DoD Instruction 8500.2 - Common Access Card (CAC)

DODI 8500.2, February 6, 2003
Table E4.T1. IA Control Subject Areas
Abbreviation Subject Area Name Number of Controls in Subject Area
DC Security Design & Configuration 31
IA Identification and Authentication 9
EC Enclave and Computing Environment 48
EB Enclave Boundary Defense 8
PE Physical and Environmental 27
PR Personnel 7
CO Continuity 24
VI Vulnerability and Incident Management 3
E4.1.3.3. IA Control Text. One or more sentences that describe the IA
condition or state that the IA Control is intended to achieve.
E4.1.3.4. IA Control Number. A unique identifier comprised of four letters, a
dash, and a number. The first two letters are an abbreviation for the subject area name
and the second two letters are an abbreviation for the individual IA Controlname. The
number represents a level of robustness in ascending order that is relative to each IA
Control. In the example in Figure E4.F2., the control level is two (2), which means
there is a related IA Control, ECCT-1, that provides less robustness. There may also be
an IA Control, ECCT-3, that provides greater robustness.
Figure E4.F2. Elements of an IA Control Number
E4.1.4. Information Assurance Controls may have one, two, or three levels. The
levels generally align to the mission assurance categories or confidentiality levels,
however, there are exceptions. For instance, some IA Controls have a single level that
applies equally to all mission assurance categories or confidentiality levels. In such
cases, the IA Controls are included in each applicable list. See enclosure 4, attachments
1 - 6. For example, DCIS-1, IA for IT Services, states, "Acquisition or outsourcing of IT
services explicitly addresses Government, service provider, and end user IA roles and
responsibilities." It applies equally to all mission assurance categories and is included
49 ENCLOSURE 4