Army Regulation 380–19 Security Information Systems Security Headquarters Department of the Army Washington, DC 27 February 1998 UNCLASSIFIED SUMMARY of CHANGE AR 380–19 Information Systems Security This regulation-- o Requires the use of cost-effective information systems security (ISS) measures to respond to the specific threats and vulnerabilities associated with each information system (para 1-5a). o Emphasizes the requirement to address security in all stages of system development (para 1-5e). o Provides information systems security requirements for system administrators (para 1-6d). o Removed the position/title of terminal area security officer (TASO) to comply with national policies (para 1-6). o Replaces the acronyms US1, US2, CS1, CS2, and CS3 with Unclassified Nonsensitive, Sensitive But Unclassified, Confidential, Secret, Top Secret, and Sensitive Compartmented Information Subsystem to comply with national policies (para 2-2). o Removed paragraph 2-11, ’Location and construction of a Central Computer Complex,’ because the U.S. Army has very few central computer facilities under construction and should not be included in an ISS policy regulation. o Removed paragraph 2-12, ’Mainframe computer equipment room standards,’ because the U.S. Army has very few mainframe computers remaining and should not be included in an ISS policy regulation. o Addresses security requirements for laptop, notebook, and portable information systems (para 2-11). o Provides minimum standards for generating and using passwords to control access to information systems (para 2-14). o Introduces the Land Information Warfare Activity as the Army focal point for reporting system vulnerabilities (2-27). o Updates reporting requirements for automated information system (AIS) security incidents and technical vulnerabilities (para 2-27). o Introduces the concept of site-based accreditation for the Sensitive Compartmented Information (SCI) system and an alternative to accrediting collateral systems while taking into account their interconnectivity concerns and allows other related systems to be included in a site (para 3- 11). o Introduces a warning banner for the monitoring of the Army system (para 4-1m). o Reconstructs chapter 5, Risk Management, to meet the ISS environment currently facing ISS managers. o Introduces policy and guidance for use of Government-sponsored Internet accounts (app B). o Incorporates the National Security Agency’s Manual 130-1, annex S, as requested by the Department of the Army Inspector General, to address clearing, purging, declassifying , and destroying magnetic media (app F). o Provides an Army Management Control Process for administration of the Army Information System Security Program (app C). Headquarters *Army Regulation 380–19 Department of the Army Washington, DC 27 February 1998 Effective 27 March 1998 Security Information Systems Security and Department of Defense (DOD) guidance C o n t r o l , C o m m u n i c a t i o n s , a n d C o m p u t e r s . contained in DOD directives governing secu- The proponent has the authority to approve rity for information in an electronic form, exceptions to this regulation that have re- including DOD Directives 5200.28, 5200.5, ceived a legal review to ensure that the ex- and 5200.19 (when used in conjunction with ception is consistent with controlling law and AR 381–14). It also provides the Army’s im- regulation. The proponent may delegate the plementation of sections 1 through 8, Act of approval authority, in writing, to a division 8 January 1988, Public Law (PL) 100–235, c h i e f w i t h i n t h e p r o p o n e n t a g e n c y i n t h e U . S . S t a t u t e ( S t a t ) 1 0 1 , p p . 1 , 7 2 4 – 1 , 7 3 0 , grade of colonel or the civilian equivalent. cited as the Computer Security Act of 1987. This regulation designates ISS as the security A r m y m a n a g e m e n t c o n t r o l p r o c e s s . discipline that encompasses communications This regulation contains management control s e c u r i t y ( C O M S E C ) , c o m p u t e r s e c u r i t y p r o v i s i o n s a n d i d e n t i f i e s k e y m a n a g e m e n t (COMPUSEC). It defines the Army Informa- controls that must be evaluated. tion Systems Security Program (AISSP) and prescribes a structure for implementing that Supplementation. Major commands may H i s t o r y . T h i s i s a r e v i s i o n . B e c a u s e t h e p r o g r a m . T h i s r e g u l a t i o n p r o v i d e s s p e c i f i c supplement this regulation. Copies of all sup- publication has been extensively revised, the policy on accreditation of AIS and networks. plements must be forwarded to Director of changed parts have not been highlighted. It also provides minimum security standards Information Systems for Command, Control, Summary. This publication introduces the for transmitting classified and sensitive un- C o m m u n i c a t i o n s , a n d C o m p u t e r s concept of site-based accreditation, provides classified information. (SAIS–PAC), 107 Army Pentagon, Washing- new security policies for the use of laptop Applicability. This regulation applies to the t o n , D C 2 0 3 1 0 – 1 0 7 , f o r c o n c u r r e n c e a n d and small deployable computers and for the Active Army, the Army National Guard of legal review prior to implementation. use of the Internet and Homepages, and is- the U.S. (ARNGUS), and the United States sues minimum requirements for degaussing, Army Reserve (USAR). It applies to contrac- Suggested Improvements. Users are in- declassifying, and downgrading of informa- tors who operate Government-owned or con- vited to send comments and suggested im- tion and media. This regulation is an update t r a c t o r - o w n e d , A I S t h a t p r o c e s s o r s t o r e p r o v e m e n t s o n D A F o r m 2 0 2 8 to meet changing information system security Army information. Contractors who process (Recommended Changes to Publications and (ISS) policies and directives for all Army au- Sensitive But Unclassified (SBU) information Blank Forms) directly to Director of Informa- tomated information systems (AIS); it imple- o n c o n t r a c t o r - o w n e d A I S a r e g o v e r n e d b y tion Systems for Command, Control, Com- ment the transition to site-based accreditation this regulation if specified in the contractual m u n i c a t i o n s a n d C o m p u t e r s ( S A I S – P A C ) , (SBA) concepts and requirements for those requirements or if they connect to an installa- 1 0 7 A r m y P e n t a g o n , W a s h i n g t o n , D C Army intelligence systems subject to Defense tion AIS/network system. All of the above 20310–107. Intelligence Agency (DIA) or National Secu- must comply with sections 1 through 8, Act rity Agency (NSA) directives derived from of 8 January 1988, PL 100–235, 101 Stat 1, Distribution. Distribution of this publica- D i r e c t o r , C e n t r a l I n t e l l i g e n c e , D i r e c t i v e 724–1,730. During mobilization, deployment, tion is made in accordance with initial distri- (DCID) 1/16. This regulation implements the o r n a t i o n a l e m e r g e n c y , t h i s r e g u l a t i o n bution number (IDN) 095066, intended for ISS portion of the Command and Control remains in effect without change. command levels B, C, D, and E of the Active Protect (C2 Protect) component of the Ar- Proponent and exception authority. Ef- Army, Army National Guard of the U.S., and my’s Information Operations Program as de- fective 1 January 1997, the proponency of U.S. Army Reserve and Government contrac- fined in Field Manual (FM) 100–6 and AR this regulation has been transferred to the Di- tors. 525–20. This regulation implements national rector of Information Systems for Command, Contents (Listed by paragraph and page number) U.S. Army Information Systems Security Program • 1–6, page 4 Chapter 1 Chapter 2 Introduction, page 1 Computer Security, page 6 Purpose • 1–1, page 1 References • 1–2, page 1 Section I Explanation of abbreviations and terms • 1–3, page 1 General Policy, page 6 Responsibilities • 1–4, page 1 Overview • 2–1, page 6 Security-related requirements • 1–5, page 4 *This regulation supersedes AR 380–19, 1 August 1990.