New or recently installed VVoIP systems, devices, and/or their software loads are NOT certified, accredited, and placed on the DoD Approved Products List per DODI 8100.3 and UCR OR existing systems DO NOT appear on the current APL or the “Retired APL” lists.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-8257	VVT 1115 (GENERAL)	SV-8743r1_rule	EBCR-1	Medium

Description
DoD Instruction 8100.3 governs DoD telecommunications, the Defense Switched Network (DSN), and the Defense RED Switched Network (DRSN), and requires that “Telecommunications switches (and associated software releases) leased, procured (whether systems or services), or operated by the DoD Components, and connected or planned for connection to the DSN or PSTN, shall be joint interoperability certified by the Defense Information Systems Agency (DISA), Joint Interoperability Test Command (JITC) and granted information assurance certification and accreditation by the Defense Information System Network (DISN) Designated Approval Authorities (DAAs).” DAA certification is obtained through the DISN Security Accreditation Working Group (DSAWG). DoDI 8100.3 also requires that the DoD use (or connect to the DISN) only devices that appear on the DoD Approved Products List (APL). Both IA and Interoperability certification requirements must be met for inclusion on the DoD APL. NOTE: The DoD APL was formerly referred to as the DSN APL. Any interconnected VVoIP system or device poses a potential security risk to the DISN and should not be connected until interoperability certification by the DISA Joint Interoperability Test Command (JITC) and Information Assurance Certification and Accreditation by the DSAWG is completed per the requirements of the DoDI 8100.3. This testing is required on two fronts to ensure that the system/device will interoperate with other DoD systems in support of C2 communications requirements and that it can be secured to within an acceptable level of risk. Once approved, and APL listed, DoD components may purchase and install the systems while following the deployment restrictions and configuration guidance developed during testing. NOTE: Through the publication of the UCR, the APL requirements are being extended by OSD/NII to cover all network elements and components that support converged Assured Service (C2) communications.

Description

DoD Instruction 8100.3 governs DoD telecommunications, the Defense Switched Network (DSN), and the Defense RED Switched Network (DRSN), and requires that “Telecommunications switches (and associated software releases) leased, procured (whether systems or services), or operated by the DoD Components, and connected or planned for connection to the DSN or PSTN, shall be joint interoperability certified by the Defense Information Systems Agency (DISA), Joint Interoperability Test Command (JITC) and granted information assurance certification and accreditation by the Defense Information System Network (DISN) Designated Approval Authorities (DAAs).” DAA certification is obtained through the DISN Security Accreditation Working Group (DSAWG). DoDI 8100.3 also requires that the DoD use (or connect to the DISN) only devices that appear on the DoD Approved Products List (APL). Both IA and Interoperability certification requirements must be met for inclusion on the DoD APL. NOTE: The DoD APL was formerly referred to as the DSN APL. Any interconnected VVoIP system or device poses a potential security risk to the DISN and should not be connected until interoperability certification by the DISA Joint Interoperability Test Command (JITC) and Information Assurance Certification and Accreditation by the DSAWG is completed per the requirements of the DoDI 8100.3. This testing is required on two fronts to ensure that the system/device will interoperate with other DoD systems in support of C2 communications requirements and that it can be secured to within an acceptable level of risk. Once approved, and APL listed, DoD components may purchase and install the systems while following the deployment restrictions and configuration guidance developed during testing. NOTE: Through the publication of the UCR, the APL requirements are being extended by OSD/NII to cover all network elements and components that support converged Assured Service (C2) communications.

STIG	Date
Voice / Video Services Policy STIG	2015-07-01

Details

Check Text ( C-23596r1_chk )
Interview the IAO and review site documentation to confirm compliance with the following requirement: Ensure that new or recently installed VVoIP systems, devices, and/or their software loads are certified, accredited, and placed on the DoD Approved Products List per DODI 8100.3 and UCR prior to obtaining an Authority to Connect (ATC). Further ensure that existing systems appear on the current APL or the retired product list. NOTE: upgrades to and new software loads for existing systems and devices must appear on the current APL.

Check Text ( C-23596r1_chk )

Interview the IAO and review site documentation to confirm compliance with the following requirement: Ensure that new or recently installed VVoIP systems, devices, and/or their software loads are certified, accredited, and placed on the DoD Approved Products List per DODI 8100.3 and UCR prior to obtaining an Authority to Connect (ATC). Further ensure that existing systems appear on the current APL or the retired product list. NOTE: upgrades to and new software loads for existing systems and devices must appear on the current APL.

Fix Text (F-20111r1_fix)
Ensure that new or recently installed VVoIP systems, devices, and/or their software loads are certified, accredited, and placed on the DoD Approved Products List per DODI 8100.3 and UCR prior to obtaining an Authority to Connect (ATC). Further ensure that existing systems appear on the current APL or the retired list. NOTE: upgrades to and new software loads for existing systems and devices must appear on the current APL.

Fix Text (F-20111r1_fix)

Ensure that new or recently installed VVoIP systems, devices, and/or their software loads are certified, accredited, and placed on the DoD Approved Products List per DODI 8100.3 and UCR prior to obtaining an Authority to Connect (ATC). Further ensure that existing systems appear on the current APL or the retired list. NOTE: upgrades to and new software loads for existing systems and devices must appear on the current APL.