"In achieving our vision of network-centric operations and FORCEnet, it is crucial that the Department of the Navy develops and maintains a sufficiently educated and trained workforce to ensure the security of our networks, information and information systems."
– Dave Wennergren, DON CIO
Strong information assurance (IA) practices provide confidence in information because the five crucial conditions — confidentiality, integrity, availability, authentication and non-repudiation — have been met. Military members, civilian employees and contractors and, in some cases, foreign nationals, perform IA and Computer Network Defense (CND) duties for the 900,000 system users at Navy and Marine Corps commands worldwide.
Information system users may be networked through the Navy Marine Corps Intranet (NMCI), OCONUS Navy Enterprise Network (ONE-NET), Marine Corps Enterprise Network, Integrated Shipboard Network System (ISNS), a legacy enclave, or a combination of networks, and it is up to the diverse IA/CND workforce to secure the networks whether they perform IA tasks for fleet/operating forces or shore/supporting establishments.
When the Defense Information Assurance Program staff stated that all Department of Defense IA/CND personnel, with privileged access or IA management tasks, would be required to obtain IA commercial certifications to meet a DoD standard, there were some who thought it could not be done.
But, in 2004, the Department of the Navy Chief Information Officer (DON CIO), Dave Wennergren, launched a far-reaching initiative, impacting virtually every command across the Department that transforms how the DON trains, certifies and manages the IA workforce. Now, two years later, the prospect of all DON IA personnel being trained to an enterprise standard is being realized as part of the IA workforce transformation.
The DON IA Workforce Working Group (IAWWG), co-chaired by the service enterprise Designated Approval Authorities, Ray Letteer, Headquarters Marine Corps (HQMC) and Donna Martin, Naval Network Warfare Command (NNWC), was chartered to build a Department-wide set of enterprise solutions to transform the DON IA workforce. Armed with the authority to define DON-wide policies, guidance and tools, the IAWWG is significantly improving the Department's security posture through a better trained, educated and managed workforce.
The IAWWG is putting in place plans and procedures to: (1) Identify and tag IA/CND billets and military, civilian and contractor IA personnel; (2) Train and certify personnel according to guidance in the DoD Information Assurance Workforce Improvement Program Manual, DoD 8570.01-M; (3) Track IA personnel electronically; and (4) Report compliance to Congress under the Federal Information Security Management Act (FISMA).
The IAWWG is already improving workforce capabilities by ensuring that all personnel with access to defense information systems have completed "DoD Information Assurance Awareness" training. Additionally, the Center for Information Dominance and the Communications and Electronics School are updating all IA professional classroom training curricula to meet these emerging IA requirements for the DON portion of the Global Information Grid.
An IA training path consisting of blended solutions that include computer-based training and e-learning; on-the-job training; and both service and commercial classroom training; will give a just-in-time economy to military training.
Readily available training will supply a highly mobile workforce with the right capabilities to fill burgeoning IA demands in the field and in the fleet. As classroom training is being updated, personnel in core IA positions and those who are members of the collateral IA workforce (such as combat systems, aviation, logisticians or intelligence analysts) are starting to take commercial certification tests as mandated by DoD 8570.01-M, whether working as a full- or part-time member of the IA workforce.
IA/CND workforce members may strive for one of several approved commercial certifications. Per DoD 8570.01-M, only one IA certification is required for each training level. The training levels and associated IA certifications are shown in Figure 1. The IAWWG Training Tiger Team is currently piloting several courses to determine the best commercial certification training and testing to blend with the military classroom environment.
IA/CND personnel with privileged access must also take the operating system commercial certification that supports the system they operate.
Since commercial certifications have not been a routine part of the IA/CND workforce training solution, new processes and procedures are being developed to support the mandated commercial credentialing. IA workforce members rely on the Navy Credentialing Program Office's new Credential Opportunities On-Line (COOL) Web tool to provide additional IA credentialing information.
A process has been developed to buy vouchers for commercial certification tests at the enterprise level. While the first IA commercial certification testing will utilize a manual process, an automated paperless process will be in place by the end of the next fiscal year.
The IAWWG is teaming with the Navy's Credentialing Program Office and the Defense Activity for Non-Traditional Training and Education (DANTES) to build an electronic paperless test voucher system so that the certifications are electronically tracked in military training jackets initially and in civilian electronic training jackets as they become available.
Bringing certification testing to DANTES facilities gets the DON information assurance workforce credentialed more quickly and at less cost. As DON IA professionals become credentialed, their skills will be highly desirable to joint operational leaders because they will be interchangeable in performing the IA warfighting mission.
As the IA credentialing program gets kicked off, previously credentialed Sailors on shore duty at the NMCI military detachments in Norfolk and San Diego are piloting an Enterprise IA Training Management System (TMS) for the Navy IA workforce. TMS is also in use by the aviation community. The TMS will maintain the Sailor's blended training information to include commercial certifications and job qualification requirements.
The Marine Corps' IA training will be tracked in the Training and Education Command (TECOM) Integrated Management System (TIMS).
If this tool meets training and workforce management requirements, it will be recommended as a part of the Sea Warrior Enterprise tool set. U.S. Pacific Fleet and U.S. Fleet Forces Command are implementing the "Fleet IA Workforce Improvement Initiative" to: (1) Systematically deploy mandated training and commercial certification testing to assess the impact and apply lessons learned for fleet implementation, and (2) Develop and apply new metrics for IA, CND and network operational performance.
Once training, testing, assessment and credentialing processes are in place, the IA workforce will engage in full-scale implementation.
The Navy and Marine Corps Designated Approval Authorities are developing a joint Navy Training Management and Planning System IA dashboard that will ultimately link individual manpower, personnel and training systems to a single source for determining Department-wide IA readiness. This system will monitor, track and report on the total IA workforce with training and credentialing metrics visible to information assurance managers at a moment's notice.
A highly trained and educated IA and CND workforce gives war fighters, commanders and users the confidence and trust they demand for the operation, security and integrity of DON technology.
To find out more about the DON IA Workforce Transformation Program and credentialing the IA Workforce, contact the Navy (757) 417-6757 or Marine Corps (703) 693-3490 points of contact.
For Navy "COOL" information e-mail questions to crry_cqcredentials@navy.mil or phone (850) 452-6683, DSN: 922-6683.
Mary Purdy is the DON IA Workforce Working Group facilitator.