DoD Instruction 8500.2 - Common Access Card (CAC)

DODI 8500.2, February 6, 2003
E3.4.4. All AIS applications shall employ ISSE as part of the acquisition process.
Those AIS applications that undergo a system engineering process should initiate ISSE
in parallel to ensure IA is built into the AIS application. Considering IA objectives,
requirements, functions, architecture, design, testing, and implementation in conjunction
with the corresponding system engineering analogues allows IA to be optimized based on
the technical and non-technical considerations of the individual AIS application. All
enclaves shall employ ISSE to implement or upgrade boundary defense and incident
detection, to address configuration changes to other IA solutions that may impact
enclave IA posture, and to implement interconnections across security domains. Using
the IA Controls as the baseline, the ISSE process elicits detailed IA requirements;
develops the physical and logical architecture, and technical specifications to satisfy
those requirements at an acceptable level of risk; insures IA is integrated into the
overall system acquisition and engineering process; and tests the system to verify the
design and implementation of IA solutions. The ISSE process shall explicitly address
all IA Controls by providing traceability from the IA Controls to the elicited
requirements, the corresponding design, and the testing. It also identifies those IA
Controls that are provided by the enclave, and identifies any additional IA Controls
required to meet AIS application-specific or unusual circumstances.
E3.4.5. As with the security engineering of AIS applications and enclaves, the IA
Controls form a baseline for allocating IA responsibilities between outsourced service
providers and DoD users, and for ensuring that IA requirements are explicitly addressed
in the acquisition of outsourced IT based processes. They perform a like function for
the allocation of IA responsibilities between enclaves and interconnecting platforms.
The IA Controls establish the baseline for the IA capabilities to be provided by enclaves
and the reference framework for the exchange of information for application hosting
and for interconnection negotiation and approval. The DoD IA Controls establish a
common dialogue among information owners, PMs, outsourced service providers,
enclave managers, information assurance certifying and accrediting authorities, and
information system security engineers. They aid in the negotiation and allocation of IA
requirements and capabilities, enable traceability to specific IA solutions, and provide a
consistent reference for certification activities and findings.
E3.4.6. Information Assurance Managers (IAMs) are responsible for establishing,
implementing and maintaining the DoD information system IA program, and for
documenting the IA program through the DoD IA C&A process. The program shall
include procedures for:
43 ENCLOSURE 3