Department of Defense - Directive 8570
Securing The Nation's Computer Networks
Due to the tragic events that took place on September 11, 2001, Congress made the decision to strengthen the protection of our national computer networks. They took steps to provide effective government-wide management and oversight of the nations information security risks. On December 17, 2002, the Federal Information Security Management Act (FISMA) became law requiring all federal agencies, including the DoD (Department of Defense), to become compliant. The Defense-wide Information Assurance Program (DIAP) was formed to develop a program and document that would be the guideline for the Directive called DoD Directive 8570.1M. The document was released in 2006.
In part, Directive 8570 does the following:
- Covers all Military, Federal, Contractor, and Foreign National Personnel, Full Time & Part Time.
- Specifies commercial certifications for “Privileged Users” or jobs that pose an increased level of IA risk.
- Requires that privileged positions must be filled with personnel who have been trained and hold appropriate certifications with documentation that validates they are qualified for the positions they are hired for.
- Requires annual reporting to Congress with deficiencies and corrective action plans.
- Requires that all users are to be trained by 2010.
- States that training will be ongoing as positions are filled with new personnel.
Who Needs the Certifications?
- IA (Information Assurance) Technical: Anyone with privileged system access performing IA functions at computing, networking or enclave positions.
- IA Management: Personnel performing management functions for DoD systems (e.g. IA Officers)
- Designated Approving Authority: Personnel performing DAA functions must meet baseline training and certification requirements.
This directive applies to the Office of the Secretary of Defense, the military departments, the Chairman of the Joint Chiefs of Staff, the combatant commands, the Office of the Inspector General of the Department of Defense, the defense agencies, the Department of Defense field activities, and all other organizational entities in the Department of Defense (referred to collectively as the DoD components)
as well as contracts for personnel providing IA functional services for DoD information systems (IS) via appropriate Defense Federal Acquisition Regulation Supplement (DFARS) clauses
How soon will this all happen?
The plan to complete certification is through 2010.
| Calendar Year |
2006 |
2007 |
2008 |
2009 |
2010 |
| Total % of Workforce Certified |
**** |
10% |
40% |
70% |
100% |
How does The Security Certified Program fit in?
- The Security Certified Network Professional (SCNP) qualifies for the Information Assurance Technical (IAT) Level 2 Position.
- The Security Certified Network Architect (SCNA) qualified for the Information Assurance Technical (IAT) Level 3 Position.
Contact SCP to learn more about DoD Directive 8570