CLASSIFICATION: UNCLASSIFIED//
ROUTINE
R 281545Z MAR 24 MID120000988763U
FM CNO WASHINGTON DC
TO NAVADMIN
INFO CNO WASHINGTON DC
BT
UNCLAS
NAVADMIN 064/24
MSGID/GENADMIN/CNO WASHINGTON DC/N2N6/MAR//
SUBJ/REVISED GUIDANCE FOR NAVY SYSTEM AUTHORIZATION ACCESS REQUEST AND
RECIPROCITY.//
REF/A/GENADMIN/CNO WASHINGTON DC/N2N6/031424Z NOV 23//
REF/B/MEMO/DONCIO/25 FEB 20//
REF/C/INST/OPNAV/18 JUL 18//
REF/D/INST/SECNAV/17 NOV 2023//
REF/E/INST/DOD/6 MAR 20//
REF/F/INST/DOD/7 OCT 19//
REF/G/MANUAL/DOD/29 OCT 20//
REF/H/MANUAL/SECNAV/AUG 2018//
NARR/REF A IS NAVADMIN 259/23, GUIDANCE FOR NAVY SYSTEM AUTHORIZATION
ACCESSREQUEST AND RECIPROCITY.
REF B IS DEPARTMENT OF NAVY CHIEF INFORMATION OFFICER MEMORANDUM, ACCEPTABLE
USE OF INFORMATION TECHNOLOGY.
REF C IS OPNAV INSTRUCTION 5239.1E, U.S. NAVY CYBERSECURITY PROGRAM.
REF D IS SECNAV M-5239.2, DEPARTMENT OF THE NAVY CYBERSPACE INFORMATION
TECHNOLOGY AND CYBERSECURITY WORK FORCE AND QUALIFICATION MANUAL, JUNE 2016.
REF E IS DODI 5200.48, CONTROLLED UNCLASSIFIED INFORMATION.
REF F IS DODI 8500.01, CYBERSECURITY.
REF G IS DOD MANUAL 5200.02, PROCEDURES FOR THE DOD PERSONNEL SECURITY
PROGRAM.
REF H IS SECNAV M-5210.2, DON STANDARD SUBJECT IDENTIFICATION CODE MANUAL.//
POC/CAPT JAYSON BEIER/MIL/OPNAV N2N6D/EMAIL:
jayson.l.beier.mil@us.navy.mil/TEL: 571-256-8514// POC/MICHAEL
CHADWELL/CIV/OPNAV N2N6D/EMAIL:
michael.w.chadwell.civ@us.navy.mil/TEL: 703-695-7620//
RMKS/1. This NAVADMIN cancels and replaces reference (a) and updates the
Navy's System Authorization Access Request (SAAR) process as directed by
references (b) through (h). The major changes to reference (a) are the
addition of language throughout the message clarifying the need to replace
the SAAR-N form (OPNAV 5239/14) with both the Department of Defense (DoD)
SAAR Form (DD Form 2875) and the Navy User Agreement/Standard Mandatory
Notice and Consent Provision.
2. Policy: Per references (b) and (c), all Department of the Navy
(DON) Information Technology users must have an approved SAAR form and signed
User Agreement on file prior to being granted access to networks, systems and
applications. In order to bring Navy into alignment with the rest of the DoD,
all new access requests must be completed using the DD Form 2875.
a. Commands can continue to use the current approved OPNAV 5239/14 (REV
9/2011) on file until the SAAR needs to be re-issued or modified.
b. All commands must use DD Form 2875 and separate user agreement for
initial access requests, re-issuance of access requests, or modification of
access requests.
(1) The Navy User Agreement/Standard Mandatory Notice and Consent Provision
using general terms and requirements is posted on the Department of Navy
Chief Information Officer portal
https://portal.secnav.navy.mil/orgs/OPNAV/N2N6/DDCION/SitePages/Forms/AllPage
s.aspx, but the specific hosting site or system may require a separate form
with site/system specific specifications.
c. The differences between the current OPNAV 5239/14 and the DD Form
2875 changes are noted below and the form is available at
https://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd2875.pdf
(1) Per reference (e), references to "For Official Use Only"
were replaced with "Controlled Unclassified Information."
(2) Block 14 no longer has a sub-block showing the Privileged Access
Agreement (PAA) form date. Users requiring privileged access must submit a
PAA for the system(s) they require privileged access alongside the SAAR. PAA
can be found in reference (d) appendix 2.
(3) Block 19 was changed from "Information Assurance Officer" to
"Information Systems Security Officer (ISSO) or Appointee" per reference (f).
(4) Blocks 22 and 22b have been added to identify if the user is
enrolled in the Continuous Evaluation Deferred Investigation Program and
enrollment date per reference (g).
(5) Block 22c was changed from "Clearance Level" to "Access Level".
Access level refers to the access determination made based on the user's
individual need for access to classified information or Controlled
Unclassified Information to perform official duties.
3. SAAR Reciprocity
a. Navy commands and organizations must reuse SAAR forms and user
agreements issued by other commands and organizations approving access to any
DON networks, systems, or applications at the same or lower classification
level and need-to-know status. This applies for both permanent changes of
station and for temporary duties (e.g., Temporary Additional Duty, exercises,
deploying, embarkation, etc.).
(1) Modifications to move accounts within the Navy and reactivate disabled
accounts due to inactivity do not require a new SAAR form. Information
System Security Manager (ISSM), ISSO, or Information System Coordinator (ISC)
will request account movement or reactivation after validating the current
SAAR form and completion of mandatory training.
(2) Users who require access to systems of a higher level of security
clearance or additional need-to-know requirements than is reflected in the
existing SAAR form require additional documentation or a new SAAR form.
b. A new SAAR form and user agreement are required upon change of
personnel category status (e.g., MIL to CTR, CTR to CIV, MIL to CIV to NAF)
and prior SAAR form will be updated by the ISSM/ISSO/ISC to request account
deactivation to retain separation of personal (e.g., CIV, MIL, NAF, CTR,
VOL).
c. For reservists who are also employed within the Navy as contractors
or civilians, one SAAR is required for each personnel category. This SAAR
does not require update for each activation.
4. SAAR Processing
a. For individuals with DoD approved digital signature certificates,
when possible the initial SAAR must be digitally signed by the account
requestor, the supervisor level person (supervisor or Information Security
Officer or ISC or ISSM/ISSO), the security manager, and the validating
official (system administrator) before the account is provisioned and
enabled. The supervisor level signature cannot be the same as the account
requestor. If a digital signature is not possible for any of the above, a
wet signature is acceptable.
(1) All signatures on the SAAR form must be within 90 days of the
signature in Block 11. Once initial provisioning is complete, original
signatures on the document will stand for the period prior to the applicable
expiration.
(2) Automated SAAR capabilities will adhere to this signature work
flow.
b. SAAR forms must have validation documented in the Date Processed
block of Part IV by one of the following: the ISSM/ISSO, an ISSM/ISSO
designee/appointee, or an ISC. ISSM/ISSO or ISC must perform validation, for
continued user access, and be documented in the Date Revalidated block of
Part IV.
c. Once approved, the SAAR form and user agreement must be retained on
file by the command ISSM/ISSO or the unit's ISC until one year after the user
account is terminated. This includes the initial SAAR form activating an
account and any subsequent SAAR forms submitted (e.g., modification or
deactivation requests).
Archive retention requirements for SAARs follow reference (g).
d. Command ISSMs will coordinate the disablement of accounts of users
who do not complete required training by its required date and maintain a
non-compliance list of accounts that were disabled.
e. SAAR forms submitted for de-provisioning will have the digital
signature of either the supervisor, ISC, or ISSM/ISSO.
f. Commands will incorporate their ISSM/ISSO, ISC, or designee into the
check-out process to ensure timely actions are taken to deactivate accounts
upon loss of affiliation with the Navy (e.g., End of Active Obligated
Service, Retirement, End of Contract, End of Employment).
5. Automated Processing
a. Command developed automated processing, storage and maintenance of
the approved SAAR forms and user agreements are authorized but automated work
flow, storage, processing and management must adhere to the requirements in
this NAVADMIN.
b. Total Workforce Management Services is the current DON and Navy
capability for automated SAAR processing and reciprocity.
c. Naval Identity Services (NIS) will be the mandated Identity,
Credential, and Access Management solution for the DON. Systems that are
integrated with NIS will use the SAAR automated account management process
for account provisioning and de-provisioning.
6. Moving forward, Navy will continue to identify efficiencies that can be
gained in the system access process with the long term goal of moving towards
only requiring a single SAAR for every user as well as a standardized user
agreement. In order to support this, Office of Chief of Naval Operations for
Information Warfare will establish a Navy-wide SAAR Working Group following
the release of this NAVADMIN to coordinate process improvements and clarify
implementation guidelines.
7. This NAVADMIN will remain in effect until cancelled or superseded.
8. Released by VADM K. O. Thomas, Deputy Chief of Naval Operations For
Information Warfare, OPNAV N2N6.//
BT
#0001
NNNN
CLASSIFICATION: UNCLASSIFIED//