Homeland Security Digital Library

SEARCH THE HSDL

Searching for terms: EXACT: "Committee on National Security Systems" in: publisher

Results 1 - 28 (of 28) sorted by relevance sort by date

Only 2/3! You are seeing results from the Public Collection, not the complete Full Collection. Sign in to search everything (see eligibility).

National Information Assurance (IA) Glossary [2010]

Show summary Open resource [pdf] (open full abstract)
This document offers definitions of terminology regarding Information Assurance. It also offers a section of "commonly used abbreviations and acronyms". "The Glossary Working Group set several overall objectives for itself in producing this version: 1) Resolve differences between the definitions of terms used by the DOD [Department of Defense], IC [Intelligence Community], and Civil Agencies (NIST Glossary) to enable all three to use the same glossary (and move towards shared documentation and processes). 2) Accommodate the transition from Certification and Accreditation (C&A) terms in current use to the terms now appearing in documents produced by the C&A Transformation initiative. Both sets of terms have been included in this update of the glossary. 3) Ensure consistency among related and dependent terms. 4) Include terms that are important to the risk management goal of C&A transformation and to the concept of information sharing. 5) Review existing definitions to reflect, as appropriate a broader enterprise perspective vice a system perspective. 6) Strike an appropriate balance between macro terms and micro terms (i.e., include terms that are useful in writing and understanding documents dealing with IA [Information Assurance] policies, directives, instructions, and guidance, and strike terms that are useful only to specific IA subspecialties)."

Committee on National Security Systems

2010-04-26
National Information Assurance (IA) Glossary [2003]

Show summary Open resource [pdf] (open full abstract)
This document offers definitions of terminology regarding Information Assurance. It also offers a section of "commonly used abbreviations and acronyms".

Committee on National Security Systems

2003-05
CNSS Directive No. 510: Directive on the Use of Mobile Devices Within Secure Spaces, November 20, 2017

Show summary Open resource [pdf] (open full abstract)
"[1.] The U.S. Government (USG) relies on mobile technologies to provide USG Departments and Agencies (D/As) increased productivity and mission flexibility. The introduction of mobile devices into secure spaces may pose risks to National Security Systems (NSS) and the information contained therein. D/As will take physical and technical security measures to mitigate these risks. [2.] This Directive provides a minimum set of requirements for the introduction and use of mobile devices in secure spaces. D/As may develop internal policies and procedures to supplement the requirements of this Directive to ensure the introduction of mobile devices into secure spaces does not adversely impact the security of NSS."

Committee on National Security Systems

2017-11-20
National Policy for Safeguarding and Control of COMSEC Materials

Show summary Open resource [pdf] (open full abstract)
As part of an ongoing effort to ensure that CNSS issuances are relevant and current, the Policy Review and Compliance Working Group reviewed NCSC-1 and determined that significant changes were not required. This policy is being issued to revalidate and renumber NCSC-1, National Policy for Safeguarding and Control of Communications Security Materials, dated 16 January 1981. It establishes a system for the control of communications security (COMSEC) material within the U.S. Executive Departments and Agencies.

Committee on National Security Systems

2004-09
National Policy on Granting Access to U.S. Classified Cryptographic Information

Show summary Open resource [pdf] (open full abstract)
"Controlling access to the technically sophisticated cryptographic systems employed by the United States Government is a government-wide challenge. The systems can be compromised if individuals are not subject to reasonable controls regarding access to the U.S. classified cryptographic information supporting these systems. This policy supersedes NSTISS Policy No. 3, 'National Policy on Granting Access to U.S. Classified Cryptographic Information,' dated 19 December 1988. This policy establishes uniform criteria for minimizing the loss or unauthorized disclosure of U.S. classified cryptographic information. The policy makes reference to the possible use of a non-lifestyle, counterintelligence scope polygraph examination. It should be noted, however, that the polygraph is not intended to be used as a prescreening mechanism for determining cryptographic access. In accordance with the Federal Information Security Management Act (FISMA) of 2002, the Committee on National Security Systems (CNSS) Secretariat has initiated an Issuance Compliance Process for reporting annual status of Department and Agency implementation of new/revised CNSS Issuances. The first report for the attached policy is due six months following its issuance. Additional copies of this policy may be obtained from the Secretariat or the CNSS Website -- www.cnss.gov."

Committee on National Security Systems

2007-10
National Policy on Certification and Accreditation of National Security Systems (U)

Show summary Open resource [pdf] (open full abstract)
"The national security community, in order to ensure the security of National Security Systems, is developing cost-effective policies, procedures, and methodologies for the certification and accreditation (C&A) of national telecommunications and information systems. This C&A policy for National Security Systems will begin to provide the community with standard methodologies for C&A processes, assign authority and responsibilities, and lay a basis for mutual recognition of certification results. This policy supersedes NSTISSP Policy No. 6, 'National Policy on Certification and Accreditation of National Security Telecommunications and Information Systems,' dated 8 April 1994. Representatives of the Committee on National Security Systems (CNSS) may obtain additional copies of this policy at the address below. U.S. Government contractors are to contact their appropriate government agency or Contracting Officer Representative regarding distribution of this document."

Committee on National Security Systems

2005-10
National Policy on Use of Cryptomaterial by Activities Operating in High Risk Environments (U)

Show summary Open resource [pdf] (open full abstract)
"The National Communications Security Committee approved this policy in January 1981 to replace the policy contained in USCSB 5-7, National Policy on Use of Cryptomaterial by Activities Operating in High Risk Environments, dated 9 September 1970. This policy provides guidance on the selection and protection of machine cryptosystems for use in high risk environments by the Heads of Federal Departments and Agencies, the Joint Chiefs of Staff, the Commanders of the Unified and Specified Commands and Military Commanders. The Director, National Security Agency, shall in coordination with the other members of the NCSC, establish standardized criteria for the identification of high risk environments, as well as establish and publish the criteria for the selection of the appropriate machine cryptosystems. These implementing guidelines, previously included as an appendix to USCSB 5--7, will be promulgated by appropriate National COMSEC Instructions."

Committee on National Security Systems

1981-01-06
National Information Assurance Policy for Space Systems Used to Support National Security Missions [March 20, 2007]

Show summary Open resource [pdf] (open full abstract)
"The primary objective of this policy is to ensure the success of national security missions that use space systems by fully integrating IA into the planning, development, design, launch, sustained operation, and deactivation of those space systems used to collect, generate, process, store, display, or transmit national security information, as well as any supporting or related national security systems. Effective with its date of signature, this policy supersedes National Security Telecommunications and Information Systems Security Policy (NSTISSP) No. 12, National Information Assurance (IA) Policy for U.S. Space Systems (U//FOUO), dated January 2001. Further, National Security Presidential Directive (NSPD) No. 49, Subject: National Space Policy, dated 31 August 2006, states that United States national security is critically dependent upon space capabilities, and this dependence will grow. Space activities are also closely linked to the operation of the U.S. Government's critical infrastructures, and have increasingly been leveraged to satisfy national security requirements. Based on the importance of these activities and increasing threats to them, it is imperative that the national-level information assurance (IA) space policy be updated, promulgated, and adopted, further ensuring the availability, confidentiality, authenticity, integrity, and survivability of the national security information environment under a wide range of peace or war time threat scenarios. Also, In accordance with the Federal Information Security Management Act (FISMA) of 2002, the Committee on National Security Systems (CNSS) Secretariat has initiated an Issuance Compliance Process for reporting annual status of Department and Agency implementation of new/revised CNSS Issuances. The first report for the attached policy, which will be promulgated by CNSS action memorandum, is due six months following its issuance."

Committee on National Security Systems

2007-03-20
National Policy Governing the Use of High Assurance Internet Protocol Encryptor (HAIPE) Products

Show summary Open resource [pdf] (open full abstract)
"The U.S. Government's communication infrastructure is becoming more reliant upon network communications. Legacy government owned and operated circuit switched communication channels are being replaced with packet switched infrastructures. National Security Systems (NSS) users are also starting to leverage commercial and foreign public Internet Protocol (IP) infrastructures. These networks will provide a converged transport infrastructure for data applications, as well as real-time services. Communication channels that were often implemented to support a single application over a link will now rely on a shared infrastructure that supports multiple applications operating over a mesh network. As this transition occurs, legacy link encryptors must be incrementally replaced with network encryption products. The interoperability of network-layer encryption devices is vital to enabling net-centric capabilities, while maintaining end-to-end protection of NSS traffic. The High Assurance Internet Protocol Encryptor (HAIPE) Interoperability Specification (IS) defines requirements for a modular suite of traffic protection, networking, and management features that provide secure interoperability between users, content repositories, and net-centric enterprise services. This policy is being issued to provide governance for the procurement of IP encryption products for Fiscal Year (FY) 2009 and beyond. The intent of this policy is to ensure that all IP products procured after FY 2008 are compliant with the appropriate version of the HAIPE IS. In accordance with the Federal Information Security Management Act (FISMA) of 2002, the Committee on National Security Systems (CNSS) Secretariat has initiated an Issuance Compliance Process for reporting annual status of Department and Agency implementation of new/revised CNSS Issuances. The first report for the attached policy is due six months following its issuance. This policy can be located in the library on the CNSS website: www.cnss.gov."

Committee on National Security Systems

2007-02
Fact Sheet NSTISSP No. 11, Revised Fact Sheet National Information Assurance Acquisition Policy

Show summary Open resource [pdf] (open full abstract)
"National Security Telecommunications and Information Systems Security Policy (NSTISSP) No. 11, Subject: National Policy Governing the Acquisition of Information Assurance (IA) and IA-Enabled Information Technology (IT) Products was issued by the National Security Telecommunications and Information Systems Security Committee (NSTISSC), now known as the Committee on National Security Systems (CNSS), in January 2000 and revised in June 2003. The Committee was established by National Security Directive (NSD) No. 42, dated July 1990, and is responsible for developing and promulgating national policies applicable to the security of national security telecommunications and information systems. The technological advances and threats of the past decade have drastically changed the way we think about protecting our communications and communications systems. Three factors are of particular significance: - The need for protection encompasses more than just confidentiality; - Commercial Off-the-Shelf (COTS) security and security-enabled IA products are readily available as alternatives to traditional NSA-developed and produced communications security equipment (i.e., Government-Off-the Shelf (GOTS) products); and - An increased and continuing recognition that the need for IA transcends more than just the traditional national security applications of the past."

Committee on National Security Systems

2003-07
National Information Assurance Policy on Enterprise Architectures for National Security Systems

Show summary Open resource [pdf] (open full abstract)
"Public Law 107-347, E.-Government Act of 2002, requires the development of enterprise architectures within and across the Federal Government, and the provision of information security protections commensurate with the risk and magnitude of the harm resulting from information systems' corruption. Information Assurance (IA) is the protection of information in information systems (IS). IA provides a level of security to assure the right information gets to the right people at the right time by ensuring the availability, integrity, authentication, confidentiality, and non-repudiation of that information. When communicating National Security Information (NSI) between government organizations, it is the responsibility of both parties to ensure the security of that information. This is accomplished through the inclusion of coordinated IA requirements in those organizations' enterprise architectures. However, in today's environment, information systems that handle NSI are operating in different Federal Departments and Agencies whose security needs and architectural requirements vary. These combined factors present great hurdles in simultaneously achieving the necessary degree of information assurance with the greatest degree of information sharing, as the national security community moves towards a net-centric environment. This policy is the central policy to coordinate and clarify the development and integration of IA components of enterprise architectures across the CNSS community, focusing on the Federal Enterprise Architecture (FEA) as the framework to make this integration possible. It enumerates responsibilities and requirements for Federal Departments and Agencies in their development of collaborative, integrated IA components of enterprise architectures that handle NSI."

Committee on National Security Systems

2007-03
National Information Assurance (IA) Policy on Wireless Capabilities

Show summary Open resource [pdf] (open full abstract)
"Wireless capabilities (devices, services, technologies, and networks) have become important elements of the Federal Government's information infrastructure, and are now virtually indistinguishable from the wired segment of that infrastructure. Individuals at all levels within the Federal Government routinely use wireless capabilities to conduct their daily business in support of mission operations. The mobility afforded by wireless capabilities supports increased productivity and connectivity, and the Federal community has responded by deploying these capabilities widely across the Enterprise. However, the advantages that result from the implementation of wireless capabilities also introduce additional risks to information systems and the operations they support. Consequently, the implementation of wireless capabilities or the use of wireless devices within national security systems (NSS), and/or within environments where national security information (NSI) is stored, processed, or transmitted, must be governed by a systematic approach that balances operational gains with the inherent risks associated with the use of these capabilities. This policy establishes the controls necessary to implement wireless capabilities within NSS, and the use of wireless devices where NSI is stored, processed or transmitted, while mitigating the effects of their known vulnerabilities and associated risks. Representatives of the Committee on National Security Systems (CNSS) may obtain additional copies of this policy from the Secretariat. U.S. Government contractors and vendors shall contact their appropriate government agency or Contracting Officer Representative regarding distribution of this document."

Committee on National Security Systems

2005-08
National Policy On Classified Information Spillage

Show summary Open resource [pdf] (open full abstract)
"The handling of 'classified national security information' spillage is a Government-wide challenge. Current national policy does not provide guidance for handling such incidents. With the continued and ever increasing interconnection of information systems (ISs), the extent and risk of classified information spillage increase dramatically. This policy provides a framework for the consistent handling of spillage of classified information onto an unclassified IS, or higher-level classified information onto a lower level classified IS, to include non-government systems. Additional copies of this policy may be obtained from the Secretariat or the CNSS Website - www.cnss.gov."

Committee on National Security Systems

2006-06
National Policy on Controlled Access Protection

Show summary Open resource [pdf] (open full abstract)
"This policy defines a minimum level of protection for automated information systems operated by executive branch, agencies and departments of the Federal Government and their contractors. The private sector is encouraged to apply the precepts of this policy wherever it perceives the need. Questions pertaining to this policy should be directed to the Executive Secretary, National Telecommunications and Information Systems Security Committee (NTISSC), Fort George G. Meade, MD 2O755-6000."

Committee on National Security Systems

1987-07-15
National Policy on Securing Voice Communications(U)

Show summary Open resource [pdf] (open full abstract)
"In May 1982, The National Communications Security Committee reissued NCSC-8 as the national policy on securing U.S. Government voice communications. The policy sets forth those U.S. voice communications which are to be secured, and specifies the manner in which the policy is to be implemented. NCSC-8 was originally classified as CONFIDENTIAL. As Chairman of the National Security Telecommunications and Information Systems Security Committee, I have reviewed this policy and determined that it should be downgraded to unclassified and reissued as NSTISSP No. 101. NCSC-8 dated May 1982 is hereby cancelled and superseded by NSTISSP 101."

Committee on National Security Systems

1999-09-14
Nomenclature for Communications Security Material

Show summary Open resource [pdf] (open full abstract)
"Committee on National Security Systems Instruction (CNSSI) No. 4033 explains the nomenclature assigned to U.S., Allied, and NATO [North Atlantic Treaty Organization] communications security (COMSEC) material produced by the U.S. Government for use in National Security Systems (NSS). The information contained in this CNSSI should be made available to all U.S. Government departments and agencies, and their agents, who hold or use COMSEC material."

Committee on National Security Systems

2012-11-14
National Information Assurance Policy for Space Systems Used to Support National Security Missions [November 28, 2012]

Show summary Open resource [pdf] (open full abstract)
"Presidential Policy Directive (PPD-4), 'National Space Policy of the United States of America', (Reference a) reiterates that United States national security is critically dependent upon space capabilities and this dependence will grow. Space activities are also closely linked to the operation of the United States Government's (USG) critical infrastructures and have increasingly been leveraged to satisfy national security requirements. Therefore, increased assurance and resilience are needed for the mission-essential functions of national security space systems, including their supporting infrastructure, to help protect against disruption, degradation, and destruction, whether from environmental, mechanical, electronic, or hostile means. […] The primary objective of this policy is to help ensure the success of national security missions that use space systems, by fully integrating information assurance into the planning, development, design, launch, sustained operation, and deactivation of those space systems used to collect, generate, process, store, display, or transmit national security information, as well as any supporting or related national security systems. Fully addressing information assurance is especially important for the space platform portion of space systems, since any vulnerability in them normally cannot be eliminated once launched."

Committee on National Security Systems

2012-11-28
Telephone Security Equipment Submission and Evaluation Procedures

Show summary Open resource [pdf] (open full abstract)
"The Committee on National Security Systems Instruction (CNSSI) No. 5007, 'Telephone Security Equipment Submission and Evaluation Procedures,' provides guidance to U.S. Government Departments or Agencies, U.S. Government sponsors, and vendors for submission and evaluation of telephone equipment or devices. […] The National Telephone Security Working Group (NTSWG), formerly known as the Telephone Security Group (TSG), is the primary technical and policy resource of the U.S. Government for all aspects of the technical security program involving telephone systems located in areas where National Security Information (NSI), (regardless of classification level) or other sensitive government information is discussed. The TSG was originally chartered to develop and promulgate telephone security standards. […] This instruction also supports compliance with Intelligence Community Directive No. 705, 'Sensitive Compartmented Information Facilities (SCIF),' 26 May 2010, which delineate SCIF compliance for the protection of sensitive information and unclassified telecommunications information processing systems and equipment."

Committee on National Security Systems

2013-04
National Policy on the Use of the Advanced Encryption Standard (AES) to Protect National Security Systems and National Security Information

Show summary Open resource [pdf] (open full abstract)
Federal Information Processing Standard (FIPS) No. 197, dated 26 November 2001, promulgated and endorsed the Advanced Encryption Standard (AES) as the approved algorithm for protecting sensitive (unclassified) electronic data. Since that time, questions have arisen whether AES (or products in which AES is implemented) can or should be used to protect classified information and at what levels. Responsive to those questions, the National Security Agency (NSA) has conducted a review and analysis of AES and its applicability to the protection of national security systems and/or information. The policy guidance documented herein reflects the results of those efforts.

Committee on National Security Systems

2003-06
Information Assurance Risk Management Policy for National Security Systems

Show summary Open resource [pdf] (open full abstract)
"Information Assurance (IA) Risk Management is a process employed by an organization to achieve and maintain an acceptable level of IA risk. This document establishes the requirements for enterprise IA risk management within the national security community which requires a holistic view of the IA risks to National Security Systems (NSS) operating within the enterprise using disciplined processes, methods, and tools. It provides a framework for decision makers to continuously evaluate and prioritize IA risks in order to accept or recommend strategies to remediate or mitigate those risks to an acceptable level. Risk assessment is the process of determining the extent to which an entity is threatened; that is, determining the likelihood of potential adverse circumstances or events and the resulting harm to or impact on organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation. When operating local information systems or communicating information between government organizations, it is the responsibility of the organization to ensure the security of that information and the information system on which it is stored, processed, or transmitted. To encourage agencies to share information, they must have confidence that the information will be adequately protected by the receiving organization. This confidence is gained through the use of universally accepted and implemented risk management activities, with demonstrated performance over time. This process provides organizations the confidence to share information at the appropriate level of trust."

Committee on National Security Systems

2009-02
2007/2008 CNSS Report: An Agenda for Safeguarding National Security Systems

Show summary Open resource [pdf] (open full abstract)
"In 2007, the work of the Committee on National Security Systems (CNSS) grew in importance with the continuing impact of the proliferation of cyberspace threats to national security systems, greater integration among Federal departments and agencies in the conduct of national security missions, and increasing reliance on telecommunications and information systems to support national security missions. The CNSS and its individual Federal departments and agencies focused on five key national goals to enhance the security of national security systems--(1) assured information sharing; (2) managing risk; (3) identity assurance; (4) network resilience for mission assurance; and (5) building and sustaining a superior information assur¬ance (IA) workforce. The 2007/2008 CNSS Report: An Agenda for Safeguarding National Security Systems illuminates the challenges, priorities, and accomplishments in assuring the security of national security systems and promotes further public and private sector collaboration on this important national security endeavor."

Committee on National Security Systems

2008-03
CNSS Report: Progress Against 2008 Priorities

Show summary Open resource [pdf] (open full abstract)
"In March 2008, the Committee on National Security Systems (CNSS) delivered to the Executive Office of the President the 2007/2008 CNSS Report, 'An Agenda for Safeguarding National Security Systems,' that described strategic accomplishments of the CNSS and its individual Federal Departments and Agencies to enhance the security of national security systems (NSS) and outlined priorities for 2008. The priorities were categorized under five major focus areas: (1) assured information sharing; (2) managing risk; (3) identity assurance; (4) network resilience for mission assurance; and (5) building and sustaining a superior information assurance workforce. The attached CNSS Progress Report highlights key actions taken in those five focus areas against the 2008 priorities and recommendations. These efforts were consistent with National Security Presidential Directive 54/Homeland Security Presidential Directive 23 and the Comprehensive National Cybersecurity Initiative (CNCI). In addition, it is important to note that a significant event occurred in late 2008 when existing CNSS authorities and policies enabled the National Security Agency to engage directly with Departments and Agencies from across the National Security Community to provide situational awareness and advise them on current threats to our networks. This activity ensured the delivery of a consistent message across the Federal Government; promoted a sense of urgency and enhanced the level of cooperation among all affected Federal Departments and Agencies; and increased the sharing of information to defend critical NSS."

Committee on National Security Systems

2009-04
National Policy Governing the Release of Information Assurance (IA) Products and Services to Authorized U.S. Persons or Activities that are Not a Part of the Federal Government

Show summary Open resource [pdf] (open full abstract)
"Information Assurance (IA) is the protection of information in information systems by ensuring its availability, integrity, authentication, confidentiality, and non-repudiation. Often, it is necessary to communicate securely with U.S. persons or activities that are not part of the U.S. Government. In such instances, it is the responsibility of both parties to ensure the confidentiality of the information being exchanged. 2. This policy assigns responsibilities and establishes the criteria to be applied when U.S. Government activities provide IA products and services, to other U.S. persons or activities that are not a part of the federal government. This policy supersedes NCSC 2, National Policy on Release of Communications Security Information to U.S. Contractors and Other U.S. Nongovernmental Sources, dated 7 July 1983. 3. Representatives of the Committee on National Security Systems (CNSS) may obtain additional copies of this policy from the Secretariat. 4. U.S. Government contractors and vendors shall contact their appropriate government agency or Contracting Officer Representative regarding distribution of this document."

Committee on National Security Systems

2002-11
Committee on National Security Systems [website]

Show summary Open resource [html] (open full abstract)
"The Committee on National Security Systems (CNSS) provides a forum for the discussion of policy issues, and is responsible for setting national-level Information Assurance policies, directives, instructions, operational procedures, guidance, and advisories for U.S. Government (USG) departments and agencies for the security of National Security Systems (NSS) through the CNSS Issuance System. The CNSS is directed to assure the security of NSS against technical exploitation by providing: reliable and continuing assessments of threats and vulnerabilities and implementation of effective countermeasures; a technical base within the USG to achieve this security; and support from the private sector to enhance that technical base assuring that information systems security products are available to secure NSS. The CNSS consists of a Committee, a Subcommittee, and various Working Groups. The Champions, chairs, and subject matter experts, recruited from the Member/Observer departments/agencies, participate as Committee and Subcommittee representatives and as experts on working groups focusing on the development of relevant IA guidance documents. The working groups generally create IA policies, directives, and instructions (referred to as 'guidance documents') for CNSS review, approval, and promulgation. The increasing cyber threat inherent in today's changing and complex cyber environment makes the need for increased and continuing synergy within the CNSS Membership and between industry, academia, and our foreign partners a crucial part of IA guidance formulation. Included in this combined effort is cybersecurity collaboration which the CNSS promotes among owners of Federal NSS, Federal non-NSS, and non-Federal systems. CNSS is the cornerstone for IA guidance collaboration efforts."

Committee on National Security Systems
Committee on National Security Systems (CNSS) Governing and Operating Procedures

Show summary Open resource [pdf] (open full abstract)
"The 'Committee on National Security Systems' Directive (CNSSD) No. 900 establishes the governing and operating procedures for the Committee on National Security Systems (CNSS), to include Subcommittee, Panels, Working Groups, and the permanent Secretariat."

Committee on National Security Systems

2012-09-21
Security Categorization and Control Selection for National Security Systems: Version 2

Show summary Open resource [pdf] (open full abstract)
"This Instruction serves as a companion document to NIST SP 800-53 [National Institute of Standards and Technology Special Publication 800-53] for organizations that employ NSS [National Security Systems]. It establishes the processes for categorizing NSS and the information they process and for appropriately selecting security controls for NSS from NIST SP 800-53. This Instruction applies to all components of NSS. For NSS, where differences between the NIST documentation and this Instruction occur, this Instruction is authoritative. The controls contained within NIST SP 800-53, Appendices F and G, are directly applicable to the national security community. However, the special nature of NSS results in some variance from the non-NSS sector with respect to the process for information and information system categorization. This Instruction, therefore, provides the processes for categorizing NSS and the information they process and for selecting security controls to provide appropriate protections for NSS. "

Committee on National Security Systems

2012-03-15
Policy on Information Assurance Risk Management for National Security Systems

Show summary Open resource [pdf] (open full abstract)
"CNSSP [Committee on National Security Systems Policy] No. 22 requires the implementation of an integrated organization-wide program for managing IA risk to organizational operations (i.e., mission, functions, and reputation), organizational assets, individuals, other organizations, and the Nation resulting from the operation and use of National Security Systems (NSS). Risk management is a comprehensive process that requires organizations to frame risk, assess risk, respond to risk once determined, and monitor risk on an ongoing basis. This policy will be implemented based upon guidance found in the documents listed in Annex B, which provide a detailed approach to IA risk management. Upon this revision of CNSSP No. 22, CNSS Policy No. 6, 'National Policy on Certification and Accreditation of National Security Systems,' dated October 2005, and National Security Telecommunications and Information Systems Security Instruction (NSTISSI) 1000, 'National Information Assurance Certification and Accreditation Process (NIACAP),' dated April 2000 will be canceled."

Committee on National Security Systems

2012-01
National Directive to Implement Public Key Infrastructure for the Protection of Systems Operating on Secret Level Networks

Show summary Open resource [pdf] (open full abstract)
"This Directive establishes the requirement for all federal agencies to implement the National Security Systems Public Key Infrastructure (NSS-PKI) to promote interoperability and secure information sharing between federal departments and agencies and to use PKI to provide strong authentication to their systems operating on Secret level networks. The authority to issue this Directive derives from National Security Directive 42, which outlines the roles and responsibilities for securing national security systems, consistent with applicable law, E.O. 12333, as amended, and other Presidential directives. Nothing in this Directive should be interpreted as altering or superseding the existing authorities of the Director of National Intelligence. This Directive applies to all departments and agencies of the United States Government (USG), and their supporting contractors, agents, and non-federal affiliates who own, operate, or maintain NSS operating at the Secret level. For purposes of this Directive, PKI refers to products and services that provide and manage X.509 certificates for public key cryptography. This Directive mandates the development and implementation of a comprehensive approach to the use of PKI to protect U.S. Government NSS. All departments and agencies of the USG, and their supporting contractors, agents, and non-federal affiliates who own, operate, or maintain NSS operating at the Secret level shall follow this directive in the implementation and use of NSS-PKI for all systems residing on Secret-level networks, including systems that reside on closed operational networks. Federal Government departments and agencies shall ensure that the implementation of NSS-PKI adheres to the requirements of this Directive."

Committee on National Security Systems

2012-10-09