DoD Instruction 8500.2 - Common Access Card (CAC)

DODI 8500.2, February 6, 2003
E4.1.7.1. Internal system exposure is a measure of the difference between the
established security criteria for individual access and the actual accessprivileges of
authorized users. The greater the difference, the higher the internal system exposure
and the lower the overall robustness of the operating environment. For example, a
system containing classified information that grants access to personnel without
security clearances has a higher level of internal system exposure and a lower level of
environmental robustness than a system that limits access to persons that are cleared
for access to all information on the system.
E4.1.7.2. External system exposure is a measure of the degree of isolation
from other information systems, either through physical or cryptographic means. The
greater the isolation, the lower the external system exposure and the higher the overall
robustness of the operating environment. For example, a standalone information system
or local area network has a lower level of system exposure and a higher level of
environmental robustness than a system that uses the Internet for user connectivity.
E4.1.7.3. The DoD baseline IA controls enforce DoD policies that limit
internal and external system exposure according to confidentiality level, as summarized
in Table E4.T3., below:
51 ENCLOSURE 4