DODD 8420.01

Abstract

<u>PURPOSE</u>. This Instruction: <br>a. In accordance with the authority in DoD Directive (DoDD) 5144.1 (Reference (a)) and the guidance in DoD Instruction 5025.01 (Reference (b)), establishes policy, assigns responsibilities, and provides procedures for the use of commercial WLAN devices, systems, and technologies to achieve and increase joint interoperability, appropriately protect DoD information, and enhance overall security to sufficiently protect DoD information by embracing open standards for WLAN devices, systems, and technologies. <br>b. Incorporates and cancels Assistant Secretary of Defense for Networks and Information Integration/DoD Chief Information Officer (ASD(NII)/DoD CIO) Memorandum (Reference (c)). <br>c. Specifies the minimum set of security measures required on WLAN-enabled portable electronic devices (PEDs) that transmit, receive, process, or store unclassified and classified information. <br>d. Provides guidance on establishing a wireless network intrusion detection capability for monitoring local area networks (LANs). <br><u>APPLICABILITY</u> <br>a. This Instruction applies to: <br>(1) OSD, the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the Department of Defense, the Defense Agencies, the DoD Field Activities, and all other organizational entities within the Department of Defense (hereafter referred to collectively as the "DoD Components"). <br>(2) WLAN devices, systems, and technologies developed by commercial Industry in compliance with the current Institute of Electrical and Electronics Engineers (IEEE) standard in IEEE Standard 802.11-2007 (Reference (d)), or the International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 8802-11 (Reference (e)) for the international operational environment, that are used to store, process, receive, or transmit unclassified and classified information. Reference (d) incorporates IEEE 802.11a-1999 (Amendment 1), IEEE 802.11b-1999 (Amendment 2), IEEE 802.11g-2003 (Amendment 4), and 802.11i-2004 (Amendment 6), which will hereafter be referred to as "IEEE 802.11." WLANenabled information systems that have direct or indirect connection to operational DoD networks (i.e., SECRET Internet Protocol Router Network (SIPRNet), Non-Secure Internet Protocol Router Network (NIPRNet)) are not exempt from this Instruction, except as noted. A PED that is capable of IEEE 802.11 connectivity will hereafter be referred to as a WLAN-enabled PED. <br>b. This Instruction does not apply to: <br>(1) Other wireless or cellular technologies (e.g., 2.5/3/4G cellular systems, IEEE 802.15 wireless personal area networking (WPAN) standards (Bluetooth, ultra-wideband (UWB), ZigBee), proprietary microwave communications systems, IEEE 802.16-based Worldwide Interoperability for Microwave Access (WiMAX) systems, receive-only pagers, global positioning system receivers, hearing aids, and personal life support systems). <br>(2) The use of external WLAN systems that are not DoD owned or operated, or that are provided by commercial entities (e.g., hotspots), not-for-profit entities, DoD employees or contractors at personal residences, Federal partners, or research, development, test and evaluation (RDT&E) environments. <br>(3) The detection segment of a PED (e.g., the laser used in optical storage media; between a barcode and a scanner head; or radio frequency (RF) energy between RF identification tags, both active and passive, and the reader and/or interrogator), in accordance with DoDD 8100.02 (Reference (f)). <br>(4) The use of other wired or wireless access technologies or services on the WLAN-enabled PED that are not compliant with IEEE 802.11 (e.g., non-IEEE 802.11 memory cards, non-IEEE 802.11 Personal Computer Memory Card International Association (PCMCIA) cards, non-IEEE 802.11 ExpressCards, cellular network interface cards, non-IEEE 802.11 Universal Serial Bus (USB) adapters).