclosure Authority Letter (DDL) or similar approved certification method documenting approved access to US Classified information must be available for review.

  NOTE: DODM 8570 requirements will be met until full implementation of DODM 8140.03 requirements. Implementation dates for DOD Manual 8140.03 include a two-year timeline for personnel (civilian and military) in positions coded with cybersecurity work roles and three years for personnel (civilian and military) in positions coded with work roles in any other workforce element. The dates for required qualification would be 15 February 2025 for cybersecurity work roles and the same date in February 2026 for all Defense Cyber Workforce Framework work roles.

check_text:
  Check that all local foreign nationals hired by DOD organizations overseas do not have access to classified systems and information unless:

  1. Permitted by National Disclosure Policy - AND

  2. Allowed under the applicable Status of Forces Agreement (SOFA) - AND 

  3. A proper background investigation/personnel vetting/security clearance adjudication for each FN granted access has been successfully completed IAW the SOFA and all other applicable DOD guidance. Security Clearance and access levels MUST be provided ONLY to the minimum necessary for mission accomplishment.
   
  4. A Delegation of Disclosure Authority Letter (DDL) or similar approved certification method documenting approved access to US Classified information is available for review.

  TACTICAL ENVIRONMENT: This check is applicable where LN/FN are employed in a tactical environment with access to US or Coalition Forces Systems.


vuln_id: V-245761
rule_id: SV-245761r917323_rule
severity: CAT II
title: Foreign National (FN) Systems Access - Local Nationals Overseas System Access - (NIPRNet User)
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to subject foreign nationals to background checks could result in the loss or compromise of classified or sensitive information by foreign sources.

  REFERENCES:

  National Disclosure Policy - 1 (NDP-l) 

  National Security Directive 42, "National Policy for the Security of National Security Telecommunications and Information Systems 

  DODD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations SPECIAL NOTE: Enclosure 3 to DODD 5230.11 establishes specific criteria for the disclosure of classified information 

  Use guidance on sharing information with REL Partners on SIPRNET at http://www.ssc.smil.mil/ - follow Policy/Guidance&Documentation link and then SIPRNet Information Sharing...

  DODD 5230.20; Visits, Assignments, and Exchanges of Foreign Nationals 

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl C, para 26.c.(2)&(3)

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AC-1, AC-2, AC-3, AC-24, CA-1, PS-4, PS-5, PM-9, MA-5(4) and IA-4(4)

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Enclosure 3, paragraph 11.                  

  DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP), 3 April 2017, paragraph 6.4.f.

  DOD 8570.01-M, Information Assurance Workforce Improvement Program, para C.3.2.4.8.2, C.8.2.7 & AP1.19

  DODD 8140.01 Cyberspace Workforce Management 

  DODI 8140.02 Identifying-Tracking and Reporting of Cyberspace Workforce Requirements 

  DODM 8140.03 Cyberspace Workforce Qualification and Management System</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  All local foreign nationals hired by DOD organizations overseas, with NIPRNet user access, must be employed IAW the applicable Status of Forces Agreement (SOFA)and meet the following requirements:

  1. Access to DOD ISs is authorized only by the DOD Component head in accordance with DOD, Department of State, and ODNI disclosure guidance, as applicable.
   
  2. Mechanisms are in place to limit access strictly to information that has been cleared for release to the represented foreign nation, coalition, or international organization (e.g., North Atlantic Treaty Organization) in accordance with policy guidance for unclassified information such as IAW DODD 5230.20E and DODI 5230.27.

  3. The Foreign Nationals have the following successfully adjudicated checks:

  a. Host government, law enforcement and security agency checks at the city, state (province), and national level, whenever permissible by the laws of the host government.
  b. Favorable DCII checks
  c. FBI-HQ/ID (Where information exists regarding residence by the foreign national in the U.S. or Territory for one year or more since age 18).  

  NOTE: DODM 8570 requirements will be met until full implementation of DODM 8140.03 requirements. Implementation dates for DOD Manual 8140.03 include a two-year timeline for personnel (civilian and military) in positions coded with cybersecurity work roles and three years for personnel (civilian and military) in positions coded with work roles in any other workforce element. The dates for required qualification would be 15 February 2025 for cybersecurity work roles and the same date in February 2026 for all Defense Cyber Workforce Framework work roles.

check_text:
  Check that all local foreign nationals hired by DOD organizations overseas, with NIPRNet user access, are employed IAW the applicable Status of Forces Agreement (SOFA) and meet the following requirements:

  1. Access to DOD ISs is authorized only by the DOD Component head in accordance with DOD, Department of State, and ODNI disclosure guidance, as applicable.
   
  2. Mechanisms are in place to limit access strictly to information that has been cleared for release to the represented foreign nation, coalition, or international organization (e.g., North Atlantic Treaty Organization) in accordance with policy guidance for unclassified information such as IAW DODD 5230.20E and DODI 5230.27.

  3. The Foreign Nationals have the following successfully adjudicated checks:

  a. Host government, law enforcement and security agency checks at the city, state (province), and national level, whenever permissible by the laws of the host government.
  b. Favorable DCII checks
  c. FBI-HQ/ID (Where information exists regarding residence by the foreign national in the U.S. or Territory for one year or more since age 18).

  TACTICAL ENVIRONMENT: This check is applicable where LN/FN are employed in a tactical environment with access to Unclassified US or Coalition Forces Systems.


vuln_id: V-245762
rule_id: SV-245762r917324_rule
severity: CAT II
title: Foreign National (FN) Systems Access - Delegation of Disclosure Authority Letter (DDL)
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Unauthorized access by foreign nationals to Information Systems can result in, among other things, security incidents, compromise of the system, or the introduction of a virus.

  REFERENCES:

  National Disclosure Policy - 1 (NDP-l) 

  National Security Directive 42, "National Policy for the Security of National Security Telecommunications and Information Systems 

  DODD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations SPECIAL NOTE: Enclosure 3 to DODD 5230.11 establishes specific criteria for the disclosure of classified information -- Specifically note paragraphs 4.6.3., E2.1.4. and Enclosure 4.

  Use guidance on sharing information with REL Partners on SIPRNET at http://www.ssc.smil.mil/ - follow Policy/Guidance&Documentation link and then SIPRNet Information Sharing...

  DODD 5230.20; Visits, Assignments, and Exchanges of Foreign Nationals, paragraph 4.4.

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl C, para 26.c.(2)&(3)

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AC-1, AC-2, AC-3, AC-24, CA-1, PS-4, PS-5, PM-9, MA-5(4) and IA-4(4)

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Enclosure 3, paragraph 11.                  

  DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP), 3 April 2017

  DOD 8570.01-M, Information Assurance Workforce Improvement Program, para C.3.2.4.8.2, C.8.2.7 & AP1.19

  DODD 8140.01 Cyberspace Workforce Management 

  DODI 8140.02 Identifying-Tracking and Reporting of Cyberspace Workforce Requirements 

  DODM 8140.03 Cyberspace Workforce Qualification and Management System</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  A Delegation of Disclosure Authority Letter (DDL) must be on hand for each assigned REL partner or other FN partner granted Limited Access to US Classified systems or information. 

  NOTE 1: All disclosures and denials of classified military information are reported in the Foreign Disclosure and Technical Information System (FORDTIS). A DDL is required to validate and set parameters for FN access to any US Classified information. 

  NOTE 2: The organization's supporting Foreign Disclosure/Contact Officer (FDO) will be the POC for this.

  NOTE 3: DODM 8570 requirements will be met until full implementation of DODM 8140.03 requirements. Implementation dates for DOD Manual 8140.03 include a two-year timeline for personnel (civilian and military) in positions coded with cybersecurity work roles and three years for personnel (civilian and military) in positions coded with work roles in any other workforce element. The dates for required qualification would be 15 February 2025 for cybersecurity work roles and the same date in February 2026 for all Defense Cyber Workforce Framework work roles.

check_text:
  1. Check that a Delegation of Disclosure Authority Letter (DDL) is on hand for each assigned REL partner or other FN partner granted Limited Access to US Classified. 

  NOTE: All disclosures and denials of classified military information are reported in the Foreign Disclosure and Technical Information System (FORDTIS) and it might also be possible for reviewers to request visual access to validate foreign clearance approvals at sites. However, a DDL is required for access to any US Classified information. 

  2. The organization's supporting Foreign Disclosure/Contact Officer (FDO) will be the ultimate POC for this. 

  TACTICAL ENVIRONMENT: This check is applicable where REL Partners or other FN allies are employed in a tactical environment with access to US Classified or Sensitive Systems.


vuln_id: V-245763
rule_id: SV-245763r1138425_rule
severity: CAT I
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Foreign National System Access - FN or Immigrant Aliens (not representing a foreign government or entity) System Access - Limited Access Authorization (LAA)

description:
  <VulnDiscussion>Failure to verify citizenship and proper authorization for access to either sensitive or classified information could enable personnel to have access to classified or sensitive information to which they are not entitled.

  REFERENCES:

  National Disclosure Policy - 1 (NDP-l) 

  National Security Directive 42, "National Policy for the Security of National Security Telecommunications and Information Systems 

  DODD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations SPECIAL NOTE: Enclosure 3 to DODD 5230.11 establishes specific criteria for the disclosure of classified information.

  Use guidance on sharing information with REL Partners on SIPRNET at http://www.ssc.smil.mil/ - follow Policy/Guidance&Documentation link and then SIPRNet Information Sharing.

  DODD 5230.20; Visits, Assignments, and Exchanges of Foreign Nationals

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl C, para 26.c.(2)&(3)

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AC-1, AC-2, AC-3, AC-24, CA-1, PS-3, PS-4, PS-5, PM-9, MA-5(4) and IA-4(4)

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Enclosure 3, paragraph 11.         

  DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP), 3 April 2017, Section 6.

  DOD 8570.01-M, Information Assurance Workforce Improvement Program, para C.3.2.4.8.2, C.8.2.7 & AP1.19

  DODD 8140.01 Cyberspace Workforce Management 

  DODI 8140.02 Identifying-Tracking and Reporting of Cyberspace Workforce Requirements 

  DODM 8140.03 Cyberspace Workforce Qualification and Management System

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  BACKGROUND INFORMATION: Compelling reasons may exist to grant access to classified information to an immigrant alien or a foreign national. Such individuals may be granted a "Limited Access Authorization" (LAA) in those rare circumstances where a non-U.S. citizen - NOT REPRESENTING A FOREIGN GOVERNMENT OR OTHER ENTITY - possesses a unique or unusual skill or expertise that is urgently needed in pursuit of a specific DOD requirement involving access to specified classified information for which a cleared or clearable U.S. citizen is not available. LAAs may be granted only at the SECRET and CONFIDENTIAL level. LAAs for TOP SECRET are prohibited. Interim access is not authorized pending approval of a LAA. 

  1. All non-U.S. citizens fitting the above described situation must have an LAA granted prior to being permitted access to sensitive duties, classified information and/or systems. 

  2. The information the non-U S. citizen has access to must be approved for release to the persons country or countries of citizenship, in accordance with DOD Directive 5230.11.

  3. The non-U.S. citizen must be the subject of a favorably completed (within the last 5 years) and adjudicated SSBI prior to granting an LAA. If the SSBI cannot provide full investigative coverage, a polygraph examination (if there are no host country legal prohibitions) to resolve the remaining personnel security issues must be favorably completed before granting access.

  4. If geographical, political, or medical situations prevent the full completion of the SSBI or prevent the polygraph examination to supplement a less than full SSBI, an LAA may be granted only with approval of the DDI(I&S).

  NOTE: DODM 8570 requirements will be met until full implementation of DODM 8140.03 requirements. Implementation dates for DOD Manual 8140.03 include a two-year timeline for personnel (civilian and military) in positions coded with cybersecurity work roles and three years for personnel (civilian and military) in positions coded with work roles in any other workforce element. The dates for required qualification would be 15 February 2025 for cybersecurity work roles and the same date in February 2026 for all Defense Cyber Workforce Framework work roles.

check_text:
  BACKGROUND INFORMATION: Compelling reasons may exist to grant access to classified information to an immigrant alien or a foreign national. Such individuals may be granted a "Limited Access Authorization" (LAA) in those rare circumstances where a non-U.S. citizen - NOT REPRESENTING A FOREIGN GOVERNMENT OR OTHER ENTITY - possesses a unique or unusual skill or expertise that is urgently needed in pursuit of a specific DOD requirement involving access to specified classified information for which a cleared or clearable U.S. citizen is not available. LAAs may be granted only at the SECRET and CONFIDENTIAL level. LAAs for TOP SECRET are prohibited. Interim access is not authorized pending approval of a LAA.

  1. Check to ensure that all non-U.S. citizens fitting the above described situation have had an LAA granted prior to being permitted access to sensitive duties, classified information and/or systems. 

  2. Ensure that the information the non-U S. citizen has access to is approved for release to the persons country or countries of citizenship, in accordance with DOD Directive 5230.11. 

  3. Ensure the non-U.S. citizen has been the subject of a favorably completed (within the last 5 years) and adjudicated SSBI prior to granting an LAA. If the SSBI cannot provide full investigative coverage, a polygraph examination (if there are no host country legal prohibitions) to resolve the remaining personnel security issues must be favorably completed before granting access.

  4. Ensure that if geographical, political, or medical situations prevent the full completion of the SSBI or
  prevent the polygraph examination to supplement a less than full SSBI, an LAA may be granted only with approval of the DDI(I&S).

  TACTICAL ENVIRONMENT: This check is applicable where any non-U.S. citizens (not representing a foreign Government or entity) are employed in a tactical environment with access to US Classified or Sensitive Systems.


vuln_id: V-245764
rule_id: SV-245764r1138426_rule
severity: CAT I
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Foreign National (FN) System Access - FN or Immigrant Aliens (not representing a foreign government or entity) with LAA Granted Uncontrolled Access

description:
  <VulnDiscussion>Failure to verify citizenship and proper authorization for access to either sensitive or classified information could enable personnel to have access to classified or sensitive information to which they are not entitled. Further uncontrolled/unsupervised access to physical facilities can lead directly to unauthorized access to classified or sensitive information.

  REFERENCES:

  National Disclosure Policy - 1 (NDP-l) 

  National Security Directive 42, "National Policy for the Security of National Security Telecommunications and Information Systems 

  DODD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations SPECIAL NOTE: Enclosure 3 to DODD 5230.11 establishes specific criteria for the disclosure of classified information.

  Use guidance on sharing information with REL Partners on SIPRNET at http://www.ssc.smil.mil/ - follow Policy/Guidance&Documentation link and then SIPRNet Information Sharing.

  DODD 5230.20; Visits, Assignments, and Exchanges of Foreign Nationals

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl C, para 26.c.(2)&(3)

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AC-1, AC-2, AC-3, AC-24, CA-1, PS-3, PS-4, PS-5, PM-9, MA-5(4) and IA-4(4)

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Enclosure 3, paragraph 11.         

  DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP), 3 April 2017, Section 6.

  DOD 8570.01-M, Information Assurance Workforce Improvement Program, para C.3.2.4.8.2, C.8.2.7 & AP1.19

  DODD 8140.01 Cyberspace Workforce Management 

  DODI 8140.02 Identifying-Tracking and Reporting of Cyberspace Workforce Requirements 

  DODM 8140.03 Cyberspace Workforce Qualification and Management System

  DOD Manual 5200.01, Volume 1, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification, Encl 2, para 9.j.(1) and Encl 3, para 5.b., 7.b.(5), 12.e.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 3, para 5, Encl 4, para 2.c., Appendix to Encl 4, para 1.f. and Encl 7.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Personnel granted LAAs must not be permitted uncontrolled access to areas where classified information is stored or discussed (safes, vaults and secure room in particular). Classified information must be maintained in a location that will be under the continuous control and supervision of an appropriately cleared U.S. citizen.  

  2. Access granted to DOD information systems must be properly controlled so that any FN granted an LAA has systems access only to that sensitive (CUI) or classified information to which they are specifically authorized.

  NOTE: DODM 8570 requirements will be met until full implementation of DODM 8140.03 requirements. Implementation dates for DOD Manual 8140.03 include a two-year timeline for personnel (civilian and military) in positions coded with cybersecurity work roles and three years for personnel (civilian and military) in positions coded with work roles in any other workforce element. The dates for required qualification would be 15 February 2025 for cybersecurity work roles and the same date in February 2026 for all Defense Cyber Workforce Framework work roles.

check_text:
  1. Check to ensure that personnel granted LAAs are not permitted uncontrolled access to areas where classified information is stored or discussed (safes, vaults and secure room in particular). Classified information must be maintained in a location that will be under the continuous control and supervision of an appropriately cleared U.S. citizen. 

  2. Check to ensure that access to DOD information systems is properly controlled so that any FN granted an LAA has systems access only to that sensitive (CUI) or classified information to which they are specifically authorized. This check will require close coordination and consultation with a network reviewer or SME. 

  TACTICAL ENVIRONMENT: This check is applicable where any non-U.S. citizens (not representing a foreign Government or entity) are employed in a tactical environment with access to US Classified or Sensitive Systems.


vuln_id: V-245765
rule_id: SV-245765r1138427_rule
severity: CAT I
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Foreign National (FN) Physical Access Control - Areas Containing US Only Information Systems Workstations/Monitor Screens, Equipment, Media or Documents

description:
  <VulnDiscussion>Physically co-locating REL Partners or other FN - who have limited or no access to the SIPRNet or other US Classified systems - near US personnel in a collateral classified (Secret or higher) open storage area or in a Secret or higher Controlled Access Area (CAA) that processes classified material is permissible for operational efficiency and coordination.

  Failure to limit and control physical access to information visible on system monitor screens, information processing equipment containing classified data, removable storage media and printed documents is especially important in mixed US/FN environments. Inadequate access and procedural controls can result in FN personnel having unauthorized access to classified materials and data, which can result in the loss or compromise of classified information, including NOFORN information. 
   
  Appropriate but simple physical and procedural security measures must be put in place to ensure the FN partners do not have unauthorized access to information not approved for release to them. 

  The primary control measure is to either keep US Only classified documents, information systems equipment and/ or associated removable storage media under continuous observation and control of a cleared US employee or place such items in an approved safe when unattended.

  Additionally, escorting visitors AND all FN employees/personnel into any area where there is US Only classified processing, documents, media, equipment or materials is not only a prudent security measure but an absolute requirement to prevent both intentional (insider threat) or unintentional (inadvertent) unauthorized exposure to classified materials and information.
   
  Following are applicable excerpts from CJCSI 6510.01F pertaining to control of US Only workstation spaces (in particular SCIFs and secure rooms):

  7. Information and Information System Access. Access to DOD ISs is a revocable privilege and shall be granted to individuals based on need-to-know and IAW DODI 8500.2, NSTISSP No. 200, "National Policy on Controlled Access Protection" , Status of Forces Agreements for host national access, and DOD 5200.2-R, "Personnel Security System".
  b. Individual foreign nationals may be granted access to specific classified U.S. networks and systems as specifically authorized under Information Sharing guidance outlined in changes to National Disclosure Policy (NDP-1). 
  (1) Classified ISs shall be sanitized or configured to guarantee that foreign nationals have access only to classified information that has been authorized for disclosure to the foreign national's government or coalition, and is necessary to fulfill the terms of their assignments.
  (2) U.S.-only classified workstations shall be under strict U.S. control at all times.
  27. Foreign Access.
  f. Foreign National Access to U.S.-Only Workstations and Network Equipment. CC/S/As shall:
  (1) Maintain strict U.S. control of U.S.-only workstations and network equipment at all times.
  (4) Announce presence. If a foreign national is permitted access to U.S.-controlled workstation space, the individual must be announced, must wear a badge clearly identifying him or her as a foreign national, and must be escorted at all times. In addition, a warning light must be activated if available and screens must be covered or blanked.

  REFERENCES:

  National Disclosure Policy - 1 (NDP-l) 

  National Security Directive 42, "National Policy for the Security of National Security Telecommunications and Information Systems 

  DODD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations SPECIAL NOTE: Enclosure 3 to DODD 5230.11 establishes specific criteria for the disclosure of classified information.

  Use guidance on sharing information with REL Partners on SIPRNET at http://www.ssc.smil.mil/ - follow Policy/Guidance&Documentation link and then SIPRNet Information Sharing.

  DODD 5230.20; Visits, Assignments, and Exchanges of Foreign Nationals

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl A, para 7.b.(1) & (2) and Encl C, para 27.f.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  PE-5, PE-18, PS-3(1), PS-6, PS-6(1), PS-6(2)

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014, Enclosure 3, paragraph 11.         

  DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP), 3 April 2017, Section 6.

  DOD 8570.01-M, Information Assurance Workforce Improvement Program, para C.3.2.4.8.2, C.8.2.7 & AP1.19

  DODD 8140.01 Cyberspace Workforce Management 

  DODI 8140.02 Identifying-Tracking and Reporting of Cyberspace Workforce Requirements 

  DODM 8140.03 Cyberspace Workforce Qualification and Management System

  DOD Manual 5200.01, Volume 1, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification, Encl 2, para 9.j.(1) and Encl 3, para 5.b., 7.b.(5), 12.e.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 3, para 5, Encl 4, para 2.c., Appendix to Encl 4, para 1.f. and Encl 7.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  This fix pertains to mixed classified environments containing US Only systems and media where FN partners are present:

  1. All classified and sensitive documents and removable storage media containing US Only information must either be under the continuous observation and control of cleared US personnel or placed in an approved GSA container (Safe) when not in use and under proper US control. 

  2. Foreign National (FN) access to classified open storage areas (includes vaults, secure rooms, and SCIFs) must be permitted only during normal working hours when US personnel are present to provide oversight.

  NOTE: DODM 8570 requirements will be met until full implementation of DODM 8140.03 requirements. Implementation dates for DOD Manual 8140.03 include a two-year timeline for personnel (civilian and military) in positions coded with cybersecurity work roles and three years for personnel (civilian and military) in positions coded with work roles in any other workforce element. The dates for required qualification would be 15 February 2025 for cybersecurity work roles and the same date in February 2026 for all Defense Cyber Workforce Framework work roles.

check_text:
  THIS REQUIREMENT PERTAINS TO CLASSIFIED ENVIRONMENTS such as Secret or higher vaults or classified open storage areas (secure rooms or SCIFs) WHERE FN partners ARE PRESENT with limited or no access to classified information /systems; in particular the SIPRNet. This is important to note, because without the FN presence in such an environment, placement of classified documents and classified removable media in safes when unattended would not normally be necessary/required.

  CHECK #1: Check to ensure all classified and sensitive documents and removable storage media containing US Only information are either under the continuous observation and control of cleared US personnel or placed in an approved GSA container (Safe) when not in use and under proper US control. (CAT I)
   
  The requirement in check #2 is complementary to the requirement covered in check #1. Unescorted access to areas where US Only classified equipment, documents and media are present must not be granted to any FN (regardless of clearance level) when cleared US personnel are not present to provide oversight.
   
  CHECK #2: Check to ensure FN access to classified open storage areas (includes vaults, secure rooms, and SCIFs) containing SIPRNet assets is permitted only during normal working hours when US personnel are present to provide oversight. (CAT I)

  TACTICAL ENVIRONMENT: This check is applicable where REL partners/LN/FN are employed within fixed facilities in a tactical environment with access to US Systems.


vuln_id: V-245766
rule_id: SV-245766r1136624_rule
severity: CAT III
title: Foreign National (FN) Physical Access Control - (Identification Badges)
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to limit access to information visible on system monitor screens in mixed US/FN environments can result in FN personnel having unauthorized access to classified information, which can result in the loss or compromise of classified information, including NOFORN information. Physically co-locating REL Partners or other FN - who have limited access to the SIPRNet or other US Classified systems - near US personnel in a collateral classified (Secret) open storage area or in a Secret Controlled Access Area (CAA) that processes classified material is permissible for operational efficiency and coordination. Appropriate but simple physical and procedural security measures must be put in place to ensure the FN partners do not have unauthorized access to information not approved for release to them. Ensuring that US employees can clearly identify FN workers is an important control measure and can be accomplished by requiring the FN employees or partners to wear picture identification badges that clearly identify their affiliated / represented Country. Wearing of Country specific military uniforms also can be used.

  REFERENCES:

  National Disclosure Policy - 1 (NDP-l) 

  National Security Directive 42, "National Policy for the Security of National Security Telecommunications and Information Systems" 

  DODD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations SPECIAL NOTE: Enclosure 3 to DODD 5230.11 establishes specific criteria for the disclosure of classified information.

  Use guidance on sharing information with REL Partners on SIPRNET at http://www.ssc.smil.mil/ - follow Policy/Guidance&Documentation link and then SIPRNet Information Sharing...

  DODD 5230.20; Visits, Assignments, and Exchanges of Foreign Nationals

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl C, para 27.f.(4).

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  PE-2, PE-3, PE-5, PE-6, PE-8, PE-18

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014, Enclosure 3, paragraph 11.                  

  DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP), 3 April 2017

  DOD Manual 5200.01, Volume 1, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification, Encl 2, para 9.j.(1) and Encl 3, para 5.b., 7.b.(5), 12.e.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 7.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. "Foreign" local nationals (LN) hired by DOD organizations overseas IAW the applicable SOFA must be issued and wear identification/access badges that clearly distinguish them as foreign national employees. 

  2. REL Partners and FN Liaison and Exchange personnel in both OCONUS and CONUS locations must also be provided and wear identification/access badges that clearly distinguish them as foreign national partners. 

  If practical they should also be required to wear the military uniform of their host country - although FN out of uniform should not be an automatic finding. 

  The intent is to enable US personnel to clearly distinguish between FN and US personnel. 

  Following is an applicable excerpt from CJCSI 6510.01F pertaining to controlled US Only workstation spaces: Announce presence. If a foreign national is permitted access to controlled US work station space, the individual must be announced, must wear a badge clearly identifying him or her as a FN, and must be escorted at all times. In addition a warning light must be activated if available and screens must be covered or blanked.

check_text:
  Check to ensure foreign local nationals (LN) hired by DOD organizations overseas IAW the applicable SOFA are issued and wear identification/access badges that clearly distinguish them as foreign national employees. REL Partners and FN Liaison and Exchange personnel in OCONUS and CONUS locations must also be provided and wear identification/access badges that clearly distinguish them as foreign national partners. If practical they should also be required to wear the military uniform of their host country - although FN out of uniform should not be an automatic finding. The intent is to enable US personnel to clearly distinguish between FN and US personnel. 

  Following is an applicable excerpt from CJCSI 6510.01F pertaining to controlled US Only workstation spaces:
  Announce presence. If a foreign national is permitted access to controlled US work station space, the individual must be announced, must wear a badge clearly identifying him or her as a FN, and must be escorted at all times. In addition a warning light must be activated if available and screens must be covered or blanked.
   
  TACTICAL ENVIRONMENT: This check is applicable where LN/FN are employed in a tactical environment with access to US Systems.


vuln_id: V-245767
rule_id: SV-245767r1138428_rule
severity: CAT I
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Foreign National (FN) Administrative Controls - Proper Investigation and Clearance for Access to Classified Systems and/or Information Assurance (IA) Positions of Trust

description:
  <VulnDiscussion>Failure to validate that FN partners or employees have the required security clearance levels for access to classified systems and/or the proper level of background investigation for IA Positions of Trust could result in untrustworthy Foreign Nationals having access to classified or sensitive US systems. In situations where they have been assigned to IA positions of trust this consideration becomes even more critical as they could adversely impact the CIA of the systems, possibly without being easily discovered. 

  REFERENCES:

  National Disclosure Policy - 1 (NDP-l) 

  National Security Directive 42, "National Policy for the Security of National Security Telecommunications and Information Systems 

  DODD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations SPECIAL NOTE: Enclosure 3 to DODD 5230.11 establishes specific criteria for the disclosure of classified information.

  Use guidance on sharing information with REL Partners on SIPRNET at http://www.ssc.smil.mil/ - follow Policy/Guidance&Documentation link and then SIPRNet Information Sharing.

  DODD 5230.20; Visits, Assignments, and Exchanges of Foreign Nationals

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl C, para 27.f.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  AC-2, AC-3, PS-2, PS-3 and PS-6

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Enclosure 3, paragraph 11.         

  DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP), 3 April 2017

  DOD Manual 5200.01, Volume 1, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification, Encl 2, para 9.j.(1) and Encl 3, para 5.b., 7.b.(5), 12.e.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 2, para 3 & 4; Encl 3, para 5; Encl 4, para 2.c.; Appendix to Encl 4, para 1.f.

  DOD 8570.01-M, Information Assurance Workforce Improvement Program, para C.3.2.4.8.2, C.8.2.7 & AP1.19

  DODD 8140.01 Cyberspace Workforce Management 

  DODI 8140.02 Identifying-Tracking and Reporting of Cyberspace Workforce Requirements 

  DODM 8140.03 Cyberspace Workforce Qualification and Management System

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  All foreign national (FN) partners or FN employees with SIPRNet access (or if applicable a classified Coalition System in the US Partition) must have the proper investigation and clearance level required for their level of classified system access or IA position of trust. Normally this will be accomplished by reciprocally accepting the partner Country equivalent security clearance.

  NOTE: DODM 8570 requirements will be met until full implementation of DODM 8140.03 requirements. Implementation dates for DOD Manual 8140.03 include a two-year timeline for personnel (civilian and military) in positions coded with cybersecurity work roles and three years for personnel (civilian and military) in positions coded with work roles in any other workforce element. The dates for required qualification would be 15 February 2025 for cybersecurity work roles and the same date in February 2026 for all Defense Cyber Workforce Framework work roles.

check_text:
  Check that all foreign national partners or FN employees with SIPRNet access (or if applicable a classified Coalition System in the US Partition) have the proper investigation and clearance level required for their classified system access or IA position of trust. Normally this will be accomplished by reciprocally accepting the partner Country equivalent security clearance.

  TACTICAL ENVIRONMENT: This check is applicable where REL partners/LN/FN are employed in a tactical environment with access to classified US Systems or Coalition Systems.


vuln_id: V-245768
rule_id: SV-245768r1138429_rule
severity: CAT II
title: Foreign National (FN) Administrative Controls - Written Procedures and Employee Training
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to limit access for Foreign Nationals to classified information can result in the loss or compromise of NOFORN information. Documented local policies and procedures concerning what information FN employees or partners have access to and what they are excluded from having, what physical access limitations and allowances are in place, how to recognize a FN (badges, uniforms, etc.), steps to take to sanitize a work area before a FN can access the area, etc. are an essential part of controlling FN access. Just as important as development of policy and procedure is the training/familiarization of both employees and assigned FNs with the rules of interaction.

  REFERENCES:

  National Disclosure Policy - 1 (NDP-l) 

  National Security Directive 42, "National Policy for the Security of National Security Telecommunications and Information Systems 

  DODD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations SPECIAL NOTE: Enclosure 3 to DODD 5230.11 establishes specific criteria for the disclosure of classified information.

  Use guidance on sharing information with REL Partners on SIPRNET at http://www.ssc.smil.mil/ - follow Policy/Guidance&Documentation link and then SIPRNet Information Sharing.

  DODD 5230.20; Visits, Assignments, and Exchanges of Foreign Nationals

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl C, paragraphs 5, 6.f.(1), 9.b., 10., 27.a, 27.b., 27.c., 27.e. (8) and 27.f.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  AC-1, PL-1, PL-4, AT-1, AT-2, AT-3, PE-2(1), PE-2(3) and PE-3

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Enclosure 3, paragraph 11.         

  DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP), 3 April 2017

  DOD Manual 5200.01, Volume 1, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification, Encl 3, para 5.b.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 3, para 5; Encl 4, para 2.c.; Appendix to Encl 4, para 1.f.; Encl 7

  DOD 8570.01-M, Information Assurance Workforce Improvement Program, para C.3.2.4.8.2, C.8.2.7 & AP1.19

  DODD 8140.01 Cyberspace Workforce Management 

  DODI 8140.02 Identifying-Tracking and Reporting of Cyberspace Workforce Requirements 

  DODM 8140.03 Cyberspace Workforce Qualification and Management System

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  BACKGROUND: US employees must clearly understand the differences and limitations between REL Officers, other NATO partners, Non-NATO partners and Coalition Partners. 

  In a mixed US/FN partner environment the US personnel must know exactly what information can be shared and what cannot be shared or how to readily determine this information. For example the restrictions and cautions for partners from Belgium, Germany, France will be significantly greater relative to viewing anything on SIPRNet work stations versus the Australia, Canada, Great Britain partners. 

  REQUIREMENT: There must be written local procedures and initial/recurring (at least annual) employee training to ensure familiarization with the rules for sharing classified and sensitive information with our partners. 

  This topic must be included in the initial and annual site security awareness training. 

  Any one of the following three items will result in a finding: 

  1. Lack of written procedures, 
  2. Lack of training, or 
  3. Clear evidence employees are not familiar with the rules for information sharing.

  NOTE: DODM 8570 requirements will be met until full implementation of DODM 8140.03 requirements. Implementation dates for DOD Manual 8140.03 include a two-year timeline for personnel (civilian and military) in positions coded with cybersecurity work roles and three years for personnel (civilian and military) in positions coded with work roles in any other workforce element. The dates for required qualification would be 15 February 2025 for cybersecurity work roles and the same date in February 2026 for all Defense Cyber Workforce Framework work roles.

check_text:
  Check to ensure that US employees clearly understand the differences and limitations between REL Officers, other NATO partners, Non-NATO partners and Coalition Partners. In a mixed US/FN partner environment the US personnel must know exactly what information can be shared and what cannot be shared or how to readily determine this information. For example the restrictions and cautions for partners from Belgium, Germany, France will be significantly greater relative to viewing anything on SIPRNet work stations versus the Australia, Canada, Great Britain partners. This can only be done if there are written local procedures and initial/recurring (at least annual) employee training to ensure familiarization with the rules for sharing classified and sensitive information with our partners. 

  It is recommended that employees sign an acknowledgement that they understand their responsibilities for sharing information, but this is not to be required. 

  This particular check should be validated by specifically checking for written procedures and training records. 

  This subject can be included in the initial and annual site security awareness training but must be clearly detailed as having been properly completed. 

  The effectiveness of the program can be validated by conducting random employee interviews concerning their understanding of rules covering sharing classified and sensitive information with FN partners assigned to or visiting their organization/site. 

  Any one of the following three items: Lack of written procedures, lack of training, or evidence employees are not familiar with the rules for information sharing will result in a finding.

  TACTICAL ENVIRONMENT: This check is applicable where REL partners/LN/FN are employed in a tactical environment with access to US Systems


vuln_id: V-245769
rule_id: SV-245769r1138430_rule
severity: CAT II
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Foreign National (FN) Administrative Controls - Procedures for Requests to Provide Foreign Nationals System Access

description:
  <VulnDiscussion>Unauthorized access by foreign nationals to Information Systems can result in, among other things, security incidents, compromise of the system, or the introduction of a virus.

  REFERENCES:

  National Disclosure Policy - 1 (NDP-l) 

  National Security Directive 42, "National Policy for the Security of National Security Telecommunications and Information Systems 

  DODD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations SPECIAL NOTE: Enclosure 3 to DODD 5230.11 establishes specific criteria for the disclosure of classified information.

  Use guidance on sharing information with REL Partners on SIPRNET at http://www.ssc.smil.mil/ - follow Policy/Guidance&Documentation link and then SIPRNet Information Sharing.

  DODD 5230.20; Visits, Assignments, and Exchanges of Foreign Nationals

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl C, paragraphs 26.c.(3) and 27.f.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  CA-1, AC-2, AC-3, PS-1, PS-2 and PS-3

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Enclosure 3, paragraph 11.         

  DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP), 3 April 2017

  DOD Manual 5200.01, Volume 1, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification, Encl 2, para 9.j.(1).

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 7

  DOD 8570.01-M, Information Assurance Workforce Improvement Program, para C.3.2.4.8.2, & AP1.19

  DODD 8140.01 Cyberspace Workforce Management 

  DODI 8140.02 Identifying-Tracking and Reporting of Cyberspace Workforce Requirements 

  DODM 8140.03 Cyberspace Workforce Qualification and Management System

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  There must be local written procedures for when there is a foreign national request to access to U.S. systems. 

  Foreign Nationals must only hold IT positions authorized by regulation. IAW DOD 8570.01-M: C3.2.4.8.2. ...LNs and Foreign Nationals (FNs) must comply with background investigation requirements and cannot be assigned to IAT Level III positions.   

  TACTICAL ENVIRONMENT: This check is applicable where REL partners/LN/FN are employed in a tactical environment with access to classified or unclassified US Systems or Coalition Systems.

  NOTE: DODM 8570 requirements will be met until full implementation of DODM 8140.03 requirements. Implementation dates for DOD Manual 8140.03 include a two-year timeline for personnel (civilian and military) in positions coded with cybersecurity work roles and three years for personnel (civilian and military) in positions coded with work roles in any other workforce element. The dates for required qualification would be 15 February 2025 for cybersecurity work roles and the same date in February 2026 for all Defense Cyber Workforce Framework work roles.

check_text:
  Check to ensure there are local written procedures for when foreign national request access to U.S. systems. 

  Validate the standards are correct. 

  Ensure Foreign Nationals only hold IT positions authorized by regulation - primarily DOD 8570.01-M, IA Workforce Improvement Program. 

  TACTICAL ENVIRONMENT: This check is applicable where REL partners/LN/FN are employed in a tactical environment with access to classified or unclassified US Systems or Coalition Systems.


vuln_id: V-245770
rule_id: SV-245770r1138431_rule
severity: CAT III
title: Foreign National (FN) Administrative Controls - Contact Officer Appointment
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to provide proper oversight of Foreign National partners or employees and limit access to classified and sensitive information can result in the loss or compromise of NOFORN information.

  REFERENCES:

  National Disclosure Policy - 1 (NDP-l) 

  National Security Directive 42, "National Policy for the Security of National Security Telecommunications and Information Systems 

  DODD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations SPECIAL NOTE: Enclosure 3 to DODD 5230.11 establishes specific criteria for the disclosure of classified information.

  Use guidance on sharing information with REL Partners on SIPRNET at http://www.ssc.smil.mil/ - follow Policy/Guidance&Documentation link and then SIPRNet Information Sharing.

  DODD 5230.20; Visits, Assignments, and Exchanges of Foreign Nationals, paragraph 4.6.

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl C, paragraphs 26.c.(3) and 27.f.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  PE-2, PE-2 and PE-8

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Enclosure 3, paragraph 11.                  

  DOD Manual 5200.02, Procedures for the DOD Personnel Security Program (PSP), 3 April 2017

  DOD Manual 5200.01, Volume 1, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification, Encl 2, para 5.b.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. A Foreign Disclosure Officer (FDO) must be available or minimally a Foreign Contact Officer must be appointed to control the activities of foreign visitors, REL Officers, FLO, and exchange personnel. 

  2. A formal Appointment Letter for these duties that outlines responsibilities, etc. must be on-hand.

check_text:
  Check to ensure there is a Foreign Disclosure Officer (FDO) available or minimally that a Foreign Contact Officer has been appointed to control the activities of foreign visitors, REL Officers, FLO, and exchange personnel. 

  Check that there is a formal Appointment Letter. 

  TACTICAL ENVIRONMENT: This check is applicable where REL partners/LN/FN are employed in a tactical environment with access to US Systems.


vuln_id: V-245771
rule_id: SV-245771r1138433_rule
severity: CAT III
title: Information Assurance - System Security Operating Procedures (SOPs)
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to have documented procedures in an SOP could result in a security incident due to lack of knowledge by personnel assigned to the organization.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND)

  NIST Special Publication 800-53 (SP 800-53), Rev 4/5, Controls: MA-1, MA-2, MA-3, MA-4, PL-1, PL-2, and PL-4

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 5, para 3.a.(4), 3.d., 7.a.; Encl 7, para 5.c., 6, 10, and 11.

  DOD Instruction 8510.01, SUBJECT: Risk Management Framework (RMF) for DoD Information Technology (IT)

  United States Cyber Command Instruction (USCCI) 5200-13, 13 April 2019, SUBJECT: Cyberspace Protection Conditions (CPCON)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Security Operating Procedures (SOPs) covering all systems, supporting infrastructure and physical facilities must be written.

  2. The procedures must be readily available to both the Information Assurance Staff (ISSM, ISSO, SA) and all system users requiring information in the procedures to perform their jobs. Information can be placed in an Information System Users Guide (SFUG) and other applicable documents as appropriate. SOP availability must be on a site intranet, shared folders, web page, etc. for ease of reference by all employees - unless classified or otherwise requiring restricted access.

  As a minimum the following areas must be documented:

  a. Handling of suspected system compromise or spillage
  b. Cyberspace Protection Conditions (CPCON) - formerly Information Operations Condition (INFOCON) - procedures and policies
  c. Procedures for eradication after an attack
  d. Proper password management
  e. Purging of storage media (disks, CDs, DVDs, drives, etc.) prior to turn-in or disposal
  f. Remote diagnostic and maintenance approval and procedure 
  g. Out-processing and turn-in of equipment
  h. Use of screensavers/Unattended terminals
  i. Virus detection and scanning
  j. In-processing and vetting of employees for systems access (proper investigation and security clearance)

check_text:
  Check written SOPs covering all systems, supporting infrastructure and physical facilities. Conduct a cursory review of the SOPs and as a minimum ensure the following areas are documented:

  a. Handling of suspected system compromise or spillage
  b. Cyberspace Protection Conditions (CPCON) - formerly Information Operations Condition (INFOCON) - procedures and policies
  c. Procedures for eradication after an attack
  d. Proper password management
  e. Purging of storage media (disks, CDs, DVDs, drives, etc.) prior to turn-in or disposal
  f. Remote diagnostic and maintenance approval and procedure 
  g. Out-processing and turn-in of equipment
  h. Use of screensavers/Unattended terminals
  i. Virus detection and scanning
  j. In-processing and vetting of employees for systems access (proper investigation and security clearance)                                                                         
  NOTE: This requirement for on-hand SOPs should not be applied to a tactical environment, unless it is a fixed computer facility in a Theater of Operations.  The standards to be applied for applicability in a tactical environment are:

  1) The facility containing the computer room has been in operation over 1-year. 
  2) The facility is "fixed facility" - a hard building made from normal construction materials - wood, steel, brick, stone, mortar, etc. 
  3) Procedures for field/mobile elements are still required and should be available at a supporting headquarters, either in Theater or perhaps even CONUS. These may be requested during pre-trip coordination or obtained after visiting the tactical AO.


vuln_id: V-245772
rule_id: SV-245772r1138487_rule
severity: CAT II
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Information Assurance - COOP Plan and Testing (Not in Place for Information Technology Systems or Not Considered in the organizational Holistic Risk Assessment)

description:
  <VulnDiscussion>Failure to develop a COOP and test it periodically can result in the partial or total loss of operations and INFOSEC. A contingency plan is necessary to reduce mission impact in the event of system compromise or disaster.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, Paragraphs 15 & 32

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  CP-2, CP-2(1) through CP-2(8), CP-4, CP-4(1) through CP-4(4), CP-6, CP-7, CP-9, MA-6

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Enclosure 3, paragraph 3.

  DODD 3020.26, SUBJECT: Department of Defense Continuity Programs, January 9, 2009

  DODI 3020.42, SUBJECT: Defense Continuity Plan Development, February 17, 2006

  Implementation of DOD Continuity Strategy - Deputy Secretary of Defense, 25 May 07

  National Security Presidential Directive (NSPD) 51 / Homeland Security Presidential Directive (HSPD) 20 - National Continuity Policy, 9 May 07

  Federal Continuity Directives 1 Oct 12 and 2 Jul 13, Federal Executive Branch National Continuity Program and Requirements.

  NIST Special Publication 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems, May 2010

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Continuity of Operations Plans (COOP) must be developed and tested for ALL DODIN connected systems to ensure system and data availability in the event of any type of failure. If no COOP is in place ensure the risk has been (specifically for lack of a COOP) accepted by the responsible Authorizing Official (AO) in a Holistic Risk Assessment of the organization.

check_text:
  Check there is a written COOP plan for inspected information technology systems:  

  1. If a COOP or Disaster Recovery Plan is not in place, ensure the AO has considered and accepted the risk (specifically for lack of COOP) from a Holistic Risk Assessment of the organization.  

  2. Check COOP documentation to ensure the plan is tested at least annually. Also check for discrepancies noted during the tests and if corrective action has been taken. 

  3. Conduct a cursory review of the COOP to ensure it is commensurate for COOP of IT systems as detailed within the risk assessment concerning recovery times and testing requirement(s). 

  NOTES: 

  1. Certain large computing centers like the DISA Computing Services (DECCs) may offer COOP as a fee for service option. Since this is applicable to "customer" applications it should not be a finding attributed to the DECC. If appropriate, COOP or lack thereof if cited as a finding in this instance should be attributed to the specific customer. 

  2. This requirement should not be applied to a tactical environment, unless it is a fixed computer facility supporting operations within a Theater of Operations. The standards to be applied for applicability in a tactical environment are: 1) The facility containing the computer room has been in operation over 1-year. 2) The facility is "fixed facility" - a hard building made from normal construction materials - wood, steel, brick, stone, mortar, etc.


vuln_id: V-245773
rule_id: SV-245773r1138488_rule
severity: CAT III
title: Information Assurance - COOP Plan or Testing (Incomplete)
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to develop a COOP and test it periodically can result in the partial or total loss of operations and INFOSEC. A contingency plan is necessary to reduce mission impact in the event of system compromise or disaster.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, Paragraphs 15 & 32

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  CP-2, CP-2(1) through CP-2(8), CP-4, CP-4(1) through CP-4(4), CP-6, CP-7, CP-9, MA-6

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014, Enclosure 3, paragraph 3.

  DODD 3020.26, SUBJECT: Department of Defense Continuity Programs, January 9, 2009

  DODI 3020.42, SUBJECT: Defense Continuity Plan Development, February 17, 2006

  Implementation of DOD Continuity Strategy - Deputy Secretary of Defense, 25 May 07

  National Security Presidential Directive (NSPD) 51 / Homeland Security Presidential Directive (HSPD) 20 - National Continuity Policy, 9 May 07

  Federal Continuity Directives 1 Oct 12 and 2 Jul 13, Federal Executive Branch National Continuity Program and Requirements.

  NIST Special Publication 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems, May 2010

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5200.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  ALL systems connected to the DODIN must be included in the enclave COOP documentation and testing. If it is determined that some (a portion of the systems on site) of the site/organization systems connected to the DODIN do not need to be included in the COOP (plan and/or testing) then the risk for this must specifically be accepted by the AO in a holistic risk assessment document.

check_text:
  This check is for when a reviewer finds that a COOP process is well established within the inspected organization, but it does not include a minority of systems, requirements, or testing of all systems, for which the risk of having no COOP or testing was not accepted by the Authorizing official (AO) in a holistic risk assessment for the organization.

  NOTES: 

  1. This finding/VUL is only applicable when some of the site/organization systems are connected to the DODIN and do not have a COOP and/or the COOP is not tested and the risk for not having a COOP and/or documented testing is not accepted by the AO in a holistic risk assessment document. 

  2. If this finding/VUL is used, IA-02.02.01 is NA. 

  3. This VUL is applicable in a tactical environment if it involves a fixed facility as previously described.


vuln_id: V-245774
rule_id: SV-245774r1136637_rule
severity: CAT II
title: Information Assurance - System Security Incidents (Identifying, Reporting, and Handling)
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to recognize, investigate and report information systems security incidents could result in the loss of confidentiality, integrity, and availability of the systems and its data.

  REFERENCES:

  CJCSM 6510.01B, CYBER INCIDENT HANDLING PROGRAM

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Appendix C

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  IR-1, IR-2, IR-3, IR-4, IR-5, IR-6, IR-7, IR-7(2), IR-8

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Encl 2, para 13.h.(1)-(5); Encl 3, para 18.g&h., 19.d.

  DOD Manual 5200.01, Volume 1, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification, Encl 2, para 9.g., 11.c, 12.b.; Encl 3, para 7.b.(8), 17.a., 17.c.,; Glossary pg 76, activity SM 

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 6 (In its entirety - with emphasis on para 5.f.); Appendix 1 to Encl 6; Encl 7, para 5.

  DODI 5200.48 Controlled Unclassified Information (CUI)

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1  
   
  DOD Instruction 8510.01, SUBJECT: Risk Management Framework (RMF) for DOD Information Technology (IT), Encl 6, para 1.d.

  CNSSI 1001, National Instruction on Classified Information Spillage

  CNSSI 1010, 24X7 Computer Incident Response Capability (CIRC) on National Security Systems</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  A program to recognize, investigate, and report information systems security incidents to include virus, system penetration, and classified contamination must be established. Such a program will include written procedures that are available for employee review as well as including the topic in initial and annual security refresher training.

check_text:
  1. Check to ensure there are written procedures for identifying, reporting, and handling systems security incidents. 

  2. Check to ensure that procedures for handling system security incidents are included in both initial and annual (refresher) employee training. 

  NOTE: Applies in a tactical environment. While procedures for incident handling might not be readily available in a mobile/field location, they should be established and available at a supporting fixed headquarters facility. Field units must still be informed and knowledgeable of their responsibility to report security incidents. This knowledge can be ascertained by asking field organization leadership what they would do in a spillage or similar computer security incident.


vuln_id: V-245775
rule_id: SV-245775r1008541_rule
severity: CAT II
title: Information Assurance - System Access Control Records (DD Form 2875 or equivalent)
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>If accurate records of authorized users are not maintained, then unauthorized personnel could have access to the system. Failure to have user sign an agreement may preclude disciplinary actions if user does not comply with security procedures.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl C, para 26.a.

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Encl 2, para 13.j., 13.y.(1); Encl 3, para 10.c., 18.b., 19.c.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AC-3(3), AC-3(4), AC-3(5), AC-3(7), AC-2(7). 

  DOD 8570.01-M, Information Assurance Workforce Improvement Program

  DODD 8140.01 Cyberspace Workforce Management 

  DODI 8140.02 Identifying-Tracking and Reporting of Cyberspace Workforce Requirements 

  DODM 8140.03 Cyberspace Workforce Qualification and Management System</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Written procedures for personnel who request access to a computer system must be developed.

  2. A System Authorization Access Request (SAAR) form (DD Form 2875 or equivalent) must be used to define and control individual access for systems. If applicable, the most current version of the DD Form 2875 SAAR must be used for ALL NEW account requests. Note: This is not a mandate to update previously processed account request forms to the most current version. Locally developed or service-level forms may also be used if the same information found on the DD Form 2875 is used.

  3. Local or service-level SAAR forms must minimally contain appropriate information for checking compliance with security requirements for privileged, routine user, Classified, and Unclassified systems access as on the DD Form 2875. Information required includes identification of the individual requesting access, signature dates, supervisory approval, ISSM and SM approval, investigation level and security clearance required, investigation and security clearance possessed. Ensure all appropriate Information Assurance (IA) training was completed for the systems personnel are requesting access to.   

  4. A separate "User Agreement" must be signed by each user before access is granted. This includes both system "users" and "privileged account holders" (System Administrators). For privileged users, a signed Privileged Access Statement IAW Appendix 4 of DOD 8570.01-M, Information Assurance Workforce Improvement Program, is required.

  Note: DODM 8570 requirements will be met until full implementation of DODM 8140.03 requirements. Implementation dates for DOD Manual 8140.03 include a two-year timeline for personnel (civilian and military) in positions coded with cybersecurity work roles and three years for personnel (civilian and military) in positions coded with work roles in any other workforce element. The dates for required qualification would be 15 February 2025 for cybersecurity work roles and 15 February 2026 for all Defense Cyber Workforce Framework work roles.

check_text:
  1. Check to ensure there are written procedures for personnel who request access to a computer system.

  2. Note in the report finding details which access form is used (locally developed, service-level, or DD Form 2875).

  3. If applicable, ensure the most current version of the DD Form 2875 (System Authorization Access Request [SAAR]) is being used for all new account requests. Note: This is not a mandate to update previously processed account request forms to the most current version.

  4. Note what training is required/conducted before system access is granted. 

  5. Review a sample of system access request forms to ensure the forms contain appropriate information for checking compliance with security requirements for privileged, user, Classified, and Unclassified systems access. Information required will include identification of the individual requesting access, signature dates, supervisory approval, ISSM and SM approval, investigation level and security clearance required, investigation and security clearance possessed. Ensure all appropriate Information Assurance (IA) training was completed for the systems personnel are requesting access to.  

  6. Check to ensure a separate "User Agreement" also exists for both system "users" and "privileged account holders" (System Administrators). For privileged users, a signed Privileged Access Statement IAW Appendix 4 of DOD 8570.01-M, Information Assurance Workforce Improvement Program, is required.

  7. In a tactical environment, the forms used to control systems access might not be readily accessible in the field. Determine where the forms are maintained and if the location is not within reach, attempt to obtain a sample copy of a completed form via fax, email, etc. Fixed locations with assigned IA staff should have the forms available.


vuln_id: V-245776
rule_id: SV-245776r1136638_rule
severity: CAT II
title: Information Assurance - System Training and Certification/ IA Personnel
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Improperly trained personnel can cause serious system-wide/network-wide problems that render a system/network unstable.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl A, para 11.

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Encl 2, para 9.g., 13.k.(2); Encl 3, para 10. a-e

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AT-2, AT-3, CP-3, IR-2

  DOD 8570.01-M, Information Assurance Workforce Improvement Program, Appendix 3

  DODD 8140.01, Cyberspace Workforce Management, 11 Aug 15, paragraphs 3.c. and 9.j.

  DODI 8140.02 Identifying-Tracking and Reporting of Cyberspace Workforce Requirements 

  DODM 8140.03 Cyberspace Workforce Qualification and Management System

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. A program must be in place to establish and document required training/certification of (IA) IAM/IAT personnel. 

  2. In addition to the initial and recurring (annual) training requirements every system user must undergo, the IA staff such as ISSM, ISSO, SA, NSO must be part of an organizational certification program IAW DOD 8570.01-M, IA Workplace Improvement Program. 

  3. Training/certification requirements must be documented for each IA staff member to include their current certification level: IAM (I-III) or IAT (I-III).

  NOTE: DODM 8570 requirements will be met until full implementation of DODM 8140.03 requirements. Implementation dates for DOD Manual 8140.03 include a two-year timeline for personnel (civilian and military) in positions coded with cybersecurity work roles and three years for personnel (civilian and military) in positions coded with work roles in any other workforce element. The dates for required qualification would be 15 February 2025 for cybersecurity work roles and the same date in February 2026 for all Defense Cyber Workforce Framework work roles.

check_text:
  1. Check records for required training/certification of (IA) IAM/IAT personnel. In addition to the initial and recurring (annual) training requirements every system user must undergo, the IA staff such as ISSM, ISSO, SA, NSO must be part of an organizational certification program IAW DOD 8570.01-M, Workplace Improvement Program. 

  2. Ensure this certification program is in place and that training/certification requirements are documented for each IA staff member, which includes current certification level: IAM (I-III) or IAT (I-III). 

  TACTICAL ENVIRONMENT: In a tactical environment records should be maintained at fixed locations where IA and security staff are working. This check is not applicable to units in a mobile/field environment.


vuln_id: V-245777
rule_id: SV-245777r1136641_rule
severity: CAT II
title: Information Assurance/Cybersecurity Training for System Users
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Improperly trained personnel can cause serious system-wide/network-wide problems that render a system/network unstable.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl A, para 11.a.

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Encl 2, para 13.l.; Encl 3, para 10.c., 17.c., 19.c., 21.j.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: AT-2, AT-3, CP-3, IR-2

  DOD 8570.01-M, Information Assurance Workforce Improvement Program, paragraphs C.1.4.1.4,5.1., C.1.4.4.3., C.5.2.1.5., Table C.4.T.3. - M.I.6., Table C.4.T.5. - M.II.18.; Chapter 6 in its entirety for minimum user training requirements.

  DODD 8140.01, Cyberspace Workforce Management, 11 Aug 15, paragraph 9.b.

  DODI 8140.02 Identifying-Tracking and Reporting of Cyberspace Workforce Requirements 

  DODM 8140.03 Cyberspace Workforce Qualification and Management System
     
  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. All system users must take both initial and recurring (annual) cybersecurity training based on applicable regulatory requirements that every system user must undergo, primarily in accordance with Chapter 6 of the DOD 8570.01-M, Information Assurance Workforce Improvement Program. 

  2. Ensure 100 percent of initial training briefings are accomplished and at least 95 percent of employees have completed annual training. Note that while 100 percent completion of annual training is the goal, employees on extended leave, TDY, or other circumstances make this difficult to accomplish. 

  3. All training accomplished must be documented for each individual user.

  NOTE: DODM 8570 requirements will be met until full implementation of DODM 8140.03 requirements. Implementation dates for DOD Manual 8140.03 include a two-year timeline for personnel (civilian and military) in positions coded with cybersecurity work roles and three years for personnel (civilian and military) in positions coded with work roles in any other workforce element. The dates for required qualification would be 15 February 2025 for cybersecurity work roles and the same date in February 2026 for all Defense Cyber Workforce Framework work roles.

check_text:
  Check training records for required initial and recurring (annual) training requirements every system user must undergo in accordance with Chapter 6 of the DOD 8570.01-M, Information Assurance Workforce Improvement Program. Ensure 100 percent of initial training briefings are accomplished and at least 95 percent of employees have completed annual training. Note that while 100 percent completion of annual training is the goal, employees on extended leave, TDY, or other circumstances make this difficult to accomplish. 

  All training accomplished must be documented. Anything less will be a finding.

  TACTICAL ENVIRONMENT: In a tactical environment, records should be maintained at fixed locations where IA and security staff are working. This check is not applicable to personnel in units in a mobile/field environment.


vuln_id: V-245778
rule_id: SV-245778r1136642_rule
severity: CAT II
title: Information Assurance - Accreditation Documentation
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to provide the proper documentation can lead to a system connecting without all proper safeguards in place, creating a threat to the networks.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl A, para 2.; Encl B, para 6.f.; Encl C, para 3, 6.d.(2), 20.e.(1)(a)&(b), 24.e and 18a .

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  PM-1, PM-9, PM-10, AC-3 AC 3(1), AC 3(2), AC-20, RA-2 and CA-6

  DODI 8500.01, SUBJECT: Cybersecurity, March 14, 2014 , Encl 3, para 2.a.(1), 9.a.(1)(c), 9.b.(13)

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 4, para 8.a.; Encl 7, para 4.c.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1
   
  DOD Instruction 8510.01, SUBJECT: Risk Management Framework (RMF) for DOD Information Technology (IT), Encl 2, para 7.f & 7.g.; Encl 4, para 1.b.(2)(e); Encl 6, paragraphs 1.b.(1), 2., and 2.e.(4)(a)-(e).

  CJCSI 6211.02D, DEFENSE INFORMATION SYSTEMS NETWORK (DISN) RESPONSIBILITIES,
  para 7.1.; Encl B, para 2.b.(1), 2.c.(1), 2.f.; Encl C, para 2.a., 5.b., 6.b.(5), 6.c., 6.e.(4), 7.c.(2), 11.a.(3)(g)&(j); Encl D, para 2.b., 4.f.(5), 5.a.(5), 5.j.(1) 7.a, 8., and 12.a&b.

  CNSSP No.29, May 2013, National Secret Enclave Connection Policy

  DISN Connection Process Guide:
  http://disa.mil/network-services/enterprise-connections/connection-process-guide</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. A current accreditation document approved by the AO must be available for all systems and applications connected to the DODIN. 

  2. Copies of the original accreditation documentation along with any subsequent modifications must be available for review. 

  3. The Approval to Operate (ATO) or Interim Approval to Operate (IATO) must be up to date and must be signed by the current Approving Authority.

  4. Check to ensure the site provided the DISN Connection Approval Office (CAO) current certification documentation IAW CAO guidance. 

  5. Check to ensure the site also has notified the CAO of any changes/modification to the approved architecture. 

  6. Check to ensure the Approval to Connect (ATC) or Interim Approval to Connect (IATC) for both SIPRNet/NIPRNet are current.

check_text:
  Check the accreditation package with only a cursory review to ensure the ATO/IATO are current. 

  1. Check the SIPRNet/NIPRNet connection approval package. Conduct a cursory review for any traditional security issues. 

  2. Ensure the approvals are current. The approvals must come from the DISN Connection Approval Office (CAO). 

  TACTICAL ENVIRONMENT: The check is applicable. The ATO and associated documentation should be found in a fixed HQ location where the ISSM/ISSO are located. When possible, documentation should be requested/sought before departing on trips to tactical locations. Copies sent to the reviewer's email (NIPR or SIPR depending on classification of document) can be used to validate compliance.

  Note: If any one of the approvals is missing, this is a finding.


vuln_id: V-245781
rule_id: SV-245781r917549_rule
severity: CAT II
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Information Assurance - KVM or A/B Switch not listed on the NIAP U.S. Government Approved Protection Products Compliance List (PCL) for Peripheral Sharing Switches

description:
  <VulnDiscussion>Failure to use tested and approved switch boxes can result in the loss or compromise of classified information.

  REFERENCES:

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  SC-3 and SC-4

  DISN Connection Process Guide:
  http://disa.mil/network-services/enterprise-connections/connection-process-guide

  NIAP Products Compliance List (PCL):
  https://www.niap-ccevs.org/index.cfm</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. All KVM or A/B switches that switch from NIPR to SIPR or other low-side to high-side systems being reviewed must be on the most current approved NIAP PCL for use for switching between high-side and low-side devices. 

  2. Any unapproved switch boxes in use (switching from NIPR to SIPR) must have specific approval for use and be addressed in the SIPRNet ATC or IATC from the CCAO. 

  NOTE: A KVM used for switching between high (SIPRNet) and low (NIPRNet) shared devices must meet one or both of the following basic criteria:
  a. Be on the NIAP PCL AND meet any configuration requirements for the sites' IA environment as the minimum requirement to be used on the DODIN. 
  b. Based on the NIAP PCL, the devices listed may be used for switching between peripheral devices across high/low (SIPR/NIPR) domains.

check_text:
  1. Check all KVM or A/B switches that switch from NIPR to SIPR or other low-side to high-side systems being reviewed.

  2. Ensure switches on the most current approved NIAP Product Compliant List (PCL) are used for switching between high-side and low-side devices.

  3. Check to ensure that any unapproved switch boxes in use have specific approval for use in the SIPRNet Approval to Connect (ATC) or (IATC) from the Classified Connection Approval Office (CCAO).

  NOTE: A KVM used for switching between high (SIPRNet) and low (NIPRNet) shared devices must meet one or both of the following basic criteria:
  a. Be on the NIAP PCL AND meet any configuration requirements for the sites' IA environment as a minimum requirement to be used on the DODIN. 
  b. Based on the NIAP PCL, the devices listed may be used for switching between peripheral devices across high/low (SIPR/NIPR) domains.

  TACTICAL ENVIRONMENT: The check is applicable where KVM devices are in use.


vuln_id: V-245782
rule_id: SV-245782r917551_rule
severity: CAT II
title: Information Assurance - KVM Switch (Port Separation) on CYBEX/Avocent 4 or 8 port
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>The back plate of some 4 or 8 port CYBEX/AVOCENT KVM devices provides a physical connection between adjacent ports. Therefore failure to provide for physical port separation between SIPRNet (classified devices) and NIPRNet (unclassified devices) when using CYBEX/AVOCENT KVM devices can result in the loss or compromise of classified information.

  REFERENCES:

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  SC-3 and SC-4

  DISN Connection Process Guide:
  http://disa.mil/network-services/enterprise-connections/connection-process-guide

  NIAP Products Compliance List (PCL):
  https://www.niap-ccevs.org/index.cfm</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Validate the correct configuration of CYBEX/Avocent 4 or 8 port KVMs used for switching devices between the SIPRNet and NIPRNet (or any switching between SIPRNet and any other unclassified network devices) IAW NIAP PCL guidance.

  2. Correct configuration must include physical port separation between SIPRNet and NIPRNet (high and low) (or any switching between SIPRNet and any other unclassified network devices) connections.

  3. Because of the internal physical configuration of the CYBEX/Avocent box backplates, only like classification levels may be connected to adjacent ports.

check_text:
  Validate the correct configuration of CYBEX/Avocent 4 or 8 port KVMs IAW NIAP PCL guidance. This includes physical port separation between SIPRNet and NIPRNet (high and low) connections. Because of the internal physical configuration of the CYBEX boxes, only like classification levels may be connected to adjacent ports. 

  TACTICAL ENVIRONMENT: The check is applicable where KVM devices are in use.


vuln_id: V-245783
rule_id: SV-245783r863300_rule
severity: CAT II
title: Information Assurance - KVM Switch Use of Hot-Keys on SIPRNet Connected Devices
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Use of "Hot Keys" for switching between devices relies on use of software to separate and switch between the devices.  Unless software use involves an approved Cross Domain Solution (CDS) it can result in the loss or compromise of classified information from low side devices to those devices on the high side.  Only physical switching between devices can assure that information will not be exchanged.

  REFERENCES:

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  SC-3 and SC-4

  DISN Connection Process Guide:
  http://disa.mil/network-services/enterprise-connections/connection-process-guide

  NIAP Products Compliance List (PCL):
  https://www.niap-ccevs.org/index.cfm</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Users of KVM devices must physically switch between devices connected to the SIPRNet and any devices connected to an Unclassified network such as NIPRNet, rather than using a Hot-Key feature.

check_text:
  1. Check to ensure users are physically switching between devices on SIPRNet and any devices connected to an unclassified network like NIPRNet, rather than using a Hot-Key feature. 

  2. Be suspicious of any KVM that is not easily reachable (within arms distance) by the keyboard operator. 

  TACTICAL ENVIRONMENT: The check is applicable where KVM devices are in use.


vuln_id: V-245784
rule_id: SV-245784r939274_rule
severity: CAT III
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Information Assurance - Authorizing Official (AO) and DoDIN Connection Approval Office (CAO) Approval Documentation for use of KVM  and A/B switches for Sharing of Classified and Unclassified Peripheral Devices

description:
  <VulnDiscussion>Failure to request approval for connection of existing or additional KVM or A/B devices (switch boxes) for use in switching between classified (e.g., SIPRNet) devices and unclassified devices (e.g., NIPRNet) from both the Authorizing Official (AO) and the DODIN Connection Approval Office could result in unapproved devices being used or approved devices being used or configured in an unapproved manner, thereby increasing the risk for the DODIN.

  REFERENCES:

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  SC-3 and SC-4

  DISN Connection Process Guide:
  http://disa.mil/network-services/enterprise-connections/connection-process-guide

  NIAP Products Compliance List (PCL):
  https://www.niap-ccevs.org/index.cfm</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. The Enclave Authorizing Official (AO) must specifically document the approval for use of KVM and/or A/B switches in the ATO or other official documentation signed by the AO authorizing use of switches between high-side (classified/SIPRNet) and low-side (unclassified/NIPRNet) shared devices.

  2. The AO must submit initial and updated documentation (as required) to the DODIN Connection Approval Office (CAO) reflecting the use or addition of KVM or A/B devices on a user's enclave. The documentation may be part of the Authorization and Accreditation (A&A) documentation IAW RMF procedures or otherwise as specified by the DODIN CAO.

check_text:
  1. Check to ensure the Enclave Authorizing Official (AO) has specifically documented the approval for use of KVM and/or A/B switches in the ATO or other official documentation signed by the AO authorizing use of switches between high-side (classified/SIPRNet) and low-side (unclassified/NIPRNet) shared devices.

  2. Check to ensure the AO has submitted initial and updated documentation (as required) to the DODIN Connection Approval Office (CAO) reflecting the use or addition of KVM or A/B devices on a user's enclave. The documentation may be part of the Authorization and Accreditation (A&A) documentation IAW RMF procedures or otherwise as specified by the DODIN CAO.

  TACTICAL ENVIRONMENT: The check is applicable where KVM devices are in use.


vuln_id: V-245785
rule_id: SV-245785r1138435_rule
severity: CAT I
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Information Assurance - Classified Portable Electronic Devices (PEDs) Connected to the SIPRNet must be Authorized, Compliant with NSA Guidelines, and be Configured for Data at Rest (DAR) Protection

description:
  <VulnDiscussion>Finding unauthorized and/or improperly configured wireless devices (PEDs) connected to and/or operating on the SIPRNet is a security incident and could directly result in the loss or compromise of classified or sensitive information either intentionally or accidentally. 

  An assessment of risk in accordance with the Risk Management Framework (RMF) along with Certification and Accreditation and an Authorization to Operate (ATO) must be  accomplished and documented prior to connecting NSA approved classified PED solutions on a classified network such as SIPRNet or using PEDs within a classified enclave.

  A key requirement is that classified PEDs used to store classified data must comply with either the NSA Data At Rest (DAR) Capability Package and associated Risk Assessment or achieve NSA approval as a Tailored Solution for protection of data at rest.

  Handling procedures should include guidance provided in NSA risk assessments and may involve two layers of National Information Assurance Partnership (NIAP)-approved DAR protection, shipping/storage in accordance with Reference (a), and programmed data wiping or certificate revocation.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl C, paragraphs 21.i. and  22.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  AC-18, AC-18(1), AC-18(2), AC-18(3), AC-18(4) and AC-19

  CNSSP No.29, May 2013, National Secret Enclave Connection Policy

  CNSSP No. 17, January 2014, Policy on Wireless Systems

  DISN Connection Process Guide:
  http://disa.mil/network-services/enterprise-connections/connection-process-guide

  Wireless STIG

  Mobility Policy Manual STIG

  DoDD 8100.02, Use of Commercial Wireless Devices, Services, and Technologies in the Department of Defense (DoD) Global Information Grid (GIG), paragraph 4.1.3.

  CNSSI 1400, National Instruction on the use of Mobile Devices within Secure Spaces

  Joint USD(I) and DoD CIO Memorandum, dated 25, Sep 2015, SUBJECT: Security and Operational Guidance for Classified Portable Electronic Devices

  NSA "Mobile Access Capability Package vl .0," April 2, 2015 or later

  NSA "Mobile Access Risk Assessment vi .0," March 27, 2015 or later

  DoD Instruction 8510.01, "Risk Management Framework (RMF) for DoD Information
  Technology (IT)," March 12, 2014

  NSA "Commercial Solutions for Classified (CSfC) Incident Reporting Guidelines vl .0,"
  June 18, 2014 or later

  NSA "Data at Rest Capability Package v 2.0," April 2, 2015 or later

  NSA "Data at Rest Risk Assessment v2.0," April 7, 2015 or later

  DoD Instruction 8420.01, Commercial Wireless Local Area Network (WLAN) Devices, Systems, and Technologies, 3 November 2017, Paragraphs 1.2.h., and 3.8.d.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Unauthorized wireless devices, such as phones, PEDs, Laptops, etc., must not be connected to the SIPRNet or other classified system/network being reviewed.

  Ensure that unauthorized wireless devices (e.g., PEDs) are not connected to the Network (SIPRNet). 

  NOTE: Portable Electronic Devices (PEDs) include but are not limited to tablets, laptops, smartphones, and cellular telephones.

  If Portable Electronic Devices (PEDs) are connected to the SIPRNet, all devices must be NSA approved/configured and meet requirements for Data at Rest (DAR) encryption.

  All SIPRNet connected PEDs must comply with requirements in the "Joint USD(I) and DoD CIO Memorandum, dated 25 September 2015, SUBJECT: Security and Operational Guidance for Classified Portable Electronic Devices".

check_text:
  1. Visually check during the walk-around to ensure that unauthorized wireless devices (e.g., PEDs) are not connected to the Network (SIPRNet). 

  NOTE: Portable Electronic Devices (PEDs) include but are not limited to tablets, laptops, smartphones, and cellular telephones.

  2. If Portable Electronic Devices (PEDs) are found connected to the SIPRNet, verify with both site security personnel, Network Reviewers and others as necessary (e.g., site ISSM) that all devices are NSA approved/configured and meet requirements for Data at Rest (DAR) encryption.

  3. Verify that SIPRNet connected PEDs comply with all requirements in the "Joint USD(I) and DoD CIO Memorandum, dated 25 September 2015, SUBJECT: Security and Operational Guidance for Classified Portable Electronic Devices".

  TACTICAL ENVIRONMENT: The check is applicable for ALL classified processing environments.


vuln_id: V-245786
rule_id: SV-245786r770301_rule
severity: CAT II
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Information Assurance - Unauthorized Wireless Devices - Portable Electronic Devices (PEDs) Used in Classified Processing Areas without Certified TEMPEST Technical Authority (CTTA) Review and Authorizing Official (AO) Approval.

description:
  <VulnDiscussion>Allowing wireless devices in the vicinity of classified processing or discussion could directly result in the loss or compromise of classified or sensitive information either intentionally or accidentally.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl C, paragraphs 21.i(3). and  22.

  CNSS Directive No. 510, 20 November 2017, Directive on the Use of Mobile Devices Within Secure Spaces

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  AC-18, AC-18(1), AC-18(2), AC-18(3), AC-18(4) and AC-19

  CNSSP No.29, May 2013, National Secret Enclave Connection Policy

  CNSSP No. 17, January 2014, Policy on Wireless Systems

  DISN Connection Process Guide:
  http://disa.mil/network-services/enterprise-connections/connection-process-guide

  Wireless STIG

  Mobility Policy Manual STIG

  DoDD 8100.02, Use of Commercial Wireless Devices, Services, and Technologies in the Department of Defense (DoD) Global Information Grid (GIG), paragraphs 4.2. and 4.3

  CNSSI 1400, National Instruction on the use of Mobile Devices within Secure Spaces

  Joint USD(I) and DoD CIO Memorandum, dated 25, Sep 2015, SUBJECT: Security and Operational Guidance for Classified Portable Electronic Devices</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Unauthorized wireless devices (PEDs such as cellphones, BlackBerry devices, laptops, etc.) must not be permitted for use in areas where classified systems or machines (SIPRNet) are in use.
   
  2. If PED usage in classified processing areas is permitted, there must be specific written AO (formerly DAA) approval and a CTTA assessment of the environment and any resulting recommended TEMPEST countermeasures must be implemented.

check_text:
  1. Check to ensure that unauthorized wireless devices (PEDs such as cellphones, BlackBerry devices, laptops, etc.) are not being used in areas where classified systems or machines (SIPRNet) are in use.
   
  2. If PED usage in classified processing areas is permitted by the site, check to ensure there is specific written AO (formerly DAA) approval and that a CTTA has assessed the environment and that any resulting recommended TEMPEST countermeasures have been implemented.
    
  TACTICAL ENVIRONMENT: The check is applicable for ALL classified processing environments.


vuln_id: V-245787
rule_id: SV-245787r770023_rule
severity: CAT III
title: Information Assurance - Unauthorized Wireless Devices - No Formal Policy and/or Warning Signs
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Not having a wireless policy and/or warning signs at entrances could result in the unauthorized introduction of wireless devices into classified processing areas.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl C, paragraphs 21.i(3). and  22.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  AC-18, AC-18(1), AC-18(2), AC-18(3), AC-18(4) and AC-19

  CNSSP No.29, May 2013, National Secret Enclave Connection Policy

  CNSSP No. 17, January 2014, Policy on Wireless Systems

  DISN Connection Process Guide:
  http://disa.mil/network-services/enterprise-connections/connection-process-guide

  Wireless STIG

  Mobility Policy Manual STIG

  DoDD 8100.02, Use of Commercial Wireless Devices, Services, and Technologies in the Department of Defense (DoD) Global Information Grid (GIG), paragraphs 4.2. and 4.3

  CNSSI 1400, National Instruction on the use of Mobile Devices within Secure Spaces

  Joint USD(I) and DoD CIO Memorandum, dated 25, Sep 2015, SUBJECT: Security and Operational Guidance for Classified Portable Electronic Devices</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. A local wireless policy or SOP must be written and available for employee reference. 

  2. There must be appropriate signage at entrances notifying employees and visitors that wireless devices are not authorized in a classified facility. 

  3. Wireless policy must be included in initial briefings for new employees and reinforced periodically such as during annual security refresher training.

check_text:
  1. Check to ensure there is a local wireless policy or SOP.  

  2. During the walk-around, ensure there is appropriate signage at entrances notifying employees and visitors that wireless devices are not authorized in a classified facility.

  3. Check that wireless policy is included in initial briefings for new employees and reinforced periodically such as during annual security refresher training.   

  TACTICAL ENVIRONMENT: The check is applicable to tactical locations where fixed facilities are used for classified processing.  Not applicable to mobile/field environments.


vuln_id: V-245788
rule_id: SV-245788r1136644_rule
severity: CAT I
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Information Assurance - Network Connections - Physical Protection of Network Devices such as Routers, Switches and Hubs (Connected to SIPRNet or Other Classified Networks or Systems Being Inspected)

description:
  <VulnDiscussion>SIPRNet or other classified network connections that are not properly protected in their physical environment are highly vulnerable to unauthorized access, resulting in the probable loss or compromise of classified or sensitive information.

  REFERENCES:

  Network Infrastructure Security Technical Implementation Guide (STIG)

  Access Control in Support of Information Systems Security STIG (Access Control STIG)

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl C, paragraph 34.c.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  AC-5, SC-7 (14)&(15), SC-8, SC-14, SC-32, PE-2(1), PE-3(1) & (4), PE-4 & PE-18

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 3, Appendix to Encl 3, and Encl 7

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 
   
  DOD Instruction 8510.01, SUBJECT: Risk Management Framework (RMF) for DOD Information Technology (IT)

  DOD Instruction 8500.01, SUBJECT: Cybersecurity

  CJCSI 6211.02D, DEFENSE INFORMATION SYSTEMS NETWORK (DISN) RESPONSIBILITIES,

  CNSSP No.29, May 2013, National Secret Enclave Connection Policy</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Network devices on a Classified Network (SIPRNet) such as routers, switches, and hubs must be housed within an approved classified storage safe, vault, or approved open storage area (AKA: secure room, or in a SCIF. Information Processing System (IPS) containers are safes designed to house operational Information System (IS) equipment and can be used to meet this requirement. 

  2. An alternative to housing classified network devices in approved storage containers or areas is they must be housed in a 24/7 continuously occupied room or area. Occupants of the room or area must possess a security clearance equal to or greater than the level of the classified network devices. 

  3. Network Administrators and other (authorized) personnel must be the only persons with unimpeded access to the SIPRNet Network devices, regardless if properly housed in an approved safe, vault, secure room (AKA: collateral classified open storage area),in a SCIF, or in a 24/7 continuously occupied room or area. Lockable equipment storage cabinets may be used to meet this requirement (when network devices are housed within a vault, secure room or SCIF). 

  4. If other (authorized) personnel (e.g., other than assigned system/network administrators) are permitted to have unimpeded access to network devices, this authorization must be approved in writing by the site commander/director or perhaps other significant staff officer with security oversight of information systems (e.g., J6, ISSM). The documentation must include a justification indicating why the unimpeded/unescorted access is mission essential. This access allowance must be limited to very few personnel and not provided for mere convenience.

check_text:
  CHECK 1. Check to ensure that network devices on a Classified Network (SIPRNet) such as routers, switches, and hubs are housed within an approved classified storage safe, vault, or approved open storage area (AKA: secure room), or a SCIF. (CAT I)

  Two alternatives exist for check #1 in lieu of storage in a classified (secret or higher) vault, secure room or a SCIF:

  a. Information Processing System (IPS) containers are safes designed to house operational Information Systems (IS) equipment and can be used to meet this requirement. The use of an IPS container is often a good recommendation when a deficiency is found.

  b. A second alternative is to house network equipment in a 24/7 continuously occupied room or area. When using this method of control the equipment must be under the continuous (physical) observation and control of the cleared occupants. If using this alternative the network equipment must be maintained in lockable equipment storage cabinets. This is to ensure that only Network Administrators and other (authorized) personnel are the only persons with unimpeded access to the Network Connections. If the equipment is under continuous observation and control but not in a lockable cabinet or otherwise maintained to ensure that only Network Administrators and other(authorized) personnel have access, then it will be a CAT II finding under check #2 below. 

  CHECK 2. Check also to ensure that only Network Administrators and other (authorized) personnel are the only persons with unimpeded access to the Network Connections, regardless if properly housed in a safe, vault or secure room (AKA: collateral classified open storage area). Lockable equipment storage cabinets may be used to meet this requirement (but only when the storage cabinets housing the network equipment is located within a vault, secure room or SCIF). (CAT II) 

  CHECK 3. If other (authorized) personnel (e.g., other than assigned system/network administrators) are permitted to have unimpeded access to network devices, this authorization must be approved in writing by the site commander/director or perhaps other significant staff officer with security oversight of information systems (e.g., J6, ISSM). The documentation must include a justification indicating why the unimpeded/unescorted access is mission essential. This access allowance must be limited to very few personnel and not provided for mere convenience. (CAT II)

  TACTICAL ENVIRONMENT: The check is applicable for fixed tactical classified processing environments. It is assumed the type of equipment referenced will be in a fixed environment. Not applicable to a field/mobile environment.


vuln_id: V-245789
rule_id: SV-245789r1136646_rule
severity: CAT I
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Information Assurance - Network Connections - Wall Jack Security on Classified Networks (SIPRNet or other Inspected Classified Network or System) Where Port Authentication Using IEEE 802.1X IS NOT Implemented

description:
  <VulnDiscussion>Following is a summary of the primary requirement to use the IEEE 802.1X authentication protocol to secure SIPRNet ports (AKA: wall jacks) , which is covered in the Network STIG:

  802.1X authentication involves three parties: a supplicant, an authenticator, and an authentication server. The supplicant is a client device (such as a laptop) that wishes to attach to the LAN/WLAN. The term 'supplicant' is also used interchangeably to refer to the software running on the client that provides credentials to the authenticator. The authenticator is a network device, such as an Ethernet switch or wireless access point; and the authentication server is typically a host running software supporting the RADIUS and EAP protocols. In some cases, the authentication server software may be running on the authenticator hardware. 

  The authenticator acts like a security guard to a protected network. The supplicant (i.e., client device) is not allowed access through the authenticator to the protected side of the network until the supplicant's identity has been validated and authorized. With 802.1X port-based authentication, the supplicant provides credentials, such as user name/password or digital certificate, to the authenticator, and the authenticator forwards the credentials to the authentication server for verification. If the authentication server determines the credentials are valid, the supplicant (client device) is allowed to access resources located on the protected side of the network.

  The requirements in this Traditional Security STIG rule serve as physical security mitigations for the lack of proper SIPRNet port security using IEEE 802.1X. It is in essence a supplement to the Network STIG and provides the details for required mitigations. 

  Network connections that are not properly protected are highly vulnerable to unauthorized access, resulting in the loss or compromise of classified or sensitive information.

  REFERENCES:

  Network Infrastructure Security Technical Implementation Guide (STIG)

  Access Control in Support of Information Systems Security STIG (Access Control STIG)

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl C, paragraph 34.c.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  SC-8, PE-4 & PE-18

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 3, Appendix to Encl 3, and Encl 7

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 
   
  DOD Instruction 8510.01, SUBJECT: Risk Management Framework (RMF) for DOD Information Technology (IT)

  DOD Instruction 8500.01, SUBJECT: Cybersecurity

  CJCSI 6211.02D, DEFENSE INFORMATION SYSTEMS NETWORK (DISN) RESPONSIBILITIES

  CNSSP No.29, May 2013, National Secret Enclave Connection Policy</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Where port authentication using IEEE 802.1X is not implemented, all SIPRNet wall jacks must be physically secured in the proper manner. The physical security mitigation for Wall Jacks not protected by 802.1X must use one of the following compensatory measures: 

  1. SIPRNet connected wall jacks must be located within a Secret or higher vault or Secret or higher secure room (open storage area) or a SCIF. 

  2. SIPRNet connected wall jacks must be under the continuous observation of a cleared individual. 

  3. SIPRNet connected wall jacks must be secured by a Hoffman or similar lock box with a GSA-approved three-position changeable combination padlock. Currently the ONLY lock meeting this standard is the S&G 8077 changeable combination padlock. Lock boxes must also have hasps attached in such a way as they cannot be removed without force. Using rivets, welds, etc. is acceptable. Also hinges must not be exposed or be peened or welded in such a manner as to preclude removal without using detectable force. Electrical-type boxes with prepunch holes for conduit or cable cannot be used even if the prepunch holes are not removed. 

  4. SIPRNet connected wall jacks must be disabled at the end of each work day. This can ONLY be accomplished by a physical disconnect of the transmission cable at the classified circuit (SIPRNet) Point of Presence (PoP). The PoP must be located in an appropriate Secret or higher vault, secure room, or SCIF.

check_text:
  At sites where port authentication using 802.1X is not implemented, check during your walk around to see if all SIPRNet wall jacks are secured in the proper manner. The wall jacks can:
   
  1. Be located within a Secret or higher vault or Secret or higher secure room (open storage area) or a SCIF. 

  2. Be under the continuous observation of a cleared individual. 

  3. Be secured by a Hoffman or similar lock box with a GSA-approved three-position changeable combination padlock. Currently the ONLY lock meeting this standard is the S&G 8077 changeable combination padlock. 

  *Lock boxes must also have hasps attached in such a way that they cannot be removed without force. Using rivets, welds, etc. is acceptable. Also hinges must not be exposed or be peened or welded in such a manner as to preclude removal without using detectable force. Electrical-type boxes with prepunch holes for conduit or cable cannot be used even if the holes are not removed. 

  4. Be disabled at the end of each work day. This can ONLY be accomplished by a physical disconnect of the transmission cable at the classified circuit (SIPRNet) Point of Presence (PoP). The PoP must be in an appropriate Secret or higher vault, secure room, or SCIF. 

  DETAILED EXPLANATION FOLLOWS:

  1. The primary and most basic requirement (IAW the Network Policy found in the Layer 2 Switch STIG - Cisco) is implementation of IEEE port authentication standard 802.1X (logical software-based port security) - regardless of the physical area or space in which the wall jacks/ports are located. TRADITIONAL SECURITY REVIEWERS MUST FIRST CHECK WITH THE NETWORK REVIEWER to determine if 802.1X has been properly implemented on SIPRNet before evaluating the physical security of SIPRNet wall jacks. * Do this early in your site visit so that wall jack physical security considerations can be properly evaluated during your site tour/walk around.

  2. Not using 802.1X based port authentication on SIPRNet is a CAT I *Network STIG" finding, separate from any traditional security considerations. However, if 802.1X is not implemented there is another software-based alternative, which is the Network STIG requirement to allow for "legacy" port security via MAC address. Several caveats go with this alternative, and this is when the physical security mitigations are required to be implemented: 

   a. Use of simple port security rather than 802.1X will result in a CAT III (*Network STIG) finding (on NIPRNet or SIPRNet). While this is not a traditional security check, it is something to be aware of.

   b. If simple port security rather than 802.1X is implemented *on SIPRNet* (OR IF THERE IS ABSOLUTELY NO LOGICAL SOFTWARE-BASED PORT SECURITY), the traditional security considerations and mitigations required IAW the Access Control STIG are as follows: 

   (1) If the wall jacks/drops/ports are located within spaces properly established as Secret or TS vaults or Secret or TS Secure Rooms (AKA: Collateral Classified Open Storage Areas) OR within an approved SCIF, then there is no requirement for supplemental physical security measures. Again - No supplemental physical security controls are required for SIPRNet wall jacks in these areas. 

   (2) If the wall jacks are not located in Secret or higher secure room/vault/SCIF, the following physical security controls must be in place:

   (a) SIPRNet wall jacks must be secured *when not attended by persons with Secret or higher clearance* by a properly constructed lock box (Hoffman or similar commercial product or locally fabricated). The lock box must be 18-gauge steel or better and have no exposed or removable hinges (internal hinges are ideal). If used, external hinge pins must be peened, welded, etc. so they cannot be removed without evidence of forced removal. Hasp hardware must be riveted to the box or otherwise installed so that removal will require physical breaking of the box or hasp, thereby leaving evidence of actual or attempted entry. No pre-punch (knock-out) holes are allowed in the box. The lock box must be secured with a 3-position high security combination padlock (IAW the CNSSI 7003 standard for PDS "Pull Boxes"). The S&G 8077 combination padlock is the ONLY existing combo padlock meeting this standard. See the DOD Lock Program site for details: 

  https://portal.navfac.navy.mil/portal/page/portal/navfac/navfac_ww_pp/navfac_nfesc_pp/locks/CM_LOCKS/CL_PADLOCK/TAB_PADLOCK_PROD

   (b) If lock boxes are not used the alternative is to physically disconnect the hot SIPRNet transmission lines at the SIPRNet Point of Presence (PoP) after normal duty hours. The PoP must be located within a proper Secret or higher secure room or vault or SCIF.

  NOTE 1: To reiterate the basic requirement: If IEEE 802.1X is properly implemented at the switch to authenticate devices *with clients (such as user work stations)* no additional supplemental physical security controls are required for the wall jacks. VERIFICATION FOR 802.1X IMPLEMENTATION MUST BE COORDINATED WITH THE NETWORK REVIEWER.

  NOTE 2: Regardless of Port Authentication using IEEE 802.1X, *clientless devices (such as printers, scanners or multi-functional devices (MFD)* cannot be authenticated - but this should not cause an issue with needing supplemental physical controls (lock box or disconnect at PoP). The reason is because clientless devices like these that are connected to SIPRNet should "normally" be maintained in a Secret/TS secure room or vault or SCIF and therefore would not require supplemental physical security of the wall jacks. Otherwise, MFD wall jacks must be protected by lock boxes or physical disconnect at the PoP after normal duty hours. Additional physical security measures or procedures for protection of classified MFD hard drives, residual images and printed materials will also be required, but these considerations are addressed elsewhere on the checklist. 

  NOTE 3: Do not confuse the STIG wall jack lock box requirement with the CNSSI 7003 lock box requirement on the physical end point (Termination Boxes) of a Protected Distribution System (PDS). The reference for PDS is the CNSSI 7003, not the Access Control STIG. The requirements for PDS (pull-boxes, Access Points or Termination Boxes) and wall jack (lock boxes) are totally separate and unique, although it is possible to find the end of a PDS terminating in a lock box - that ALSO fulfills the requirement for protection of a wall jack where 802.1X is not implemented. 

  NOTE 4: If there is no "legacy" MAC port security in place there will be a CAT I port security finding written by the Network reviewer. If the traditional security reviewer also finds a CAT I finding for lack of physical security protective measures there is a CCRI scoring over ride that will decrease the OVERALL CCRI score. So where there is absolutely no logical or physical port/wall jack security in place - the result is very severe in terms of the CCRI score. Traditional Security reviewers, Network Reviewers (and Team Leads) need to be aware of this because of its significance to the site being reviewed. 
   
  NOTE 5: TACTICAL ENVIRONMENT APPLICABILITY: The check is applicable for fixed facility tactical processing environments. Not applicable to a field/mobile environment.


vuln_id: V-245790
rule_id: SV-245790r1138489_rule
severity: CAT II
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Information Assurance - Network Connections - Physical Protection of Unclassified (NIPRNet) Network Devices such as Routers, Switches and Hubs

description:
  <VulnDiscussion>Unclassified (NIPRNet) network connections that are not properly protected in their physical environment are highly vulnerable to unauthorized access, resulting in the probable loss or compromise of sensitive information such as personally identifiable information (PII) or Controlled Unclassified Information (CUI).

  REFERENCES:

  Network Infrastructure Security Technical Implementation Guide (STIG)

  Access Control in Support of Information Systems Security STIG (Access Control STIG)

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl C, paragraph 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  AC-5, SC-7 (14)&(15), SC-8, SC-14, SC-32, PE-2(1), PE-3(1) & (4), PE-4 & PE-18

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 7

  DODI 5200.48 Controlled Unclassified Information (CUI)

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5200.32 Volume 1 

  DOD Instruction 8510.01, SUBJECT: Risk Management Framework (RMF) for DOD Information Technology (IT)

  DOD Instruction 8500.01, SUBJECT: Cybersecurity

  CJCSI 6211.02D, DEFENSE INFORMATION SYSTEMS NETWORK (DISN) RESPONSIBILITIES</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. All network connections (on NIPRNet or other Unclassified Network under review) such as routers, switches, and hubs must be secured within a locked communications closet/room OR secured within a cabinet if the equipment is located in a room that is accessed by personnel other than designated network system administrators (e.g., SAs specifically designated to administer the network devices) and/or those with security management oversight (e.g., ISSM, ISSO, SM).

  2. If other (authorized) personnel (e.g., other than assigned system/network administrators or security management) are permitted to have unimpeded access to network devices, this authorization must be approved in writing by the site commander/director or perhaps other significant staff officer with security oversight of information systems (e.g., J6, ISSM). The documentation must include a justification indicating why the unimpeded/unescorted access is mission essential. This access allowance must be limited to very few personnel and not provided for mere convenience. 

  3. The locked room or cabinet must be adequately secured so that it cannot be easily accessed without forcible entry. 

  4. Proper key control procedures must be in place for associated keys used to secure doors to communications rooms AND equipment cabinets. 

  NOTE: Because locks and keys to equipment cabinets are often inferior and do not provide for adequate physical protection it is recommended that a metal hasp be attached (using rivets or other means that cannot be removed without evidence of forcible entry) to equipment cabinets securing network equipment. General Services Administration (GSA) Medium Security Keyed Padlocks or (preferably) the S&G 8077 Changeable Combination Padlock should then be used to secure the cabinet using the hasp.

check_text:
  1. Check that ALL network connections (on NIPRNet or other Unclassified Network under review) such as routers, switches, and hubs are secured in a locked communications closet/room OR secured in a locked equipment cabinet if the equipment is located in a room that is accessed by personnel other than designated network system administrators (e.g., SAs specifically designated to administer the network devices) and/or those with security management oversight (e.g., ISSM, ISSO, SM). The intent is to ensure that only Network Administrators and other (authorized) personnel are the only persons with unimpeded access to the Network Connections.

  2. If other (authorized) personnel (e.g., other than assigned system/network administrators or security management) are permitted to have unimpeded access to network devices, this authorization must be approved in writing by the site commander/director or perhaps other significant staff officer with security oversight of information systems (e.g., J6, ISSM). The documentation must include a justification indicating why the unimpeded/unescorted access is mission essential. This access allowance must be limited to very few personnel and not provided for mere convenience.

  3. Ensure the locked room or cabinet cannot be easily accessed without forcible entry. Also ensure that proper key control procedures are used for ALL keys associated with both communication room doors and/or equipment cabinet doors. 

  4. ANY discrepancies with the above guidelines will result in a finding.

  TACTICAL ENVIRONMENT: The check is applicable for fixed tactical processing environments. It is assumed the type of equipment referenced will be in a fixed environment. Not applicable to a field/mobile environment.


vuln_id: V-245791
rule_id: SV-245791r1136650_rule
severity: CAT II
title: Industrial Security - DD Form 254
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to complete a DD Form 254 (Contract Security Classification Specification) or to specify security clearance and/or IT requirements for all contracts that require access to classified material can result in unauthorized personnel having access to classified material or mission failure if personnel are not authorized the proper access.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl A, Para 11, Encl B, para 4.h & 4.i., Encl C, para 5. (a, b & c), Encl C, para 26.g.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  PE-2, PE-2(1), PE-3, PE-8, , PS-3(1), PS-6(2), PS-7

  DOD Manual 5200.01, Volume 4, SUBJECT: DOD Information Security Program: Controlled Unclassified Information (CUI), Encl 3, para 1.e.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 2, para 18.i.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 

  DOD Manual 5200.48 Controlled Unclassified Information (CUI)

  DOD Manual 5220.22, Volume 2, National Industrial Security Program: Industrial Security Procedures for Government Activities, 1 August 2018, Section 3, paragraph 3.4.a. and Section 6.
   
  DOD Instruction 8510.01, SUBJECT: Risk Management Framework (RMF) for DOD Information Technology (IT): Encl 2, para 7.l., Encl 3, para 3.b.(3), Encl 6, para 1.b.(5)(a)&(c)&(d) and para 2.c(c).

  DOD Instruction 8500.01, SUBJECT: Cybersecurity: Encl 2, para 13.i., j & l. and Encl 3, para 7.f., k., & l, para 9.b(4) and para 10.d.

  CJCSI 6211.02D, DEFENSE INFORMATION SYSTEMS NETWORK (DISN) RESPONSIBILITIES, Encl B, para 2.c.(7) and para 7., Encl C, para 6.b(7)(a) &(b), Encl D, para 2.j.

  DOD 8570.01-M, Information Assurance Workforce Improvement Program, paragraphs: C1.4.4.5, C1.4.4.12., C2.3.9., C3.2.4.4., C3.2.4.8., C3.2.4.8.1., C4.2.3.7.1., C7.3.4., C10.2.3.7.1., C11.2.4.7.1.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. DD Forms 254 must be on hand for each classified contract. 

  2. All security requirements must be properly detailed on the form, particularly for information technology-related requirements (in addition to security clearance, training, and certification requirements) for the positions or types of work to be performed.

check_text:
  1. Check there are DD Forms 254 available for all classified contracts. 

  NOTE: These forms may be held by the site contracting officials but should be available to the site security manager and information security manager for review.

  2. Conduct a cursory review of the DD 254 to ensure all security requirements are properly detailed on the form, especially with regard to Information Assurance Positions in addition to security clearance, training and certification requirements. 

  NOTE: Applicable to tactical environments if there are contractor personnel performing classified work. This form will likely only be found at fixed locations rather than field locations. While the DD 254 may not be available on site or even in Theater, the completed document's location should be identified and if possible a scanned and emailed copy requested for review. This will likely only be able to occur via SIPRNet email because some of these forms contain classified information, while all others are only FOUO.


vuln_id: V-245792
rule_id: SV-245792r1136653_rule
severity: CAT III
title: Industrial Security - Contractor Visit Authorization Letters (VALs)
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to require Visit Authorization Letters (VALs) for contractor visits could result in sensitive or classified materials being released to unauthorized personnel.

  REFERENCES:

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  PE-2, PE-2(1), PE- 3, , PE-8, PS-3(1), PS-6(2)

  DOD Manual 5200.01, Volume 1, SUBJECT: DOD Information Security Program: Overview, Classification, and Declassification, Encl 2, para 9.k., 9.l. & 9.m.

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information, Encl 2, para 7.a.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Written procedures must be developed that cover the requirements and process for VALs for contractors visiting and/or employed at government sites. 

  2. All government sites must have a VAL on file for each contractor visiting the site temporarily and also for permanent party contractors routinely working/physically employed at the site. 

  NOTES: 

  DISS should be used for most short-term "visitor" VALs; however, in addition to DISS (or as an alternative to JPAS for contractors who do not have DISS accounts) VALs may also be passed via hard copy or electronically using email (mail, fax, email) for "assigned" contractor employees. This is because DISS is by design intended for short-term visits, whereas contractor "employee" VALs require additional information (such as contract number, COR identification, etc.) that cannot be input or passed via DISS. 

  A hard-copy VAL for assigned contractor employees will help to eliminate substantive confusion over the company Facility Clearance Level (FCL), individual contract employee security clearance levels, IA Roles of assignments based on job descriptions (found in applicable SOW and/or DD 254), etc.

check_text:
  1. Check with the security manager or personnel security specialists to ensure there are written procedures for contractors visiting government sites. 

  2. Ask to see copies of the site VALs and/or determine site VAL process based on the processing of contractors on your inspection team. 

  3. Ensure all government facilities have a VAL on file for all contractors visiting the site, including permanent party contractors. 

  NOTES: 

  1. DISS should and will likely be used for most short-term "visitor" VALs; however, in addition to DISS the VAL may also be passed via hard copy or electronically using email (mail, fax, email) for "assigned" contractor employees. This is because DISS is by design intended for short-term visits, whereas contractor "employee" VALs should require additional information (such as contract number, COR identification, etc.) that cannot be input or passed via DISS. Lack of a hard-copy VAL alone for assigned contractor employees at a site will not necessarily be cause for a finding if a VAL in DISS is available. Reviewers must use discretion when evaluating if the lack of hard-copy VAL has caused any substantive confusion over the company Facility Clearance Level (FCL), individual contract employee security clearance levels, IA Roles of assignments based on job descriptions (found in applicable Statements of Work [SOW] and/or DD 254), etc. when deciding if a finding is warranted. For instance, an individual employee's DISS access might indicate they have TS clearance - but the FCL for the company is only at the Secret level and/or the contract only allows for up to Secret access. If the site is allowing access to TS for this individual, the lack of a hard-copy VAL could be cited as a finding, in addition to any other related findings for this discovery.

  2. Applies in a tactical environment if contract personnel visit or are assigned.

  3. Reviewers should be sure to note in the findings report if the finding concerns DISS issues for short-term contractor visitors or if it concerns "hard-copy" VALs for assigned contractor employees.


vuln_id: V-245793
rule_id: SV-245793r770041_rule
severity: CAT II
title: Industrial Security - Contract Guard Vetting
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to screen guards could result in employment of unsuitable personnel who are responsible for the safety and security of DOD personnel and facilities.

  REFERENCES:

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  PS-2, PS-2(1), PS- 3

  DoD Manual 5200.02, Procedures for the DoD Personnel Security Program (PSP), 3 April 2017</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. Contract guards must have a minimum favorable Tier 1 (T1) background investigation (formerly National Agency Check (NAC)) prior to DoD facility assignment or an appropriate level of security clearance if required by the DD 254 and classified duties are performed.  

  2. If classified work is not required security specifications must be contained within the contract documentation (Statement of Work (SOW) or other appropriate documentation) for a T1/NAC and any other security requirements for guards not involving access to classified.  

  NOTES:  

  1. Fully applicable in a tactical environment if contract guards are employed. 

  2. This check does not "necessarily" apply to base police/gate guards - only to the guards employed specifically to protect "inspected site" assets. If the host installation employs contract guards to assist or directly protect "inspected site" assets then the requirements of this requirement will apply.

check_text:
  Check to ensure:  

  1. Contract guards have a minimum favorable Tier 1 (T1) background investigation (formerly National Agency Check (NAC)) prior to DoD facility assignment or an appropriate level of security clearance if required by the DD 254 and classified duties performed.  

  2. If classified work is not required check to ensure security specifications are contained within the contract documentation (Statement of Work (SOW) or other appropriate documentation) for T1/NAC and any other security requirements not involving access to classified.  

  3. That contract guards actually have current investigations for the position level of trust and/or security clearance requirements.  

  NOTES:  

  1. Fully applicable in a tactical environment if contract guards are employed. 

  2. This check does not "necessarily" apply to base police/gate guards - only to the guards employed specifically to protect "inspected site" assets. If the host installation employs contract guards to assist or directly protect "inspected site" assets then the requirements of this requirement will apply.


vuln_id: V-245794
rule_id: SV-245794r770044_rule
severity: CAT II
title: Information Security (INFOSEC) - Safe/Vault/Secure Room Management
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Lack of adequate or Improper procedures for management of safes/vaults and secure rooms could result in the loss or compromise of classified material.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl C, paragraphs 26.s.(5) and 34.c.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  MP-4 and PE-5

  DoD Manual 5200.01, Volume 3, SUBJECT: DoD Information Security Program: Protection of Classified Information, Encl 2, para 9; Encl 3, para 1.b, 1.d., 6.b., 6.d., 7., 8., 9., 10., 11., 13., and 14.

  Information Security Oversight Office, 32 CFR Parts 2001 and 2003 Classified National Security Information; Final Rule: Subpart H - Standard Forms</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  All safes, vaults and/or secure rooms containing SIPRNet assets must adhere to the following proper management practices:

  1. Only GSA-approved security containers are utilized. GSA-approved security containers and vault doors must have a label indicating "General Services Administration Approved Security Container," affixed to the front of the container, usually this is on the control or the top drawer of safes.

  2. Combinations must be changed as required. This is recorded on the applicable SF 700 form and must be done: When placed in service, When someone with knowledge of the combination departs (unless other sufficient controls exist to prevent that individual's access to the lock), When compromise of the combination is suspected, or When taken out of service built-in combination locks shall be reset to the standard combination of 50-25-50.

  3. Standard Forms (SF) 700, Security Container Information and SF 702, Security Container Check Sheet must be properly completed and maintained.

  4. Repairs must be conducted correctly IAW FED-STD-809. Details are at the DoD Lock Program WEB Portal for Drawer head Replacement.

check_text:
  Check all safes, vaults and/or secure rooms (*only those containing DoDIN assets) for proper management practices:

  1. Ensure only GSA-approved security containers are being utilized. GSA-approved security containers and vault doors must have a label indicating "General Services Administration Approved Security Container," affixed to the front of the container. Usually this is on the control or the top drawer of safes.

  2. Ensure combinations are changed as required. This is recorded on the applicable SF 700 form and must be done: When placed in service, When someone with knowledge of the combination departs (unless other sufficient controls exist to prevent that individual's access to the lock), When compromise of the combination is suspected, or When taken out of service,  built-in combination locks shall be reset to the standard combination of 50-25-50.

  3. Ensure forms SF 700, Security Container Information are properly completed for each safe, vault and secure room used to store classified DISN assets. The SF 700 is a two-part form consisting of an envelope with a tear-off tab and cover sheet. The cover sheet and face of the envelope (Part 1 of the form) provide space for information about the activity, container, type of lock, and who to contact if the container is left open. Required checks follow. Ensure the SF 700: 

    a. Shows the location of the door or container.

    b. Reflects the names, home addresses, and home telephone numbers of the individuals having knowledge of the combination who are to be contacted in the event that the vault, secure room, or container is found open and unattended.

    c. Part 1 of SF 700 is not classified, but contains personally identifiable information (PII) that shall be protected by sealing Part 1 in an opaque envelope (not provided as part of the SF 700) conspicuously marked "Security Container Information" and stored in accordance with SF 700 instructions. NOTE: If the information must be accessed during non-duty hours and a new opaque envelope is not available to replace the opened one, the original envelope should be temporarily resealed, to the extent possible, until Part 1 can be placed in a new envelope the next working day.

    d. After the cover sheet (Part 1) is filled out and sealed in an opaque envelope, attach it to the inside of the control drawer or on the inside face of the vault or secure room door, with either tape or a magnetically-attached holder.

    e. The tear-off tab (Part 2) with the combination record is placed in the envelope provided with the form, sealed, properly marked with the classification level and stored by the security manager in another approved classified container.

  4. Ensure forms SF 702, Security Container Check Sheet are properly completed for each safe, vault and secure room used to store classified DISN assets. Following are required checks for the SF 702 form. Ensure:
   
    a. It provides a record of the names and times that persons have opened, closed or checked a particular container (safe, vault or secure room) that holds classified information.

    b. It is properly annotated to reflect each opening and closing of the container.

    c. It is properly annotated to reflect (at least) daily checks of ALL containers - whenever an area housing the containers is entered/occupied - EVEN IF THE CONTAINER IS NOT OPENED. If on weekends or holidays the area housing the container is not occupied the SF 702 would not require annotation; however, in the event the area is accessed for even a short period of time, the SF 702 forms for each container in the area should be annotated to reflect the container was checked. Annotation of the SF 702 forms should be conducted IN ADDITION TO the annotation of SF 701 forms reflecting end-of-day checks.

  NOTE: If CC/S/A INFOSEC implementing instructions contain specific guidance in contradiction to the above DoDIN SF 702 requirements/checks then the CC/S/A guidance may be followed. Failure to comply with either the above guidance or CC/S/A documented guidance will result in a finding of non-compliance.

  5. Ensure container repairs are conducted correctly IAW FED-STD-809. Details are at the DoD Lock Program WEB Portal for Drawer head Replacement.

  TACTICAL ENVIRONMENT: This check is applicable where safes, vaults or secure rooms are used to protect classified materials or systems. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245795
rule_id: SV-245795r1136655_rule
severity: CAT I
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Information Security (INFOSEC) - Vault/Secure Room Storage Standards - Door Combination Lock Meeting Federal Specification FF-L-2740

description:
  <VulnDiscussion>Failure to meet Physical Security storage standards could result in the undetected loss or compromise of classified material.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl A, paragraph 7.f.; Encl C, paragraph 10.a., and 10.b.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  MP-4, PE-3 and PE-5

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Encl 3, para 1.d, 2., 3.a.(2), 3.b.(1), 6.a.(2), 7. and Appendix to Encl 3, para 1.b.(3).

  Information Security Oversight Office, 32 CFR Parts 2001 and 2003 Classified National Security Information

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  *This requirement is specifically for vaults and secure rooms or open storage areas containing inspectable SIPRNet assets*:

  The primary ingress/egress door must be equipped with a proper combination lock that is installed properly and is being used. Door must be equipped with a built-in GSA-approved combination lock meeting Federal Specification FF-L-2740, such as the X07, X09, and Kaba Mas X-10 locks. 

  NOTE: The use of automated entry control systems (AECS) is encouraged to control access to secure room space during working hours; however, electrically actuated locks (e.g., cypher and magnetic access card locks) do not afford by themselves the required degree of protection for classified information and must not be used as a substitute for the combination locks meeting Federal Specification FF-L-2740.

check_text:
  *This check is specifically for vaults and secure rooms or open storage areas containing inspectable SIPRNet assets*:

  Check the primary ingress/egress door to ensure a proper combination lock is installed and is being used. Door must be equipped with a built-in GSA-approved combination lock meeting Federal Specification FF-L-2740, such as the X07, X09, or Kaba Mas X-10 locks. 

  NOTE: The use of automated entry control systems (AECS) is encouraged to control access to secure room space during working hours; however, electrically actuated locks (e.g., cypher and magnetic access card locks) do not afford by themselves the required degree of protection for classified information and must not be used as a substitute for the combination locks meeting Federal Specification FF-L-2740.
   
  TACTICAL ENVIRONMENT: This check is applicable where vaults or secure rooms are used to protect classified materials or systems. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245796
rule_id: SV-245796r1014156_rule
severity: CAT I
title: Information Security (INFOSEC) - Secure Room Storage Standards - Door Construction
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to meet construction standards could result in the undetected loss or compromise of classified material.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Encl A, paragraph 7.f.; Encl C, paragraph 10.a., and 10.b.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  MP-4, PE-3 and PE-5

  DoD Manual 5200.01, Volume 3, SUBJECT: DoD Information Security Program: Protection of Classified Information: Encl 3, para 1.b, 14.b. and Appendix to Encl 3, para 1.b.(3), 2.e.(4) and Glossary page 122, vault definition.

  Information Security Oversight Office, 32 CFR Parts 2001 and 2003 Classified National Security Information: paragraph 2001.53 Open storage areas, (b) Doors.

  DoD 5220.22-M (NISPOM), Incorporating Change 2, 18 May 2016, Chapter 5, Section 8, Construction Requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  All secure room doors (*containing inspectable SIPRNet assets) must meet the following standards: 

  1. The doors to the room (primary and secondary) shall be substantially constructed of wood or metal. 

  2. For outswing doors, hinge-side protection shall be provided by making hinge pins nonremovable (i.e., spot welding) or by using hinges with interlocking leaves that prevent removal. There are certain hinge pins made with internal locking pins or locking flanges and are acceptable if they cannot be removed.

  3. Secondary (emergency exit only) doors other than those secured with locks meeting FF-L-2740 shall be secured from the inside with deadbolt emergency egress hardware, a deadbolt, or a rigid wood or metal bar that extends across the width of the door. IAW Unified Facilities Criteria (UFC) UFC 4-026-01, 4 Mar 2020, section 5-5.5.  All nonentry doors to the defense layer must present a blank, flush surface to the outside and have internal locking or bolting mechanisms to reduce vulnerability to attack (to the secure room).

  4. Secondary doors (doors other than those secured with locks meeting FF-L-2740) shall be secured from the inside with deadbolt emergency egress hardware, a deadbolt, or a rigid wood or metal bar that extends across the width of the door. These deadbolt locks shall be secured when the combination lock on the primary door is spun.

check_text:
  Check all secure room doors (*containing inspectable SIPRNet assets) as follows:

  1. The doors to the room (primary and secondary) shall be substantially constructed of wood or metal. (CAT II) 

  2. For outswing doors, hinge-side protection shall be provided by making hinge pins nonremovable (i.e., spot welding) or by using hinges with interlocking leaves that prevent removal. There are certain hinge pins made with internal locking pins or locking flanges and are acceptable if they cannot be removed. (CAT I)     

  3. Secondary (emergency exit only) doors other than those secured with locks meeting FF-L-2740 shall be secured from the inside with deadbolt emergency egress hardware, a deadbolt, or a rigid wood or metal bar that extends across the width of the door.  IAW Unified Facilities Criteria (UFC) UFC 4-026-01, 4 Mar 2020, section 5-5.5.  All non-entry doors to the defense layer must present a blank, flush surface to the outside and have internal locking or bolting mechanisms to reduce vulnerability to attack (to the secure room) (CAT I)  

  4. Secondary doors (doors other than those secured with locks meeting FF-L-2740) shall be secured from the inside with deadbolt emergency egress hardware, a deadbolt, or a rigid wood or metal bar that extends across the width of the door. These deadbolt locks shall be secured when the combination lock on the primary door is spun. (CAT I)

  TACTICAL ENVIRONMENT: This check is applicable where  secure rooms are used to protect classified materials or systems.  The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245797
rule_id: SV-245797r1136658_rule
severity: CAT I
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Information Security (INFOSEC) - Secure Room Storage Standards Wall and Ceiling Structural Integrity (AKA: True Floor to True Ceiling Connection)

description:
  <VulnDiscussion>Failure to meet standards for ensuring that there is structural integrity of the physical perimeter surrounding a secure room (AKA: collateral classified open storage area) IAW DOD Manual 5200.01, Volume 3, Enclosure 3 could result in the undetected loss or compromise of classified material.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraphs 24.j. and 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  MP-4, PE-3 and PE-5

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Appendix to Encl 3, para 1.b.(1).

  Information Security Oversight Office, 32 CFR Parts 2001 and 2003 Classified National Security Information: paragraph 2001.53 Open storage areas, (a) Construction.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. For secure rooms or areas (*containing inspectable SIPRNet as well as other classified systems assets) walls must be true floor to true ceiling. 

  2. Walls shall be extended to the true ceiling and attached with permanent construction materials. 

  3. As an alternative true walls and true ceilings can be connected with steel mesh or 18-gauge expanded steel screen. 

  4. Likewise, walls below raised floor (computer room) space may be connected to the true floor with steel mesh or 18-gauge expanded steel screen.

check_text:
  For secure rooms or areas (*containing inspectable SIPRNet as well as other classified systems assets) check walls are true floor to true ceiling. Walls shall be extended to the true ceiling and attached with permanent construction materials. As an alternative true walls and true ceilings can be connected with steel mesh or 18-gauge expanded steel screen. Likewise, walls below raised floor (computer room) space may be connected to the true floor with steel mesh or 18-gauge expanded steel screen.    

  TACTICAL ENVIRONMENT: This check is applicable where secure rooms are used to protect classified materials or systems. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245798
rule_id: SV-245798r1136661_rule
severity: CAT I
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Information Security (INFOSEC) - Vault/Secure Room Storage Standards - Openings in Perimeter Exceeding 96 Square Inches

description:
  <VulnDiscussion>Failure to meet standards for ensuring that there is structural integrity of the physical perimeter surrounding a vault or secure room (AKA: collateral classified open storage area) IAW DOD Manual 5200.01, Volume 3, Enclosure 3 could result in the undetected loss or compromise of classified material.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraphs 24.j. and 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  MP-4, PE-3 and PE-5

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Appendix to Encl 3, para 1.b.(5).

  Information Security Oversight Office, 32 CFR Parts 2001 and 2003 Classified National Security Information: paragraph 2001.53 Open storage areas, (c) Vents, ducts, and miscellaneous openings.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  For vaults, secure rooms or areas (*containing inspectable SIPRNet as well as other classified systems assets): Utility openings such as ducts and vents and any holes or passages through the secure room perimeter must be kept at less than a man-passable (96 square inches) opening. Openings larger than 96 square inches will be hardened in accordance with Military Handbook 1013/1A.

check_text:
  For vaults, secure rooms or areas (*containing inspectable SIPRNet as well as other classified systems assets): Utility openings such as ducts and vents and any holes or passages through the secure room perimeter will be kept at less than a man-passable (96 square inches) opening. Openings larger than 96 square inches will be hardened in accordance with Military Handbook 1013/1A.

  TACTICAL ENVIRONMENT: This check is applicable where secure rooms are used to protect classified materials or systems. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245799
rule_id: SV-245799r1138437_rule
severity: CAT I
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
title:
  Information Security (INFOSEC) - Secure Room Storage Standards Windows - Accessible from the Ground Hardened Against Forced Entry and Shielded from Exterior Viewing of Classified Materials Contained within the Area.

description:
  <VulnDiscussion>Failure to meet standards for ensuring that there is structural integrity of the physical perimeter surrounding a secure room (AKA: collateral classified open storage area) IAW DOD Manual 5200.01, Volume 3 could result in the undetected loss or compromise of classified material.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraphs 24.j. and 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  MP-4, PE-3, PE-5 and PE-6

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Appendix to Encl 3, para 1.b.(4)(a) & (b).

  Information Security Oversight Office, 32 CFR Parts 2001 and 2003 Classified National Security Information: paragraph 2001.53 Open storage areas, (d) Windows (1) and (2).

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  For secure rooms or areas (*containing inspectable SIPRNet as well as other classified systems assets) the following standards must be used: 

  1. Window placement in secure rooms must be minimal. There must be no large or entirely glass walls. Where windows are located on the exterior of secure rooms (AKA: collateral classified open storage areas) the vulnerabilities, existing and potential additional countermeasures, and residual risk associated with the windows must be considered in an assessment of risk for the secure room. NOTE that a risk assessment is required for all secure rooms IAW DOD Manual 5200.01, Volume 3, Enclosure 3, paragraph 4.  

  2. Windows that are less than 18 feet above the ground measured from the bottom of the window, or are easily accessible by means of objects directly beneath the windows, shall be constructed from or covered with materials that provide protection from forced entry. The protection provided to the windows need be no stronger than the strength of the contiguous walls. Hurricane-rated windows, ballistic-proof windows, non-opening double- or triple-pane windows, etc., should be considered acceptable as equivalent to contiguous walls. Welded steel bars attached to the structure surrounding the window may also be used for hardening windows that are not as strong as the contiguous walls (e.g., single pane glass). 

  3. As an alternative to hardening windows (that are not as strong as the contiguous walls) with welded steel bars, secure rooms that are located within an access-controlled installation or compound may eliminate the requirement for forced entry protection if the following countermeasures are taken: All windows within 18 feet of ground level, that are capable of being opened from inside the protected space, shall make the windows inoperable either by permanently sealing them or equipping them on the inside with a locking mechanism and also protecting them by an IDS, either independently (e.g., glass break sensors) or by motion detection sensors in the space.

  4. Windows will be covered with curtains or screens or will otherwise limit visibility into the secure room space when classified equipment, documents, or media can be viewed from outside the area.

check_text:
  For secure rooms or areas (*containing inspectable SIPRNet as well as other classified systems assets) check windows as follows: 

  1. Window placement in secure rooms should be minimal. Ideally, there should be no large or entirely glass walls; although this will not automatically result in a finding if the glass is hardened to the same degree as the contiguous walls and properly obscured from outside viewing. Where windows are located on the exterior of secure rooms (AKA: collateral classified open storage areas) the vulnerabilities, existing and potential additional countermeasures, and residual risk associated with the windows must be considered in an assessment of risk for the secure room. NOTE that a risk assessment is required for all secure rooms IAW DOD Manual 5200.01, Volume 3, Enclosure 3, paragraph 4.  

  2. Windows that are less than 18 feet above the ground measured from the bottom of the window, or are easily accessible by means of objects directly beneath the windows shall be constructed from or covered with materials that provide protection from forced entry. The protection provided to the windows need be no stronger than the strength of the contiguous walls. Hurricane rated windows, ballistic proof windows, non-opening double or triple pane windows, etc. should be considered acceptable as equivalent to contiguous walls. Welded steel bars attached to the structure surrounding the window may also be used for hardening windows that are not as strong as the contiguous walls (e.g., single pane glass). 

  3. As an alternative to hardening windows (that are not as strong as the contiguous walls) with welded steel bars; secure rooms that are located within an access controlled installation or compound may eliminate the requirement for forced entry protection if the following countermeasures are taken: All windows within 18 feet of ground level, that are capable of being opened from inside the protected space shall make the windows inoperable either by permanently sealing them or equipping them on the inside with a locking mechanism and also protecting them by an IDS, either independently (e.g., glass break sensors) or by motion detection sensors in the space. 

  4. Windows will be covered with curtains, screens or otherwise limit visibility into the secure room space when classified equipment, documents or media can be viewed from outside the area.

  TACTICAL ENVIRONMENT: This check is applicable where secure rooms are used to protect classified materials or systems. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254800
rule_id: IS-02.01.06_rule
severity: CAT I
title: Information Security (INFOSEC) ‐ Vault Storage/Construction Standards
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: For vaults containing inspectable SIPRNet assets check with supporting Facility Engineers to ensure it is properly constructed IAW one of the following two specifications: 1. As a Class A vault (concrete poured‐in‐place) built to Federal Standard (FED STD) 832 and specifically check/validate the following: a. Floor and Walls. Eight inches of reinforced concrete. Walls are to extend to the underside of the roof slab above. b. Roof/True Ceiling. Monolithic reinforced‐concrete slab of thickness to be determined by structural requirements, but not less than the floors and walls. c. “True" vaults must have a Class 5 Vault Door and Frame and be fitted with an FF‐L‐2740 combination lock. The vault door and frame unit must conform to Federal Specification AA‐D‐600 Class 5 vault door with lock meeting Federal Specification FF‐L‐2740. Ensure it is not an armory vault door, which should have a GSA label (silver with red letters) stating that it is a "GSA Approved Armory Vault Door". AN ARMORY DOOR IS NOT APPROVED FOR CLASSIFIED STORAGE ‐ AA&E STORAGE ONLY. The "proper “security vault door label reads "GSA Approved Security Vault Door" (label also silver with red letters). The difference between the two doors is that armory vault doors are fitted with Federal Specification FFL‐2937 mechanical combination locks. Facility Engineer (FE) construction certificates or other documentation should be requested to ensure construction standards are met. Often these certificates are posted on the inside of the vault near the door. 2. As a Class B vault (GSA‐approved modular vault) meeting Federal Specification AA‐V‐2737, Modular Vault Systems, April 25, 1990, with Amendment 2, October 30, 2006. NOTE: Here again, normally FE certification documentation will be posted within the vault, but it is OK if such documentation is on file elsewhere at the site. The DoD Lock Program WEB Portal provides detailed specifications for vaults and ordering instructions for doors. Available through DoD Lock Program at the Documents, Federal Specifications tab for Federal Specifications or Documents, Directives and Guidance tab for Federal Standards and Military Handbooks: https://locks.navfac.navy.mil TACTICAL ENVIRONMENT: This check is applicable where vaults are used to protect classified materials or systems in a tactical environment.

check_text:
  Check Content: For vaults containing inspectable SIPRNet assets check with supporting Facility Engineers to ensure it is properly constructed IAW one of the following two specifications: 1. As a Class A vault (concrete poured‐in‐place) built to Federal Standard (FED STD) 832 and specifically check/validate the following: a. Floor and Walls. Eight inches of reinforced concrete. Walls are to extend to the underside of the roof slab above. b. Roof/True Ceiling. Monolithic reinforced‐concrete slab of thickness to be determined by structural requirements, but not less than the floors and walls. c. “True" vaults must have a Class 5 Vault Door and Frame and be fitted with an FF‐L‐2740 combination lock. The vault door and frame unit must conform to Federal Specification AA‐D‐600 Class 5 vault door with lock meeting Federal Specification FF‐L‐2740. Ensure it is not an armory vault door, which should have a GSA label (silver with red letters) stating that it is a "GSA Approved Armory Vault Door". AN ARMORY DOOR IS NOT APPROVED FOR CLASSIFIED STORAGE ‐ AA&E STORAGE ONLY. The "proper “security vault door label reads "GSA Approved Security Vault Door" (label also silver with red letters). The difference between the two doors is that armory vault doors are fitted with Federal Specification FFL‐2937 mechanical combination locks. Facility Engineer (FE) construction certificates or other documentation should be requested to ensure construction standards are met. Often these certificates are posted on the inside of the vault near the door. 2. As a Class B vault (GSA‐approved modular vault) meeting Federal Specification AA‐V‐2737, Modular Vault Systems, April 25, 1990, with Amendment 2, October 30, 2006. NOTE: Here again, normally FE certification documentation will be posted within the vault, but it is OK if such documentation is on file elsewhere at the site. The DoD Lock Program WEB Portal provides detailed specifications for vaults and ordering instructions for doors. Available through DoD Lock Program at the Documents, Federal Specifications tab for Federal Specifications or Documents, Directives and Guidance tab for Federal Standards and Military Handbooks: https://locks.navfac.navy.mil TACTICAL ENVIRONMENT: This check is applicable where vaults are used to protect classified materials or systems in a tactical environment.


vuln_id: V-245801
rule_id: SV-245801r1138439_rule
severity: CAT I
title: Information Security (INFOSEC) - Secure Room Storage Standards - Intrusion Detection System (IDS)
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to meet standards for maintenance and validation of structural integrity of the physical perimeter surrounding a secure room (AKA: collateral classified open storage area) IAW DOD Manual 5200.01, Volume 3, could result in the undetected loss or compromise of classified material. Using a physical intrusion detection system enables immediate detection of attempted and/or actual intrusion into a secure room space. This is often the best supplemental protective measure (vice using 4-hour random checks) due to providing capability for immediate detection, and for immediate response to assess and counter the threat to the secure room space. Use of 4-hour checks may be adequate if supported by a risk assessment, but will not provide the immediate detection and response capability of a properly installed IDS. It is required that a risk assessment be conducted to determine which of these two intrusion detection methods (use of IDS OR 4-hour random checks) is appropriate for any particular location.

  REFERENCES:

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraphs 24.j. and 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: 
  MP-4, PE-3, PE-5 and PE-6

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Encl 3, paragraphs 3.a.(3), 3.b.(1), 3.b.(3)(a)&(b) and paragraph 4.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  1. All secure rooms (AKA: collateral classified open storage areas) that afford access to classified SIPRNet as well as other classified systems equipment (servers, routers, switches, comm equipment, work stations, DASD) must be protected by an Intrusion Detection System (IDS) unless continuously occupied. 

  IMPORTANT NOTE: Random checks not exceeding four hours are an allowable alternative to IDS ONLY if supported by a valid risk assessment and security-in-depth. 

  Random checks and risk analysis are each covered as separate requirements elsewhere in this document. This particular requirement for IDS is Not Applicable (NA) if random checks are properly conducted and are supported by the risk analysis and security-in-depth approved by the senior agency (security) official in writing.

  2. Prior to the installation of an IDS, the site must perform a risk analysis to determine the threat, vulnerabilities, security-in-depth countermeasures, the acceptability of risk, potential cost savings, procedural requirements, and potential cost of additional manpower associated with random checks of each secure room as an alternative to IDS. 

  3. Security-in-Depth for each secure room must be approved *in writing* by the CC/S/A senior agency official (senior official for security) 

  In summary: An IDS must be used as a supplemental protective measure AND it must be supported both by a valid risk assessment AND security-in-depth as approved in writing by the senior agency official.

check_text:
  Background Details:
   
  Except for storage in a GSA-approved container (AKA: safe) or a vault built to FED STD 832, one of the following supplemental controls is required for secure rooms or areas containing SIPRNet as well as other classified (secret) assets, provided the CC/S/A senior agency official determines in writing that security-in-depth exists:
   
  (1) Inspection of the container or open storage area every four hours by an employee cleared at least to the Secret level; or 
  (2) An IDS with the personnel responding to the alarm arriving within 30 minutes of the alarm annunciation.

  IMPORTANT NOTE: Random checks not exceeding 4-hours are an allowable alternative to IDS ONLY if supported by a valid risk assessment. 

  Prior to the installation of an IDS, the site shall perform a risk analysis to determine the threat, vulnerabilities, security-in-depth countermeasures, the acceptability of risk, potential cost savings, procedural requirements, and potential cost of additional manpower associated with random checks of the secure room as an alternative to IDS. 

  Random checks and risk analysis are each covered as separate checks elsewhere in this checklist. 

  This particular check for IDS is Not Applicable (NA) if random checks are properly conducted and are supported by the risk analysis and security-in-depth approved by the senior agency official in writing.

  In summary this check is to validate an IDS is being used AND that it is supported by a valid risk assessment AND security-in-depth approved by the senior agency official in writing. 
   
  Checks: 

  1. Check to ensure that all secure rooms/classified open storage areas that afford access to classified SIPRNet equipment (servers, routers, switches, comm equipment, work stations, DASD, etc...) are protected by an Intrusion Detection System (IDS) *unless continually occupied. (CAT I)

  2. Where IDS is being used check to ensure that its use is supported by both a RISK ASSESSMENT and a SECURITY-IN-DEPTH DETERMINATION * (Security-In-Depth Determination must IN WRITING by the C/S/A senior agency (security) official) that specifically addresses the secure room or open storage space. (CAT II) 

  TACTICAL ENVIRONMENT: This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254802
rule_id: IS-02.01.08_rule
severity: CAT I
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
title:
  Information Security (INFOSEC) ‐ Secure Room Storage Standards ‐ Balanced Magnetic Switch
  (BMS) on Perimeter Doors

description:
  Severity Override Guidance: Default severity level is a CAT I: Secure Rooms containing SIPRNet assets that use an Intrusion Detection System (IDS) do not have all doors (primary and secondary) monitored with an alarm contact. Reduction to CAT II: Secure Rooms containing SIPRNet assets using an IDS have all doors monitored with alarm contacts; however, the alarm contacts are not Balanced Magnetic Switches (BMS) meeting UL Standard 634. This particular requirement for BMS (IS‐02.01.08) can only be used when the IDS requirement (IS‐02.01.07) is the supplemental control selected for secure rooms. It is not applicable (NA) if the requirement for 4‐hour random checks (IS‐02.01.10) is used in lieu of IS‐02.01.07. Check Content: Where an IDS is used in lieu of 4‐hour random checks, for secure rooms or collateral classified open storage areas containing SIPRNet assets, each perimeter door (primary and secondary) shall be protected by a balanced magnetic switch (BMS) that meets the standards of UL 634. NOTE: Ensure the alarm contact is an actual BMS, which is defined as a "Triple Biased" alarm contact. Introduction of a foreign magnet by an intruder in an attempt to defeat the BMS will result in an alarm being sent. If used, Simple and Dual Biased contacts are not BMS and will result in a CAT II finding. No alarm contacts on all doors is a CAT I finding. TACTICAL ENVIRONMENT: This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.

check_text:
  Severity Override Guidance: Default severity level is a CAT I: Secure Rooms containing SIPRNet assets that use an Intrusion Detection System (IDS) do not have all doors (primary and secondary) monitored with an alarm contact. Reduction to CAT II: Secure Rooms containing SIPRNet assets using an IDS have all doors monitored with alarm contacts; however, the alarm contacts are not Balanced Magnetic Switches (BMS) meeting UL Standard 634. This particular requirement for BMS (IS‐02.01.08) can only be used when the IDS requirement (IS‐02.01.07) is the supplemental control selected for secure rooms. It is not applicable (NA) if the requirement for 4‐hour random checks (IS‐02.01.10) is used in lieu of IS‐02.01.07. Check Content: Where an IDS is used in lieu of 4‐hour random checks, for secure rooms or collateral classified open storage areas containing SIPRNet assets, each perimeter door (primary and secondary) shall be protected by a balanced magnetic switch (BMS) that meets the standards of UL 634. NOTE: Ensure the alarm contact is an actual BMS, which is defined as a "Triple Biased" alarm contact. Introduction of a foreign magnet by an intruder in an attempt to defeat the BMS will result in an alarm being sent. If used, Simple and Dual Biased contacts are not BMS and will result in a CAT II finding. No alarm contacts on all doors is a CAT I finding. TACTICAL ENVIRONMENT: This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254803
rule_id: IS-02.01.09_rule
severity: CAT I
title: Information Security (INFOSEC) ‐ Secure Room Storage Standards ‐ Interior Motion Detection
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Severity Override Guidance: The default severity level for a finding is CAT I for either no motion detection or lack of adequate interior motion detection (defined as when classified SIPRNet assets are not directly covered by motion detection) or the employment of motion detection sensors is not addressed in the organizations risk assessment or placement of motions sensors is not IAW the risk assessment considerations. There is no mitigation provided for reduction to a CAT II or CAT III severity level. Check Content: The following applies where IDS is used in lieu of 4‐hour random checks, for secure rooms or collateral classified open storage areas containing SIPRNet assets: Checks: 1. Check at sites where IDS is being used and: ‐ There is NO RISK ASSESSMENT approved by the Component Authorizing Official (AO) or ‐ The risk assessment does not specifically provide a detailed evaluation of the need for motion sensor employment, including a thorough assessment of the most effective and efficient methods for employment of motion detection and/or ‐ There is NO SECURITY‐IN‐DEPTH DETERMINATION *IN WRITING by the CC/S/A Senior Agency Official (SAO)(Security/INFOSEC) that considers factors contained in the risk assessment and specifically focuses on the collateral classified secure room/open storage space: Check to ensure that secure rooms or areas where classified SIPRNet equipment and/or associated media is stored in the open is protected with interior motion detection sensors; e.g., ultrasonic and passive infrared, during times when the specific area containing the classified material is closed or not under continuous observation and control by a cleared employee. Use of dual technology sensors is authorized when one technology transmits an alarm condition independently from the other technology. A failed detector shall cause an immediate and continuous alarm condition. Employment of motion detectors need not cover 100% of the entire secure room space (although that is recommended) but shall minimally (directly) cover any SIPRNet assets (equipment or media) that are accessible (not stored within a GSA approved container (safe)) within the secure room or area. 2. Where a proper risk assessment signed by the AO, which specifically considers both the number and employment (positioning) of motion sensors in the secure room space and a supporting Security‐in‐Depth Determination signed by the SAO are both available: Check that motion sensors are either employed to directly cover all areas within the secure room containing SIPRNet assets OR that motion sensors are employed in the secure room space as specifically detailed in the risk assessment. NOTE: Unless adequately detailed and justified in the risk assessment, motion detectors placed to cover only doors that are protected with BMS alarm contacts are not sufficient to meet this requirement/check. TACTICAL ENVIRONMENT: This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.

check_text:
  Severity Override Guidance: The default severity level for a finding is CAT I for either no motion detection or lack of adequate interior motion detection (defined as when classified SIPRNet assets are not directly covered by motion detection) or the employment of motion detection sensors is not addressed in the organizations risk assessment or placement of motions sensors is not IAW the risk assessment considerations. There is no mitigation provided for reduction to a CAT II or CAT III severity level. Check Content: The following applies where IDS is used in lieu of 4‐hour random checks, for secure rooms or collateral classified open storage areas containing SIPRNet assets: Checks: 1. Check at sites where IDS is being used and: ‐ There is NO RISK ASSESSMENT approved by the Component Authorizing Official (AO) or ‐ The risk assessment does not specifically provide a detailed evaluation of the need for motion sensor employment, including a thorough assessment of the most effective and efficient methods for employment of motion detection and/or ‐ There is NO SECURITY‐IN‐DEPTH DETERMINATION *IN WRITING by the CC/S/A Senior Agency Official (SAO)(Security/INFOSEC) that considers factors contained in the risk assessment and specifically focuses on the collateral classified secure room/open storage space: Check to ensure that secure rooms or areas where classified SIPRNet equipment and/or associated media is stored in the open is protected with interior motion detection sensors; e.g., ultrasonic and passive infrared, during times when the specific area containing the classified material is closed or not under continuous observation and control by a cleared employee. Use of dual technology sensors is authorized when one technology transmits an alarm condition independently from the other technology. A failed detector shall cause an immediate and continuous alarm condition. Employment of motion detectors need not cover 100% of the entire secure room space (although that is recommended) but shall minimally (directly) cover any SIPRNet assets (equipment or media) that are accessible (not stored within a GSA approved container (safe)) within the secure room or area. 2. Where a proper risk assessment signed by the AO, which specifically considers both the number and employment (positioning) of motion sensors in the secure room space and a supporting Security‐in‐Depth Determination signed by the SAO are both available: Check that motion sensors are either employed to directly cover all areas within the secure room containing SIPRNet assets OR that motion sensors are employed in the secure room space as specifically detailed in the risk assessment. NOTE: Unless adequately detailed and justified in the risk assessment, motion detectors placed to cover only doors that are protected with BMS alarm contacts are not sufficient to meet this requirement/check. TACTICAL ENVIRONMENT: This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254804
rule_id: IS-02.01.10_rule
severity: CAT I
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
title:
  Information Security (INFOSEC) ‐ Secure Room Storage Standards ‐ Four (4) Hour Random
  Checks in Lieu of Using Intrusion Detection System (IDS)

description:
  Checks: Check #1. Use of random checks in lieu of IDS must be supported by a valid risk assessment (addressing each secure room or area) that specifically considers the threat, vulnerabilities, security‐in‐depth countermeasures, acceptability of risk, potential cost savings, procedural requirements, and potential cost of additional manpower associated with random checks of the secure areas ‐ as an alternative to IDS. Check #2. The frequency of random checks shall not exceed 4‐hours when the secure area space is not attended. Check #3. Checks must be conducted by guards/employees who are cleared to at least the Secret level. Check #4. Checks will be conducted of each door (primary and all secondary), each window, and each opening exceeding 96 square inches (which are required to be protected with either bars, expanded metal grills, commercial metal sounds baffles) to ensure they are properly secured. Additionally all traversable space surrounding the exterior of the Secure Room should be viewed by the checker by walking around the entire perimeter. Check #5. Checks must be supported by written procedures/instructions for the checkers and results of checks must be recorded. Check #6. Locally developed checklists or the Standard Form (SF) 701 must be used to document checks. Completed checklists should be maintained on‐hand for at least 90‐days as an audit trail or indefinitely if discrepancies were noted during any checks. It is important to note that random checks are an allowable alternative to IDS *ONLY* if supported by a valid risk assessment AND security‐in‐depth countermeasures as determined in writing by the C/S/A senior security official. Otherwise this is a finding. Use of IDS and risk analysis are each covered as separate checks elsewhere in this document. This particular check (random checks of secure rooms) is Not Applicable (NA) if IDS is used. In summary this check must validate that random checks not exceeding 4‐hours are being used AND that it is supported by a valid risk assessment along with security‐in‐depth countermeasures. TACTICAL ENVIRONMENT: This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.

check_text:
  Checks: Check #1. Use of random checks in lieu of IDS must be supported by a valid risk assessment (addressing each secure room or area) that specifically considers the threat, vulnerabilities, security‐in‐depth countermeasures, acceptability of risk, potential cost savings, procedural requirements, and potential cost of additional manpower associated with random checks of the secure areas ‐ as an alternative to IDS. Check #2. The frequency of random checks shall not exceed 4‐hours when the secure area space is not attended. Check #3. Checks must be conducted by guards/employees who are cleared to at least the Secret level. Check #4. Checks will be conducted of each door (primary and all secondary), each window, and each opening exceeding 96 square inches (which are required to be protected with either bars, expanded metal grills, commercial metal sounds baffles) to ensure they are properly secured. Additionally all traversable space surrounding the exterior of the Secure Room should be viewed by the checker by walking around the entire perimeter. Check #5. Checks must be supported by written procedures/instructions for the checkers and results of checks must be recorded. Check #6. Locally developed checklists or the Standard Form (SF) 701 must be used to document checks. Completed checklists should be maintained on‐hand for at least 90‐days as an audit trail or indefinitely if discrepancies were noted during any checks. It is important to note that random checks are an allowable alternative to IDS *ONLY* if supported by a valid risk assessment AND security‐in‐depth countermeasures as determined in writing by the C/S/A senior security official. Otherwise this is a finding. Use of IDS and risk analysis are each covered as separate checks elsewhere in this document. This particular check (random checks of secure rooms) is Not Applicable (NA) if IDS is used. In summary this check must validate that random checks not exceeding 4‐hours are being used AND that it is supported by a valid risk assessment along with security‐in‐depth countermeasures. TACTICAL ENVIRONMENT: This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254805
rule_id: IS-02.01.11_rule
severity: CAT I
title: Vault/Secure Room Storage Standards ‐ IDS Transmission Line Security
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: Explanation of requirement: Transmission lines used to carry IDS sensor alarm signals between secure rooms or areas containing SIPRNet assets and IDS monitoring equipment, shall have line supervision. If all portions of an IDS transmission line (protecting SIPRNet assets) are run within secret or higher secure area space or secret or higher controlled access area (CAA) spaces it will not require line supervision.

check_text:
  Check Content: Explanation of requirement: Transmission lines used to carry IDS sensor alarm signals between secure rooms or areas containing SIPRNet assets and IDS monitoring equipment, shall have line supervision. If all portions of an IDS transmission line (protecting SIPRNet assets) are run within secret or higher secure area space or secret or higher controlled access area (CAA) spaces it will not require line supervision.


vuln_id: V-254806
rule_id: IS-02.01.12_rule
severity: CAT I
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
title:
  Vault/Secure Room Storage Standards ‐ IDS Access/Secure Control Units Must be Located
  within the Secure Room Space

description:
  Check Content: Requirement Explanation: Alarm sensor control units must be located inside the secure area and should be located near the primary entrance for ease of accessing and securing alarm sensors in the space. Only assigned personnel with proper security clearances and need‐to‐know should initiate changes in access and secure status. Check: Check to ensure that no capability exists to allow changing the access/secure status of the IDS from a location outside the protected area (secure room or vault). TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.

check_text:
  Check Content: Requirement Explanation: Alarm sensor control units must be located inside the secure area and should be located near the primary entrance for ease of accessing and securing alarm sensors in the space. Only assigned personnel with proper security clearances and need‐to‐know should initiate changes in access and secure status. Check: Check to ensure that no capability exists to allow changing the access/secure status of the IDS from a location outside the protected area (secure room or vault). TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-245807
rule_id: SV-245807r1138490_rule
severity: CAT I
title: Information Security (IS) - Continuous Operations Facility: Access Control Monitoring Methods
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-12 15:36:38
description:
  <VulnDiscussion>Failure to control door access to a Continuous Operations Facility containing classified SIPRNET assets may result in immediate and potentially undetected access to classified information, with no capability to immediately alert response forces. Ultimately this could result in the undetected loss or compromise of classified material, especially SIPRNet.

  USE CASE EXPLANATION:

  A Continuous Operations Facility functions 24/7 and contains classified SIPRNet equipment and/or media. It often does not meet all the physical and/or procedural requirements of a vault or secure room (AKA: collateral classified open storage area) and the classified equipment and/or media may not be stored in an approved safe when not in use. Examples of such facilities are Emergency Operations Centers (EOC), Information System Monitoring Centers, Trouble Desk Centers, etc. All standards for access control monitoring for Continuous Operations Facilities are found in the DOD Manual 5200.01, V3, and this STIG Requirement/Rule (Method 1/Check 5, Method 2/Check 6, Method 3/Check 5, Method 4/Check 5, Method 5/Check 6) provides additional clarification and implementation standards for all Continuous Operations Facilities containing SIPRNet assets.

  Continuous Operations Facilities are not routinely closed and secured after normal business hours and reopened at the beginning of normal workdays.  A CONTINUOUS OPERATIONS FACILITY MUST BE CONTINUOUSLY OCCUPIED at all times, OR IT MUST MEET ALL PHYSICAL STRUCTURAL AND PROCEDURAL STANDARDS FOR A SECURE ROOM AND BE SECURED (*using an approved FF-L-2740 combination lock) DURING PERIODS WHEN IT IS NOT OCCUPIED. It is not necessary to activate the supplemental controls (IDS or 4-hour checks) when securing the facility using the FF-L-2740 lock during working hours. However, this must be done if the facility is formally closed at any time and will include End-of-Day (EOD) checks.  A "facility" can be a single room or a larger contiguous area, often (but not always) without Federal Specification FF-L-2740 combination locks on the primary access door. Continuous Operations area access control procedures must meet the requirements herein even where the surrounding area is continuously occupied. Continuous Operations (again - continuous occupancy) minimizes or eliminates the need for/use of certain security measures such as FF-L-2740 combination locks, standard door locks, IDS, 4-hour guard checks, etc.

  Where there is a Continuous Operations Facility there should be demonstrated mission need for continuous occupation of the "specific" room or area containing the classified SIPRNet assets. A justification that the surrounding building or facility is continuously occupied is not acceptable. If this is observed, reviewers should consider the possibility that the stated requirement for a Continuous Operations Facility is being used to cover deficiencies with what should legitimately be established as a secure room or vault. In such cases the use of Traditional Security STIG. Requirements and applicable physical and procedural standards for vaults and/or secure rooms may be more appropriate, resulting in findings under those requirements. (Method 1/Check 5, Method 2/Check 6, Method 3/Check 5, Method 4 /Check 5, and Method 5/Check 6).

  A Continuous Operations Facility containing classified materials is most appropriate when it is continuously occupied by properly cleared employees (or others with security clearance and a need-to-know) who are capable of controlling or monitoring ingress and egress from within the area. This provides the most legitimate justification for using a Continuous Operations Facility vice using a properly constructed and access controlled vault or secure room (AKA: collateral classified open storage area). Convenience and ease of access is not proper justification for a Continuous Operations Facility.

  Continuous Operations Facility door control may be accomplished multiple ways. There are five main types of access control methods listed below. One or more of the five methods may apply to any facility. Each access point must comply with one or more of the methods of access control for 24 hours of each operational day. Any deficiency for any facility access point (even for a portion of the day for an access point) will result in a finding under this STIG rule. All Continuous Operations Facilities access points should be checked for proper access control according to the type of access control method(s) implemented.

  Direct access control monitoring for both occupied and unoccupied Continuous Operations Facilities is conducted by: cleared employees, guards or receptionists located inside the area or directly outside the area. A properly configured Automated Entry Control System (AECS) or continuously monitored Closed Circuit Television (CCTV) are the only options for indirect monitoring of Continuous Operations Facilities.

  The five basic methods for controlling access to Continuous Operations Facilities are:

  1. Method #1: Use of an Automated Entry Control System (AECS) Card Reader with Biometrics or Personal Identification Number (PIN)

  2. Method #2: Access Continually Monitored by Occupants (Cleared Employees) of the Continuous Operations Facility - all doors NOT visible

  3. Method #3: Access Monitored by Occupants (Cleared Employees) of the Continuous Operations Facility - all doors are visible

  4. Method #4: Access Monitored by Employees Directly Outside the Open Storage Space - all doors MUST BE visible

  5. Method #5: Access Monitored by Closed Circuit Television (CCTV) reporting to a Central Monitoring Station Staffed 24/7 by cleared Guards or Other cleared Security Professionals - each individual door MUST HAVE a CCTV camera(s)

  Normally only one method of access control will be applicable to a specific Continuous Operations Facility; however, there may be situations where more than one approved method is being used at a single facility. For instance an Automated Entry Control System (AECS) with card reader and PIN may be used to secure the access door while there are also employees located inside the room who can monitor and control access. In situations where multiple methods are found, reviewers need only choose one of the five to evaluate compliance and its effectiveness of access control to the Continuous Operations Facility. If one of the methods is found to be totally compliant while others in use contain deficiencies, the method that is 100% compliant should be selected for use during the review. In the example just provided, if the room is only occupied by one employee who is monitoring access and during breaks or for other reasons exits the room for periods of time this would cause a significant deficient condition since the access door is not continuously monitored by the employee. Therefore using the AECS as the method to evaluate access control for the Continuous Operations Facility would likely be selected since it appears to be (and for this example we will assume) 100% compliant.

  There is also a possibility that multiple Continuous Operations Facilities could be found at a particular site location (even in the same building) that are using different methods to control access. Once again, multiple methods of access control from the list of five could be selected for the evaluation, based on the access control methods actually being used for the various 24/7Continuous Operations Facilities.

  Once the applicable Continuous Operations Facility access control methods that apply to each of the Continuous Operations Facilities at the site are selected, the site must comply with all of the individual checks for the selected method(s). Specific checks for requirements associated with a method of access control are found in the Check Content information field.

  If there is no Continuous Operations Facility at a particular site this Requirement is Not Applicable (NA) for a review.

  REFERENCES:

  The Information Security Oversight Office (ISOO): http://www.archives.gov/isoo/  Implementing Directive for Protection of Classified (for Executive Order 13526), 32 CFR Parts 2001 and 2003 Classified National Security Information: paragraph 2001.43 Storage, (2) Secret.

  CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure C, paragraphs 24.j. and 34.

  NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: MP-4, PE-2, PE-3, PE-5 and PE-6

  DOD Manual 5200.01, Volume 3, SUBJECT: DOD Information Security Program: Protection of Classified Information: Specific paragraph references are individually annotated with each specific check - under the "Checks" section.

  32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Continuous Operations Facilities storing classified SIPRNet and other classified systems assets in the open are not routinely opened or closed using Federal Specification FF-L-2740 combination locks due to being continuously occupied by cleared employees or due to very frequent access requirements for operational reasons.

  As applicable to the operating environment at a particular site/location, select one or more of the five Methods of Access Control to be used for 24/7 Continuous Operations Facilities. The five methods of access control along with specific requirements/checks are found in the Check Content of this Requirement.

  More than one method of access control might apply to a particular Continuous Operations Facility or to multiple Continuous Operations Facilities at a single site/location. 

  Based on the access control method(s) used for each individual Continuous Operations Facility at a site, comply with all of the requirements detailed in all of the individual checks applicable to the selected method(s) of access control. Compliance with at least one complete set of checks applicable to a particular method of access control is required for each Continuous Operations Facility.

check_text:
  Unless otherwise indicated all the paragraph citations preceding each check are from DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information.

  The following set of 5 checks for Continuous Operations Access Control Monitoring Method #1 is to be used when an Automated Entry Control System (AECS) Card Reader with Biometrics or Personal Identification Number (PIN) is the primary means of access control to the Continuous Operations Facility:

  Method 1/Check #1. Appendix to Enclosure 3, para 3.a.(2)(a); para 3.a.(2)(b); para 3.a.(3); para 3.a.(4) -- Check to ensure an Automated Entry Control System (AECS) is used that incorporates a coded ID card or badge PLUS either a PIN or Biometrics on both the primary entrance and all secondary doors that may be used for continuous or intermittent access to the secure room space. (CAT I)

  Method 1/Check #2. Appendix to Enclosure 3, para 2.d.(6); para 2.f.(2)& para 3.a. -- Check to ensure the AECS is controlled and monitored at a continuously manned central monitoring station. (CAT I)

  Method 1/Check #3. Enclosure 3, para 3 & para 12; Appendix to Enclosure 3, para 2.e(6); Enclosure 2, para 2; -- If there is no IDS employed (*which must be based on a documented risk assessment) on doors or other man-passable openings: Check to ensure the 24/7 secure rooms or collateral secret open storage areas (containing SIPRNet equipment) are continuously occupied by at least one properly cleared employee. (CAT I)

  Method 1/Check #4. Appendix to Enclosure 3, para 2.e(6) -- If there is no Intrusion Detection System (IDS) employed in the Continuous Operations Facility: Check to ensure that a duress device is available for occupants inside the facility, IF DETERMINED NECESSARY BY A DOCUMENTED RISK ASSESSMENT (RA). If there is no duress device and no RA to validate that there is no need for duress, it is a finding. (CAT II)

  Method 1/Check #5. Enclosure 3, para 3.b.(3)(a) & (b)-- Where there is no IDS employed in the Continuous Operations Facility and ALL classified (SIPRNet) equipment, devices and media are not under the direct continuous observation and control of area occupants (CLEARED EMPLOYEES): Check to ensure a system of checks of classified assets (especially SIPRNet connected assets) internal to the Continuous Operations Facility, not exceeding 4 hours is established and conducted. (CAT I)

  XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

  The following set of 6 checks for Continuous Operations Access Control Monitoring Method #2 is to be used Access is Continuously Monitored by Occupants (Cleared Employees) of the Continuous Operations Facility - all doors are NOT visible - is the primary means of access control to the Continuous Operations Facility:

  Method 2/Check #1. Appendix to Enclosure 3, para 2.e(6) - When cleared occupants cannot directly and continuously observe all potential entrances into the room, check to ensure an open door alerting system is used to alert occupants of the 24/7 continuous operations. The alerting system MUST cover all access points that cannot be observed by occupants including the primary entrance and all secondary doors that could be used for continuous or intermittent access. (CAT I)

  Method 2/Check #2. Enclosure 3, para 3 & para 12; Appendix to Enclosure 3, para 2.e(6); Enclosure 2, para 2 -- Check to ensure the 24/7 Continuous Operations Facility is "continuously occupied" by at least one properly cleared employee. (CAT I)

  Method 2/Check #3. Appendix to Enclosure 3, para 3.a.(2)(a); para 3.a.(2)(b); para 3.a.(3); para 3.a.(4)-- On those doors not visible to cleared occupants: Check to ensure that an Automated Entry Control System (AECS) is used that incorporates both a coded ID card or badge plus either a PIN or Biometrics. This requirement is for all doors that are not continuously visible including the primary entrance and all secondary doors that may be used for continuous or intermittent access. (CAT I)

  Method 2/Check #4. Appendix to Enclosure 3, para 3.a. & para 3.c. -- Check to ensure doors that are continuously visible to cleared occupants are access controlled minimally by either an AECS using swipe or proximity cards (*not required to have PIN or biometric verification) OR by Electric, Mechanical, or Electromechanical Access Control Devices IAW the specifications of DOD Manual 5200.01, Volume 3, Appendix to Enclosure 3, para 3.c... (CAT I)

  Method 2/Check #5. Appendix to Enclosure 3, para 2.e(6) -- If there is no IDS employed in the Continuous Operations Facility: Check to ensure that a duress device is available for occupants inside the facility, IF DETERMINED NECESSARY BY A DOCUMENTED RISK ASSESSMENT (RA). If there is no duress device and no RA to validate that there is no need for duress, it is a finding. (CAT II)

  Method 2/Check #6. Enclosure 3, para 3.b.(3)(a) & (b) -- Where there is no IDS employed in the Continuous Operations Facility and ALL classified (SIPRNet) equipment, devices and media are not under the direct continuous observation and control of area occupants (CLEARED EMPLOYEES): Check to ensure a system of checks of classified assets (especially SIPRNet connected assets) internal to the Continuous Operations Facility, not exceeding 4 hours is established and conducted. (CAT I)

  XXXXXXXXXXXXXXXXXXXX

  The following set of 5 checks for Continuous Operations Access Control Monitoring Method #3 is to be used when Access is Monitored by Occupants (Cleared Employees) of the Continuous Operations Facility and all doors are visible - is the primary means of access control to the Continuous Operations Facility:

  Method 3/Check #1. Enclosure 3, para 12; Appendix to Enclosure 3, para 3.a -- Check to ensure that cleared employees who work in the space just inside the Continuous Operations Facility have continuous visual observation of all primary entrance and all secondary doors that may be used for continuous or intermittent access. (CAT I)

  Method 3/Check #2. Enclosure 3, para 3 & para 12; Appendix to Enclosure 3, para 2.e(6); Enclosure 2, para 2; -- -- Check to ensure the 24/7 Continuous Operations Facility is "continuously occupied" by at least one properly cleared employee. (CAT I)

  Method 3/Check #3. Appendix to Enclosure 3, para 3.a. & para 3.c. -- Check to ensure doors that are continuously visible to cleared occupants are access controlled minimally by either an AECS using swipe or proximity cards (*not required to have PIN or biometric verification) OR by Electric, Mechanical, or Electromechanical Access Control Devices IAW the specifications of DOD Manual 5200.01, Volume 3, Appendix to Enclosure 3, para 3.c... (CAT I)

  Method 3/Check #4. Appendix to Enclosure 3, para 2.e(6)-- If there is no IDS employed in the Continuous Operations Facility: Check to ensure that a duress device is available for occupants inside the facility, IF DETERMINED NECESSARY BY A DOCUMENTED RISK ASSESSMENT (RA). If there is no duress device and no RA to validate that there is no need for duress, it is a finding. (CAT II)

  Method 3/Check #5. Enclosure 3, para 3.b.(3)(a) & (b) -- Where there is no IDS employed in the Continuous Operations Facility and ALL classified (SIPRNet) equipment, devices and media are not under the direct continuous observation and control of area occupants (CLEARED EMPLOYEES): Check to ensure a system of checks of classified assets (especially SIPRNet connected assets) internal to the Continuous Operations Facility, not exceeding 4 hours is established and conducted. (CAT I)

  XXXXXXXXXXXXXXXXXXX

  The following set of 5 checks for Continuous Operations Access Control Monitoring Method #4 is to be used when Access is Monitored by Cleared Employees Directly Outside the Continuous Operations Facility - all doors MUST BE visible - is the primary means of access control to the Continuous Operations Facility:

  Method 4/Check #1. Appendix to Enclosure 3, para 3.a. - Check to ensure that cleared employees who work in the space just outside the Continuous Operations Facility (containing SIPRNet equipment) are providing continuous visual observation of the primary entrance and all secondary doors that may be used for continuous or intermittent access. They must be continuously present with no gaps in coverage. (CAT I)

  Method 4/Check #2. Appendix to Enclosure 3, para 3.a. - Check to ensure that cleared employees working outside the Continuous Operations Facility are located directly adjacent to a particular door or set of doors being monitored and are informed concerning their specific responsibilities for monitoring door security/access control. Written procedures must be available to substantiate this. (CAT II)

  Method 4/Check #3. Appendix to Enclosure 3, para 3.a. & para 3.c.-- Check to ensure doors that are continuously visible and controlled by cleared employees directly outside the Continuous Operations Facility are access controlled minimally by either an AECS using swipe or proximity cards (*not required to have PIN or biometric verification) OR by Electric, Mechanical, or Electromechanical Access Control Devices IAW the specifications of DOD Manual 5200.01, Volume 3, Appendix to Enclosure 3, para 3.c... (CAT I)

  Method 4/Check #4. Appendix to Enclosure 3, para 2.e(6) - If there is no IDS employed in the Continuous Operations Facility: Check to ensure that a duress device is available for cleared employees monitoring door access from outside the facility, IF DETERMINED NECESSARY BY A DOCUMENTED RISK ASSESSMENT (RA). If there is no duress device and no RA to validate that there is no need for duress, it is a finding. (CAT II)

  Method 4/Check #5. Enclosure 3, para 3.b.(3)(a) & (b) -- Where there is no IDS employed in the Continuous Operations Facility and ALL classified (SIPRNet) equipment, devices and media are not under the direct continuous observation and control of occupants within the facility (CLEARED EMPLOYEES): Check to ensure a system of checks of classified assets (especially SIPRNet connected assets) internal to the Continuous Operations Facility, not exceeding 4 hours is established and conducted. (CAT I)

  XXXXXXXXXXXXXXXXXXX

  The following set of 6 checks for Continuous Operations Access Control Monitoring Method #5 is to be used when Access is Monitored by Closed Circuit Television (CCTV) reporting to a Central Monitoring Station Staffed 24/7 by cleared Guards or Other cleared Security Professionals - all doors MUST HAVE CCTV cameras - is the primary means of access control to the Continuous Operations Facility:

  Method 5/Check #1. Enclosure 3, para 12; Appendix to Enclosure 3, para 3.a.; para 2.d.(6)& para 2.f.(2) - Check to ensure ALL doors (primary and secondary) are actively monitored via CCTV by cleared guards at a central monitoring facility. (CAT I)

  Method 5/Check #2. Appendix to Enclosure 3, 3.a.(7) - Check to ensure that CCTV activity is recorded and maintained on file for a minimum of 90 days. (CAT II)

  Method 5/Check #3. Enclosure 3, para 12; Appendix to Enclosure 3, para 3.a. & para 2.f.(2) - Check to ensure that guards are continuously present at the monitoring location and informed concerning their specific responsibilities for monitoring and responding to potential unauthorized attempts to breach the Continuous Operations Facility. Written procedures must be available. (CAT I)

  Method 5/Check #4. Enclosure 3, para 3 & para 12; Appendix to Enclosure 3, para 2.e(6); Enclosure 2, para 2; - Check to ensure the 24/7 Continuous Operations Facilities are continuously occupied by at least one properly cleared employee. (CAT I)

  Method 5/Check #5. Appendix to Enclosure 3, para 3.a. & para 3.c. -- Check to ensure doors that are continuously visible and controlled by CCTV from directly outside the Continuous Operations Facility are access controlled minimally by either an AECS using swipe or proximity cards (*not required to have PIN or biometric verification) OR by Electric, Mechanical, or Electromechanical Access Control Devices IAW the specifications of DOD Manual 5200.01, Volume 3, Appendix to Enclosure 3, para 3.c... (CAT I)

  Method 5/Check #6. Enclosure 3, para 3.b.(3)(a) & (b) -- Where there is no IDS employed in the Continuous Operations Facility and ALL classified (SIPRNet) equipment, devices and media are not under the direct continuous observation and control of occupants within the facility (CLEARED EMPLOYEES): Check to ensure a system of checks of classified assets (especially SIPRNet connected assets) internal to the Continuous Operations Facility, not exceeding 4 hours is established and conducted. (CAT I)

  TACTICAL ENVIRONMENT: The 5 sets of monitoring methods and associated checks are applicable where Continuous Operations Facilities are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254808
rule_id: IS-02.01.14_rule
severity: CAT I
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
title:
  Vault/Secure Room Storage Standards ‐ Access Control During Working Hours Using Visual
  Control OR Automated Entry Control System (AECS) with PIN / Biometrics

description:
  Severity Override Guidance: Default severity level is a Category I (CAT I). The severity level may be decreased to either CAT II or CAT III if the following 4‐ check(s) are the ONLY findings under this Rule (no findings against CAT I checks found): Check #3. Check to ensure that in addition to the swipe or proximity card or badge ‐ that a personal identification number (PIN) is used. This is required WHEN VISUAL (MONITORING) of the entrance IS NOT USED during working hours. (CAT II when an AECS card and reader is used w/o PIN or biometrics) Check #4. Check the PINs are separately entered into the system by each individual using a keypad device and consist of four or more digits, randomly selected, with no known or logical association with the individuals. (CAT II only when an AECS with card and PIN is used) Check #5. Check to ensure there is a procedure to cover changing PINs when it is believed they have been compromised or subjected to compromise. (CAT III) NOTE: This check pertains only to situations where access is controlled by use of a swipe or proximity card (using an AECS card reader) along with a Personal Identity Number (PIN). Check #6. Biometrics Devices, which identify an individual requesting access by some unique personal characteristic, such as Fingerprinting, Hand Geometry, Handwriting, Retina scans, or Voice recognition may be used in conjunction with an ID badge or card in lieu of a PIN. (CAT II when an AECS card and reader is used w/o PIN or biometrics) Check Content: Background Information and Requirements Summary: 1. The FF‐L‐2740 combination lock securing the primary access door for vaults and secure rooms (AKA: collateral classified open storage areas) may be opened at the beginning of normal duty hours and left unlocked for frequent employee access only if the entrance is properly monitored and controlled. The combination lock will be secured at the end of normal duty hours and interior motion alarms (if used) activated. 2. Entrances to vaults, secure rooms or collateral classified open storage areas must be under visual control at all times during duty hours to prevent entry by unauthorized personnel. 3. An automated access control system (AECS) may be used to monitor and control admittance during working hours instead of visual control, if it consists of a swipe or proximity coded card and reader, supplemented by the use of a Personal Identification Number (PIN) or by use of Biometric readers (fingerprints, retina scanner, etc.). Additionally, the secure room or classified storage area must be occupied by cleared employees OR under direct visual control from just outside the room or area. Use of an Automated Entry Control System (AECS) alone may not be used to meet this standard. Use of an AECS to control and monitor access requires the room or area be occupied by at least one properly cleared person. 4. Visual monitoring or control of secure room access points may be accomplished by several methods (e.g., employee work station, guard, "continuously monitored" CCTV). Employee monitoring may be conducted by cleared employees within the secure room space, who can observe all entrances or employees located just outside the secure room adjacent to an entrance may also "actively" monitor access. If CCTV is used to monitor, the CCTV cameras must cover all potential entrances and send real time images back to a continuously manned monitoring station. 5. Regardless of the visual method used to monitor daytime access, a locking system for access control must still be used on the entrance to the secure area. The use of automated entry control systems, (AECS with coded ID cards or badges) is encouraged. Supplementing the coded (swipe or proximity) cards or badges with a PIN or biometrics is not required if the entrances are properly monitored by visual means. 6. Access to secure areas may also be controlled by electric, mechanical or electro‐mechanical access control devices to limit access during duty hours, but only if the entrance is also under continuous visual control. 7. IMPORTANT NOTE: Electrically actuated locks (e.g., cypher, proximity card and magnetic strip card locks) do not afford by themselves the required degree of protection for classified information and must not be used as a substitute for the combination locks meeting Federal Specification FF‐L‐2740. CHECKS: *If f visual control methods are the primary means to monitor and control access during duty hours, use the following three checks to evaluate: Check #1. Check to ensure that all possible primary or secondary entrances to vaults or secure rooms are continuously monitored by cleared employees or guards (inside or outside the room or area) or by CCTV, whenever the FF‐L‐2740 combination lock is disengaged for daytime or other routine access. (CAT I) Check #2. Check to ensure that if CCTV is used it sends real time images to a continuously manned monitoring station. (CAT I) Check #3. If CCTV is used to visually monitor the secure room or area and / or guards or other personnel are not physically controlling access: Check to ensure that access to a continuously (visually) monitored vault, secure room or collateral classified open storage area is controlled either by an Automated Entry Control System (AECS) using coded cards or badges (biometrics or PIN are not required) or by electric, mechanical or electro‐mechanical access control devices to limit access during duty hours. (CAT I) NOTE: Electric, mechanical or electro‐mechanical access control devices may not be used to control access when the entrance(s) to the vault, secure room or area are not under continuous visual monitoring either directly by cleared employees at the entrance(s) or via CCTV. If using CCTV it must also be continuously monitored and recorded at an occupied monitoring station. **If an Automated Entry Control System (AECS) is used to control access (without use of any authorized visual control methods), use the following seven checks to evaluate: CHECKS: Check#1. Check to ensure the vault, secure room or area is continuously occupied by at least one properly cleared employee during working hours (when the FF‐L‐2740 combination lock is not engaged. (CAT I) Check #2. Check to ensure the AECS identifies individuals and authenticates the person's authority to enter the area through the use of a coded identification (ID) badge or card. (CAT I) Check #3. Check to ensure that in addition to the swipe or proximity card or badge ‐ that a personal identification number (PIN) is used. This is required WHEN VISUAL (MONITORING) of the entrance IS NOT USED during working hours. (CAT II – when an AECS card and reader is used w/o PIN or biometrics) Check #4. Check the PINs are separately entered into the system by each individual using a keypad device and consist of four or more digits, randomly selected, with no known or logical association with the individuals. (CAT II –only when an AECS with card and PIN is used) Check #5. Check to ensure there is a procedure to cover changing PINs when it is believed they have been compromised or subjected to compromise. (CAT III) Check #6. Biometrics Devices, which identify an individual requesting access by some unique personal characteristic, such as Fingerprinting, Hand Geometry, Handwriting, Retina scans, or Voice recognition may be used in conjunction with an ID badge or card in lieu of a PIN. (CAT II – when an AECS card and reader is used w/o PIN or biometrics) Check #7. VERY IMPORTANT: Check to ensure that electric, mechanical or electro‐mechanical access control devices such as Cipher locks ARE NOT USED to control access to vaults, secure rooms or areas when entrances are not under continuous visual control during working hours. Generally these locks do not provide the means for individual access codes and do not report to a central server or system monitor. Therefore they are permissible ONLY for access control to vault, secure rooms and spaces when the entrance is under continuous visual control. (CAT I) TACTICAL ENVIRONMENT: These checks are applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.

check_text:
  Severity Override Guidance: Default severity level is a Category I (CAT I). The severity level may be decreased to either CAT II or CAT III if the following 4‐ check(s) are the ONLY findings under this Rule (no findings against CAT I checks found): Check #3. Check to ensure that in addition to the swipe or proximity card or badge ‐ that a personal identification number (PIN) is used. This is required WHEN VISUAL (MONITORING) of the entrance IS NOT USED during working hours. (CAT II when an AECS card and reader is used w/o PIN or biometrics) Check #4. Check the PINs are separately entered into the system by each individual using a keypad device and consist of four or more digits, randomly selected, with no known or logical association with the individuals. (CAT II only when an AECS with card and PIN is used) Check #5. Check to ensure there is a procedure to cover changing PINs when it is believed they have been compromised or subjected to compromise. (CAT III) NOTE: This check pertains only to situations where access is controlled by use of a swipe or proximity card (using an AECS card reader) along with a Personal Identity Number (PIN). Check #6. Biometrics Devices, which identify an individual requesting access by some unique personal characteristic, such as Fingerprinting, Hand Geometry, Handwriting, Retina scans, or Voice recognition may be used in conjunction with an ID badge or card in lieu of a PIN. (CAT II when an AECS card and reader is used w/o PIN or biometrics) Check Content: Background Information and Requirements Summary: 1. The FF‐L‐2740 combination lock securing the primary access door for vaults and secure rooms (AKA: collateral classified open storage areas) may be opened at the beginning of normal duty hours and left unlocked for frequent employee access only if the entrance is properly monitored and controlled. The combination lock will be secured at the end of normal duty hours and interior motion alarms (if used) activated. 2. Entrances to vaults, secure rooms or collateral classified open storage areas must be under visual control at all times during duty hours to prevent entry by unauthorized personnel. 3. An automated access control system (AECS) may be used to monitor and control admittance during working hours instead of visual control, if it consists of a swipe or proximity coded card and reader, supplemented by the use of a Personal Identification Number (PIN) or by use of Biometric readers (fingerprints, retina scanner, etc.). Additionally, the secure room or classified storage area must be occupied by cleared employees OR under direct visual control from just outside the room or area. Use of an Automated Entry Control System (AECS) alone may not be used to meet this standard. Use of an AECS to control and monitor access requires the room or area be occupied by at least one properly cleared person. 4. Visual monitoring or control of secure room access points may be accomplished by several methods (e.g., employee work station, guard, "continuously monitored" CCTV). Employee monitoring may be conducted by cleared employees within the secure room space, who can observe all entrances or employees located just outside the secure room adjacent to an entrance may also "actively" monitor access. If CCTV is used to monitor, the CCTV cameras must cover all potential entrances and send real time images back to a continuously manned monitoring station. 5. Regardless of the visual method used to monitor daytime access, a locking system for access control must still be used on the entrance to the secure area. The use of automated entry control systems, (AECS with coded ID cards or badges) is encouraged. Supplementing the coded (swipe or proximity) cards or badges with a PIN or biometrics is not required if the entrances are properly monitored by visual means. 6. Access to secure areas may also be controlled by electric, mechanical or electro‐mechanical access control devices to limit access during duty hours, but only if the entrance is also under continuous visual control. 7. IMPORTANT NOTE: Electrically actuated locks (e.g., cypher, proximity card and magnetic strip card locks) do not afford by themselves the required degree of protection for classified information and must not be used as a substitute for the combination locks meeting Federal Specification FF‐L‐2740. CHECKS: *If f visual control methods are the primary means to monitor and control access during duty hours, use the following three checks to evaluate: Check #1. Check to ensure that all possible primary or secondary entrances to vaults or secure rooms are continuously monitored by cleared employees or guards (inside or outside the room or area) or by CCTV, whenever the FF‐L‐2740 combination lock is disengaged for daytime or other routine access. (CAT I) Check #2. Check to ensure that if CCTV is used it sends real time images to a continuously manned monitoring station. (CAT I) Check #3. If CCTV is used to visually monitor the secure room or area and / or guards or other personnel are not physically controlling access: Check to ensure that access to a continuously (visually) monitored vault, secure room or collateral classified open storage area is controlled either by an Automated Entry Control System (AECS) using coded cards or badges (biometrics or PIN are not required) or by electric, mechanical or electro‐mechanical access control devices to limit access during duty hours. (CAT I) NOTE: Electric, mechanical or electro‐mechanical access control devices may not be used to control access when the entrance(s) to the vault, secure room or area are not under continuous visual monitoring either directly by cleared employees at the entrance(s) or via CCTV. If using CCTV it must also be continuously monitored and recorded at an occupied monitoring station. **If an Automated Entry Control System (AECS) is used to control access (without use of any authorized visual control methods), use the following seven checks to evaluate: CHECKS: Check#1. Check to ensure the vault, secure room or area is continuously occupied by at least one properly cleared employee during working hours (when the FF‐L‐2740 combination lock is not engaged. (CAT I) Check #2. Check to ensure the AECS identifies individuals and authenticates the person's authority to enter the area through the use of a coded identification (ID) badge or card. (CAT I) Check #3. Check to ensure that in addition to the swipe or proximity card or badge ‐ that a personal identification number (PIN) is used. This is required WHEN VISUAL (MONITORING) of the entrance IS NOT USED during working hours. (CAT II – when an AECS card and reader is used w/o PIN or biometrics) Check #4. Check the PINs are separately entered into the system by each individual using a keypad device and consist of four or more digits, randomly selected, with no known or logical association with the individuals. (CAT II –only when an AECS with card and PIN is used) Check #5. Check to ensure there is a procedure to cover changing PINs when it is believed they have been compromised or subjected to compromise. (CAT III) Check #6. Biometrics Devices, which identify an individual requesting access by some unique personal characteristic, such as Fingerprinting, Hand Geometry, Handwriting, Retina scans, or Voice recognition may be used in conjunction with an ID badge or card in lieu of a PIN. (CAT II – when an AECS card and reader is used w/o PIN or biometrics) Check #7. VERY IMPORTANT: Check to ensure that electric, mechanical or electro‐mechanical access control devices such as Cipher locks ARE NOT USED to control access to vaults, secure rooms or areas when entrances are not under continuous visual control during working hours. Generally these locks do not provide the means for individual access codes and do not report to a central server or system monitor. Therefore they are permissible ONLY for access control to vault, secure rooms and spaces when the entrance is under continuous visual control. (CAT I) TACTICAL ENVIRONMENT: These checks are applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254809
rule_id: IS-02.01.15_rule
severity: CAT I
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
title:
  Vault/Secure Room Storage Standards ‐ Automated Entry Control System (AECS) and
  Intrusion Detection System (IDS) Head‐End Equipment Protection

description:
  Check Content: Requirements Summary: Protection must be established and maintained for all component devices or equipment that constitute the automated entry control system (AECS) and/or the intrusion detection system (IDS) used to protect a vault, secure room or collateral classified open storage area, which contains SIPRNet assets. In particular the physical location (room or area) containing AECS and IDS "head‐end" equipment (server and/or work station/monitoring equipment) where authorization, personal identification or verification data is input, stored, or recorded and/or where system status/alarms are monitored must be protected. CHECKS: Check #1. Check to ensure the physical location containing the primary IDS "head‐end" equipment (server and/or work station/monitoring equipment) is in a continuously occupied location (e.g., guard monitoring station ‐ for alarms and CCTV). (CAT I) Check #2. Check to ensure the continuously occupied space limits unescorted access to only those employees responsible for monitoring or controlling the IDS and/or AECS. Automated entry control system card/badge readers or cipher locks may be used to fulfill this requirement. (CAT II) Check #3. If not co‐located with the IDS "head‐end" equipment; check to ensure the physical location containing the primary AECS "head‐end" equipment is in a continuously occupied location OR protected minimally within a room with a BMS alarm contact on each door, window or opening and with interior motion detection sensors that are activated at the end of each duty day. (CAT II) Check #4. Check to ensure that AECS system card readers with coded access cards or badges (not cipher locks or keyed locks) are used to secure the doors to rooms protecting AECS "head‐end" equipment that are not located within a continuously occupied location. (CAT II) Check #5. Check to ensure that alarms from sensors in the room protecting AECS "head‐end" equipment are monitored at the primary IDS monitoring location. (CAT II) Check #6. A secondary or supplemental AECS server/workstation or IDS data/monitoring workstation might not be located in a 24/7 occupied work space. In instances when AECS or IDS secondary head‐end equipment is not continuously attended by employees responsible for monitoring or controlling it ‐ Check to ensure it is protected minimally within a room with a BMS alarm contact on each door, window or opening and interior motion detection sensors are installed and activated at the end of each duty day. (CAT I) Check #7. Check to ensure that AECS system card readers with coded access cards or badges (not cipher locks or keyed locks) are used to secure the doors to rooms protecting secondary IDS or AECS "headend" equipment that are not located within a continuously occupied location. (CAT II) Check #8. Check to ensure that alarms from sensors in the room protecting secondary IDS or AECS "head‐end" equipment are monitored at the primary IDS monitoring location. (CAT I) Check #9. If 4‐hour checks are used in lieu of IDS for vaults, secure rooms or collateral classified open storage areas; then 4‐hour checks of the room or area used to house the (secondary) IDS and/or (primary/secondary) AECS "head‐end" equipment may also be used in lieu of an IDS. Check to ensure the use of 4‐hour checks in lieu of IDS to protect (secondary) IDS and/or (primary/secondary) AECS "head‐end" equipment is based on a documented risk assessment. (CAT II) Check #10. If used, check to ensure that random checks (not to exceed 4‐hours) of the room or area used to house the IDS or AECS "head‐end" equipment are documented and maintained on file for a minimum of 90 days. (CAT II) TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.

check_text:
  Check Content: Requirements Summary: Protection must be established and maintained for all component devices or equipment that constitute the automated entry control system (AECS) and/or the intrusion detection system (IDS) used to protect a vault, secure room or collateral classified open storage area, which contains SIPRNet assets. In particular the physical location (room or area) containing AECS and IDS "head‐end" equipment (server and/or work station/monitoring equipment) where authorization, personal identification or verification data is input, stored, or recorded and/or where system status/alarms are monitored must be protected. CHECKS: Check #1. Check to ensure the physical location containing the primary IDS "head‐end" equipment (server and/or work station/monitoring equipment) is in a continuously occupied location (e.g., guard monitoring station ‐ for alarms and CCTV). (CAT I) Check #2. Check to ensure the continuously occupied space limits unescorted access to only those employees responsible for monitoring or controlling the IDS and/or AECS. Automated entry control system card/badge readers or cipher locks may be used to fulfill this requirement. (CAT II) Check #3. If not co‐located with the IDS "head‐end" equipment; check to ensure the physical location containing the primary AECS "head‐end" equipment is in a continuously occupied location OR protected minimally within a room with a BMS alarm contact on each door, window or opening and with interior motion detection sensors that are activated at the end of each duty day. (CAT II) Check #4. Check to ensure that AECS system card readers with coded access cards or badges (not cipher locks or keyed locks) are used to secure the doors to rooms protecting AECS "head‐end" equipment that are not located within a continuously occupied location. (CAT II) Check #5. Check to ensure that alarms from sensors in the room protecting AECS "head‐end" equipment are monitored at the primary IDS monitoring location. (CAT II) Check #6. A secondary or supplemental AECS server/workstation or IDS data/monitoring workstation might not be located in a 24/7 occupied work space. In instances when AECS or IDS secondary head‐end equipment is not continuously attended by employees responsible for monitoring or controlling it ‐ Check to ensure it is protected minimally within a room with a BMS alarm contact on each door, window or opening and interior motion detection sensors are installed and activated at the end of each duty day. (CAT I) Check #7. Check to ensure that AECS system card readers with coded access cards or badges (not cipher locks or keyed locks) are used to secure the doors to rooms protecting secondary IDS or AECS "headend" equipment that are not located within a continuously occupied location. (CAT II) Check #8. Check to ensure that alarms from sensors in the room protecting secondary IDS or AECS "head‐end" equipment are monitored at the primary IDS monitoring location. (CAT I) Check #9. If 4‐hour checks are used in lieu of IDS for vaults, secure rooms or collateral classified open storage areas; then 4‐hour checks of the room or area used to house the (secondary) IDS and/or (primary/secondary) AECS "head‐end" equipment may also be used in lieu of an IDS. Check to ensure the use of 4‐hour checks in lieu of IDS to protect (secondary) IDS and/or (primary/secondary) AECS "head‐end" equipment is based on a documented risk assessment. (CAT II) Check #10. If used, check to ensure that random checks (not to exceed 4‐hours) of the room or area used to house the IDS or AECS "head‐end" equipment are documented and maintained on file for a minimum of 90 days. (CAT II) TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254810
rule_id: IS-02.02.01_rule
severity: CAT II
title: Information Security (INFOSEC) ‐ Secure Room Storage Standards ‐ Structural Integrity Checks
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Severity Override Guidance: The default finding is a CAT II. It may be lowered to a CAT III finding if it can be determined the perimeter checks are actually conducted as specified, but written procedures or documentation covering results of the checks are not developed or maintained. Check Content: BACKGROUND: In spite of all physical security defensive devices deployed, the possibility of an intrusion always exists. The highest fence can be scaled, the densest wall can be breached and the stoutest lock can be compromised. Even highly sophisticated alarm systems can be contravened by a knowledgeable professional. It is therefore necessary to institute a system of checks to physically inspect secure room perimeters to check for signs of attempted intrusions and ensure that structural integrity of the perimeter is maintained. This requirement is concerned with ensuring there is periodic visual validation of structural integrity of secure room/collateral classified open storage area perimeters containing SIPRNet assets and associated media. It ensures that any breach or attempted breach of the walls, true floors and true ceilings of a secure area (portions which are not readily visible) are discovered in a timely manner. In Check #1 there are 3 different situations covered and each requires a different inspection frequency for physical/visual validation of structural integrity. Check #1. Check to ensure that structural integrity of secure rooms or spaces containing SIPRNet equipment is validated as follows: Situation #1 (No structural integrity checks required): If interior IDS (motion detection) is *properly employed (*directly covering all SIPRNet assets) within the secure room or collateral classified open storage space where classified SIPRNet assets are located AND under raised floor spaces (if applicable) AND above suspended ceiling spaces (if applicable), then no physical check for structural integrity is required. This is contingent upon the interior motion sensors being activated when the room is closed or unattended, and that the sensors work properly as determined by required checks of sensor functionality. Situation #2 (Monthly checks required): If motion sensors are properly employed ONLY within the secure room space where classified assets are located, then a visual check of spaces below raised floor, above suspended ceilings and anywhere else the perimeter of the secure area cannot be readily observed must be conducted on at least a monthly basis. The goal is to visually inspect all walls, true floor and true ceiling perimeters for signs of breach or attempted breach. Situation #3 (Weekly checks required): When random checks (not exceeding 4‐hours) of secure rooms or open storage spaces are used in lieu of IDS then the checks specified in situation #2 for above suspended ceilings and below raised floors must be conducted at least weekly. The increased frequency of checks is due to the significant vulnerability of the SIPRNet assets to undetected attack from portions of the perimeter that cannot be readily observed. NOTE: Physical inspection of the perimeter walls, floor and ceiling can be greatly expedited and may be conducted without ladders or other equipment where there are no false/suspended ceilings and/or raised floors within or surrounding the secure room or area. NOTE: If the entire perimeter of the secure room or area containing SIPRNet assets is surrounded by a secret or top secret (TS) Controlled Access Area (CAA) the frequency of structural integrity checks may be reduced to once every two weeks. This is due to the increased security‐in‐depth provided by the CAA. A secret or TS CAA is an area where unescorted access is granted only to those individuals who have a secret or higher security clearance. All others are escorted by cleared employees. The DoD does not provide specific physical security requirements for a CAA but allows each CC/S/A Senior Agency Official (SAO) for Information Security the authority to establish such standards. All the Services have established standards for CAAs within their Protected Distribution System (PDS) implementing guidelines. Minimally all require some form of access control methodology (AECS/guards/reception…) be in place to ensure only properly vetted and cleared personnel have unescorted access to a CAA. Check #2. Check to ensure there are written procedures developed for the checks and that the checks are documented and maintained on file for a minimum of 90 days. Where discrepancies (holes in perimeter or other signs of successful or attempted access) are noted these checks will be maintained indefinitely or until an inquiry determines the cause of the discrepancy. TACTICAL ENVIRONMENT: This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.

check_text:
  Severity Override Guidance: The default finding is a CAT II. It may be lowered to a CAT III finding if it can be determined the perimeter checks are actually conducted as specified, but written procedures or documentation covering results of the checks are not developed or maintained. Check Content: BACKGROUND: In spite of all physical security defensive devices deployed, the possibility of an intrusion always exists. The highest fence can be scaled, the densest wall can be breached and the stoutest lock can be compromised. Even highly sophisticated alarm systems can be contravened by a knowledgeable professional. It is therefore necessary to institute a system of checks to physically inspect secure room perimeters to check for signs of attempted intrusions and ensure that structural integrity of the perimeter is maintained. This requirement is concerned with ensuring there is periodic visual validation of structural integrity of secure room/collateral classified open storage area perimeters containing SIPRNet assets and associated media. It ensures that any breach or attempted breach of the walls, true floors and true ceilings of a secure area (portions which are not readily visible) are discovered in a timely manner. In Check #1 there are 3 different situations covered and each requires a different inspection frequency for physical/visual validation of structural integrity. Check #1. Check to ensure that structural integrity of secure rooms or spaces containing SIPRNet equipment is validated as follows: Situation #1 (No structural integrity checks required): If interior IDS (motion detection) is *properly employed (*directly covering all SIPRNet assets) within the secure room or collateral classified open storage space where classified SIPRNet assets are located AND under raised floor spaces (if applicable) AND above suspended ceiling spaces (if applicable), then no physical check for structural integrity is required. This is contingent upon the interior motion sensors being activated when the room is closed or unattended, and that the sensors work properly as determined by required checks of sensor functionality. Situation #2 (Monthly checks required): If motion sensors are properly employed ONLY within the secure room space where classified assets are located, then a visual check of spaces below raised floor, above suspended ceilings and anywhere else the perimeter of the secure area cannot be readily observed must be conducted on at least a monthly basis. The goal is to visually inspect all walls, true floor and true ceiling perimeters for signs of breach or attempted breach. Situation #3 (Weekly checks required): When random checks (not exceeding 4‐hours) of secure rooms or open storage spaces are used in lieu of IDS then the checks specified in situation #2 for above suspended ceilings and below raised floors must be conducted at least weekly. The increased frequency of checks is due to the significant vulnerability of the SIPRNet assets to undetected attack from portions of the perimeter that cannot be readily observed. NOTE: Physical inspection of the perimeter walls, floor and ceiling can be greatly expedited and may be conducted without ladders or other equipment where there are no false/suspended ceilings and/or raised floors within or surrounding the secure room or area. NOTE: If the entire perimeter of the secure room or area containing SIPRNet assets is surrounded by a secret or top secret (TS) Controlled Access Area (CAA) the frequency of structural integrity checks may be reduced to once every two weeks. This is due to the increased security‐in‐depth provided by the CAA. A secret or TS CAA is an area where unescorted access is granted only to those individuals who have a secret or higher security clearance. All others are escorted by cleared employees. The DoD does not provide specific physical security requirements for a CAA but allows each CC/S/A Senior Agency Official (SAO) for Information Security the authority to establish such standards. All the Services have established standards for CAAs within their Protected Distribution System (PDS) implementing guidelines. Minimally all require some form of access control methodology (AECS/guards/reception…) be in place to ensure only properly vetted and cleared personnel have unescorted access to a CAA. Check #2. Check to ensure there are written procedures developed for the checks and that the checks are documented and maintained on file for a minimum of 90 days. Where discrepancies (holes in perimeter or other signs of successful or attempted access) are noted these checks will be maintained indefinitely or until an inquiry determines the cause of the discrepancy. TACTICAL ENVIRONMENT: This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254811
rule_id: IS-02.02.02_rule
severity: CAT II
title: Vault/Secure Room Storage Standards ‐ IDS Performance Verification
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: This check is concerned with verification of IDS functionality where IDS is used as a supplemental control for vaults or secure rooms/areas containing SIPRNet assets. Following are the required checks: Check #1. Checks of ALL individual alarm sensors (BMS, motion, glass break, etc.) will be conducted at least semi‐annually. Check #2. Valid tests IAW best practices using government or industry standards and tools will be used to conduct the checks. Check #3. Written procedures will be developed for tests of each sensor type in use at a site. Check #4. Results of testing will be maintained on file for at least 1‐year. TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.

check_text:
  Check Content: This check is concerned with verification of IDS functionality where IDS is used as a supplemental control for vaults or secure rooms/areas containing SIPRNet assets. Following are the required checks: Check #1. Checks of ALL individual alarm sensors (BMS, motion, glass break, etc.) will be conducted at least semi‐annually. Check #2. Valid tests IAW best practices using government or industry standards and tools will be used to conduct the checks. Check #3. Written procedures will be developed for tests of each sensor type in use at a site. Check #4. Results of testing will be maintained on file for at least 1‐year. TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254812
rule_id: IS-02.02.03_rule
severity: CAT II
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
title:
  Vault/Secure Room Storage Standards ‐ Masking of IDS Sensors Displayed at the Intrusion
  Detection System (IDS) Monitoring Station

description:
  Check Content: Shunting or masking of any secure room IDS internal zone or sensor must be appropriately logged or recorded in the system archive. A shunted or masked internal zone or sensor must be displayed as such at the monitor station throughout the period the condition exists whenever there is a system (IDS) survey of zones or sensors. TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.

check_text:
  Check Content: Shunting or masking of any secure room IDS internal zone or sensor must be appropriately logged or recorded in the system archive. A shunted or masked internal zone or sensor must be displayed as such at the monitor station throughout the period the condition exists whenever there is a system (IDS) survey of zones or sensors. TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254813
rule_id: IS-02.02.04_rule
severity: CAT II
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
title:
  Vault/Secure Room Storage Standards ‐ IDS Alarm Monitoring Indicators, both audible and
  visual (Alarm Status) must be displayed for each sensor or alarmed zone at the monitoring station.

description:
  Severity Override Guidance: Default CAT II: Alarm activations do not provide BOTH visual and audible indicators. Check Content: Check that all alarm activations provide both a visual and audible indicators at the primary monitoring station. TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.

check_text:
  Severity Override Guidance: Default CAT II: Alarm activations do not provide BOTH visual and audible indicators. Check Content: Check that all alarm activations provide both a visual and audible indicators at the primary monitoring station. TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254814
rule_id: IS-02.02.05_rule
severity: CAT II
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
title:
  Vault/Secure Room Storage Standards ‐ Intrusion Detection System (IDS) / Automated Entry
  Control System (AECS) Primary and Emergency Power Supply

description:
  Check Content: Primary Power Checks: Check #1. Check to ensure primary power for all Intrusion Detection System (IDS) equipment and Automated Entry Control system (AECS) equipment is either commercial AC or DC power. Check #2. Check to ensure that in the event of commercial power failure at either the secure room/area or monitor station, the equipment changes power sources without causing an intrusion alarm indication. An Uninterrupted Power Supply (UPS) will be required for this to occur. Emergency (Backup) Power Checks: Check #1. Check to ensure that emergency power consists of a protected independent backup power source that provides a minimum of 8‐hours operating battery and/or generator power. When batteries are used for emergency power, they shall be maintained at full charge by automatic charging circuits. The manufacturer's periodic maintenance schedule shall be followed and results documented. Check #2. Power Source and Failure Indication: Check to ensure that an illuminated indication exists at the Power Control Unit (PCU) of the power source in use (AC or DC). Check #3. Check to ensure equipment at the IDS/AECS monitor station indicates a failure in power source, a change in power source, and the location of the failure or change. TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.

check_text:
  Check Content: Primary Power Checks: Check #1. Check to ensure primary power for all Intrusion Detection System (IDS) equipment and Automated Entry Control system (AECS) equipment is either commercial AC or DC power. Check #2. Check to ensure that in the event of commercial power failure at either the secure room/area or monitor station, the equipment changes power sources without causing an intrusion alarm indication. An Uninterrupted Power Supply (UPS) will be required for this to occur. Emergency (Backup) Power Checks: Check #1. Check to ensure that emergency power consists of a protected independent backup power source that provides a minimum of 8‐hours operating battery and/or generator power. When batteries are used for emergency power, they shall be maintained at full charge by automatic charging circuits. The manufacturer's periodic maintenance schedule shall be followed and results documented. Check #2. Power Source and Failure Indication: Check to ensure that an illuminated indication exists at the Power Control Unit (PCU) of the power source in use (AC or DC). Check #3. Check to ensure equipment at the IDS/AECS monitor station indicates a failure in power source, a change in power source, and the location of the failure or change. TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254815
rule_id: IS-02.02.06_rule
severity: CAT II
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
title:
  Vault/Secure Room Storage Standards ‐ Intrusion Detection System and Automated Entry
  Control System (IDS/AECS) Component Tamper Protection

description:
  Failure to tamper protect IDS/AECS component enclosures and access points external to protected
  vaults/secure rooms space could result in the undetected modification or disabling of IDS/AECS system
  components. This could lead to the undetected breach of secure space containing SIPRNet assets and
  result in the undetected loss or compromise of classified information or materials.

check_text:
  Failure to tamper protect IDS/AECS component enclosures and access points external to protected
  vaults/secure rooms space could result in the undetected modification or disabling of IDS/AECS system
  components. This could lead to the undetected breach of secure space containing SIPRNet assets and
  result in the undetected loss or compromise of classified information or materials.


vuln_id: V-254816
rule_id: IS-02.02.07_rule
severity: CAT II
title:
  Vault/Secure Room Storage Standards ‐ Primary IDS Monitoring Location Outside the
  Monitored Space

created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: Check to ensure that primary monitoring of alarms for secure rooms or spaces containing SIPRNet equipment is located outside of the protected space. It is allowable to monitor alarms within the protected space if this is only used for supplemental/secondary monitoring. Ideally alarms will be monitored from the same location that police/guards or other response forces are contacted and dispatched, although this is not required if there are procedures and means for the monitoring station personnel to notify security response forces in a timely manner. TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.

check_text:
  Check Content: Check to ensure that primary monitoring of alarms for secure rooms or spaces containing SIPRNet equipment is located outside of the protected space. It is allowable to monitor alarms within the protected space if this is only used for supplemental/secondary monitoring. Ideally alarms will be monitored from the same location that police/guards or other response forces are contacted and dispatched, although this is not required if there are procedures and means for the monitoring station personnel to notify security response forces in a timely manner. TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254817
rule_id: IS-02.02.08_rule
severity: CAT II
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
title:
  Vault/Secure Room Storage Standards ‐ Automated Entry Control System (AECS) Records
  Maintenance, which includes documented procedures for granting and removal of access.

description:
  Check Content: Requirements Summary: A procedure must be established for removal of an individual's authorization to enter the secure room area upon reassignment, transfer, or termination, or when the individual's access is suspended, revoked, or downgraded to a level lower than the former access level. Records shall also be accurately maintained reflecting active assignment of ID badge/card, PIN, level of access, and similar systemrelated records. Records concerning personnel removed from the system shall be retained for a minimum of 90 days. CHECKS: Check #1. Check to ensure that records reflecting active assignment of ID badge/card, PIN, level of access, and similar system‐related records are accurately maintained. (CAT II) Check #2. Check to ensure there is a documented procedure for removal of persons from the Automated Entry Control System. (CAT III) Check #3. Check to ensure that records concerning personnel removed from the system are retained for a minimum of 90 days. (CAT III) TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.

check_text:
  Check Content: Requirements Summary: A procedure must be established for removal of an individual's authorization to enter the secure room area upon reassignment, transfer, or termination, or when the individual's access is suspended, revoked, or downgraded to a level lower than the former access level. Records shall also be accurately maintained reflecting active assignment of ID badge/card, PIN, level of access, and similar systemrelated records. Records concerning personnel removed from the system shall be retained for a minimum of 90 days. CHECKS: Check #1. Check to ensure that records reflecting active assignment of ID badge/card, PIN, level of access, and similar system‐related records are accurately maintained. (CAT II) Check #2. Check to ensure there is a documented procedure for removal of persons from the Automated Entry Control System. (CAT III) Check #3. Check to ensure that records concerning personnel removed from the system are retained for a minimum of 90 days. (CAT III) TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254818
rule_id: IS-02.02.09_rule
severity: CAT II
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
title:
  Vault/Secure Room Storage Standards ‐ Automated Entry Control System (AECS)
  Transmission Line Security

description:
  Check Content: 1. Where Automated Entry Control Systems (AECS) protect SIPRNet assets in Secure Rooms, Vaults, or secret/TS CAAs: Ensure that transmission lines used to carry access authorizations, personal identification data, or verification data between devices or equipment, which are located outside "minimally" a Secret Controlled Access Area (CAA) have line supervision. 2. Electrical, mechanical, or electromechanical access control devices, which do not constitute an AECS that are used to control access during duty hours (while under direct continuous visual observation and control of a cleared employee or via CCTV) must have all electrical components, including wiring, or mechanical links (cables, rods, and so on) accessible only from inside the area, or, if they traverse outside a controlled area "minimally" a Secret Controlled Access Area (CAA), they must be physically secured within conduit to preclude surreptitious manipulation of components. TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.

check_text:
  Check Content: 1. Where Automated Entry Control Systems (AECS) protect SIPRNet assets in Secure Rooms, Vaults, or secret/TS CAAs: Ensure that transmission lines used to carry access authorizations, personal identification data, or verification data between devices or equipment, which are located outside "minimally" a Secret Controlled Access Area (CAA) have line supervision. 2. Electrical, mechanical, or electromechanical access control devices, which do not constitute an AECS that are used to control access during duty hours (while under direct continuous visual observation and control of a cleared employee or via CCTV) must have all electrical components, including wiring, or mechanical links (cables, rods, and so on) accessible only from inside the area, or, if they traverse outside a controlled area "minimally" a Secret Controlled Access Area (CAA), they must be physically secured within conduit to preclude surreptitious manipulation of components. TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254819
rule_id: IS-02.02.10_rule
severity: CAT II
title: Vault/Secure Room Storage Standards ‐ Automated Entry Control System (AECS) Door Locks
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: Vault/Secure Room Storage Standards ‐ Automated Entry Control System (AECS) Door Lock Standards for Areas Containing SIPRNet Assets. Check to ensure the following configuration and control considerations are used according to the types of locking mechanisms being used, as specified in each check: Check #1. Electric Strikes and/or Magnetic Locking devices used in access control systems shall be heavy duty, industrial grade. Check #2. Backup batteries and/or emergency power generators should be connected to AECS components; however, the total loss of power (primary and emergency) should also be planned for. Check #3. When used on secure rooms, vaults or areas protecting SIPRNet equipment, electric strikes on doors will be set to fail secure in the event of power disruption. Check #4. On the primary ingress/egress door to secure rooms (which contains the combination lock) the strike may be set to fail open to facilitate access to the room in emergencies only if the door is under continuous visual observation when the combination lock is not secure. In this instance the combination lock will be immediately secured and subsequently opened as required to allow access to the room. Check #5. As an alternative the strike on the primary access door (only those under continuous visual control) may be set to fail secure and configured to allow for opening of the strike lock with a key. Check #6. Keys for locks as discussed in check 5 will be strictly controlled, inventoried periodically and not issued to individuals for personal retention. Check #7. KEYS TO SECURE ROOMS WILL NOT BE REMOVED FROM THE SITE. Check #8. When Magnetic Locks (Mag locks) are used on primary access doors the total loss of ALL power (primary and backup) will cause the lock to fail open. Therefore doors with mag locks installed MUST BE UNDER CONTINUOUS VISUAL OBSERVATION WHEN THE COMBINATION LOCK IS OPEN. Check #9. Where Mag locks are used on primary access doors and upon a total power failure ‐ the combination lock will be immediately secured and subsequently opened as required to allow access to the room. Check #10. Secondary doors not used for access (emergency egress only) should use standard locking door latches rather than electric strikes or mag locks. Check #11. Access hardware on the side of the secondary door that is external to the room must be removed to prevent use of secondary doors for routine ingress. Check #12. In the event a mag lock or electric strike is used on a secondary door, the door must be configured to be locked during a power disruption. This can be accomplished with internal sliding deadbolt locks or lockable door latches. Electric strikes on secondary doors should be set to fail secure. Any secondary door secured with Mag Locks must be under CONTINUOUS visual observation when the interior deadbolt locks are not engaged. Deadbolt locks must not be engaged while the room is occupied ‐ for life safety, but will be secured upon closing the secure room or area. TACTICAL ENVIRONMENT: This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.

check_text:
  Check Content: Vault/Secure Room Storage Standards ‐ Automated Entry Control System (AECS) Door Lock Standards for Areas Containing SIPRNet Assets. Check to ensure the following configuration and control considerations are used according to the types of locking mechanisms being used, as specified in each check: Check #1. Electric Strikes and/or Magnetic Locking devices used in access control systems shall be heavy duty, industrial grade. Check #2. Backup batteries and/or emergency power generators should be connected to AECS components; however, the total loss of power (primary and emergency) should also be planned for. Check #3. When used on secure rooms, vaults or areas protecting SIPRNet equipment, electric strikes on doors will be set to fail secure in the event of power disruption. Check #4. On the primary ingress/egress door to secure rooms (which contains the combination lock) the strike may be set to fail open to facilitate access to the room in emergencies only if the door is under continuous visual observation when the combination lock is not secure. In this instance the combination lock will be immediately secured and subsequently opened as required to allow access to the room. Check #5. As an alternative the strike on the primary access door (only those under continuous visual control) may be set to fail secure and configured to allow for opening of the strike lock with a key. Check #6. Keys for locks as discussed in check 5 will be strictly controlled, inventoried periodically and not issued to individuals for personal retention. Check #7. KEYS TO SECURE ROOMS WILL NOT BE REMOVED FROM THE SITE. Check #8. When Magnetic Locks (Mag locks) are used on primary access doors the total loss of ALL power (primary and backup) will cause the lock to fail open. Therefore doors with mag locks installed MUST BE UNDER CONTINUOUS VISUAL OBSERVATION WHEN THE COMBINATION LOCK IS OPEN. Check #9. Where Mag locks are used on primary access doors and upon a total power failure ‐ the combination lock will be immediately secured and subsequently opened as required to allow access to the room. Check #10. Secondary doors not used for access (emergency egress only) should use standard locking door latches rather than electric strikes or mag locks. Check #11. Access hardware on the side of the secondary door that is external to the room must be removed to prevent use of secondary doors for routine ingress. Check #12. In the event a mag lock or electric strike is used on a secondary door, the door must be configured to be locked during a power disruption. This can be accomplished with internal sliding deadbolt locks or lockable door latches. Electric strikes on secondary doors should be set to fail secure. Any secondary door secured with Mag Locks must be under CONTINUOUS visual observation when the interior deadbolt locks are not engaged. Deadbolt locks must not be engaged while the room is occupied ‐ for life safety, but will be secured upon closing the secure room or area. TACTICAL ENVIRONMENT: This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254820
rule_id: IS-02.02.11_rule
severity: CAT II
title: Information Security (INFOSEC) ‐ Secure Room Storage Standards ‐ (Ceiling, Walls and Floors)
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: For secure rooms or areas (*containing inspectable SIPRNet assets) check: 1. That walls, floor, and roof construction of secure rooms are made of permanent construction materials; i.e., plaster, gypsum wallboard, metal panels, hardboard, wood, plywood, or other materials offering resistance to, and evidence of unauthorized entry into the area. Materials such as plywood must be attached in a manner so as not to enable easy removal of screws or nails to gain ingress and then replace upon egress. 2. The "True" ceiling shall be constructed of plaster, gypsum, wallboard material, hardware or any other acceptable material. TACTICAL ENVIRONMENT: This check is applicable where vaults or secure rooms are used to protect classified materials or systems. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.

check_text:
  Check Content: For secure rooms or areas (*containing inspectable SIPRNet assets) check: 1. That walls, floor, and roof construction of secure rooms are made of permanent construction materials; i.e., plaster, gypsum wallboard, metal panels, hardboard, wood, plywood, or other materials offering resistance to, and evidence of unauthorized entry into the area. Materials such as plywood must be attached in a manner so as not to enable easy removal of screws or nails to gain ingress and then replace upon egress. 2. The "True" ceiling shall be constructed of plaster, gypsum, wallboard material, hardware or any other acceptable material. TACTICAL ENVIRONMENT: This check is applicable where vaults or secure rooms are used to protect classified materials or systems. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254821
rule_id: IS-02.03.01_rule
severity: CAT III
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
title:
  Vault/Secure Room Storage Standards ‐ Automated Entry Control System (AECS) Keypad
  Device Protection:

description:
  Requirements Summary: Keypad devices (cipher locks or PIN pads for card readers) shall be designed or installed in such a manner that an unauthorized person in the immediate vicinity cannot observe the selection of input numbers. CHECKS: Check to ensure that all keypad devices are properly shielded and/or that persons using these devices have been advised by site security and are aware of the risk of having someone in the vicinity view their PIN as it is entered and that they are exercising due care to shield entry of their PIN. Verification of employee awareness can be obtained by observing SOPs or employee training records reflecting a warning or requirement to shield entry of PINs. TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.

check_text:
  Requirements Summary: Keypad devices (cipher locks or PIN pads for card readers) shall be designed or installed in such a manner that an unauthorized person in the immediate vicinity cannot observe the selection of input numbers. CHECKS: Check to ensure that all keypad devices are properly shielded and/or that persons using these devices have been advised by site security and are aware of the risk of having someone in the vicinity view their PIN as it is entered and that they are exercising due care to shield entry of their PIN. Verification of employee awareness can be obtained by observing SOPs or employee training records reflecting a warning or requirement to shield entry of PINs. TACTICAL ENVIRONMENT: This check is applicable where Vaults/Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254822
rule_id: IS-03.02.01_rule
severity: CAT II
title: Marking Classified ‐ Equipment, Documents or Media
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: Check to ensure ALL equipment/media/documents in the areas housing SIPRNet assets contain proper classification markings. In a classified operating environment, all unclassified items must be marked in addition to all classified items. For instance: In areas where any classified equipment such as servers, client workstations, printers, routers, crypto, etc. are being used ‐ all classified equipment, media and documents must be properly marked with classification levels and handling caveats ‐ AND ALL UNCLASSIFIED equipment (servers, client workstations, printers, routers, crypto, etc.), media and documents must also be properly marked as unclassified and with handling caveats such as FOUO, when appropriate. This total marking of all assets in a classified environment eliminates the assumption that anything not marked is unclassified. Hence, all equipment, media and documents within SCIFs, Vaults, Secure Rooms and classified Controlled Access Areas (CAA) must be marked with classification levels and handling caveats. SPECIAL NOTE FOR MONITORS: Monitors connected to SIPRNet/NIPRNet are inert items of equipment in that they do not store/retain classified data. Typically, in a mixed classified/unclassified environment it is appropriate to physically label a monitor classification based on the system to which it is connected. If a classification banner is displayed on an active monitor screen then the physical monitor is not required to have a SF 710 (unclassified) or SF 707 (secret) sticker. Regardless, there is no prohibition against also using the SF labels as an additional identifier but it is not required. Typically, most monitor screens connected to the DISN do have classification banners displayed ‐ so placement of SF stickers on monitors is practically a non‐issue. Also, consider that many workstations are using KVM switches to share monitor screens between NIPRNet and SIPRNet. Hence, the single monitor will be unclassified or classified depending on the network it is connected to at a particular moment; making placement of physical classification labels impractical. TACTICAL ENVIRONMENT: This check is applicable in a tactical environment if classified documents or media are created/extracted from the SIPRNet. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used. All deployed SIPRNet equipment should already contain applicable classification markings/labels.

check_text:
  Check Content: Check to ensure ALL equipment/media/documents in the areas housing SIPRNet assets contain proper classification markings. In a classified operating environment, all unclassified items must be marked in addition to all classified items. For instance: In areas where any classified equipment such as servers, client workstations, printers, routers, crypto, etc. are being used ‐ all classified equipment, media and documents must be properly marked with classification levels and handling caveats ‐ AND ALL UNCLASSIFIED equipment (servers, client workstations, printers, routers, crypto, etc.), media and documents must also be properly marked as unclassified and with handling caveats such as FOUO, when appropriate. This total marking of all assets in a classified environment eliminates the assumption that anything not marked is unclassified. Hence, all equipment, media and documents within SCIFs, Vaults, Secure Rooms and classified Controlled Access Areas (CAA) must be marked with classification levels and handling caveats. SPECIAL NOTE FOR MONITORS: Monitors connected to SIPRNet/NIPRNet are inert items of equipment in that they do not store/retain classified data. Typically, in a mixed classified/unclassified environment it is appropriate to physically label a monitor classification based on the system to which it is connected. If a classification banner is displayed on an active monitor screen then the physical monitor is not required to have a SF 710 (unclassified) or SF 707 (secret) sticker. Regardless, there is no prohibition against also using the SF labels as an additional identifier but it is not required. Typically, most monitor screens connected to the DISN do have classification banners displayed ‐ so placement of SF stickers on monitors is practically a non‐issue. Also, consider that many workstations are using KVM switches to share monitor screens between NIPRNet and SIPRNet. Hence, the single monitor will be unclassified or classified depending on the network it is connected to at a particular moment; making placement of physical classification labels impractical. TACTICAL ENVIRONMENT: This check is applicable in a tactical environment if classified documents or media are created/extracted from the SIPRNet. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used. All deployed SIPRNet equipment should already contain applicable classification markings/labels.


vuln_id: V-254823
rule_id: IS-03.03.01_rule
severity: CAT III
title: Marking Classified ‐ Local or Enclave Classified Marking Procedures
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: Check to ensure the local site/enclave security manager has developed written procedures on proper marking of classified documents / media/ equipment. These procedures should primarily involve guidance for employees concerning what to mark, how to mark items, where classified labels, stamps and other marking tools and supplies are located, etc. Reference to DoD or component marking guides should be in the local procedures with information on how/where to obtain copies. TACTICAL ENVIRONMENT: This check is applicable in a tactical environment if classified documents or media are created/extracted from the SIPRNet. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used. All deployed SIPRNet equipment should already contain applicable classification markings/labels.

check_text:
  Check Content: Check to ensure the local site/enclave security manager has developed written procedures on proper marking of classified documents / media/ equipment. These procedures should primarily involve guidance for employees concerning what to mark, how to mark items, where classified labels, stamps and other marking tools and supplies are located, etc. Reference to DoD or component marking guides should be in the local procedures with information on how/where to obtain copies. TACTICAL ENVIRONMENT: This check is applicable in a tactical environment if classified documents or media are created/extracted from the SIPRNet. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used. All deployed SIPRNet equipment should already contain applicable classification markings/labels.


vuln_id: V-254824
rule_id: IS-04.03.01_rule
severity: CAT III
title: Classified Working Papers (180 days)
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: Check any Working Papers, documents and/or Computer Media (CD, tape, flash drive, etc.) for compliance with the following guidance: Working papers are documents and material (includes computer media) accumulated or created in the preparation of finished documents and material. Working papers are marked in the same manner as a finished document at the same classification level when released by the originator outside the originating activity, retained more than 180 days from date of origin (30 days for SAPs), or filed permanently. Working papers containing classified information shall be: ‐ Dated when created ‐ Marked Top and Bottom with the highest classification of any information contained in the document ‐Annotated "WORKING PAPER" If any Automated Information System (AIS) hard drives or media are found to contain working papers or documents, the automated documents must be marked and handled in the same manner as hard copy documents. If an entire AIS media storage device (tapes, diskettes, flash drives, CDs, DVDs, etc.) contains classified documents or data that are being treated as a working documents ‐ then each individual working document on the media should be marked and handled as detailed above AND the media itself should be marked with the highest classification level, dated and marked "Working Documents". TACTICAL ENVIRONMENT APPLICABILITY: If classified working documents are found in a tactical environment they should be marked and handled according to the aforementioned guidance.

check_text:
  Check Content: Check any Working Papers, documents and/or Computer Media (CD, tape, flash drive, etc.) for compliance with the following guidance: Working papers are documents and material (includes computer media) accumulated or created in the preparation of finished documents and material. Working papers are marked in the same manner as a finished document at the same classification level when released by the originator outside the originating activity, retained more than 180 days from date of origin (30 days for SAPs), or filed permanently. Working papers containing classified information shall be: ‐ Dated when created ‐ Marked Top and Bottom with the highest classification of any information contained in the document ‐Annotated "WORKING PAPER" If any Automated Information System (AIS) hard drives or media are found to contain working papers or documents, the automated documents must be marked and handled in the same manner as hard copy documents. If an entire AIS media storage device (tapes, diskettes, flash drives, CDs, DVDs, etc.) contains classified documents or data that are being treated as a working documents ‐ then each individual working document on the media should be marked and handled as detailed above AND the media itself should be marked with the highest classification level, dated and marked "Working Documents". TACTICAL ENVIRONMENT APPLICABILITY: If classified working documents are found in a tactical environment they should be marked and handled according to the aforementioned guidance.


vuln_id: V-254825
rule_id: IS-05.01.01_rule
severity: CAT I
title: Storage/Handling of Classified Documents, Media, Equipment
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: 1. In areas containing SIPRNet assets ‐ Check to ensure that classified documents, information system (IS) equipment and removable media that is not under the direct personal control and observation of an authorized person is guarded or stored in a locked security container (GSA approved safe), vault, secure room, collateral classified open storage area or SCIF with protection equal to or exceeding the highest classification of the material/equipment. (CAT I) 2. Check to ensure that site security personnel develop written procedures for response to incidents of classified materials found not in secure storage or under continuous observation and control of a cleared employee and make the procedures readily available to each employee via electronic means, such as in space on an organizational intranet, shared folders or other means available. (CAT III) Procedures for response to classified materials discovered that are not in proper storage or under proper control of a cleared person must include the following: a. Site security personnel, security reviewers/inspectors, employees or anyone making discovery of classified material not in secure storage or under continuous observation and control of a cleared employee immediately take control and properly secure the classified materials not under proper control when not in approved storage. Second they must report the discovery to their supervisory chain and/or site security officials. (CAT III) b. Site security personnel must initiate a preliminary inquiry if appropriate to determine the cause of the improperly secure material and to determine if any material was lost or compromised (security incident). (CAT III) c. Site security personnel must conduct remedial training action subsequent to incidents of classified materials found not in secure storage or under continuous observation and control of a cleared employee to remind employees of procedures and requirements to maintain positive control of classified materials removed from approved storage. (CAT III) d. Site managers/supervisors must discipline employees, as appropriate who do not comply with appropriate requirements to maintain positive control of classified material they have removed from secure storage. (CAT III) 3. Check to ensure that’s site security personnel conduct initial and annual training to indoctrinate and remind employees of procedures and requirements to maintain positive control of classified materials removed from approved storage and measures to take upon discovery of classified material not in proper storage or under proper control of a cleared person. (CAT II) Suggested methodology for reviewers: During the review/walk‐around be observant for classified materials (documents media, and equipment) that have been removed from approved storage. Specifically look to determine if employees are maintaining positive control of the material. Unless a properly cleared employee is able to clearly see and control the material ‐ this will be a finding. The employee(s) must be specifically aware the classified material is in their area AND that they are responsible for ensuring it is controlled/protected. Just having cleared employee(s) “in the area” of the classified material or assuming other cleared employees in the area are responsible for the classified material is not sufficient control. An example of a possible finding is when someone working on a classified system departs their work space (cube environment) for lunch or other type of break and does not ask another cleared employee to take control of their classified equipment, documents or media OR does not place the classified hard drive, classified documents and classified media in approved storage. TACTICAL ENVIRONMENT: This check is applicable in a tactical environment. The only exception will be where there is a lack of permanent storage solutions for urgent (short term) tactical operations or other contingency situations. Primarily this involves field/mobile environments where fixed facilities and equipment are not yet present or incapable of being used. However, all classified equipment, documents or media not properly stored in a safe, vault or secure room must still be under the continuous observation and control of an appropriately cleared person.

check_text:
  Check Content: 1. In areas containing SIPRNet assets ‐ Check to ensure that classified documents, information system (IS) equipment and removable media that is not under the direct personal control and observation of an authorized person is guarded or stored in a locked security container (GSA approved safe), vault, secure room, collateral classified open storage area or SCIF with protection equal to or exceeding the highest classification of the material/equipment. (CAT I) 2. Check to ensure that site security personnel develop written procedures for response to incidents of classified materials found not in secure storage or under continuous observation and control of a cleared employee and make the procedures readily available to each employee via electronic means, such as in space on an organizational intranet, shared folders or other means available. (CAT III) Procedures for response to classified materials discovered that are not in proper storage or under proper control of a cleared person must include the following: a. Site security personnel, security reviewers/inspectors, employees or anyone making discovery of classified material not in secure storage or under continuous observation and control of a cleared employee immediately take control and properly secure the classified materials not under proper control when not in approved storage. Second they must report the discovery to their supervisory chain and/or site security officials. (CAT III) b. Site security personnel must initiate a preliminary inquiry if appropriate to determine the cause of the improperly secure material and to determine if any material was lost or compromised (security incident). (CAT III) c. Site security personnel must conduct remedial training action subsequent to incidents of classified materials found not in secure storage or under continuous observation and control of a cleared employee to remind employees of procedures and requirements to maintain positive control of classified materials removed from approved storage. (CAT III) d. Site managers/supervisors must discipline employees, as appropriate who do not comply with appropriate requirements to maintain positive control of classified material they have removed from secure storage. (CAT III) 3. Check to ensure that’s site security personnel conduct initial and annual training to indoctrinate and remind employees of procedures and requirements to maintain positive control of classified materials removed from approved storage and measures to take upon discovery of classified material not in proper storage or under proper control of a cleared person. (CAT II) Suggested methodology for reviewers: During the review/walk‐around be observant for classified materials (documents media, and equipment) that have been removed from approved storage. Specifically look to determine if employees are maintaining positive control of the material. Unless a properly cleared employee is able to clearly see and control the material ‐ this will be a finding. The employee(s) must be specifically aware the classified material is in their area AND that they are responsible for ensuring it is controlled/protected. Just having cleared employee(s) “in the area” of the classified material or assuming other cleared employees in the area are responsible for the classified material is not sufficient control. An example of a possible finding is when someone working on a classified system departs their work space (cube environment) for lunch or other type of break and does not ask another cleared employee to take control of their classified equipment, documents or media OR does not place the classified hard drive, classified documents and classified media in approved storage. TACTICAL ENVIRONMENT: This check is applicable in a tactical environment. The only exception will be where there is a lack of permanent storage solutions for urgent (short term) tactical operations or other contingency situations. Primarily this involves field/mobile environments where fixed facilities and equipment are not yet present or incapable of being used. However, all classified equipment, documents or media not properly stored in a safe, vault or secure room must still be under the continuous observation and control of an appropriately cleared person.


vuln_id: V-254826
rule_id: IS-06.03.01_rule
severity: CAT III
title: Non‐Disclosure Agreement ‐ Standard Form 312
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: The check is to review a sample of Personnel Security Records (minimum of 10% assigned military and civilian employees) to ensure SF 312s have been signed by persons granted access to classified information systems. The now outdated SF 189 or SF 189A, if found are still valid Non‐Disclosure Agreements (NDA). The execution of an NDA should also be annotated in the Joint Personnel Accountability System (JPAS). If a paper copy is found but the form is not in JPAS OR if it is annotated in JPAS and a paper copy is not on‐hand this is not a finding. TACTICAL ENVIRONMENT: This check is applicable in a tactical environment. Anyone with access to classified information must have signed an NDA. Paper copies of the signed NDA will likely not be available in a tactical area of operations; however, system access to JPAS should be possible if the theater of operations has been well established.

check_text:
  Check Content: The check is to review a sample of Personnel Security Records (minimum of 10% assigned military and civilian employees) to ensure SF 312s have been signed by persons granted access to classified information systems. The now outdated SF 189 or SF 189A, if found are still valid Non‐Disclosure Agreements (NDA). The execution of an NDA should also be annotated in the Joint Personnel Accountability System (JPAS). If a paper copy is found but the form is not in JPAS OR if it is annotated in JPAS and a paper copy is not on‐hand this is not a finding. TACTICAL ENVIRONMENT: This check is applicable in a tactical environment. Anyone with access to classified information must have signed an NDA. Paper copies of the signed NDA will likely not be available in a tactical area of operations; however, system access to JPAS should be possible if the theater of operations has been well established.


vuln_id: V-254827
rule_id: IS-07.03.01_rule
severity: CAT III
title: Handling of Classified Documents, Media, Equipment ‐ Written Procedures
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: 1. Check there are written procedures for handling classified material/equipment when removed from a security container and/or secure room. These procedures must thoroughly cover all aspects of protection and storage of classified materials and be made readily available to each employee via electronic means, such as in space on an organizational intranet, shared folders or other means available. (CAT III) 2. Check training logs (initial and annual refresher) that all employees granted access to classified are briefed on proper handling procedures e.g., use of cover sheets, maintaining positive control of the material, marking/labeling, access by vendors, determining clearance and need‐to‐know before release, reproduction, etc. (CAT III) TACTICAL ENVIRONMENT: The check is applicable for fixed tactical classified processing environments. Not applicable to a field/mobile environment.

check_text:
  Check Content: 1. Check there are written procedures for handling classified material/equipment when removed from a security container and/or secure room. These procedures must thoroughly cover all aspects of protection and storage of classified materials and be made readily available to each employee via electronic means, such as in space on an organizational intranet, shared folders or other means available. (CAT III) 2. Check training logs (initial and annual refresher) that all employees granted access to classified are briefed on proper handling procedures e.g., use of cover sheets, maintaining positive control of the material, marking/labeling, access by vendors, determining clearance and need‐to‐know before release, reproduction, etc. (CAT III) TACTICAL ENVIRONMENT: The check is applicable for fixed tactical classified processing environments. Not applicable to a field/mobile environment.


vuln_id: V-254828
rule_id: IS-07.03.02_rule
severity: CAT III
title: Handling of Classified ‐ Use of Cover Sheets
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: During the review/walk‐around be observant for classified documents without cover sheets. Unless an employee is specifically working on the document ‐ a cover sheet must be placed on it to ensure classified information is not inadvertently exposed. If the document without a cover sheet is located in a SCIF, Secret or TS vault or secure room ‐ this should not be written as a finding; however, highly recommend use of cover sheets as a best security practice for enforcement of need‐to‐know. If the document w/o cover sheet is found in a Secret Controlled Access Area (CAA) or below, this should be made a finding. TACTICAL ENVIRONMENT: The check is applicable for fixed tactical classified processing environments. It is assumed the type of equipment referenced will be in a fixed environment. Not applicable to a field/mobile environment.

check_text:
  Check Content: During the review/walk‐around be observant for classified documents without cover sheets. Unless an employee is specifically working on the document ‐ a cover sheet must be placed on it to ensure classified information is not inadvertently exposed. If the document without a cover sheet is located in a SCIF, Secret or TS vault or secure room ‐ this should not be written as a finding; however, highly recommend use of cover sheets as a best security practice for enforcement of need‐to‐know. If the document w/o cover sheet is found in a Secret Controlled Access Area (CAA) or below, this should be made a finding. TACTICAL ENVIRONMENT: The check is applicable for fixed tactical classified processing environments. It is assumed the type of equipment referenced will be in a fixed environment. Not applicable to a field/mobile environment.


vuln_id: V-254829
rule_id: IS-08.01.01_rule
severity: CAT I
title: Classified Monitors/Displays
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: BACKGROUND NOTE: This requirement includes both situations where there is primarily a US Classified processing environment (no routine Foreign National (FN) presence) AND also contains guidance to be used for environments where FN are employed or present. It is arranged first by GUIDELINES FOR SITES WITHOUT A FN PRESENCE followed by GUIDELINES FOR ENVIRONMENTS WITH FN PRESENCE. Following a lengthy discussion of the guidelines and considerations, the specific checks for this requirement are found, along with the default severity level applicable to each check. Finally, guidance for applicability to tactical environments is provided. GUIDELINES FOR SITES WITHOUT A FN PRESENCE: The following physical controls should be used (individually or collectively) as a guide to evaluate compliance and can be recommended for site use; however, any method or combination of methods clearly being used successfully by the site under review may be acceptable. POSSIBLE SOLUTIONS: 1. The best physical control solution is to locate all US Only classified terminals (open SIPRNet) in areas where only persons with at least a secret (or higher) security clearance have unescorted access. This type of area is commonly known as a secret Controlled Access Area (CAA). Placement of classified terminals in more highly controlled spaces like in secret or top secret (TS) vaults or secure rooms or SCIFs meets the access control requirements of a secret or TS CAA in addition to providing superior physical security of the location. Such additional physical security protection may be appropriate depending on organization mission and need to continually maintain classified information processing equipment within an open storage environment. 2. Regardless of the type of environment in which classified work stations/monitors are located, ensuring that uncleared persons or those without need‐to‐know do not have easy access or inadvertent visibility to the classified monitor screens can be accomplished by placing (grouping together) the classified work stations in the back of such rooms/areas or behind partitions. This ensures uncleared visitors have limited opportunity to walk by a classified monitor and inadvertently be exposed to classified data. 3. If isolation (grouping in controlled space) of the terminals is not practical, a privacy filter should be placed on each classified (SIPRNET) monitor to prevent ease of observation by any unauthorized individual simply passing by. This is a good idea even if other physical controls of classified work stations are used. The use of the privacy filters is an excellent alternative solution where physical separation or repositioning of monitors in rooms is not possible due to space limitations. 4. Classified monitor screens should not be placed facing doorways or windows through which public or unrestricted viewing of the monitor is possible. If space limitations do not allow for such placement then ensuring doors are closed or that windows are covered by screens or blinds during classified processing can be used ‐ but only if this procedure is part of documented security procedures and security training. 5. Finally a solution for areas where work stations (cubes) are used is to place doors or the less costly cube screens across the openings for use when classified work is being conducted. ABSOLUTE REQUIREMENTS: While the “possible solutions” cover a range of suggest compliance possibilities the following covers an absolute requirement for which there can be no exception: 1. When uncleared visitors need to enter CAAs, secure rooms, vaults or SCIFs where classified work stations are located there must be a procedure to ensure their presence is announced before entering. This will allow time for screens and classified material to be covered from view. 2. All uncleared visitors must be under continuous escort by a properly cleared employee while within the CAA/secure room/vault/or SCIF. GUIDELINES FOR ENVIRONMENTS WITH FN PRESENCE: Environments where FN are present (may even be embedded as US DoD employees) require even more diligence and additional considerations for protection of US Only classified (SIPRNet) terminal screens/workstation screens/ and monitors. This is because while sharing of certain specific classified information may be permitted, there is always the possibility that US Only or NOFORN information may also be present within the physical environment or accessible on visible/unprotected workstation screens. Foreign Nationals, even if they are embedded partners in US DoD operations, are not afforded access to any and all US classified information. This erroneous assumption is prevalent in many CC/S/A operation centers where FN liaison and exchange personnel are routinely present. Release of US classified information can only be made to FN partners if specifically compliant with National Disclosure Policy, has been determined releasable to the Foreign National’s host country and a Delegation of Disclosure Letter (DDL) has been issued to the specific FN partner to support the release of US classified information or material. *Where FN are present (regardless of their authorized physical and systems access or security clearance) ‐ US Only work stations and network equipment must be under strict US control at all times. This process involves a combination of physical control measures AND employee awareness. Reviewers must use a flexible approach with an understanding of the synergistic relationship of physical controls and employee awareness to properly evaluate compliance. REGULATORY STANDARD FOR ENVIRONMENTS WITH FN PRESENCE: This relationship of physical protective measures with employee awareness gained through procedures and training is based on the following excerpt from CJCSI 6510‐01F: In areas where there is the potential for Foreign National Access to U.S.‐Only Workstations and Network Equipment, CC/S/As shall: 1. Maintain strict U.S. control of U.S.‐only workstations and network equipment at all times. This includes network equipment such as printers, copiers, and faxes. 2. Group U.S.‐only workstations together in a U.S.‐controlled workstation space when workstations are located in workspaces physically accessible by foreign nationals (such as combined operations centers). 3. If the grouping of U.S.‐only workstations at a site is not operationally possible, the following steps shall be taken: a. The U.S. command or agency shall authorize an exception at the site, in writing, stating operational reasons for exception, and maintain the record of exception. NOTE: this exception must be approved by the appropriate CC/S/A level of command, which is normally a 3 or 4 star Flag Officer. b. Develop, publish, and maintain specific site written procedures on security measures to safeguard U.S.‐only classified workstations. c. Ensure that U.S. personnel are briefed and enforce security measures. 4. Announce presence. If a foreign national is permitted access to U.S.‐controlled workstation space, the individual must be announced, must wear a badge clearly identifying him or her as a foreign national, and must be escorted at all times. In addition, a warning light must be activated if available and screens must be covered or blanked. 5. If the foreign national is permitted to view the screen, U.S. personnel must ensure: a. Information is releasable in accordance with CC/S/A guidance and shall be consistent with National Disclosure Policy (NDP)‐1; DoDD 5230.11; DoDD 5230.20; DoD Manual 5200.01; and CJCSI 5221.01. b. Check with organization security office to ensure foreign national has security clearances granted by his or her government at a level equal to that of the classified information involved and an official need‐to‐know.

check_text:
  Check Content: BACKGROUND NOTE: This requirement includes both situations where there is primarily a US Classified processing environment (no routine Foreign National (FN) presence) AND also contains guidance to be used for environments where FN are employed or present. It is arranged first by GUIDELINES FOR SITES WITHOUT A FN PRESENCE followed by GUIDELINES FOR ENVIRONMENTS WITH FN PRESENCE. Following a lengthy discussion of the guidelines and considerations, the specific checks for this requirement are found, along with the default severity level applicable to each check. Finally, guidance for applicability to tactical environments is provided. GUIDELINES FOR SITES WITHOUT A FN PRESENCE: The following physical controls should be used (individually or collectively) as a guide to evaluate compliance and can be recommended for site use; however, any method or combination of methods clearly being used successfully by the site under review may be acceptable. POSSIBLE SOLUTIONS: 1. The best physical control solution is to locate all US Only classified terminals (open SIPRNet) in areas where only persons with at least a secret (or higher) security clearance have unescorted access. This type of area is commonly known as a secret Controlled Access Area (CAA). Placement of classified terminals in more highly controlled spaces like in secret or top secret (TS) vaults or secure rooms or SCIFs meets the access control requirements of a secret or TS CAA in addition to providing superior physical security of the location. Such additional physical security protection may be appropriate depending on organization mission and need to continually maintain classified information processing equipment within an open storage environment. 2. Regardless of the type of environment in which classified work stations/monitors are located, ensuring that uncleared persons or those without need‐to‐know do not have easy access or inadvertent visibility to the classified monitor screens can be accomplished by placing (grouping together) the classified work stations in the back of such rooms/areas or behind partitions. This ensures uncleared visitors have limited opportunity to walk by a classified monitor and inadvertently be exposed to classified data. 3. If isolation (grouping in controlled space) of the terminals is not practical, a privacy filter should be placed on each classified (SIPRNET) monitor to prevent ease of observation by any unauthorized individual simply passing by. This is a good idea even if other physical controls of classified work stations are used. The use of the privacy filters is an excellent alternative solution where physical separation or repositioning of monitors in rooms is not possible due to space limitations. 4. Classified monitor screens should not be placed facing doorways or windows through which public or unrestricted viewing of the monitor is possible. If space limitations do not allow for such placement then ensuring doors are closed or that windows are covered by screens or blinds during classified processing can be used ‐ but only if this procedure is part of documented security procedures and security training. 5. Finally a solution for areas where work stations (cubes) are used is to place doors or the less costly cube screens across the openings for use when classified work is being conducted. ABSOLUTE REQUIREMENTS: While the “possible solutions” cover a range of suggest compliance possibilities the following covers an absolute requirement for which there can be no exception: 1. When uncleared visitors need to enter CAAs, secure rooms, vaults or SCIFs where classified work stations are located there must be a procedure to ensure their presence is announced before entering. This will allow time for screens and classified material to be covered from view. 2. All uncleared visitors must be under continuous escort by a properly cleared employee while within the CAA/secure room/vault/or SCIF. GUIDELINES FOR ENVIRONMENTS WITH FN PRESENCE: Environments where FN are present (may even be embedded as US DoD employees) require even more diligence and additional considerations for protection of US Only classified (SIPRNet) terminal screens/workstation screens/ and monitors. This is because while sharing of certain specific classified information may be permitted, there is always the possibility that US Only or NOFORN information may also be present within the physical environment or accessible on visible/unprotected workstation screens. Foreign Nationals, even if they are embedded partners in US DoD operations, are not afforded access to any and all US classified information. This erroneous assumption is prevalent in many CC/S/A operation centers where FN liaison and exchange personnel are routinely present. Release of US classified information can only be made to FN partners if specifically compliant with National Disclosure Policy, has been determined releasable to the Foreign National’s host country and a Delegation of Disclosure Letter (DDL) has been issued to the specific FN partner to support the release of US classified information or material. *Where FN are present (regardless of their authorized physical and systems access or security clearance) ‐ US Only work stations and network equipment must be under strict US control at all times. This process involves a combination of physical control measures AND employee awareness. Reviewers must use a flexible approach with an understanding of the synergistic relationship of physical controls and employee awareness to properly evaluate compliance. REGULATORY STANDARD FOR ENVIRONMENTS WITH FN PRESENCE: This relationship of physical protective measures with employee awareness gained through procedures and training is based on the following excerpt from CJCSI 6510‐01F: In areas where there is the potential for Foreign National Access to U.S.‐Only Workstations and Network Equipment, CC/S/As shall: 1. Maintain strict U.S. control of U.S.‐only workstations and network equipment at all times. This includes network equipment such as printers, copiers, and faxes. 2. Group U.S.‐only workstations together in a U.S.‐controlled workstation space when workstations are located in workspaces physically accessible by foreign nationals (such as combined operations centers). 3. If the grouping of U.S.‐only workstations at a site is not operationally possible, the following steps shall be taken: a. The U.S. command or agency shall authorize an exception at the site, in writing, stating operational reasons for exception, and maintain the record of exception. NOTE: this exception must be approved by the appropriate CC/S/A level of command, which is normally a 3 or 4 star Flag Officer. b. Develop, publish, and maintain specific site written procedures on security measures to safeguard U.S.‐only classified workstations. c. Ensure that U.S. personnel are briefed and enforce security measures. 4. Announce presence. If a foreign national is permitted access to U.S.‐controlled workstation space, the individual must be announced, must wear a badge clearly identifying him or her as a foreign national, and must be escorted at all times. In addition, a warning light must be activated if available and screens must be covered or blanked. 5. If the foreign national is permitted to view the screen, U.S. personnel must ensure: a. Information is releasable in accordance with CC/S/A guidance and shall be consistent with National Disclosure Policy (NDP)‐1; DoDD 5230.11; DoDD 5230.20; DoD Manual 5200.01; and CJCSI 5221.01. b. Check with organization security office to ensure foreign national has security clearances granted by his or her government at a level equal to that of the classified information involved and an official need‐to‐know.


vuln_id: V-254830
rule_id: IS-08.01.02_rule
severity: CAT I
title: Monitor Screens ‐ Disable Access by CAC or Token Removal
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: Check to ensure: 1. SIPRNet servers and/or work station hard drives/monitors/keyboards are disabled (locked) by CAC or Token Removal, or where CACs or tokens are not used the Computer must be locked via Ctrl/Alt/Del ‐ when not personally and physically attended by properly vetted and cleared US personnel. (CAT I) 2. NIPRNet servers and/or work station hard drives/monitors/keyboards (*used by system administrators with privileged access) are disabled (locked) by CAC or Token Removal, or where CACs or tokens are not used the Computer must be locked via Ctrl/Alt/Del ‐ when not personally and physically attended by properly vetted US personnel. (CAT I) 3. NIPRNet work station hard drives/monitors/keyboards (*used by general users or individuals without privileged systems access) are disabled (locked) by CAC or Token Removal, or where CACs or tokens are not used the Computer must be locked via Ctrl/Alt/Del ‐ when not personally and physically attended by properly vetted US personnel. (CAT II) 4. CACs and other tokens are not left unattended and are in the physical custody of the person to whom they were issued. (CAT II) TACTICAL ENVIRONMENT: This check is applicable to all environments (including a field/mobile tactical environment) where information system assets are connected to the DISN.

check_text:
  Check Content: Check to ensure: 1. SIPRNet servers and/or work station hard drives/monitors/keyboards are disabled (locked) by CAC or Token Removal, or where CACs or tokens are not used the Computer must be locked via Ctrl/Alt/Del ‐ when not personally and physically attended by properly vetted and cleared US personnel. (CAT I) 2. NIPRNet servers and/or work station hard drives/monitors/keyboards (*used by system administrators with privileged access) are disabled (locked) by CAC or Token Removal, or where CACs or tokens are not used the Computer must be locked via Ctrl/Alt/Del ‐ when not personally and physically attended by properly vetted US personnel. (CAT I) 3. NIPRNet work station hard drives/monitors/keyboards (*used by general users or individuals without privileged systems access) are disabled (locked) by CAC or Token Removal, or where CACs or tokens are not used the Computer must be locked via Ctrl/Alt/Del ‐ when not personally and physically attended by properly vetted US personnel. (CAT II) 4. CACs and other tokens are not left unattended and are in the physical custody of the person to whom they were issued. (CAT II) TACTICAL ENVIRONMENT: This check is applicable to all environments (including a field/mobile tactical environment) where information system assets are connected to the DISN.


vuln_id: V-254831
rule_id: IS-08.03.01_rule
severity: CAT III
title: Classified Monitors/Displays Procedures for Obscuration
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: Check to ensure there are written procedures for employees to follow to keep classified monitors from being viewed by unauthorized persons. Procedures should include when to cover or turn‐off classified monitors ‐ such as when visitors are announced, importance of maintaining monitor positioning for privacy, pulling of window shades, blinds, etc. Procedures must be tailored to the physical environment and mission operations of the organization. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments. Not applicable to a field/mobile environment.

check_text:
  Check Content: Check to ensure there are written procedures for employees to follow to keep classified monitors from being viewed by unauthorized persons. Procedures should include when to cover or turn‐off classified monitors ‐ such as when visitors are announced, importance of maintaining monitor positioning for privacy, pulling of window shades, blinds, etc. Procedures must be tailored to the physical environment and mission operations of the organization. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments. Not applicable to a field/mobile environment.


vuln_id: V-254832
rule_id: IS-09.02.01_rule
severity: CAT II
title: End‐of‐Day Checks ‐ SF 701
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: Organizations that process or store classified information must establish a system of security checks at the close of each duty and/or business day to ensure that any area where classified information is used or stored is secure. SF 701, “Activity Security Checklist,” shall be used to record such checks. An integral part of the security check system shall be the securing of all vaults, secure rooms, and containers used for storing classified material. SF 702, “Security Container Check Sheet,” shall be used to record each opening, closing, and verification checks of these storage mediums. Area verification checks will be recorded on the SF 701 upon completion of end‐of‐day checks. Recommended end‐of‐day checks, which should be included on the SF 701 are: a. Activation of Intrusion Detection System (IDS) alarm sensors where applicable. b. All classified material has been properly stored. c. Removal of CAC Cards and SIPRNet tokens from workstations. d. All windows, doors or other openings are properly secured. e. Verification of lock box closure for SIPRNet wall jacks and PDS lines, where applicable. f. Additional checks such as turning off of coffee pots and lights, power‐off of printers/MFDs, securing of STE keys, etc. can be identified and accomplished as part of the check. g. The SF 701, Activity Security Checklist shall be used to record these checks, to include after hours, weekend and holiday activities. Results of end‐of‐day checks (SF 701 forms) should be retained for at least 30 days after completion of the monthly form (or otherwise as required by Component records management schedules) to ensure availability for audits and resolution of subsequent discovery of security incidents or discrepancies. TACTICAL ENVIRONMENT: This check is applicable in a fixed operational facility in a tactical environment if classified equipment is used or documents or media are created/extracted from the SIPRNet. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.

check_text:
  Check Content: Organizations that process or store classified information must establish a system of security checks at the close of each duty and/or business day to ensure that any area where classified information is used or stored is secure. SF 701, “Activity Security Checklist,” shall be used to record such checks. An integral part of the security check system shall be the securing of all vaults, secure rooms, and containers used for storing classified material. SF 702, “Security Container Check Sheet,” shall be used to record each opening, closing, and verification checks of these storage mediums. Area verification checks will be recorded on the SF 701 upon completion of end‐of‐day checks. Recommended end‐of‐day checks, which should be included on the SF 701 are: a. Activation of Intrusion Detection System (IDS) alarm sensors where applicable. b. All classified material has been properly stored. c. Removal of CAC Cards and SIPRNet tokens from workstations. d. All windows, doors or other openings are properly secured. e. Verification of lock box closure for SIPRNet wall jacks and PDS lines, where applicable. f. Additional checks such as turning off of coffee pots and lights, power‐off of printers/MFDs, securing of STE keys, etc. can be identified and accomplished as part of the check. g. The SF 701, Activity Security Checklist shall be used to record these checks, to include after hours, weekend and holiday activities. Results of end‐of‐day checks (SF 701 forms) should be retained for at least 30 days after completion of the monthly form (or otherwise as required by Component records management schedules) to ensure availability for audits and resolution of subsequent discovery of security incidents or discrepancies. TACTICAL ENVIRONMENT: This check is applicable in a fixed operational facility in a tactical environment if classified equipment is used or documents or media are created/extracted from the SIPRNet. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254833
rule_id: IS-10.01.01_rule
severity: CAT I
title: Classified Reproduction ‐ SIPRNet Connected Classified Multi‐Functional Devices (MFD)
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Checks: 1. Unless the MFD can be properly purged and sanitized (made unclassified) of all classified data or images after each use for classified ‐ it must be housed in an area approved for open storage of classified material. Most current copiers, printers, scanners and facsimile machines or multi‐functional devices (MFD) contain hard drives that collect and store images and data. Therefore check to ensure that such machines are maintained in space approved for open storage of classified (secret or higher for SIPRNet). NOTE that to be properly sanitized means that the MFD can be treated as an unclassified piece of equipment once a successful purge of data or images is completed. (CAT I) 2. If not maintained within a secret or higher collateral classified open storage area: Check that MFD (or individual copiers, scanners, printers or facsimile machines) do not have hard drives containing non‐volatile memory in the device and that the volatile memory is purged/sanitized of all classified data or images after each use. Additionally check that these MFD are maintained in space where access is controlled to at least the level of the classified material authorized to be copied on the machine. This type of area is referred to as a Controlled Access Area (CAA) – at least a secret CAA or TS CAA for SIPRNet connections. ONLY those MFD with entirely volatile memory can be sanitized and reused upon removal of power from the device. Check to ensure that powering down the machine is a part of the MFD sanitization procedure to ensure that volatile memory is totally erased and sanitized so that it can be considered to be an unclassified device. Documented procedures must be on‐hand for this process. NOTE: Sanitizing a MFD means it can be considered and treated as an unclassified device. Hard drives with non‐volatile memory cannot be sanitized by current overwriting/clearing procedures and must be destroyed (degaussing and/or physical destruction) to be considered sanitized/unclassified. Hence MFD with non‐volatile memory cannot be sanitized for reuse. Only MFD with volatile memory can be sanitized for reuse. Only if ALL of the sub‐checks listed under check 2 are compliant is it a CAT II finding. Otherwise if ANY of the sub‐checks are not compliant it remains a CAT I finding. (CAT II) 3. If not maintained within a secret or higher collateral classified open storage area and hard drives with non‐volatile memory are present: Check to ensure MFD (or individual copiers, scanners, printers or facsimile machines) are located in a secret or higher CAA and the hard drive is promptly removed after each use and stored in a GSA approved safe. Check to ensure that powering down the machine is a required part of this procedure to ensure that volatile memory is totally erased and sanitized so that it can be considered to be an unclassified device. Check that documented procedures are on hand to support this process. Only if ALL of the sub‐checks listed under check 3 are compliant is it a CAT II finding. Otherwise if ANY of the sub‐checks are not compliant it remains a CAT I finding. (CAT II) EXPLANATION for CAT II FINDINGS: Despite the mitigations in checks 2 and 3 above, there is still a concern that the mitigation procedure will not be accomplished promptly or successfully each time and there is a risk for printed or copied classified documents to be left unattended for periods of time in the networked MFD machines, especially when printed from a remote workstation location. Therefore, since a potential vulnerability still exists it is still considered as a CAT II finding. TACTICAL ENVIRONMENT: This check is applicable in a fixed operational facility in a tactical environment if classified equipment is used or documents or media are created/extracted from the SIPRNet. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.

check_text:
  Checks: 1. Unless the MFD can be properly purged and sanitized (made unclassified) of all classified data or images after each use for classified ‐ it must be housed in an area approved for open storage of classified material. Most current copiers, printers, scanners and facsimile machines or multi‐functional devices (MFD) contain hard drives that collect and store images and data. Therefore check to ensure that such machines are maintained in space approved for open storage of classified (secret or higher for SIPRNet). NOTE that to be properly sanitized means that the MFD can be treated as an unclassified piece of equipment once a successful purge of data or images is completed. (CAT I) 2. If not maintained within a secret or higher collateral classified open storage area: Check that MFD (or individual copiers, scanners, printers or facsimile machines) do not have hard drives containing non‐volatile memory in the device and that the volatile memory is purged/sanitized of all classified data or images after each use. Additionally check that these MFD are maintained in space where access is controlled to at least the level of the classified material authorized to be copied on the machine. This type of area is referred to as a Controlled Access Area (CAA) – at least a secret CAA or TS CAA for SIPRNet connections. ONLY those MFD with entirely volatile memory can be sanitized and reused upon removal of power from the device. Check to ensure that powering down the machine is a part of the MFD sanitization procedure to ensure that volatile memory is totally erased and sanitized so that it can be considered to be an unclassified device. Documented procedures must be on‐hand for this process. NOTE: Sanitizing a MFD means it can be considered and treated as an unclassified device. Hard drives with non‐volatile memory cannot be sanitized by current overwriting/clearing procedures and must be destroyed (degaussing and/or physical destruction) to be considered sanitized/unclassified. Hence MFD with non‐volatile memory cannot be sanitized for reuse. Only MFD with volatile memory can be sanitized for reuse. Only if ALL of the sub‐checks listed under check 2 are compliant is it a CAT II finding. Otherwise if ANY of the sub‐checks are not compliant it remains a CAT I finding. (CAT II) 3. If not maintained within a secret or higher collateral classified open storage area and hard drives with non‐volatile memory are present: Check to ensure MFD (or individual copiers, scanners, printers or facsimile machines) are located in a secret or higher CAA and the hard drive is promptly removed after each use and stored in a GSA approved safe. Check to ensure that powering down the machine is a required part of this procedure to ensure that volatile memory is totally erased and sanitized so that it can be considered to be an unclassified device. Check that documented procedures are on hand to support this process. Only if ALL of the sub‐checks listed under check 3 are compliant is it a CAT II finding. Otherwise if ANY of the sub‐checks are not compliant it remains a CAT I finding. (CAT II) EXPLANATION for CAT II FINDINGS: Despite the mitigations in checks 2 and 3 above, there is still a concern that the mitigation procedure will not be accomplished promptly or successfully each time and there is a risk for printed or copied classified documents to be left unattended for periods of time in the networked MFD machines, especially when printed from a remote workstation location. Therefore, since a potential vulnerability still exists it is still considered as a CAT II finding. TACTICAL ENVIRONMENT: This check is applicable in a fixed operational facility in a tactical environment if classified equipment is used or documents or media are created/extracted from the SIPRNet. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254834
rule_id: IS-10.02.01_rule
severity: CAT II
title: Classified Reproduction
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: General guidance: Paper copies, electronic files, and other material containing classified information shall be reproduced only when necessary for accomplishing the organizations mission or for complying with applicable statutes or Directives. Personnel reproducing classified information must be knowledgeable of the procedures for classified reproduction and aware of the risks involved with the specific reproduction equipment and media being used and the appropriate countermeasures they are required to take. Reproduced material is to be placed under the same accountability and control requirements as applied to the original material. Classified material is to be reproduced only on approved and when applicable, properly accredited systems. This check concerns ONLY reproduction and/or transfer of classified data using all forms of removable media on SIPRNet connected devices or systems. Check to ensure that US Cybercom Communications Tasking Order (CTO) 10‐133A is being complied with as follows: 1. Ensure that the write capability for all possible removable media is disabled as a default setting on all SIPRNet connected machines. 2. Ensure that write settings are only allowed when specifically approved by using the HBSS Device Control Module (DCM). 3. Ensure the system AO has specifically approved all persons authorized to transfer data from SIPRNet connected system components. 4. Ensure the ISSM maintains a list of all persons authorized by the AO to transfer data from the SIPRNet. 5. Ensure there are written procedures approved by the AO for use of removable media on SIPRNet. NOTE: Coordination with Technical Reviewers may be required to determine all of the information outlined above. TACTICAL ENVIRONMENT: This check is applicable in a fixed operational facility in a tactical environment if classified equipment is used or documents or media are created/extracted from the SIPRNet. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.

check_text:
  Check Content: General guidance: Paper copies, electronic files, and other material containing classified information shall be reproduced only when necessary for accomplishing the organizations mission or for complying with applicable statutes or Directives. Personnel reproducing classified information must be knowledgeable of the procedures for classified reproduction and aware of the risks involved with the specific reproduction equipment and media being used and the appropriate countermeasures they are required to take. Reproduced material is to be placed under the same accountability and control requirements as applied to the original material. Classified material is to be reproduced only on approved and when applicable, properly accredited systems. This check concerns ONLY reproduction and/or transfer of classified data using all forms of removable media on SIPRNet connected devices or systems. Check to ensure that US Cybercom Communications Tasking Order (CTO) 10‐133A is being complied with as follows: 1. Ensure that the write capability for all possible removable media is disabled as a default setting on all SIPRNet connected machines. 2. Ensure that write settings are only allowed when specifically approved by using the HBSS Device Control Module (DCM). 3. Ensure the system AO has specifically approved all persons authorized to transfer data from SIPRNet connected system components. 4. Ensure the ISSM maintains a list of all persons authorized by the AO to transfer data from the SIPRNet. 5. Ensure there are written procedures approved by the AO for use of removable media on SIPRNet. NOTE: Coordination with Technical Reviewers may be required to determine all of the information outlined above. TACTICAL ENVIRONMENT: This check is applicable in a fixed operational facility in a tactical environment if classified equipment is used or documents or media are created/extracted from the SIPRNet. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254835
rule_id: IS-10.03.01_rule
severity: CAT III
title: Classified Reproduction ‐ Written Procedures
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: Classified Reproduction ‐ Document Copying using Multi‐Functional Device (MFD) machines (i.e., printer, copier, fax, and scanner) connected to SIPRNet. This STIG Check concerns ONLY PROCEDURES for the reproduction of classified DOCUMENTS on Multi‐Functional Devices (MFD) connected to the DoDIN. General guidance: Paper copies, electronic files, and other material containing classified information shall be reproduced only when necessary for accomplishing the organization’s mission or for complying with applicable statutes or Directives. Personnel reproducing classified information must be knowledgeable of the procedures for classified reproduction and aware of the risks involved with the specific reproduction equipment being used and the appropriate countermeasures they are required to take. Reproduced material is to be placed under the same accountability and control requirements as applied to the original material. Classified material is to be reproduced only on approved and, when applicable, properly accredited systems. Check to ensure: Check #1. Procedures for the proper reproduction of classified documents are posted on or near the MFD approved for classified reproduction. This is especially true when the MFD is capable of directly making copies of documents on the machine. The procedures must alert users when the particular MFD is approved for classified reproduction. Check #2. Other MFD (used as copiers) in the organization that are not approved for classified document reproduction must also be marked to alert users of the prohibition against making classified copies. Check #3. Procedures posted near the MFD must contain steps for users to take after printing, copying, scanning or faxing classified documents. Steps must include double checking of the MFD for missed pages, counting original and copied pages, purging or clearing of images from the MFD (if applicable), use of cover sheets, and general protection/control guidelines for reproduced documents. NOTE: Most MFD contain both hard drives (non‐volatile memory) and volatile memory and cannot be properly sanitized of classified data or images to make the MFD unclassified. Therefore, most (if not all) classified MFD should be housed and operated within space approved for collateral classified open storage. If not maintained in spaces approved for classified open storage all MFD with non‐volatile memory that is used for classified reproduction must be under the continuous observation and control of a cleared person AT ALL TIMES. A violation of this is a Category 1 Severity level finding and is covered under: STIG ID: IS‐10.01.01, Vuln ID: V‐32008. TACTICAL ENVIRONMENT: This check is applicable in a fixed operational facility in a tactical environment if classified equipment is used or documents or media are created/extracted from the SIPRNet. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.

check_text:
  Check Content: Classified Reproduction ‐ Document Copying using Multi‐Functional Device (MFD) machines (i.e., printer, copier, fax, and scanner) connected to SIPRNet. This STIG Check concerns ONLY PROCEDURES for the reproduction of classified DOCUMENTS on Multi‐Functional Devices (MFD) connected to the DoDIN. General guidance: Paper copies, electronic files, and other material containing classified information shall be reproduced only when necessary for accomplishing the organization’s mission or for complying with applicable statutes or Directives. Personnel reproducing classified information must be knowledgeable of the procedures for classified reproduction and aware of the risks involved with the specific reproduction equipment being used and the appropriate countermeasures they are required to take. Reproduced material is to be placed under the same accountability and control requirements as applied to the original material. Classified material is to be reproduced only on approved and, when applicable, properly accredited systems. Check to ensure: Check #1. Procedures for the proper reproduction of classified documents are posted on or near the MFD approved for classified reproduction. This is especially true when the MFD is capable of directly making copies of documents on the machine. The procedures must alert users when the particular MFD is approved for classified reproduction. Check #2. Other MFD (used as copiers) in the organization that are not approved for classified document reproduction must also be marked to alert users of the prohibition against making classified copies. Check #3. Procedures posted near the MFD must contain steps for users to take after printing, copying, scanning or faxing classified documents. Steps must include double checking of the MFD for missed pages, counting original and copied pages, purging or clearing of images from the MFD (if applicable), use of cover sheets, and general protection/control guidelines for reproduced documents. NOTE: Most MFD contain both hard drives (non‐volatile memory) and volatile memory and cannot be properly sanitized of classified data or images to make the MFD unclassified. Therefore, most (if not all) classified MFD should be housed and operated within space approved for collateral classified open storage. If not maintained in spaces approved for classified open storage all MFD with non‐volatile memory that is used for classified reproduction must be under the continuous observation and control of a cleared person AT ALL TIMES. A violation of this is a Category 1 Severity level finding and is covered under: STIG ID: IS‐10.01.01, Vuln ID: V‐32008. TACTICAL ENVIRONMENT: This check is applicable in a fixed operational facility in a tactical environment if classified equipment is used or documents or media are created/extracted from the SIPRNet. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.


vuln_id: V-254836
rule_id: IS-11.01.01_rule
severity: CAT I
title: Destruction of Classified Documents
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: General Guidance: Classified documents and paper material identified for destruction shall be destroyed completely, to prevent anyone from reconstructing the classified information. Effective January 1, 2011, only equipment listed on an evaluated products list (EPL) issued by NSA may be used to destroy classified information. (1) Equipment approved for use prior to January 1, 2011, and not found on the appropriate EPL may be used for destruction of classified information until December 31, 2016. (2) Unless determined otherwise by NSA, whenever an EPL is revised, equipment removed from the EPL may be utilized for destruction of classified information for up to 6 years from the date of its removal from the EPL. (3) In all cases, if any such previously approved equipment needs to be replaced or otherwise requires a rebuild or replacement of a critical assembly (e.g., shredder blade assembly), the unit must be replaced with one listed on the appropriate EPL. The EPLs and further guidance may be obtained by calling (410) 854‐6358 or at http://www.nsa.gov/ia/guidance/media_destruction_guidance/index.shtml.

check_text:
  Check Content: General Guidance: Classified documents and paper material identified for destruction shall be destroyed completely, to prevent anyone from reconstructing the classified information. Effective January 1, 2011, only equipment listed on an evaluated products list (EPL) issued by NSA may be used to destroy classified information. (1) Equipment approved for use prior to January 1, 2011, and not found on the appropriate EPL may be used for destruction of classified information until December 31, 2016. (2) Unless determined otherwise by NSA, whenever an EPL is revised, equipment removed from the EPL may be utilized for destruction of classified information for up to 6 years from the date of its removal from the EPL. (3) In all cases, if any such previously approved equipment needs to be replaced or otherwise requires a rebuild or replacement of a critical assembly (e.g., shredder blade assembly), the unit must be replaced with one listed on the appropriate EPL. The EPLs and further guidance may be obtained by calling (410) 854‐6358 or at http://www.nsa.gov/ia/guidance/media_destruction_guidance/index.shtml.


vuln_id: V-254837
rule_id: IS-11.01.02_rule
severity: CAT I
title: Classified Material Destruction (AIS harddrives)
created_at: 2026-02-02 23:35:39
updated_at: 2026-02-10 04:15:00
description:
  Check Content: For CLASSIFIED automated information system (AIS) data processing and/or storage equipment such as hard drives and media: Check to ensure data processing or storage devices are properly sanitized (purged of all classified data so that recovery using known laboratory attack is not possible) in accordance with current NSA guidance before such equipment or media is disposed of or placed in use (and/or stored) in a lower classification environment or an unclassified environment. Note 1: Clearing procedures using overwrite software is not sufficient to dispose of classified equipment or media (for instance by release to property disposal, vendors, or placement in trash) or to re‐use it in an unclassified or lesser classification environment other than its original classification level. Clearing will only enable the equipment or media to be re‐used within the original classified environment. NOTE 2: NSA guidance can be found in the NSA/CSA Policy Manual 9‐12, NSA/CSS Storage Device Declassification Manual. Be certain to also read and apply specific guidance for the DoD from Enclosure 3 and Enclosure 7 of Volume 3 of DoD Manual 5200.01. Important excerpts from this guidance pertaining to disposal of classified equipment and storage media follow: Classified IT storage media (e.g., hard drives) cannot be declassified by overwriting. Sanitization (which may destroy the usefulness of the media) or physical destruction is required for disposal. NOTE 3: The specific methods and procedures for sanitization of classified hard drives or storage media differ depending on sensitivity of data, type of hard drive or storage media (magnetic, solid state, etc…) and ownership of the hard drive or storage media. To ensure DoD information is not inadvertently disclosed to unauthorized individuals, the activity security manager should coordinate with the local Authorizing Official (AO) and/or IT staff to ensure local procedures for disposal of computer hard drives appropriately address removal of U.S. Government data prior to disposal. TACTICAL ENVIRONMENT: Applies in all environments whenever classified documents or materials are to be destroyed.

check_text:
  Check Content: For CLASSIFIED automated information system (AIS) data processing and/or storage equipment such as hard drives and media: Check to ensure data processing or storage devices are properly sanitized (purged of all classified data so that recovery using known laboratory attack is not possible) in accordance with current NSA guidance before such equipment or media is disposed of or placed in use (and/or stored) in a lower classification environment or an unclassified environment. Note 1: Clearing procedures using overwrite software is not sufficient to dispose of classified equipment or media (for instance by release to property disposal, vendors, or placement in trash) or to re‐use it in an unclassified or lesser classification environment other than its original classification level. Clearing will only enable the equipment or media to be re‐used within the original classified environment. NOTE 2: NSA guidance can be found in the NSA/CSA Policy Manual 9‐12, NSA/CSS Storage Device Declassification Manual. Be certain to also read and apply specific guidance for the DoD from Enclosure 3 and Enclosure 7 of Volume 3 of DoD Manual 5200.01. Important excerpts from this guidance pertaining to disposal of classified equipment and storage media follow: Classified IT storage media (e.g., hard drives) cannot be declassified by overwriting. Sanitization (which may destroy the usefulness of the media) or physical destruction is required for disposal. NOTE 3: The specific methods and procedures for sanitization of classified hard drives or storage media differ depending on sensitivity of data, type of hard drive or storage media (magnetic, solid state, etc…) and ownership of the hard drive or storage media. To ensure DoD information is not inadvertently disclosed to unauthorized individuals, the activity security manager should coordinate with the local Authorizing Official (AO) and/or IT staff to ensure local procedures for disposal of computer hard drives appropriately address removal of U.S. Government data prior to disposal. TACTICAL ENVIRONMENT: Applies in all environments whenever classified documents or materials are to be destroyed.


