ACP 122 (F) - Multilateral Planners Conference

UNCLASSIFIED
ACP 122(F)
CHAPTER 12
PERSONNEL SECURITY
OVERVIEW
1201. There is a risk that any person who enters a facility containing CIS equipment may
interfere with or damage the equipment, or see classified or sensitive information being printed,
displayed, copied, etc. Persons requiring legitimate access to such facilities must be duly
authorised and where necessary, cleared to the highest classification of information being
processed. The following is a minimum set of personnel security issues that should be
considered in each combined system’s security policy.
NATIONAL MAPPING
1202. The following table provides details of the national lead authority for any clarification
required on this topic.
Lead
Authority
AUS CAN NZ UK US
DSA
DISSP
D IM Secur
DJCIS
ISEC
DGS&S
InfoSy(Pol)
Joint Staff
J65C
MEASURES REQUIRED
1203. All persons who have access to sensitive CIS should have the appropriate clearances
and formal access approval for the systems, including a need-to-know. The principle of
assigning the least privilege necessary for a user to accomplish his task should be adopted in
personnel security procedures.
1204. All Personnel Security activities in an Allied and Coalition context will be handled in
line with existing national procedures and CJM3IEM (Combined Joint Multilateral Master
Military Information Exchange Memorandum of Understanding). To that end, the following
personnel security concerns exist with regard to CIS:
a. Breaches of Security. Procedures must be in place for identifying, reporting and
managing breaches of security,
b. Classification by Users. Originators of information are responsible for the
classification of that information,
c. Clearances and Authorisations. The System Sponsor(s)/Owner(s) are to ensure
that all users of the IT system have appropriate clearance, briefings and
authorisation to the highest level of data processed/stored on the CIS or
commensurate with the Mode of Secure Operation,
12-1 Original
UNCLASSIFIED