Army Regulation Ar 380 28 Army Sensitive Compartmented Information Security Program August 2018

This document, Army Regulation AR 380-28 Army Sensitive Compartmented Information Security Program August 2018, establishes policy, procedures, and responsibilities for the Sensitive Compartmented Information Security Program. It implements National Policy, Intelligence Community Policy Guidance, Intelligence Community Standards and Intelligence Community Directives for the direction, administration, and management of Special Security Programs; and Department of Defense security policy as promulgated in DODM 5105.21, Volumes 1 through 3 and DODM 5200.1, Volumes 1 through 4. This regulation applies to the Regular Army, the Army National Guard/Army National Guard of the United States, and the U.S. Army Reserves, unless otherwise stated. It also applies to Department of the Army civilian personnel and Army contractors authorized to receive, store, process, or use sensitive compartmented information. Proponent and exception authority. The proponent of this regulation is the Deputy Chief of Staff, G-2. The proponent has the authority to approve exceptions or waivers to this regulation that are consistent with controlling law and regulations. The proponent may delegate this approval authority, in writing, to a division chief within the proponent agency or its direct reporting unit or field operating agency, in the grade of colonel or the civilian equivalent. Activities may request a waiver to this regulation by providing justification that includes a full analysis of the expected benefits and must include formal review by the activity's senior legal officer. All waiver requests will be endorsed by the commander or senior leader of the requesting activity and forwarded through their higher headquarters to the policy proponent. Supplementation of this regulation and establishment of command and local forms are prohibited without prior approval from the Deputy Chief of Staff, G-2 (DAMI-CDS), 1000 Army Pentagon, Washington, DC 20310-1000. This publication is intended for the Regular Army, the Army National Guard/National Guard of the United States, and the U.S. Army Reserve.

This regulation implements the policy set forth in Executive Order 12958 “Classified National Security Information” and DOD 5200.1-R “Information Security Program”. It establishes policy for classification, downgrading, declassification, and safeguarding of information requiring protection in the interest of national security. This regulation applies to all military and civilian members of the Active Army, Army National Guard of the United States (ARNGUS), and US Army Reserve (USAR), and Department of the Army (DA) personnel.

This regulation, Army Regulation AR 380-5 Security: Army Information Security Program October 2019, establishes Department of the Army (DA) policy for the classification, downgrading, declassification, transmission, transportation, and safeguarding of information requiring protection in the interests of national security. It primarily pertains to classified national security information, or classified information, but also addresses controlled un-classified information (CUI). For purposes of this regulation, classified national security information, or classified information, is defined as information and/or material that has been determined, pursuant to Executive Order (EO) 13526, or any applicable predecessor order, to require protection against unauthorized disclosure and is marked to indicate its appropriate classification. This regulation implements Executive Order 13526 and Department of Defense Manual (DODM) 5200.01, Volumes 1 through 4. This regulation also establishes policy on the safeguards of restricted data (RD) and formerly restricted data (FRD), as specified by the Atomic Energy Act of 1954, as amended.

This manual, Army Regulation AR 25-2 Information Management: Army Cybersecurity April 2019, establishes the Army Cybersecurity Program and sets forth the mission, responsibilities, and policies to ensure uniform implementation of public law and Office of Management and Budget, Committee on National Security Systems, and Department of Defense issuances for protecting and safeguarding Army information technology, to include the Army-managed portion of the Department of Defense Information Network, (hereafter referred to as information technology) and information in electronic format (hereafter referred to as information). Information technology includes infrastructure, services, and applications used directly by the Army or for the Army by legal agreements or other binding contracts. This regulation applies to the Regular Army, the Army National Guard/Army National Guard of the United States, and the U.S. Army Reserve, to include all Headquarters, Department of the Army staff, Army commands, Army Service component commands, direct reporting units, all other Army agencies, and all personnel, authorized users and privileged users, unless otherwise stated. It applies to all Army information technology and information in electronic format at all classification levels; and Special Access Program and Sensitive Activity information systems except when handling sensitive compartmented information. Nothing in this regulation alters or supersedes the existing authorities and policies of the Department of Defense or the Director of National Intelligence regarding the protection of sensitive compartmented information as directed by Executive Order 12333. The Director of National Intelligence has delegated authority for all Army Sensitive Compartmented Information systems to the Deputy Chief of Staff, G-2.

This regulation provides policy and procedures for the disclosure of Army classified military information and controlled unclassified information to foreign governments and international organizations; policy regarding contacts with foreign representatives; policy and procedures for the Department of the Army International Visits Program; certification of foreign liaison officers to Department of the army commands, installations. and contractor facilities for which the Department of the Army is the lead agent or has security cognizance; guidelines for foreign representative attendance at Army sponsored meetings, conferences, and symposia; and establishment of policy, procedures, and assignment of responsibilities for foreign disclosure involvement in direct and indirect international transfer of critical military information and technology.

Army Tactics, Techniques, and Procedures (ATTP) 3-39.32, “Physical Security,” provides doctrinal guidance for personnel who are responsible for planning and executing physical security programs. It is the basic reference for training security personnel and is intended to be used in conjunction with the Army Regulation (AR) 190 series (Military Police), Security Engineering Unified Facilities Criteria (UFC) publications, Department of Defense (DOD) directives, and other Department of the Army (DA) publications. This publication applies to the Active Army, the Army National Guard (ARNG)/Army National Guard of the United States (ARNGUS), and the United States Army Reserves (USAR) unless otherwise stated.

Army Tactics, Techniques, and Procedures (ATTP) 3-39.32 provides doctrinal guidance for personnel who are responsible for planning and executing physical security programs. It is the basic reference for training security personnel and is intended to be used in conjunction with the Army Regulation (AR) 190 series (Military Police), Security Engineering Unified Facilities Criteria (UFC) publications, Department of Defense (DOD) directives, and other Department of the Army (DA) publications. This publication applies to the Active Army, the Army National Guard (ARNG)/Army National Guard of the United States (ARNGUS), and the United States Army Reserves (USAR) unless otherwise stated. Prevention and protection are the two primary concerns of physical security; both serve the security interests of people, equipment, and property. This ATTP establishes physical security as a supporting component of the protection warfighting function and describes defensive measures that enable protection tasks, such asoperations security, antiterrorism, operational area security, survivability, and information protection.