Surface Warfare Officers School Command
Department Head Combat Systems
Newport, Rhode Island
TITLE: CMS PROCEDURES
A. INTRODUCTION TO THE COMSEC MATERIAL CONTROL SYSTEM (CMCS):
Communications Security (COMSEC) material is that material used to protect U.S. Government transmissions, communications, and the processing of classified or sensitive unclassified information related to national security from unauthorized persons and that material used to ensure the authenticity of such communications. The protection of vital and sensitive information moving over government communications systems is crucial to the effective conduct of the government and specifically to the planning and execution of military operations. To this end, a system has been established to distribute, control, and safeguard COMSEC material This system which consists of production facilities, COMSEC Central Offices of Records (COR's), distribution and storage facilities (ie., depots, and CMS accounts), is known collectively as the COMSEC Material Control System (CMCS). COMSEC material is managed m COMSEC accounts throughout the federal government to include departments and civil agencies as well as the civilian sector supporting the federal government.
B. NATIONAL SECURITY AGENCY (NSA)
The National Security Agency is the executive agent for developing and implementing national level policy affecting the control of COMSEC material NSA is also responsible for the production of most COMSEC material used to secure communications as well as the development and production of cryptographic equipment.
C. DEPARTMENT OF THE NAVY (DON)
The DON administers its own CMCS which includes Navy, Marine Corps, Coast Guard, and Military Sealift Command (MSC) CMS Accounts. The DON system implements national policy, publishes procedures, establishes its own COMSEC accounts which it refers to as CMS accounts, and provides a COR to account for COMSEC material .
1. Chief of Naval Operations (CNO)--Has overall responsibility and authority for implementation of National COMSEC policy within the DON. The Head, Navy Information Security (INFOSEC) Branch (N652) is the COMSEC resources sponsor and is responsible for consolidating the COMSEC programming, planning and implementation of policy and technical improvements.
In the context of the CMCS, each item of COMSEC material is control or managed by a designated official known as a controlling authority (CA). A CA is responsible for evaluating COMSEC incidents and authorizing the issue/destruction of COMSEC material under their control By definition, a CA is the command designated responsibility for directing the establishment and operation of a cryptonet/circuit and managing the operational use and control of keying material assigned to a cryptonet/circuit.
E. IMMEDIATE SUPERIOR IN COMMAND (ISIC)
Immediate Superior m Command is responsible for the administrative oversight of all CMS matters for their subordinate commands.
F. STAFF CMS RESPONSIBILITY OFFICER (SCMSRO)
A flag or general officer in command status, or any officer occupying the billet of a flag or general officer with command status, may either assume personal responsibility for routine CMS matters or may designate the responsibility to a senior staff officer (04/GS-12 and above). Officers not meeting the above requirement may not designate a SCMSRO.
G. COMMANDING OFFICER (CO)
The Commanding Officer (CO) is responsible for properly administering his/her command's CMS account and ensuring compliance with established policy and procedures. Annex D of CMS-I is written specifically for COs and contains a CMS account assurance checklist.
H. CMS ACCOUNT
A CMS account is an administrative entity, identified by a six-digit account number, in which custody and control of COMSEC material are maintained.
I. CMS CUSTODIAN
An individual designated in writing by the Commanding Officer to manage COMSEC material issued to a CMS account. The CMS Custodian is the Commanding Officer's primary advisor on matters concerning the security and handling of COMSEC material and the associated records and reports.
J. ALTERNATE CUSTODIAN(S)
The individual(s) designated in using by the Commanding Officer responsible for assisting the CMS Custodian in the performance of his/her duties and assuming the duties of
the CMS Custodian his/her absence. Alternate Custodian(s) share equally with the CMS Custodian the responsibility for the proper management and administration of a CMS account.
K. LOCAL HOLDER (LH) ACCOUNT
Local Holder accounts are separate units or commands that require COMSEC material and function essentially as sub-accounts of a numbered CMS account. LH accounts are managed much the same way as a CMS account except they are not assigned a CMS account number and normally receive their COMSEC material from a parent CMS account instead of directly from a CMIO or other source.
L. LOCAL HOLDER CUSTODIAN AND ALTERNATE(S)
Individuals designated in writing by a Commanding Officer manage the COMSEC material issued to a LH account.
An individual designated in writing by the Commanding Officer who assists the CMS Custodian and Alternate(s) with routine administrative account matters. Appointment of a CMS Clerk is not mandatory but is at the discretion of the Commanding Officer.
N. CMS USER
An individual designated in writing by the Commanding Officer who, regardless of whether or not they have personally signed for COMSEC material requires COMSEC material to accomplish an assigned duty and has obtained the material from a Custodian or another User on local custody. CMS Users must comply with the procedures for the handling and accountability of COMSEC material placed in their charge.
O. CMS WITNESS
Any properly cleared U.S. Government employee (military or civilian) who may be called upon to assist a Custodian or User in performing routine administrative tasks related to the handling of COMSEC material A witness must be authorized in writing, access to keying material
II INTRODUCTION TO COMSEC MATERIAL
COMSEC material must be handled and safeguarded based on its assigned classification and accounted for based on its accountability legend (AL) code. COMSEC material control within the U.S. Government is based on a system of centralized and local accounting and decentralized custody and protection. COMSEC material is centrally accountable to DCMS and/or accounted for locally at the account command.
1. Control of COMSEC material is based on the following:
b. Accounting records, such as periodic inventory reports destruction records, transfer reports, and local custody records.
C. COMSEC MATERIAL CLASSIFICATION
The classification of COMSEC material is indicated by the standard classification markings: Top Secret (TS), Secret (S), Confidential (C), or Unclassified (U). The security classification assigned to COMSEC material determines its storage and access requirements.
D. COMSEC MATERIAL IDENTIFICATION
b. Class: Second field consists of letters and/or digits found between the system and the number of a short title. For example, in the short title "USKAC D 166," the
c. AL Code 3: COMSEC material is locally accountable by serial number and handled/safeguarded based on its classification after initial receipt to DCMS. (NOTE: Assigned to COMSEC keying material in lieu of AL 1 when tactical or operational need dictates decentralized accounting.)
2. CMIO's are required to continuously account to DCMS for all AL3 and 4 material
All transfers of AL 3 and 4 material to or from a CMIO, cache, or a non-DON account must be reported to DCMS.
F. CRYPTO MARKING
The marking or designation "CRYPTO" identifies all COMSEC keying material which is used to protect or authenticate classified or sensitive unclassified government or government derived information, the loss of which could adversely affect national security. The marking "CRYPTO" is not a security classification
CMIO's are required to continuously account to DCMS for all AL3 and 4 material
All transfers of AL 3 and 4 material to or from a CMIO, cache, or a non-DON account must be reported to DCMS. AL codes are assigned by the originating government department or agency that produces the COMSEC material and represent the minimum accounting standard.
AL codes will appear on all accounting reports but not necessarily on the material. If DCMS changes the AL code for any COMSEC material the material must be accounted for based on its new AL code effective upon notification of the change. The classification of COMSEC material has no bearing on the AL code assigned to an item. For example, Top Secret COMSEC material may be assigned AL 1 or AL 3; however, there is also Secret, Confidential and Unclassified COMSEC material that is assigned AL 1 or AL 3. AL codes determine how material is accounted for and classification determines handling and storage requirements.
The DCMS COR computer system, ACMS (Automated COMSEC Material System), requires assignment of an AL code to each short title in the system to permit automated processing (ie., automatic distribution and report generation requirements).
G. CONTROLLED CRYPTOGRAPHIC ITEM (CCI)
Controlled Cryptographic Item (CCI) is the designator which identifies secure telecommunications or information handling equipment, or an associated cryptographic component, which is unclassified but controlled within the CMCS.
H. STATUS OF COMSEC MATERIAL
c. SUPERSEDED: No longer authorized for use; must be immediately destroyed.
NOTE: An edition of COMSEC keying material is one in a series of printings of the same short title. Each edition has its own effective period and contains different key variables divided into parts, known as segments. Each segment within an edition will have a designated effective period (ie., daily, weekly, monthly, bi-monthly, etc.) assigned to it based on the key's crypto-equipment. 2. Some keying material (e.g., Inter-Theater COMSEC Package (ICP)) may be categorized as being in a contingency status. Material in this category is defined as material held for use under specific operational conditions or in support of specific contingency plans. Status documents (e.g., CSPM MIC-3) will reflect this material as when directed (WHENDI).
I. COMSEC MATERIAL SUPERSESSION
REGULAR SUPERSESSION: Supersession based on a specific, predetermined supersession date for each edition of material For example, each edition of a monthly keytape is superseded on the first day ofthe month after its implementation; each edition often-day material is superseded on the 11th, 21st, and the 31st of the month.
IRREGULAR SUPERSESSION: Supersession that is not pre-determined but which occurs as a result of use. Editions and individual segments of irregularily superseded COMSEC material are to be destroyed after the material has been used operationally, when the controlling authority directs supersession, or, in the case of maintenance key, it may be used until the key becomes unserviceable. irregular supersession is normally associated with one-time pads, test key, maintenance key, publications, and equipment.
EMERGENCY SUPERSESSION: An unplanned change of supersession, usually as a result of a compromise.
J. SOURCES OF SUPERSESSION INFORMATION
a. CSPM MIC-3:
DTG AIG SUBJECT FREQUENCY
4. A limited number of commands are authorized to hold two-person controlled (TPC) Sealed Authentication Systems (SAS) keying material
a. Policy and procedures for handling this material are contained in JO PUB 1-04. The DCMS role for TPC or SAS material is limited to accounting functions only.
K. CATEGORIES OF COMSEC MATERLAL
a. Paper keying material Includes key lists, key tapes, codes, authenticators (includes Identify Friend or Foe (IFF)), one-time tapes, and one-time pads. Keying material can be designated for use as operational, exercise, test (on-the-air), maintenance (off-the-air), or training (off-the-air (e.g., classroom)). The majority of keying material bears the following types of short titles:
One-time Pads (AKAP/USKAP)
(2) Non-extractable keying material is designed to remain intact throughout its entire effective period. An example of non-extractable keying material is operations or numeral codes with separate encode and decode sections.
1. Selected limited maintenance KAM's are being/have been replaced by Limited
Maintenance Manuals (LMMs). LMMs are unclassified and are not accountable as
COMSEC or COMSEC-related material
2. Status information on LMMs will be promulgated by DCMS//60//.
3. LMMs will have a Technical Manual Identification Number (TMIN) and a National Stock Number (NSN) assigned to them
III CMS EDUCATION, TRAINING, AND INSPECTIONS
c. Training and assistance provided by CMS A&A Training Teams.
B. CMS CUSTODIAN COURSE OF INSTRUCTION (COI)
1. General: The CMS Custodian COI provides personnel the basic skills necessary to fill a CMS Custodian or CMS Clerk position The CMS Custodian COI is a five-day course of instruction, emphasizing CMS accounting and reporting requirements to include ANCRS and CARC,.
2. Locations: The CMS COI is offered in the following areas:
CONUS East Coast:
CONUS West Coast:
(3) Submarine Training Facility, San Diego, CA
(1) NCTAMS MED DET Rota, Spain
(2) ATG, Yokosuka, Japan
3. Quotas for the CMS Custodian COI are available from each of the sites and should be coordinated through the command CMS Custodian and Training Officer.
4. Criteria for Attending: Criteria for attending the CMS Custodian COI are:
U.S. citizenship (includes naturalized) SECRET security clearance E-6/GS-7 and above (Custodians only) Six months of government service Be assigned to or designated to fill a CMS Custodian or CMS Clerk Position.
NOTE: LH Custodians/Alternates are not authorized to attend the CMS Custodian COI.
CMS LOCAL HOLDER (LH) CUSTODIAN COURSE OF INSTRUCTION (COI)
1. General: The CMS LH Custodian COI provides personnel the basic skills necessary to fill a CMS LH Custodian position. The CMS LH Custodian COI is a three-day course of instruction, emphasizing management of a CMS LH account and operation of the data transfer device (DTD).
2. Locations/Quotas: Same as paragraphs B.2. and B.3. above.
Criteria for attending: Same as paragraph B.4. above except that attendance is for personnel assigned to or designated to fill a LH CMS Custodian position.
D. CMS TRAINING VISITS AND CMS INSPECTIONS
F. CMS A&A TRAINING TEAM SERVICES
a. CMS TRAINING VISITS:
(1) Training Visits provide the basis for self-improvement and are not to be confused with a formal CMS Inspection. Training visits last six to eight hours, are strictly informal, and provide guidance on the policy and procedures for COMSEC material
4. CMS FOR COMMANDlNG OFFICER's:
CMS USER WORKSHOPS
H. CMS SEMINARS
2. Provides guidance and training on STU-m policy and procedures for the handling and safeguarding of STU-m Type I material held by DON CMS accounts only.
I. AUTOMATED CMS SYSTEMS
1. CMS A&A Training Team personnel can provide training and assistance on the following automated systems:
a. Automated Navy COMSEC Reporting System (ANCRS): ANCRS is a software program which permits CMS Custodians to maintain their account records and generate CMS reports using a personal computer (PC).
COMSEC Automated Reporting System (CARS)
(l) CARS provides a method for electronically transferring CMS reports and CMS-related information in the form of ASC II files to and from the DCMS word processing software, and other commmunication software. Annex F of CMS l contains procedures for accessing/using CARS.
K. VIDEO CASSETTE LIBRARY
Each CMS A&A Training Team maintains a library of VHS tapes covering a variety of CMS topics to supplement area training efforts or for use as training material at remote locations that are not visited on a regular basis. Contact you area CMS A&A Training Team office for a list of available tapes.