Communications Security (COMSEC): Key Events, Policies, and Roles (copy)

Capture of the USS PUEBLO

Captured by North Korea in 1968. It was the first U.S. Navy ship to be hi-jacked on the high seas by a foreign military force in over 150 years.

Navajo Code Talkers

The idea to use Navajo for secure communications came from Philip Johnston, the son of a missionary to the Navajos and one of the few non-Navajos who spoke their language fluently.

Purple Code

Cryptologic machine used by Japan and Germany during WWII. Once broke, allowed the allies to read dispatches between Japan and Germany.

Hainan Island EP-3 incident

On 1 April 2001, a Chinese J-811 interceptor collided with an EP-3, which was forced down. The 24-man crew was detained for 10 days.

Bletchley Park

Also known as Station X during World War II, was the site of the United Kingdom's main decryption establishment, the Government Code and Cipher School.

COMSEC/KOAM Account Manager

The CAM is designated in writing by the current CO and serves as the CO's primary advisor on matters concerning the security and handling of COMSEC material.

Alternate COMSEC/KOAM Account Manager

Alternates are equally responsible and must be trained and able to assume the duties of the CAM in their absence.

Local Element Custodian User

LE (using) entities are static work centers or individual COMSEC Users assigned to a company, department, division, etc.

Local Element Custodian Issuing

An LE (issuing) receives COMSEC material from an established account and issues material on a manually-created local custody document.

COMSEC User

Individual responsible for the proper security, control, accountability, and disposition of the COMSEC material placed in their charge.

Client Platform Administrator (CPA)

An individual designated in writing by the CO responsible for system administration functions of the KMI Management Client referred to herein as the MGC.

COMSEC incidents

Any uninvestigated or unevaluated occurrence that has the potential to jeopardize the security of COMSEC material or the secure transmission of classified or sensitive government information.

Client Platform Security Officer (CPSO)

An individual designated in writing by the CO responsible for security monitoring, including the review of audit data associated with the MGC.

CRYPTO security

Cryptographic security is that component of COMSEC which results from the use of technically sound cryptosystems, and from their proper use.

Transmission security

Transmission security is that component of COMSEC which is designed to protect transmissions from unauthorized intercept, traffic analysis, imitative deception, and disruption.

Emission security

Emission security is that component of COMSEC which results from all measures taken to prevent compromising emanations from cryptographic equipment or telecommunications systems.

Physical security

Physical security is that component of COMSEC, which results from all physical measures to safeguard cryptographic material, information, documents, and equipment from access by unauthorized persons.

Tier 0 (Central Facility)

Resides at the National Security Agency (NSA) and provides centralized key management services for all forms of COMSEC key.

Reportable PDS

Reportable PDS will be submitted via official message and must be classified based on the content at a minimum of CUI.

Non-reportable PDS

Non-reportable PDS will be documented via official memorandum or communicated via official, digitally signed email to the CO of the account.

Tier 1

Serves as the intermediate key generation and distribution center, central office of record (COR), privilege managers, and registration authorities for COMSEC accounts.

SF 700

Used to record an individual's (single person) passwords/PINs and will be classified based on the highest level of access the password or PIN permits an individual.

SF 701

End of Day Security Checklist (30 days after last recorded date).

SF 702

A security container open/closure log that must be maintained for each lock on a COMSEC storage container.

SD 572

Cryptographic Access Certification (3 years after termination or last recorded date).

Tier 2

COMSEC accounts that manage COMSEC material to meet mission requirements.

SF 153

A multi-purpose COMSEC accounting report used primarily but not limited to receipt for, transfer, destruction, or inventory of COMSEC-accountable material.

CMS 25

The CMS-25 COMSEC keying material report is a two-sided document used to record destruction of individual, one-time keying material segments of COMSEC material.

Tier 3

Local Element (hand receipt holder/work center level). This is the lowest layer in the architecture and may include the fill devices used for key loading and storage.

OF 89

A Maintenance Record for Security Containers and Vault Doors.

Form 10

Used to authorize personnel to receipt and ship material via the DCD.

DD-2625

Controlled Cryptographic Item Briefing (3 years after termination or last recorded date).

Storage

Store COMSEC material only in containers and spaces approved for their storage.

COMSEC material

Classified material that must be stored separately and segregated by classification, status, and type.

Transportation

Refers to the procedures for distributing, relaying, and transferring electronic key or update traffic encryption keys (TEKs).

OTAD/OTAR/OTAT

NSA-approved procedures for distributing, relaying, and transferring electronic keys in point-to-point circuits.

Annex J

Provides the COMSEC Briefing and Acknowledgment Form and Cryptographic Access Brief for three years after termination.

Watch-to-watch inventory

An inventory process where COMSEC material is accounted for during shifts in responsibility.

Destruction of keying material

Must be done as soon as possible after it has been superseded or served its intended purpose.

Semi-annual inventory

A fixed-cycle inventory used to satisfy National policy requirements.

Change of command or custodian inventory

Documents a change of Commanding Officer (CO) or Custodian Account Manager (CAM).

Change of Account Location (COAL)

A management tool to enhance accountability and keep databases in sync.

ESD/Fill Devices

Used to store and transfer cryptographic keying material securely.

End Cryptographic Unit (ECU)

The operational endpoint where cryptographic functions are performed.

Combined Inventories

Used to document a Semi-Annual Inventory in conjunction with other inventories.

AKP/MGC

The hardware platform and software interface used by COMSEC Account Managers to manage keying material.

Access list

A current, signed list identifying all personnel authorized to handle or access COMSEC material.

Over-the-Air Key Transfer (OTAT)

Electronically distributing key without changing the traffic encryption key used on the secured communications path.

Over-the-Air Rekeying (OTAR)

Changing traffic encryption key in remote crypto-equipment by sending a new key directly over the communications path.

Need to Know

Access to COMSEC material is restricted to individuals with a legitimate operational requirement.

Areas of Responsibility (AORs)

Geographic areas assigned to CMS Accounting and Auditing Teams for auditing and supporting COMSEC accounts.

Responsibilities of CMS A&A Teams

Conduct audits, provide technical assistance, investigate incidents, and ensure policy enforcement.

Commanding Officer (CO)

Responsible for administering the command's COMSEC account and ensuring compliance with policies.

COR Audits

Internal reviews conducted by the CO to assess compliance with COMSEC policies and procedures.

Relationship with ISIC

ISIC oversees subordinate units and ensures proper conduct of COR audits.

Relationship with the Unit

The unit is responsible for conducting and documenting COR audits as part of its self-assessment program.

Relationship with NCMS

NCMS is the Navy's central authority for COMSEC policy and program management.