DoD Instruction 8500.2 - Common Access Card (CAC)

DODI 8500.2, February 6, 2003
Table E4.T3. Operating Environment Summary by Confidentiality Level
Confidentiality Level Internal System Exposure External System Exposure
High (Systems
Processing Classified
Information)
Medium (Systems
Processing Sensitive
Information
Basic (Systems
Processing Public
Information)
• Each user has a clearance for all
information processed, stored or
transmitted by the system.
• Each user has access approval
for all information stored or
transmitted by the system.
• Each user is granted access
only to information for which the
user has a valid need-to-know.
• Each user has access approval
for all information stored or
transmitted by the system.
• Each user is granted access
only to information for which the
user has a valid need-to-know.
• Each IT user meets security
criteria commensurate with the
duties of the position.
• Each user has access approval
for all information stored or
transmitted by the system.
• Each IT user meets security
criteria commensurate with the
duties of the position.
• System complies with DoDD C-5200.5
(reference (aj)) requirements for physical or
cryptographic isolation.
• All Internet access is prohibited.
• All enclave interconnections with enclaves
in the same security domain require
boundary protection (e.g., firewalls, IDS, and
a DMZ).
• All enclave interconnections with enclaves
in a different security domain require a
controlled interface.
• All interconnections undergo a security
review and approval.
• All non-DoD network access (e.g., Internet)
is managed through a central access point
with boundary protections (e.g., a DMZ).
• All enclave interconnections with enclaves
in the same security domain require
boundary protection (e.g., firewalls, IDS, and
a DMZ).
• All remote user access is managed
through a central access point.
• All interconnections undergo a security
review and approval.
• N/A as the purpose of system is providing
publicly released information to the public.
E4.1.8. Internal and external system exposure are often assigned levels of High,
Medium, and Low. The combined levels of internal and external system exposure may
be referred to as total system exposure. Total system exposure is a general indicator
of risk, and is the inverse of a system's operating environment robustness, a term used in
U.S. Government protection profiles. Table E4.T4., below, outlines the total system
exposure and operating environment robustness of DoD information systems that are
compliant with the baseline IA controls for confidentiality:
52 ENCLOSURE 4