PAM 25-2-2 — Cybersecurity Tools Unified Capabilities Approved Products List Process
PAM 25-2-2 governs the vetting, approval, acquisition, and use of cybersecurity tools within the Department of the Army.
- Publication number: PAM 25-2-2
- Title: CYBERSECURITY TOOLS UNIFIED CAPABILITIES APPROVED PRODUCTS LIST PROCESS
- Date: 04/08/2019
- Proponent: G-6
- Status: ACTIVE
View PAM 25-2-2 on armypubs.army.mil
Related publications
It covers cybersecurity tool evaluation, DOD UC APL placement, desktop reviews, fast-track processing, and the duties of Army sponsors and vendors. It requires approved tools to meet validation, acquisition, coordination, and certification conditions.
Applies to: This pamphlet applies to cybersecurity tools used in the Army for strategic, operational, and tactical network environments.
Topics covered
- Cybersecurity tool vetting
- DOD UC APL approval
- Acquisition and use requirements
- Desktop review process
- Fast-track product placement
- Army sponsor duties
- Vendor duties
Questions and answers
What validation must encryption modules used to protect Army information have?
All cybersecurity tools using encryption modules for the protection of Army information will use encryption modules that are FIPS 1402 validated at the appropriate security levels. (paragraph 2-1)
How must approved cybersecurity tools be procured?
Procure all approved cybersecurity tools through CHESS. (paragraph 2-2)
What product versions may be procured as approved products?
Procure approved products with the exact hardware models, firmware, and software release versions listed on the DOD UC APL. (paragraph 2-2)
Are products removed from the UC APL still approved for purchase?
Products with expired certifications/removed from UC APL are no longer approved for purchase. (paragraph 2-2)
What must the Army sponsor document during cybersecurity testing?
The Army sponsor must ensure that critical testing requirements and all findings identified during cybersecurity testing are properly documented. (paragraph 3-3)