DoD Instruction 8500.2 - Common Access Card (CAC)

DODI 8500.2, February 6, 2003
E3.3.11. In summary, elements of a DoD Component IA program include an IA
architecture and supporting master plan, coordination of IA investments, clear
assignment of organizational roles and responsibilities, and development and
management of a professional IA workforce. The DoD Component IA program shall be
integrated with the Defense IA program through the tracking and reporting of
management review items, the identification of IA program plans and needs, and
collaboration with other DoD Components for IA solutions.
E3.4. ELEMENTS OF A DoD INFORMATION SYSTEM IA PROGRAM
E3.4.1. The foundation level of the DoD IA management structure is composed of
IA programs at the individual DoD information system. For IA management purposes,
DoD information systems are organized into the four categories defined in enclosure 2
of this Instruction and further described below:
E3.4.1.1. AIS Applications. An AIS application is the product or deliverable
of an IT acquisition program. It has readily identifiable security requirements that must
be addressed as part of the acquisition and are the responsibility of the acquisition
program manager (PM). These requirements are established by its mission assurance
category and information classification or sensitivity and need-to-know. The IA
solutions that satisfy the identified requirements must comply with the DoD
Component-level IA architecture, and to the extent possible, draw upon the common IA
capabilities provided by hosting enclaves. An AIS application's mission assurance
category and security classification remain fixed by its information and user base; they
do not inflate to match an enclave's. Thus, DoD AIS applications may be hosted in an
enclave with a higher mission assurance category or security classification, but never in
one with a lower mission assurance category or security classification. An AIS
application is also subject to DoD IA management processes and controls that focus on
the protection and availability of the GIG itself (e.g., ports and protocols and mobile
code). Responsibility for IA services is negotiated with hosting enclaves through
information systems security engineering (ISSE) and the IA certification and
accreditation process. An AIS application is deployed to an enclave for operations, at
which time responsibility for operational security is assumed by the enclave. The
acquisition program manager retains responsibility for addressing security in new
releases of the AIS application.
E3.4.1.2. Enclaves. An enclave is a collection of computing environments
that is connected by one or more internal networks and is under the control of a single
authority and security policy. Examples include local area networks and the operational
39 ENCLOSURE 3