MARADMINS

R 192053Z MAR 09
UNCLASSIFIED//
MARADMIN 0176/09
MSGID/GENADMIN/CMC WASHINGTON DC/C4//
SUBJ/MCBUL 5239. USMC CERTIFICATION AND ACCREDITATION PROGRAM//
REF/A/DESC:DOD INSTRUCTION 8510.01 DOD INFORMATION ASSURANCE CERTIFICATION AND ACCREDITATION PROCESS (DIACAP) 27 NOVEMBER 2007//
REF/B/MSGID:DOC/FEDERAL INFORMATION SECURITY MANAGEMENT ACT 2002/6 JULY 2006//
REF/C/MSGID:DOC/DOD DIRECTIVE 8500.1/24 OCTOBER 2002//
REF/D/MSGID:DOC/USMC ENTERPRISE INFORMATION ASSURANCE DIRECTIVE 018 USMC CERTIFICATION AND ACCREDITATION PROCESS/1 NOVEMBER 2008//
REF/E/MSGID:DOC/DON DOD INFORMATION ASSURANCE CERTIFICATION AND ACCREDITATION HANDBOOK 15 JULY 2008//
REF/F/MSGID:MCO 5239.2/MARINE CORPS INFORMATION ASSURANCE PROGRAM/18 NOVEMBER 2002//
REF/G/MSGID:MARADMIN 663/08/MCBUL 5239 TRANSITION TO THE DOD INFORMATION ASSURANCE CERTIFICATION AND ACCREDITATION PROCESS//
POC/C. B. BUCKLEY/CAPT/UNIT:C4IA/-/TEL: DSN 223-3490/TEL:COMM (703)693-3490/EMAIL: CHARLES.BUCKLEY@USMC.MIL//
POC/R. A. LETTEER/CIV/UNIT:C4IA/-/TEL: DSN 223-3490/TEL:COMM (703)693-3490/EMAIL: RAY.LETTEER@USMC.MIL//
NARR/REF A IS THE DOD CERTIFICATION AND ACCREDITATION POLICY.  REF B ESTABLISHES THE REQUIREMENT TO SECURE INFORMATION SYSTEMS AND REPORT COMPLIANCE.  REF C IMPLEMENTS THE DOD INFORMATION ASSURANCE PROGRAM. REF D IS THE USMC ENTERPRISE IA DIRECTIVE ON CERTIFICATION AND ACCREDITATION.  REF E PROVIDES DON GUIDANCE IN COMPLETING THE REQUIREMENTS OF THE DIACAP.  REF F ESTABLISHES THE INFORMATION ASSURANCE DIVISION OF C4.  REF G IDENTIFIES THE USMC GUIDANCE WHEN TRANSITIONING FROM DITSCAP TO DIACAP.//
GENTEXT/REMARKS/1.  THIS MCBUL ANNOUNCES POLICY RELATED TO CERTIFICATION AND ACCREDITATION OF USMC INFORMATION SYSTEMS.
2.  BACKGROUND
A.  THE USMC HAS TRANSITIONED FROM THE DOD INFORMATION TECHNOLOGY SECURITY CERTIFICATION AND ACCREDITATION PROCESS (DITSCAP) TO THE DOD INFORMATION ASSURANCE CERTIFICATION AND ACCREDITATION PROCESS (DIACAP) IN SUPPORT OF THE CERTIFICATION AND ACCREDITATION (C&A) OF USMC INFORMATION SYSTEMS (IS) AND NETWORKS.
B.  IN ACCORDANCE WITH REF A THRU G, C&A IS REQUIRED FOR:
(1) ALL INFORMATION SYSTEMS (IS) OWNED AND OPERATED BY THE USMC (GOGO: GOVERNMENT OWNED, GOVERNMENT OPERATED), REGARDLESS OF NETWORK CONNECTION STATE.
(2) ALL IS(S) OWNED AND OPERATED BY AN EXTERNAL ENTITY ON BEHALF OF THE USMC (COCO: CONTRACTOR OWNED, CONTRACTOR OPERATED).
(3) ALL IS(S) OWNED BY THE USMC AND OPERATED BY A EXTERNAL ENTITY ON BEHALF OF THE USMC (GOCO: GOVERNMENT OWNED, CONTRACTOR OPERATED).
(4) IS(S) INCLUDES: NETWORK CONNECTED ASSETS, NON-NETWORKED ASSETS (STAND ALONE COMPUTERS), IS(S) AND NETWORKS CONNECTED TO INTERNET SERVICE PROVIDERS, AND NEWORKS USED IN SUPPORT OF EXERCISES. 
C.  INFORMATION RELATED TO THE USMC C&A PROCESS CAN BE FOUND AT: HTTPS(DOUBLE SLASH)HQDOD.HQMC.USMC.MIL(SLASH)CA.ASP.
D.  A KEY FEATURE OF THE DIACAP IS AUTOMATION OF THE C&A PROCESS. THE USMC HAS IMPLEMENTED XACTA IA MANAGER AS THE TOOL FOR CREATING AND MAINTAINING C&A DOCUMENTATION.  XACTA IA MANAGER ALSO AUTOMATES THE C&A SUBMISSION PROCESS.  INFORMATION RELATED TO XACTA IA MANAGER CAN BE FOUND AT: HTTPS(DOUBLE SLASH)HQDOD.HQMC.USMC.MIL(SLASH)CA.ASP.
E.  IN ACCORDANCE WITH THE ABOVE REFERENCES, THE DIRECTOR, COMMAND, CONTROL, COMMUNICATIONS, AND COMPUTERS (C4) HAS DESIGNATED THE CHIEF, C4 IA DIVISION AS THE MARINE CORPS ENTERPRISE NETWORK DESIGNATED ACCREDITING AUTHORITY (MCEN DAA).  THE ROLES AND RESPONSIBILITIES OF THE MCEN DAA ARE ESTABLISHED BY THE REFERENCES.
(1) THE MCEN DAA IS RESPONSIBLE FOR THE ESTABLISHMENT AND MANAGEMENT OF THE USMC C&A PROCESS.
(2) THE MCEN DAA IS RESPONSIBLE FOR ACCREDITING ALL IS AND NETWORKS IN USE THROUGHOUT THE USMC.
(3) THE MCEN DAA IS RESPONSIBLE FOR ENDORSING COMMANDER'S ASSIGNMENTS OF DEPLOYED DAAS FOR OPERATIONAL ENVIRONMENTS.
(4) THE MCEN DAA IS RESPONSIBLE FOR ENDORSING THE APPOINTMENT OF DEVELOPMENTAL DAA(S) FOR CENTRALLY MANAGED PROGRAMS CURRENTLY UNDER DEVELOPMENT FOR USE WITHIN THE USMC.  THE DIRECTOR, C4 WILL FORMALLY APPOINT DEVELOPMENTAL DAA(S).
3.  ACTION
A.  EFFECTIVE IMMEDIATELY, IN ACCORDANCE WITH REFS A, D, AND E, ALL USMC IS(S) AND NETWORK S ARE REQUIRED TO UNDERGO C&A.  COMMANDERS SHALL ENSURE THAT:
(1) ALL IS(S) AND NETWORKS UNDER THEIR CONTROL SUCCESSFULLY COMPLETE THE C&A PROCESS NLT 1 DEC 09. 
(2) ALL IS(S) AND NETWORKS UNDER THE CONTROL OF AN EXTERNAL AGENCY ON BEHALF OF THE USMC SUCCESSFULLY COMPLETE THE C&A PROCESS NLT 1 DEC 09.
B.  USE OF XACTA IA MANAGER:
(1) EFFECTIVE IMMEDIATELY, PROGRAM MANAGERS AND SYSTEM OWNERS OF IS AND NETWORKS WILL UTILIZE XACTA IA MANAGER TO ASSIST IN THE CREATION AND SUBMISSION OF C&A DOCUMENTATION.
(2) C&A PACKAGES CURRENTLY UNDER REVIEW WILL CONTINUE WITHOUT BEING ENTERED INTO XACTA. 
(3) INFORMATION REGARDING XACTA ACCESS AND TRAINING MAY BE FOUND AT: HTTPS(DOUBLE SLASH)HQDOD.HQMC.USMC.MIL(SLASH)CA.ASP.
(4) C&A PACKAGES CREATED FOR SIPRNET ISS AND NETWORKS WILL NOT BE CREATED AND PROCESSED UTILIZING XACTA.  FOR SIPRNET IS AND NETWORKS, A DIACAP PACKAGE IS REQUIRED AND CAN BE DOWNLOADED AT THE URL IDENTIFIED IN SECTION 3.B.(3) OF THIS MESSAGE.
4.  CANCELLATION CONTINGENCY.  THIS BULLETIN, UNLESS SUPERCEDED, IS CANCELLED 31 DECEMBER 2009.
5.  RELEASE AUTHORIZED BY BGEN G. J. ALLEN, DIRECTOR, COMMAND, CONTROL, COMMUNICATIONS, AND COMPUTERS/CHIEF INFORMATION OFFICER OF THE MARINE CORPS.//