J-13 - SAAS - PAAS Requirements.pdf

SAAS/PAAS REQUIREMENTS

1 Dec-22

Definitions COTS (Commercial off The Shelf) – COTS products are pre-built software systems that are installed onto Library managed infrastructure.

SaaS (Software as a Service) – SaaS products are hosted, managed and administered by the vendor. The Library is not responsible for providing hosting facilities or administrative support for the infrastructure that the software is running on.

PaaS (Platform as a Service) – PaaS provides cloud components to certain software while being used mainly for applications. PaaS delivers a framework for developers that they can build upon and use to create customized applications.

IaaS (Infrastructure as a Service) – IaaS provides cloud-based services, such as storage, networking, and virtualization in a pay as you go model.

Product Support Models Depending on the product type, the support roles and responsibilities differ. This table represents a high-level view of those responsibilities of the Library, Cloud Service Providers (CSP) and/o IT Vendors (external providers, including other government agencies).

Category Hosting Infrastructure

Administration Application

Administration Software

Engineering O&M

Security

ATO

BCDR

COTS Library Library Library Vendor* Vendor Joint Joint SaaS Vendor Vendor** Library Vendor* Vendor Joint Joint

PaaS Vendor Vendor** Library Vendor* Vendor Joint Joint IaaS (See

Note)

Library CSP Library Library Library/CSP*** Joint Joint

* For either COTS or SaaS, if the product allows for customer configuration, the Library may require software engineering resources to manage those configurations. This is product dependent, and in some cases, the Service Unit will be able to manage those customizations themselves.

** If the SaaS product needs to “reach back” into the Library infrastructure, Library resources will be required to manage those secure connections. Some examples of this might be connecting to active directory for user authentication, or connections that allow for storage/retrieval of data to library-hosted systems.

***For IaaS O&M for deployed services fall to the Library deployed software (Applications, Library Hardened Images, Library Database Image and the CSP for the infrastructure and CSP based services (Database, Operating Systems, etc.).

NOTE: OCIO currently provides two IaaS platforms for utilization (OCIO Amazon Services (OAS) and OCIO Google Services (OGS). Addition of services on these General Support Systems requires coordination with IT Service Operations and IT Design and Development analysis prior to implementation.

Attachment J-13

2 Dec-22

Administrative Access, Alerting/Monitoring, API, Configurations, Cost Model, Data Movement, Test Environment requirements below all apply to SaaS and PaaS ONLY

BCDR, Security, Uptime/SLA, and Interconnects apply to SaaS, PaaS, and IaaS

Administrative Access If Administrative access is allowed for Library Administrators, it must be initiated from Library Networks over a Secure VPN Connection

Alerting/Monitoring

Alerting or monitoring functionality that will provide real-time up/down alerts, as well as time-based availability metrics

Ability to integrate into existing 3rd party alerting/monitoring tools. Specify which 3red party tools you support.

API

Fully documented API that allows for 1) Extract/insert data into the platform 2) Allows execution of business functions

Data Movement and Ownership o Ability to extract/bulk export our data from platform o Ability to support encrypted connection from the Library to the SaaS platform via

Virtual Provider Network, transit gateway or equivalent technology o Ability to bulk import our data from on premise to the platform o Library Retains data ownership rights.

Test Environment

A Test environment must be provided for testing, patches, upgrades, interface and new features prior to promotion to the production environment.

Uptime / SLA (Business Needs to Set this Value)

24X7 – 99.9%+ Uptime for SaaS solutions production environment o No/minimal down time deployments/updates/patches o Deployments/patches/updates only in approved maintenance window.

Business Continuity and Disaster Recovery (BCDR)

Vendor shall participate in BCDR planning and testing, including Information Technology Contingency Plan (ITCP) and Test Training and Exercise (TT&E) activities, which are based on the following standards:

o NIST SP-800-34 o NIST SP-800-53

3 Dec-22 o NIST SP-800-53b o NIST SP-800-84 o FIPS-PHU-199

The Library tailors requirements to solutions that are:

o Offered by another Federal agency and for which the Library has a specific MOU and/or SLA; or o Specifically designated in a security categorization as low-impact externally hosted; or o FEDRAMP approved, with authorization package information made available.

Specific components of these activities and their requirements are documented in the table containing BCDR Requirements below.

BCDR Requirements

Library ITCP Requirements Cloud IaaS

Cloud PaaS

Cloud SaaS

NIST References- 800-34 Rev1 and and Related TTE Activities 800-53 Rev4

Business Impact Analysis:

1. Maximum Tolerable

2. Downtime

3. Recovery Point Objective

4. Recovery Time Objective x x x CP-1 Policy and Procedures CP-2 Contingency Plan

Business Impact Analysis:

1. Special Circumstance Identification (e.g., requirements for operations outside business hours or in specific cycles) x x CP-1 Policy and Procedures CP-2 Contingency Plan

System Description:

1. Includes system architecture

2. System components

3. Related systems

4. DR pattern

5. DR preparation details x x x CP-2 Contingency Plan CP-6 Alternate Storage Site CP-7 Alternate Computing Facility

Notification Tree: x x x CP-2 Contingency Plan

1. Notification Sequence (including both LC and Vendor Staff)

Personnel Contact Data for Notification Tree x x x CP-2 Contingency Plan

Data Backup –

1. Server , Storage and Database Backup Information x x CP-9 System Backup

4 Dec-22

Data Backup

1. Backup Validation Testing x x CP-9 System Backup

Recovery and Reconstitution Procedures

1. Outage Assessment,

2. Failover/Failback if Applicable

3. Concurrent Processing if Applicable

4. Recovery

5. Reconstitution x x CP-2 Contingency Plan CP-9 System Backup CP-10 Recovery and Reconstitution

Validation Testing

1. Procedures for System Functionality

2. Procedures for Data Integrity x x CP-2 Contingency Plan

Annual TTE Exercise:

1. TTE Notifications

2. TTE Recovery Procedures x x x CP-2 Contingency Plan CP-4 Testing and Exercises

TTE Testing

1. Primary Hosting Environments

2. Alternate Hosting Environments x x x CP-2 Contingency Plan CP-4 Testing and Exercises CP-7 Alternate Computing Facility