COMSEC Custdian Quick Reference Guide COMSEC Custdians are respnsible fr the generatin, receipt, custdy, distributin, safeguard, dispsitin r destructin, and accunting f COMSEC material entrusted t their COMSEC Accunt. An verview f these respnsibilities fllws. COMSEC Accunt Management Ensure that ther assigned duties d nt interfere r cnflict with yur duties as a COMSEC Custdian; Attend a frmal COMSEC Custdian training curse as sn as pssible fllwing yur appintment; Ensure that the Alternate Custdian assumes yur respnsibilities and duties when yu are absent fr a perid f less than 60 days; Prvide adequate training fr Alternate Custdian(s) and Lcal Elements; Keep infrmed (thrugh Infrmatin Technlgy [IT] Security and COMSEC publicatins) f any new requirements r mdificatins t existing equipment; Maintain up-t-date administrative files cntaining dcumentatin related t the COMSEC Accunt (e.g. COMSEC Briefing Certificates, Curier Certificates, COMSEC Incident Reprts and Security Screening Certificates); Maintain accurate and up-t-date accunt registratin recrds; Prmptly pst all accunt registratin changes t the Canadian Central Facility (CCF) Message Server r frward the changes t yur Central Office f Recrd (COR); and Cnnect t the CCF Message Server t btain messages n at least a weekly basis, if using Lcal COMSEC Management Sftware (LCMS). COMSEC Accunting Reprts and Files Ensure that accunting reprts are cmplete, accurate and that all crrectins are made in ink and initialled fr paper transactins r digitally signed; Verify the material listed n the accunting reprt prir t transfer, issue, hand receipt, destructin, cnversin, relief frm accuntability and pssessin; Return accunting reprts t the riginatr within tw wrking days f preparatin r receipt; Initiate tracer actin fr delinquent accunting reprts; Reprt any accunting discrepancies t yur COR; Maintain accurate and up-t-date accunting files and limit access t these accunting recrds t authrized persnnel; D nt apply a mre stringent Accunting Legend Cde (ALC), unless authrized by the Natinal Central Office f Recrd (NCOR); Retain inactive r archive Mark accunting reprts that d n cntain classified infrmatin as PROTECTED A (PA) ; Establish lcal accunting prcedures t ensure strict cntrl f keying material, whenever the keying material is turned ver t a Temprary User; and Establish lcal accunting prcedures t ensure cntrl f COMSEC-related material such as crypt-ignitin keys (CIKs), persnal identificatin numbers (PINs), sftware and hardware. Custdy and Safeguard f Accuntable COMSEC Material Stre COMSEC material based n COMSEC directives; Maintain a recrd f safe cmbinatins and limit access t the cmbinatins t users wh have a need-t-knw and wh pssess the required security clearance; Ensure cmbinatins fr cntainers used t stre COMSEC material are changed as required; Page 1 f / de 5
Submit requests fr access t COMSEC material by freign natinals r resident aliens t the COMSEC Client Services at Cmmunicatins Security Establishment Canada (CSEC); Restrict access t keying material t the minimum number f persnnel required, based n a strict need-t-knw basis; Immediately ntify (within 24 hurs) yur Departmental COMSEC Authrity (DCA) f any incident that may have subjected COMSEC material r sensitive infrmatin t cmprmise; Mark lst r ptentially cmprmised COMSEC material as Pending Investigatin in yur inventry file (and place the material in quarantine); Prtect the integrity f COMSEC material by: inspecting the prtective packaging upn initial receipt, during each inventry and prir t transfer, issue r use; perfrming page checks n all keying material and accuntable publicatins upn initial receipt, during each inventry and prir t transfer, issue r use; prmptly entering amendments t accuntable publicatins; and being able t lcate every item f accuntable COMSEC material held by the COMSEC Accunt and being aware f the general purpse fr which it is being used; Ensure that persnnel wh are authrized t receipt fr packages cntaining Accuntable COMSEC Material (ACM) have the apprpriate secure strage (when yu and yur Alternate Custdian are nt available); Ntify yur mailrm and the persnnel authrized t receipt fr packages that the nly nes authrized t pen packages addressed t the COMSEC Accunt are the COMSEC Custdian and Alternate COMSEC Custdian; Physically stre effective editins f keying material, reserve editins f keying material and superseded keying material awaiting destructin in separate lcatins; Stre TOP SECRET keying material under tw-persn integrity (TPI) cntrls emplying tw different cmbinatin lcks with n ne persn authrized access t bth cmbinatins; D nt stre COMSEC equipment in a keyed state (e.g. CIK inserted), unless peratinal requirements mandate it and n practical alternative exists r keyed equipment cannt be zerized due t malfunctin r damage; and D nt remve any manufacturing labels, including the equipment nmenclature plate, the Cntrlled Cryptgraphic Item r CCI label and any ther labels that identify the equipment fr accunting purpses. Distributin f Accuntable COMSEC Material Prperly package, mark and ship ACM; Obtain pre-apprval frm yur COR fr irregular r nn-cnventinal distributin f COMSEC material; Ensure the receiving COMSEC Accunt is classified r designated t the security level f the material and authrized t hld the material; Distribute COMSEC material t Lcal Elements (users) wh have a valid need-t-knw and ensure that each user: is cleared t the security level f the COMSEC material, is infrmed f what cnstitutes a COMSEC incident, receives a COMSEC Briefing and signs a COMSEC Briefing Certificate, and understands and accepts respnsibility fr the prtectin and use f the COMSEC material; Separate elements which, as a whle, cmprise a cryptgraphic system (i.e. the basic cryptgraphic equipment, ancillaries, assciated dcumentatin and Key Variable [KVs]); Keep individual shipments t the minimum required t supprt peratinal and cntingency requirements; List, package and dispatch keying material separately frm its assciated COMSEC equipment (i.e. list keying material n a separate GC-223, package separately frm its assciated equipment and ship in different transprt vehicles); Perfrm page checking and equipment checking prir t shipment; Page 2 f / de 5
Send the list f effective dates f keying material separately frm the keying material, n different days; Package Traffic Encryptin Key (TEK) separately frm its assciated Key Encryptin Key (KEK); Erase r zerize KV settings in CCI equipment, cmpnents, and Cmmn Fill Devices (CFDs) befre packaging. Remve assciated CIKs prir t transprtatin; Identify Gvernment Furnished Equipment as GFE n the accunting reprt and include the assciated cntract number. All apprpriate dcumentatin must be raised and included in the cnsignment r dispatched separately, if required; Where required, ntify the receiving COMSEC Custdian f details f the shipment and estimated time f delivery; Initiate Tracer actin if the Transfer Reprt Receipt (TRR) has nt been received within the alltted time; and Immediately reprt (i.e. within 24 hurs) the lss, imprper shipment r imprper handling f any COMSEC packages t yur DCA. Any keying data fund in place during transit (i.e. with the ECU r CFD) r upn receipt must be reprted immediately t the Cntrlling Authrity (CA), issuing COMSEC Custdian and CSEC Natinal COMSEC Incidents Office (NCIO). Receipt f Accuntable COMSEC Material Ntify the shipping COMSEC Accunt if a package has nt been received within 48 hurs f expected delivery; Carefully inspect bth the inner and uter wrappings fr signs f tampering; Immediately reprt (within 24 hurs) any evidence f tampering t yur DCA and secure the package(s) in quarantine; Check the cntents fr agreement with the enclsed Transfer Reprt Initiating (TRI); Make authrized changes t the TRR in ink and initial these changes; Check that the first segment shws in any enclsed key tape canisters; Cmplete all required publicatin page checks; Inspect the prtective packaging f keying material fr signs f tampering (but d nt pen until issued t a Lcal Element); and Never affix a label t prtective packaging. Accuntable COMSEC Material Destructin Ensure a prperly cleared and COMSEC briefed individual witnesses the destructin f all ACM; Use the Destructin Reprt as a checklist during the destructin; D nt destry COMSEC material withut specific authrizatin; Ensure that persnnel wh perfrm destructins are trained in the crrect prcedures and methds; D nt destry damaged r faulty key (submit a COMSEC incident reprt and return the damaged/faulty key t the Natinal Distributin Authrity [NDA] at CSEC); Perfrm equipment verificatin and page checking prir t destructin (nrmally within 48 hurs); Destry superseded key, whether regularly r irregularly superseded, as sn as pssible after use r supersessin, and d nt hld lnger than 72 hurs fllwing supersessin; Destry COMSEC publicatins within 15 calendar days fllwing the date f supersessin r the authrized date f destructin; D nt destry COMSEC equipment, unless specifically authrized t d s; Ensure each segment f key is prperly destryed, and reprted as destryed, befre reprting the destructin f the cmplete key; Ensure all cpies f key issued t Lcal Elements and subrdinate COMSEC Sub-accunts have been destryed befre destrying the key frm which the cpies were made; Accurately verify the material being destryed against the Destructin Reprt; Destry the material using apprved destructin methds; Page 3 f / de 5
Examine the destructin device and the surrunding area t ensure the material has been destryed and thrughly inspect the residue t ensure that the destructin was cmplete; and Submit Cnslidated Destructin Reprts cntaining rutine destructin infrmatin t yur COR n a mnthly basis (n later than the 16th f the mnth fllwing supersessin f the key). Generatin f Keying Material Submit all requests fr authrizatin t generate and prduce cryptgraphic keying material t the Crypt Material Assistance Centre (CMAC) at CSEC; Assign ALC 6 t electrnic key that will be generated frm ALC 1 physical key; and Assign ALC 7 t electrnic key that will be generated frm ALC 4 physical key. COMSEC Inventry Maintain an up-t-date inventry recrd f the COMSEC material charged t the COMSEC Accunt, including COMSEC material issued t Lcal Elements and COMSEC Sub-accunts; Limit access t inventry recrds t authrized persnnel; Cnduct an inventry annually upn appintment f a new COMSEC Custdian and when directed by yur COR; Mark inventry recrds that d n cntain classified infrmatin as PROTECTED A (PA) ; Return the annual COR-initiated Inventry Reprt, the Amendment t Inventry Reprt and all supplemental accunting reprts t yur COR, n later than 10 wrking days after receipt f the Inventry Reprt; and Take crrective actin t inventry discrepancies and advise yur COR f the actin taken, within 48 hurs f receipt f the Inventry Recnciliatin Status Transactin (IRST). Management f COMSEC Sub-Accunts Establish and clse COMSEC Sub-accunts, as deemed necessary, in accrdance with the prcedures described fr pening and clsing COMSEC Accunts; Prvide frmal training and interim training fr COMSEC Sub-accunt persnnel; Maintain a recrd f the inventry f all subrdinate COMSEC Sub-accunts; Maintain a file n ther assciated COMSEC Sub-accunt infrmatin; Prvide advice and guidance t Sub-accunt persnnel relating t the management f their COMSEC Sub-accunt; Cnduct inventry recnciliatin annually with each subrdinate COMSEC Sub-accunt; Audit COMSEC Sub-accunts at least every tw years in rder t ensure that recrds are accurate and cntrl prcedures are crrectly applied; and Prvide COMSEC Sub-accunt audit results t the Natinal COMSEC Audit Team (NCAT) at CSEC upn request. In-Prcess Accunting When applicable, maintain In-Prcess (IP) accunting recrds t ensure that apprpriate IP prcedures are being fllwed; and Perfrm a sight inventry with an apprpriately cleared and briefed witness t recncile all IP accunting recrds: semi-annually; upn the appintment f a new COMSEC Custdian; and as directed by the CSEC NCAT. Page 4 f / de 5
COMSEC Emergency Plan Assist yur DCA in the preparatin f a plan fr the prtectin f COMSEC material during emergencies; Ensure the plan clearly and cncisely describes all duties; Infrm all persnnel with a need-t-knw f the existence f the plan; Infrm each individual wh has duties assigned under the plan f their duties and hw t carry ut these duties when the plan becmes effective; Peridically cnduct training exercises t ensure that everyne (especially new persnnel) can carry ut their duties; and Revise the plan based n the experience gained in the training exercises. Page 5 f / de 5