Attachment_G._Cloud_and_ColdFusion_Environment.docx

1605DC-18-R-00009 Attachment H

7.0 Cloud and ColdFusion Environment Requirements

The CMS solution shall be connected to enterprise technology environment through an infrastructure (cloud-based) hosting capability that seamlessly provides and meets all connectivity requirements to ultimately provide customers with access to their daily activities. This solution shall allow better scalability, reliability, and cost benefits over the current system architecture. Below are requirements that apply to the environment and all phases of development (The contractor may propose alternative commercially utilized standards):

Description of Function

Infrastructure (Cloud Hosting)

6.

The contractor shall provide Hardware, OS, COTS and custom Software, Database, Storage and Network configuration and server administration for application infrastructure support.

Network downtime exists when a Cluster is not reachable as a result of a failure in the Cloud data center network. An SLA Credit will be provided for Network Downtime: 5% of the Cluster fees for each 30 minutes of network downtime (or portion thereof), up to 100% of the Cluster fees.

An SLA Credit for Data Center Infrastructure Downtime: 5% of the Cluster fees for each 30 minutes of data center infrastructure downtime (or portion thereof) above allowed limit set in SLA, up to 100% of the Cluster fees.

SLA Credit for Cluster Host Downtime: 5% of the Cluster fees for each additional hour of downtime (or portion thereof), above allowed limit set in SLA, , up to 100% of the Cluster fees.

SLA credits will be calculated as a percentage of the Cluster fees for those Clusters adversely affected by the failure for the monthly billing period during which the failure occurred.

Infrastructure (Cloud Hosting)

11.

The contractor shall provide all related cloud hosting documentation that specifies the configuration specific to interfaces between DOL hosted and managed systems and the provided solution’s cloud PaaS, IaaS, or SaaS must be documented and managed.

Infrastructure (Cloud Hosting)

16.

The contractor shall provide release management support for the approved changes to the Content Management Services solution (patches, upgrades, new products, releases, etc.).

a. Preventive maintenance,

b. Proactive monitoring, and

c. On-call maintenance.

In addition, the contractor shall provide future services associated with the growth of the ETA-OIST’S core competencies.

Infrastructure (Cloud Hosting)

21.

The solution shall provide for huge uptick (up to 1000 users) in user access during the time of event hosting ( regular concurrent access of 50 to 75 concurrent users surges up to 750 concurrent users)

· Optimize risk exposure (supporting the risk profile required by the business), Minimize the severity of any impact and disruption, Achieve success at the first attempt, and

· Ensure that all stakeholders receive appropriate and timely communication about change so that they are aware and ready to adopt and support the change.

Configuration Management

33.

The contractor shall ensure Configuration Management (CM) to include managing, controlling and reporting changes made to hardware, software, firmware, and documentation of information systems throughout the development and operational life of systems.

The contractor shall report ALL non-authorized changes to the CLOUD environment, including but not limited to HW/SW configuration, applications changes, security penetrations, etc. within 4 hours of detection of the incident.

Security

34.

The CMS solution shall support role-based access controls for all user accounts to manage solution configurations and features based on separation of duties and least privilege.

Security

36.

The CMS solution shall have the ability to prevent network and web application attacks from impacting the system using technologies such as firewalls, intrusion detection/prevention systems, web application firewalls, and other devices.

Security

37.

The CMS solution shall manage, prevent, or absorb foreseeable known malicious attacks (including, but not limited to Denial of Service (DoS/DDoS), SQL Injection, HTTP Request Smuggling/Request Splitting, Buffer Overflow, and Cross Site Scripting.

Security

38.

The CMS solution shall have the ability to provide access to logs daily (compiled logs, database logs, trace files, core and audit files, redo logs and archive log files for 24 hour period ending midnight eastern time) for DOL to download via SFTP.

Security

40.

The CMS solution shall meet FISMA compliance and obtain an Authority to Operate (ATO) from DOL via OIST IT Governance Branch.

· Security Plan;

· Security Assessment Report to include test results completed/provided by an independent assessor;

· Risk Assessment Report; and

· Plan of Actions and Millstones (POA&M).

Security

42.

The CMS provider solution shall meet the required NIST SP 800-53 Controls prior to production implementation. (See Appendix for List of Mandatory Controls).

/OCIO Security review, addressing any deficiencies, and authorizing official acceptance.

a. Annually: complete/review/update DOL compliant system self-assessment, Privacy Impact Assessment (PIA), FIPS-199 Security and System Categorization Review, e-Authentication Risk Assessment, Risk Assessments (RA), Contingency Plan (CP) Testing, System Security Plan (SSP) and appropriate staff completing security awareness and role based training. Assist in ad-hoc data calls for information related to the system.

b. Quarterly: complete Security Control Testing and Evaluation (SCT&E), Management of the system's weaknesses through a Plans of Action & Milestones (POA&M) management tool. This management should include closure of identified system weaknesses within specified time periods and providing supporting evidence to validate closure of identified weaknesses (see performance measures).

c. Monthly: tracking and reporting on security incidents that have been experienced by the provider to include confirmed or suspected incidents involving Personally Identifiable Information (PII), unauthorized access, denial of service, malicious code, improper usage and scans, probes, and attempted accesses. Provider shall follow the standards defined by NISI SP 800-61 (current revision) and the DOL CSH.

Security

49.

The Cloud Services solution shall meet Federal government regulatory compliance requirements (i.e. Privacy Act, FISMA, CIPSEA, Federal Records Act, Freedom of Information Act, Trade Secrets Act, Health Insurance Portability and Accountability Act (HIPAA), Privacy Rules, etc.).

Security

52.

In the event the system is identified for a DOL OIG audit the Contractor shall assist DOL in providing audit services and support upon request during the DOL Inspector General (IG) or other federally supported IG audit processes (i.e.; providing supporting evidence, ad-hoc reports, interviews, documentation, etc.). This is applicable for both DOL and Contractor hosted options.

Security Assurance requirements.

· Transport Security Services: Shall support appropriate transport security services by demonstrating capability for mutually authenticated SSLv3.0 or TLSv 1.0 authentication approaches when exchanging data over networks.

· DOL Unique Identifiers: Shall be capable of utilizing a DOL determined unique identifiers (UID) (e.g., Microsoft Active Directory User-Principal- Name (UPN) values, DOL Employee ID, etc.) as the basis for authoritatively determining the user's identity.

· Internal/ External Authorization: Shall describe whether the application is required to make its own internal authorization decisions, independent of a third party system, for access to internal application or service provider solution functionality. Otherwise describe if the capability exists within the application security model to utilize the preferred authorization services from a standards based IAM COTS solution (i.e., the IBM Tivoli IAM Suite).

· Develop comprehensive security documentation for the Content Management Services solution including, but not limited to the, System Security Plan (SSP), Contingency Plan (CP)/Disaster Recovery Plan (DRP), Privacy Impact Assessment (PIA), Incident Response Plan (IRP), Risk Assessment / Security Controls Assessment, FIPS 199 Security Categorization, Plan of Action & Milestones (POA&Ms).

· Conduct Contingency Plan and Incident Response Plan testing, exercises, and training in accordance with the DOL/ETA Computer Security Handbook.

· Develop any Memorandum of Understanding / Interconnection Security Agreements necessary to support the Content Management Services solution when interfacing with components external to the system boundary.

· Conduct an independent Security Controls Assessment to determine compliance with the DOL/ETA specific security requirements in accordance with the DOL/ETA Computer Security Handbook (delta analysis).

· Document all security weaknesses and remedial actions as Plan of Action & Milestones (POA&Ms).

· Develop security authorization memos for ATO Package (Memo for Information Security Officer to Authorizing Official and Memo for Authorizing Official to Chief Information Security Officer).

· Includes documenting roles, responsibilities, methodology, and assessment procedures for continuous monitoring activities of the information system (ETA Information Systems); selecting a subset of security controls for continuous monitoring testing; ranking for selection of security controls includes: NIST SP 800-53 identifies several security controls that require execution at least annually, controls that have a recently closed POA&M, controls that have changed but didn’t warrant a full C&A, controls that have a high volatility, and controls that were not tested in the previous annual continuous monitoring exercise; and indicating the frequency of testing, volatility, next planned test date, and if a POA&M was identified.

· Conduct periodic risk assessments and security testing including vulnerability scanning and penetration testing at all system layers (i.e., network, application (static/dynamic), database, and code analysis).

· Provide ongoing security operations and maintenance support to ensure that the system is operating as expected and meets DOL/ETA Computer Security Handbook requirements.