Committee on National Security Systems …

Committee on National Security Systems


                              CNSS Instruction No. 4007
                                        November 2007




    COMMUNICATIONS SECURITY
           (COMSEC)
       UTILITY PROGRAM
                 Committee on National Security Systems



                                                                            CNSS Instruction No. 4007


                                  National Manager


                                          FOREWORD

1.    The Committee on National Security Systems Instruction (CNSSI) No. 4007,
entitled "Communications Security (COMSEC) Utility Program," establishes the criteria
for ensuring the availability of commonly required COMSEC equipment to satisfy crisis,
contingency, and emergent national security requirements. This instruction supersedes
NSTISSI No. 4007 dated 30 October 1989.

2.   Copies of this instruction are available via CNSS website, www.cnss.gov, or by
contacting the office at the address listed below:

                         NATIONAL SECURITYAGENCY
                                 CNSS Secretariat
                              Attn: 1922 - Suite 6716
                                9800 Savage Road
                    Fort George G. Meade, Maryland 20755-6716




                                           //s//
                                KEITH B. ALEXANDER
                              Lieutenant General, U.S. Army




                        CNSS Secretariat (I922) / National Security Agency
                     9800 Savage Road - Suite 6716 - Ft Meade MD 20755-6716
                     Office: (410) 854-6805 / Unclassified FAX: (410) 854-6814
                                       cnss@radium.ncsc.mil
                                                                          CNSS Instruction No.4007




             Communications Security (COMSEC) Utility Program

Title                                                                              Section

PURPOSE AND SCOPE................................................................I

DEFINITIONS............................................................................II

RESPONSIBILITIES.....................................................................III

PROCEDURES...........................................................................IV


                           SECTION I - PURPOSE AND SCOPE

1.    The Communications Security (COMSEC) Utility Program (CUP) is a pool of
selected information assurance (IA) security equipment available to federal departments
and agencies on a reimbursable or temporary basis, used to satisfy crisis, contingency,
and emergent national security requirements. This instruction establishes the criteria,
assigns responsibilities, and defines procedures for the CUP. The provisions of this
instruction are applicable to all federal departments and agencies that have requirements
for information systems security equipment.


                               SECTION II ­ DEFINITIONS

2.      The following definitions apply for the purpose of this instruction:

        a. Crisis or Contingency Requirement: An immediate need for IA security
           equipment not available from department or agency-owned assets and which are
           required to meet a crisis or contingency operation.

        b. Emergent National Security Requirement: A requirement demanding immediate
           attention, which surfaces as a result of such actions as policy changes,
           interoperability requirements, security compromises, or unforeseen technology
           changes and, which cannot be met within the time constraints of the normal
           budget or procurement processes.




                                                1
                                                                  CNSS Instruction No.4007




                        SECTION III ­ RESPONSIBILITIES

3.  The Director, National Security Agency (DIRNSA), as the Program Manager for
CUP shall:

     a. Establish, maintain, and administer the CUP in accordance with the criteria
        contained herein.

     b. Consolidate suggestions from Department of Defense (DoD) elements and U.S.
        civil agencies for potential equipment program candidates for inclusion in the
        CUP procurement plan, and provide a recommended plan to the Joint Chiefs of
        Staff (JCS) for validation at periodic intervals conducive to proper and adequate
        management of the CUP.

     c. Procure, store, maintain, issue, and dispose of CUP assets through use of
        existing NSA facilities or in conjunction with other government facilities having
        capabilities to perform the required asset services.

     d. Plan, program, and fund for the storage, maintenance, and handling of CUP
        assets in inventory.

     e. Establish pricing for CUP assets available for procurement by federal
        departments and agencies.

     f. Provide annually, to the JCS, a CUP inventory status and equipment transaction
        report.

     g. Provide specific item information of CUP asset availability upon request to the
        National Security Agency (NSA) Customer Advocates (CA) and potential
        federal department and agency customers.

4.   Federal departments and agencies shall budget for IA security requirements with
due consideration for the extensive lead-time required for delivery. CUP assets fill
minimum requirements, which cannot be otherwise satisfied.

5.     DoD Service Elements, through appointed IA security product management and/or
their representatives to the Multi-Service COMSEC Working Group (MSCWG), and
U.S. civil agencies shall identify equipment to be considered for procurement during the
CUP program build and validation process. A prioritized list of recommended equipment,
quantity, applicable program(s), and justification supporting the recommendation shall be
submitted to DIRNSA, ATTN: Asset Management, with an information copy to the JCS,
ATTN: J6X.




                                             2
                                                                  CNSS Instruction No.4007




6.   The JCS - J6X shall:

     a. Review the recommended CUP procurement plan and forward a validated
        equipment requirements list to DIRNSA, ATTN: Asset Management.

     b. In conjunction with NSA, jointly resolve competing U.S. military requirements
        for CUP assets.

     c. Provide comment to NSA, if requested, on established minimum equipment
        quantities to be retained in the CUP inventory to meet crisis or contingency
        requirements.


                            SECTION IV ­ PROCEDURES

7.   Federal departments, agencies, and the U.S. military, having an immediate need for
IA security equipment, unable to satisfy within the time frame required through normal
COMSEC acquisition channels may:

     a. Request availability, pricing, delivery, or loan information from the NSA CUP
        Program Office (Asset Management, 410-854-6154). All formal requests for
        loan or procurement of CUP assets will be forwarded, in writing, to the NSA
        CA office.

     b. When procurement through the CUP is authorized, the procuring department or
        agency shall provide reimbursable acceptable funding to DIRNSA to cover the
        cost of the equipment and transportation. Proceeds from the sale of CUP assets
        will be reinvested in the program.

8.    CUP assets may be loaned for a maximum of six months when it is determined by
DIRNSA to be in the government's best interest. Federal departments, agencies, and the
Military borrowing a CUP asset shall provide funding to cover the cost of transportation,
testing, and rehabilitation if necessary, to ensure its future utility. Loan extensions
beyond the six-month period will be reviewed on a case-by-case basis. If a loan extension
is approved, the government entity borrowing the asset should, at that time, identify the
requisite funds to procure the item. If CUP assets are loaned with the stipulation of
customer payback via existing customer contracted quantities, the customer must
coordinate that payback through the Program or Business Manager that generated the
contracted items, and Asset Management must be informed of that arrangement,
including documentation affecting the customer's line item number (CLIN) and delivery
stipulations for CUP within a timeframe agreeable to the Asset Management office.




                                             3
                                                                     CNSS Instruction No.4007




9.   This program was established in conjunction with the Joint Staff and Multi-Service
organizations, from appropriated Congressional funding from U.S. military budgets, to
enhance the IA security product availability of the U.S. military and civil entities during
times of emergent need. It was not intended nor should it be assumed that products
maintained in the asset inventory of the CUP are for general release to any Ally. Only
under the defined conditions below will CUP products be released for Allied sales
through the Foreign Military Sales office:

     a. Sales of a specific IA security product within the CUP inventory will not occur
     if the Asset Management office deems it potentially detrimental to U.S. source
     provisioning, insofar as our capability to acquire and re-supply any U.S. customer
     with the product.

     b. The sale represents security needs of an Ally in a joint endeavor with the
     United States, and loss of life/limb is true potential consequences of non-supply.
     The justification for Allied need would require written documentation submitted to
     the Asset Management office, and the final determination for transfer of product
     would rest with that office after it has received approval pursuant to the
     requirements of NSTISSP 8 or its successor document.

10. No assets from the CUP inventory will be released for customer sales without
funding availability. In extreme circumstances, a written "promise to pay" by a
representative of the military or civil entity may be deemed acceptable by Asset
Management office to proceed with the provisioning. However, the "promise to pay"
must be fulfilled within a reasonable timeframe as stated by Asset Management office, or
within 90 days, whichever occurs first.




                                                4