STEP 1
Determine if this is a new connection or an existing connection requirement
In order to start the connection process, the Customer/Sponsor must first determine if this is a requirement for a new connection or the modification or renewal of an existing connection requirement.
- New Connections
For Customers with a new connection requirement, it is necessary to start the process from the beginning.
- Existing Connections
If an accreditation decision is approaching its Authorization Termination Date (ATD), the DAA must reinitiate the C&A process and issue a new accreditation decision. Ideally, the new ATO/IATO will be issued and an updated CAP package forwarded to the CAO at least 30 days prior to the current accreditation decision’s ATD. This is important because the expiration date of an ATC/IATC will not be later than an ATO/IATO expiration date and an expired ATO/IATO will prompt the issuance of a Denial of Authorization to Connect (DATC) that includes a possible recommendation that JTF-GNO order disconnect of the enclave from the DISN network/service.
Significant changes to an existing IS/enclave may also generate a requirement that the CAO be notified prior to deployment, or provided updates (for example, a new topology diagram) after deployment. In some cases, the changes may be significant enough for the DAA to reinitiate the full C&A process and issue a new accreditation decision inside the normal 3-year (or 180-day) cycle. If no physical reconfiguration of the DISN circuit is needed, such changes (whether it is an update or a new accreditation decision) do not need to be coordinated with the corresponding DISN service manager.
Documentation and IA requirements for follow-on approvals for existing DoD and Non-DoD connections to DISN networks/services are generally the same as for new connections, including the requirement for a risk assessment by the CAO. (See Para 3.2 Step 11, below for the risk assessment methodology.)
A follow-on ATC/IATC will not be issued in the event of a “high” risk assessment. The Customer/Sponsor must work with the CAO to reduce the risk conditions to allow the downgrade of “high” risk to a “medium” or “low” risk.
There are instances where existing Non-DoD connections to the DISN require re-initiation of the new connection request process. These include:- Change in the DoD Sponsor
- Change in the Customer’s mission requirement
- For contractor connections, expiration/cancellation of the contract and a new contract is awarded, or change in contractor location.
