SAP Policy

Question 1

Section 119, Title 10 United States Code

Answer 1

SAPs Congressional Oversight, requires SAPs to report to Congress annually. It also subjects SAPs to oversight in the form of inspections and audits.

Question 2

Executive Order 13526

Answer 2

“Classified National Security Information,” is the foundation of national policy for classified information. This Executive Order directs the Information Security Oversight Office (ISOO) under the direction of the National Archives, to develop implementing guidance. They issued ISOO Directive No. 1, “Classified National Security Information,” which sets forth more specific guidance to agencies on the implementation of the Executive Order

Question 3

DoDI 5205.11

Answer 3

Management, Administration, and Oversight of DoD SAPs, is the implementing document for the DoDD 5205.07. It disseminates policy, assigns responsibilities, and prescribes procedures for implementation and use in the management, administration, and oversight of all DoD SAPs.

Question 4

DoD Manual 5205.07 v1

Answer 4

Volume 1 assigns responsibilities; implements policy established in DoD Instruction or DoDI (Dee-oh-Dee-Eye) 5205.11 and describes the general procedures for the administration of DoD SAP security.

Question 5

DoD Manual 5205.07 v2

Answer 5

Volume 2 assigns responsibilities and provides procedures for personnel security for DoD SAPs.

Question 6

DoD Manual 5205.07 v3

Answer 6

Volume 3 implements policy established in DoDI (Dee-oh-Dee-Eye) 5205.11 and assigns responsibilities and provides procedures for physical security for DoD SAPs.

Question 7

DoD Manual 5205.07 v4

Answer 7

Volume 4 provides guidance and procedures for the application of control markings on DoD SAP information

Question 8

DoD Manuals Overview

Answer 8

The DoD Manuals were published by the DoD and applies to all DoD SAPs. It standardizes the foundational SAP security guidance throughout the DoD, outlining the minimum security procedures for DoD SAPs. This policy applies to all Industry as well as to all non-DoD organizations that require access to DoD SAPs.

Question 9

Executive Order 13526 - Classified National Security Information

Answer 9

Prescribes a uniform system for classifying, safeguarding, and declassifying national security information • Directs the Information Security Oversight Office (ISOO) to develop implementing guidance

Question 10

Information Security Oversight Office (ISOO) 32 CFR Parts 2001 and 2003 Classified National Security Information; Final Rul

Answer 10

Defines specific guidance to agencies on the implementation of the Executive Order 13526

Question 11

DoD 5220.22-M: National Industrial Security Program Operating Manual (NISPOM

Answer 11

Establishes the standard procedures and requirements for all government contractors with regard to protection of classified information in the interest of national security

Question 12

DoDM 5200.01-M, Volume 1-4, Information Security Manua

Answer 12

• Prescribes the defined procedures for the DoD Information Security Program

Question 13

DoD 5200.02-R: Personnel Security Program

Answer 13

• Outlines the responsibilities of personnel to safeguard classified information

Question 14

DoD 5200.08-R: Physical Security Progra

Answer 14

Implements the policies and minimum standards for the physical security of DoD installations and resources

Question 15

DoDD 5205.02E: DoD OPSEC Program

Answer 15

Implements policy, assigns responsibilities, and provides procedures for managing DoD operations security (OPSEC) program

Question 16

Section 119, Title 10 United States Code: Special Access Programs Congressional Oversight

Answer 16

Outlines SAP oversight and reporting requirements

Question 17

DoDD 5205.07, Special Access Program Policy

Answer 17

Outlines policy and responsibilities on the oversight and management of all DoD Special Access Programs (SAPs)

Question 18

DoDI O-5205.11, Management, Administration, and Oversight of DoD Special Access Programs

Answer 18

• Implements DoD Directive 5205.07 • Disseminates policy, assigns responsibilities, and prescribes procedures for implementing and using in the management, administration, and oversight of all DoD SAPs

Question 19

DoD Directive 5205.07, Volumes 1-4

Answer 19

Implements policy established in DoDD 5205.07, assign responsibilities, and provide security procedures for DoD SAP information

Question 20

The DoDI 8500.01

Answer 20

Cybersecurity document outlines the overarching risk management process

Question 21

The DoD 5200.01

Answer 21

DoD Security Policy which addresses the processes, roles, and responsibilities

Question 22

The DoD 8510.01

Answer 22

Risk Management Framework which outlines the risk management framework that applies to DoD information technology and identifies the process to follow and specific roles and responsibilities

Question 23

The DoD 8530.01

Answer 23

Cybersecurity Activities Support to DoD Information Network Operations which states that the DoD needs to ensure information is confidently protected by vulnerability assessment and analysis, vulnerability management malware protection, continuous monitoring, cyber incident handling, DoDIN user activity monitoring for the DoD Insider Threat Program, and warning intelligence and attack sensing and warning (AS&W)

Question 24

The NIST 800-30

Answer 24

Guide for Conducting Risk Assessments

Question 25

When you compile and look at all of these policies and drivers together, the overarching Security Policy emerges. It is to do the following

Answer 25

Identify and protect national security information and controlled unclassified information (CUI) in accordance with national-level policy issuances • Promote information sharing, facilitate judicious use of resources, and simplify management through implementation of uniform and standardized processes • Employ, maintain, and enforce standards for safeguarding, storing, destroying, transmitting, and transporting classified information • Actively promote and implement security education and training throughout the Department of Defense • Mitigate the adverse effects of unauthorized access to classified information by investigating and acting upon reports of security violations and compromises of classified information

Question 26

DoD cybersecurity policy elements

Answer 26

The DoD cybersecurity policies include risk management, operational resilience, integration and interoperability, cyberspace defense, performance, DoD information, identity assurance, information technology, cybersecurity workforce, and mission partners.