2.5.1.9. Section 9: Intelligence Supportability. No change from a regular CDD to the Intelligence Supportability section of the IS-CDD.

{From Annex G, Appendix G, Enclosure B}

3.3.2.6. Counterintelligence and Security Support

3.3.2.6.1. Consistent with references [102], [103], and [104], counterintelligence (CI) and security support are necessary to protect technology and CPTI against FIE, supply chain and similar threats throughout a system’s lifecycle. CI support includes the intelligence information, resources, and activities used to help establish plans, tools, or techniques to protect designated CPTI.

3.3.2.6.1.1. CPTI is U.S. capability elements that contribute to warfighters’ technical advantage, which would undermine U.S. technical preeminence if compromised. CPTI is identified through an analytic process conducted by the program office early in program development. The program office then requests a technology, program, and system threat assessment from appropriate intelligence, CI, and security organizations. These threat assessments describe the FIE, supply chain, and anti-tamper threats to a program, which are included in a JCIDS document Threat Summary, and are the foundation for a capability’s CI and Security Support requirements.

3.3.2.6.2. Security support addresses efforts to maintain a technological advantage and program protection for all DoD research, technology, and programs. Security support includes physical measures designed to safeguard personnel, and prevent unauthorized access to equipment, installations, material, and documents; communications security measures designed to deny unauthorized persons information of value, including the use of cryptographic material; and, measures to prevent the insertion of malicious capabilities, or exploitation of existing vulnerabilities, in hardware or software to disrupt or degrade system performance.

3.3.2.6.3. CI and Security Support may include any number of activities applied throughout a capability solution's lifecycle to protect CPTI, address supply chain risks, and support development of a Program Protection Plan (PPP). At a minimum, the following actions are required in order to fully identify CI and Security Support requirements and devise adequate protection measures to capability development. These actions should be consistent with the FIE and supply chain threats in Threat Summaries. Sponsors should engage associated Service CI personnel to coordinate collection, analytic, or production support requirements.

3.3.2.6.3.1. ICDs and IS-ICDs. If the Threat Summary includes FIE and/or supply chain threats, Sponsors should include the CI and Security Support category in the document’s Intelligence Supportability Requirements paragraph. Sponsors should also coordinate closely with the Program Office, MDCOs, and intelligence support offices to ensure necessary criticality analysis, CI assessments of the FIE threat, supply chain threat analysis, and technology targeting risk assessment production requirements are initiated and on track to support further capability development.

3.3.2.6.3.2. CDDs, IS-CDDs and CDD Updates (as applicable).

3.3.2.6.3.2.1. Sponsors shall address identification of capability-associated critical components and CPTI, the production status and currency of CI assessments of the FIE threat, supply chain threat analysis, and the development of any other associated CI activities supporting protection of CPTI. Sponsors may include correspondence or COLISEUM production requirements to document such supportability requests.

3.3.2.6.2.3.2.2. Sponsors shall identify the measures and countermeasures required to protect CPTI, to include the following:

3.3.2.6.3.2.2.1. Providing foreign collection threat information to personnel supporting concept, doctrine, organization, training, leadership and education, policy, or other non-materiel capability development activities.

3.3.2.6.3.2.2.2. Participating in installation-level, program-level, or facility-level threat working groups to inform participants of foreign collections threats to concept, doctrine, organization, training, leadership and education, policy, or other non-materiel capability development activities.

3.3.2.6.3.2.2.3. Coordinating with security managers, intelligence, and cybersecurity personnel to aid in cyber threat identification and the establishment of countermeasures designed to detect and mitigate foreign and international terrorist cyber-associated threats to concept, doctrine, organization, training, leadership and education, policy, or other non-materiel capability development activities.

3.3.2.6.3.2.2.4. Reviewing Sponsor-affiliated capability development documents to assist in developing foreign collection threat awareness training and requesting CI analytical support.

3.3.2.6.3.2.2.5. Evaluating individual and organizational awareness of foreign collection threats to determine vulnerabilities of FIE collection, assessing the effectiveness of existing countermeasures, and assisting Sponsor’s security personnel develop new countermeasures.

3.3.2.6.3.2.3. Sponsors shall address security support requirements to enhance protection of the capability, including measures for physical security, personnel, Industrial, Classified and Controlled Unclassified Information (CUI) security, communication security, technology security, and requirements associated with the exportability or foreign-involvement with CPTI, including anti-tamper, supply chain and foreign disclosure.

3.3.2.6.3.3. Joint DCRs. Sponsors shall address CI and Security support requirements as stated in para 3.3.2.6, if the Joint DCR will increase quantities or alternate applications of existing materiel solutions, especially those solutions previously identified with CPTI, newly intended for release or disclosure to Allies, or will result in foreign-military sales.