Minimum security requirements for all AIS are listed in paragraph 2-3a. Additionally, systems operating in the systems high, partitioned, or multilevel security modes must include features which meet the appropriate trusted systems class from DOD 5200.28-STD. Use this appendix to determine which class is required.
B-1. Determine mode of operation according to paragraph 2-2b of this regulation. Determine if the system processes formal categories of data and, if so, whether or not all users have been granted formal access to all categories of data. Formal categories of data are categories for which a written approval must be issued prior to access, for example: SCI compartments, NATO information, and special access programs.
B-2. If the mode of operation is dedicated, there is no further requirement beyond those contained in paragraph 2-3a.
B-3. If the mode of operation is systems high, a class C2 minimum evaluation class is required.
B-4. If the mode of operation is partitioned- a. A class B1 minimum evaluation class is required if no user lacks formal access approval for more than one category. b. A class B2 minimum evaluation class is required if at least one user does not have formal access approval for more than one category being processed.
B-5. If the mode of operation is multilevel, determine minimum evaluation class according to table B-1. a. Enter the "Maximum Data Classification" column at the highest classification of data processed. b. Find the minimum clearance level of users, defined to be the maximum clearance of the least-cleared user. Although a "clearance" does not exist for unclassified-sensitive information, users usually have at least this level of access if they are U.S. Government employees or work on behalf of the U.S. Government on official business. c. Use the column for case one if there are no formal categories of information involved, or if all users have formal access approval for all categories of data processed by the system. Use the column for case two if no user lacks formal access approval for more than one category. Use the column for case three if at least one user lacks formal access approval for more than one category being processed. d. If SCI data is being processed and all users have not been granted access to SCI based on a special background investigation, the mode of operation is multilevel. Enter table B-1 as if the user's clearance was secret, even if the actual clearance is top secret based on a background investigation. In no case may a system process SCI data unless the minimum clearance level of all users is at least secret. e. Entries in table B-1 marked N/A mean these combinations of user clearance, access and data classification are prohibited for ARMY AIS.
Table B-1 Determining minimum evaluation class from DOD 5200.28-STD for multilevel operations
Minimum
Maximum clearance
data level of
classification users Case 1 Case 2 Case 3
TS S B2 B3 A1
C B3 A1 N/A
Unclas, Sen A1 N/A N/A
Uncleared N/A N/A N/A
S C B1 B2 B3
Unclas, Sen B2 B3 A1
Uncleared B3 A1 N/A
C Unclas, Sen B1 B2 B2
Uncleared B2 B3 A1