SORT: 5215.01
DOCI: DODD 5215.1
DATE: 19821025
TITL: DODD 5215.1 Computer Security Evaluation Center, October 25, 1982
thru ch 1 November 16, 1994

Ref: (a) DoD Directive 5200.28, "Security Requirements for Automatic Data
Processing (ADP) Systems," December 18, 1972
(b) DoD 5200.28-M, "ADP Security Manual," January 1973, authorized by
reference (a)
(c) QMB Circular No.  A-71, Transmittal Memorandum No. 1, "Security of
Federal Automated Information Systems," July 27, 1978
(d) through (m), see enclosure 1


This Directive establishes the DoD Computer Security Evaluation Center
(CSEC), provides policy, and assigns responsibilities for the technical
evaluation of computer system and network security, and related technical


1. This Directive applies to the Office of the Secretary of Defense (OSD),
the Military Departments, the Organization of the Joint Chiefs of Staff,
the Unified and Specified Commands, and the Defense Agencies (hereafter
referred to as "DoD Components").

2. Its provisions govern the conduct of trusted computer system evaluation
and technical research activities within the Department of Defense in
support of overall computer system security evaluation and approval
responsibilities assigned to the DoD Components under references (a), (b),
(c), DoD Directives 5220.22, and 5400.11 (references (d) and (e)).


1. Sensitive/Classified Information.  Sensitive information as defined in
reference (c), and classified information as defined in DoD 520O.1-R
(reference (f)).

2. A Trusted Computer System.  Employs sufficient hardware and software
integrity measures to allow its use for processing simultaneously a
range of sensitive or classified information.

3. Generic Computer Security Research and Development.  Has potential
application over a very broad, generalized basis, and includes
experimental exploration and development of feasible and potentially
useful technology, responsive to a broad class of computer security needs.


1. It is DoD policy to encourage the easy availability of trusted computer
systems.  The establishment of the DoD CSEC, the consolidation of generic
computer security research and development (R&D), the evaluation of
computer security systems and the establishment of an Evaluated Products
List (EPL) are designed to further this objective.

2. The DoD Consolidated Computer Security Program (CCSP) shall include
resources for the operation of the CSEC and for generic computer security
R&D activities in support of DoD Components.  The DoD Components are
responsible for DoD Component security research, development, test, and
evaluation (RDT&E) efforts and application-dependent research and
development for specific DoD Component systems.

3. The activities and products of the CSEC, including technical advice and
support, shall complement the established responsibilities of DoD
Components relating to the overall policy, security evaluation, and
approval of computer systems as prescribed in DoD Directive 5200.28, DoD
5200.28-M, OMB Circular A-71, Directives 5220.22 and 5400.11 (references
(a), (b), (c), (d), and (e)), for the processing, use, and production of
sensitive and classified information.

4. The EPL is not intended to replace prescribed procurement practices in
the acquisition of computers and computer services.  The CSEC and EPL are
established to assist procuring activities in evaluating available
products; computer products or services will not be rejected on the basis
that the product or service is not on an EPL.


Procedures for consolidated technical research are at enclosure 2.


1. The Under Secretary of Defense for Research and Engineering (USDR&E),
or his designee, shall:

a.  Provide overall policy direction, guidance, and management over-sight
for the CSEC in coordination with the Deputy Under Secretary of Defense
(Policy) (DUSD(P)) and the Assistant Secretary of Defense (Comptroller)

b.  Establish a steering committee composed of representatives of DoD
Components to review center activities and recommend future directions.

c.  In coordination with the Deputy Assistant Secretary of Defense (Policy)(DUSD(P)) and the Assistant Secretary of Defense (Comptroller) (ASD(C))
represent the Secretary of Defense with other government agencies, foreign
governments, the North Atlantic Treaty Organization (NATO), and to the
extent permitted, industry, in trusted computer system evaluation policy
matters.  Enter into agreements, if appropriate, consistent with National
Disclosure Policy (reference (g)), with other government agencies, foreign
governments, and NATO.

d.  Establish an information exchange forum on computer security matters
among DoD Components.

2. The Director, National Security Agency (NSA), in cooperation with the
USDR&E, shall::

a.  Establish and operate the CSEC as a separate and unique entity within
the NSA.

b.  Program and budget for CCSP support resources under procedures
prescribed for the DoD planning, programing, and budgeting processes, but
excluding National Foreign Intelligence Program funds controlled by the
Director of Central Intelligence (DCI) under E.O. 12333 (reference (h)).

c.  Appoint a Director to manage the CSEC who shall:

(1) Establish and maintain technical standards and criteria for the
evaluation of trusted computer systems that can be incorporated readily
into the DoD Component life-cycle management process (DoD Directives
7920.1, 5000.29, 5000.1, 5000.2 (references (i),(k),(l),(m)). Provide
assistance to the DoD Components in the application of the technical
standards and criteria.

(2) Conduct evaluations of selected industry and government-developed
trusted computer systems against these criteria.  Request for evaluation ofgovernment-developed computer systems will be from the DoD Component
responsible for the security of the system to be evaluated.

(3) Maintain and publish an EPL of the selected industry and government-
developed trusted computer systems that is suitable for use by the DoD

(4) Conduct and sponsor R&D for trusted computer systems, and for computer
security evaluation and verification methods and techniques.

(5) Provide assistance to the DoD Components by conducting evaluations of
selected DoD and DoD contractor trusted computer systems in response to
requests from the DoD Component responsible for the security of the
computer system to be evaluated.

(6) Serve as the focal point for technical matters concerning the use of
trusted computer systems for the protection of sensitive and classified
information and, in conjunction with DoD Component computer security test
and evaluation activities, provide technical advice to the DoD Components.

(7) Sponsor DoD Component cooperative efforts, public seminars, and
workshops for the purpose of technology transfer.

(8) Serve as the DoD principal technical point of contact on trusted
computer system matters with other government agencies, industry, foreign
governments, and NATO under the policy guidance of the USDR&E or designee,
consistent with National Disclosure Policy (reference (g)).

(9) Develop and maintain the CCSP, in conjunction with DoD Components.
(See procedures at enclosure 2).

3. Heads of DoD Components, or designees, shall:

a.  Make maximum use of the standards, technical criteria, and evaluations
promulgated by the CSEC in meeting their responsibilities for overall
automatic data processing (ADP) system security evaluation, approval, and
maintenance as set forth in DoD Directive 5200.28, DoD 5200.28-M, DoD
Directives 5220.22, and 5400.11 (references (a), (b), (d), and (e)).

b.  Establish overall ADP security policy for specific types of sensitive
and classified information under their security cognizance, and prescribe
the security procedures and constraints appropriate for the classes of
trusted computer systems as defined in the EPL.

c.  Designate central DoD Component focal points for interaction with the
CSEC in the development of Component trusted computer systems.

d.  Formulate jointly the CCSP and manage directly the execution of their
respective portions of the CCSP in accordance with enclosure 2.

e.  Conduct RDT&E to meet specific operational needs identified by
Component requirements.


This Directive is effective immediately.

Frank C. Carlucci Deputy Secretary of Defense

Enclosures - 2 1. References 2. Summary of Procedures for Consolidated
Technical Research

REFERENCES, continued

(d) DoD Directive 5220.22, "DoD Industrial Security Program," December 8,
(e) DoD Directive 5400.11, "Department of Defense Privacy Program," June
9, 1982
(f) DoD 5200.1-R, "Information Security Program Regulation," August 1982,
authorized by DoD Directive 5200.1, "DoD Information Security Program,"
June 7, 1982
(g) DoD Instruction 5230.17, "Procedures and Standards for Disclosure of
Military Information to Foreign Activities," August 17, 1979
(h) Executive Order 12333, "United States Intelligence Activities"
December 4, 1981
(i) DoD Directive 7920.1, "Life Cycle Management of Automated Information
Systems (AIS)," October 17, 1978
(j) DoD Directive 7200.1, "Administrative Control of Appropriations,"
November 15, 1978
(k) DoD Directive 5000.29, "Management of Computer Resources in Major
Defense Systems," April 26, 1976
(l) DoD Directive 5000.1, "Major Systems Acquisition," March 9, 1982
(m) DoD Directive 5000.2, "Major Systems Acquisition Process," March 19,


This establishes the procedures for developing the generic computer
security R&D portion of the CCSP, as defined in subsection C.3. of this
Directive.  Portions of the CCSP relating solely to the operations of the
CSEC are not included in this summary.

1. Under paragraph F.2.b of this Directive, the Director, NSA, shall issue
a data call for each fiscal year to the DoD Components for the CCSP. The
data call shall request identification of major tasks and milestones for
that fiscal year.

2. DoD Components shall submit to NSA their proposed projects for generic
computer security R&D in the format prescribed.  This shall include a
program-quality technical description, cost estimates, and recommendation
for the execution responsibility, namely, the submitting Component,
another Component, or the CSEC. The CSEC similarly shall prepare its own

3. The CSEC shall convene the technical review group (TRG) composed of an
identified principal from each DoD Component with participation by the
working level engineering, scientific, communications and data processing
personnel of DoD Components and the CSEC. The purpose and function of this
group is to review the Component submissions for redundancies,
completeness, and resource requirements, and to determine initial
priorities.  The TRG deliberations are directed toward an understanding andagreement among all principals of the nature and scope of the proposed
CCSP research and development projects.

4. The CSEC shall compile the TRG-reviewed projects and provide the DoD
Components a copy of the draft program for review and comment.

5. The Director, CSEC, shall chair the program working group (PWG) which
is composed of a principal from each DoD Component.  The function of the
PWG is to review and refine the priorities for the generic security R&D
portion of the CCSP under published OSD guidance.  The PWG shall recommend
the generic computer security R&I) program to the Director, NSA. The CSEC
shall prepare the draft consolidated computer security R&D program and
provide the Components a copy for review and comment.

6. The Director, NSA, shall chair the program manager's review group
(PMRG) consisting of representatives from DoD Components, including the
Deputy Assistant Secretary of Defense (Communications, Command, Control,
and Intelligence) and the Deputy Assistant Secretary of Defense (Research
and Advanced Technology) as members, with additional observers, as
appropriate.  A formal briefing on the overall CCSP shall be presented to
the Director and this group.

7. The Director, NSA, shall approve the CCSP after considering the changes
or modifications suggested by this review group.  This shall constitute thebasis for the CCSP portion of the NSA Program Objectives Memorandum (PON)

8. Acting upon published guidance and based on the approved CCSP, NSA
shall make the budget submission for the CCSP. The CSEC shall distribute
the CCSP portion of the NSA POM submission to the DoD Components.

9. Before anticipated appropriation, the PWG shall refine further
priorities, confirm execution responsibilities, and identify possible
candidates in the event of program reductions.  These actions shall be the
basis for suballocation of funding.

10. Following receipt of obligational authority, NSA shall suballocate
CCSP funds to DoD Components for their approved tasks under DoD Directive
7200.1 (reference (j)). The sub allocation process requires that each DoD
Component provide to NSA by the 15th of each month a status report of
commitmenace and obligations of the CCSP funds.