Att._1_-_IDM_SOO.pdf

STATEMENT OF OBJECTIVES (SOO)

I. PURPOSE

The Department of State (the Department or DOS) requires a Department-wide HSPD-12 compliant Identity Management System and Credential Management System (IDMS) solution and the subject matter expertise and technical services to sustain and extend it. The purpose of this

SOO is to convey the Department’s objectives, scope, constraints, and applicable documents. The intent is to afford the maximum flexibility to each offeror to propose an innovative solution that meets or exceeds the Department’s objectives within the applicable constraints.

II. OVERVIEW

Homeland Security Presidential Directive 12 (Policy for a Common Identification Standard for

Federal Employees and Contractors) – or HSPD-12 – was signed on August 27, 2004, in response to the general threat of unauthorized physical access to facilities and logical access to Information

Technology (IT) assets. HSPD-12 applies to all federal employees and contractors, including contractor employees. The HSPD-12 program uses Personal Identity Verification (PIV) credentials and services that facilitate trusted physical and logical access to federally controlled facilities and IT networks using smart card technology. The Department calls its implementation of HSPD-12 and its official credential “One Badge.”

The Department has implemented One Badge, a hardware appliance-based HSPD-12 compliant

IDMS solution, domestically and at selected pilot sites overseas. One Badge provides identity management, card management, and an authentication mechanism for physical access to all of its domestic facilities. It also provides identity management and card management at the overseas pilot locations. While the Department requires continued, uninterrupted IDMS capability at current

One Badge locations, as well as the potential for future expansion both domestically and overseas, the Department is open to consideration of alternative platforms and/or services as long as these solutions meet the objectives and requirements described in this SOO.

The One Badge system produces PIV and PIV–Interoperable (PIV-I) cards. At DOS, the Facility and Logical Access Card (FLAC) and the Facility Access Card (FAC) equate to a PIV-I card.

FLACs and FACs will be issued to DOS employees and contractors and to approved employees and contractors of other Federal government agencies (OGA), Locally Employed Staff (LE Staff), Eligible Family Members (EFM), local contractors, and other U.S. citizens or non-U.S. citizens who are authorized logical and/or physical access to the Department’s unclassified IT network or access to U.S. diplomatic facilities. Note: LE Staff includes Foreign Nationals (FNs) and

Ordinarily Resident American-Citizen hire employees (AMCITs) hired at a foreign post by the

Department or OGA under Chief of Mission authority.

The One Badge system meets all HSPD-12 technical requirements expressed in the following documents: Federal Information Security Management Act (FISMA) of 2014; Office of

Management and Budget (OMB) circulars and memorandums relating to HSPD-12; National

Institute of Standards & Technology (NIST) documentation pertaining to IT systems, smart cards, and peripherals; and General Services Administration (GSA) technical implementation strategy documentation. If these documents, implementation strategies, and technological solutions are updated, replaced, or extended, the DOS solution must remain compliant (see Section VI.B.

Applicable Documents for specific documentation).

III. BACKGROUND

A. Organizational Background

The Bureau of Diplomatic Security (DS) is the security and law enforcement arm of the

Department. DS is a world leader in international investigation, threat analysis, cyber security, counterterrorism, security technology, and protection of people, property, and information.

The current implementation of HSPD-12 in the Department is a joint effort of the bureaus of

Diplomatic Security (DS), Human Resources (HR), and Information Resource Management

(IRM). For DS, the implementation technology is managed by the Identity Management Program within the Network Systems Management Branch (NSM), Security Systems Integration Division

(SSI), Office of Security Technology (ST).

The key missions of the Identity Management Program are to sustain One Badge operations, provide the Department with HSPD-12 and FICAM subject matter expertise and counsel, support

Diplomatic Security’s Domestic Operations (DS/DO) in its badging mission, and deploy a global identity management solution that can be used for rapid identity authentication and permit physical and logical access to government facilities and information systems.

B. Current Department Operations

The high-level enrollment and issuance processes are presented in Appendix B. Listed below are several attributes of the Department’s One Badge implementation that make it unique in its

HSPD-12 requirements:

1. Global footprint:

a. The Department is comprised of offices and bureaus currently located in 152 domestic facilities and 275 diplomatic and consular posts around the world, including embassies, consulates, and U.S. missions to international organizations.

i. Appendix C, Table C-1, Summary of Domestic IDMS Units, provides the current number of enrollment, issuance, and self-service card management stations located domestically.

ii. Appendix C, Table C-2, Summary of Overseas IDMS Units, provides the current number of enrollment and issuance stations as well as self-service management stations located at overseas locations.

b. Department personnel often incur considerable inconvenience and cost to get to a facility with card issuing capability or a self-service management stations. Appendix D lists DOS sites with IDMS units.

2. The Department owns and operates its own independent, Federal Bridge cross-certified, Certificate Authority (CA).

3. DOS uses a symmetric card authentication key (CAK) for domestic physical access control.

Additionally the department will begin use of asymmetric authentication during the life of the contract. Therefore, the card must be capable of both symmetric and asymmetric operation. The Department also operates a legacy Automated Access Control System

(AACS) that operates with a magnetic stripe.

4. The One Badge system currently provides the authentication function for domestic physical access control transactions and passes access grant or deny status to the access control system.

5. DOS provides a wide range of security support for LE Staff and others:

a. Several types of cards are needed, not just PIV for cleared Americans.

b. Official identity documents vary by country, so the Department has unique country-by-country document review and acceptance criteria. The data collection system used for enrollment will need to be able to copy, store and catalog a number of different types of national identification for local employees, contractors and visitors.

6. DOS provides an IDMS solution for its partner agencies (currently United States Agency for International Development (USAID) and Millennium Challenge Corporation (MCC)), to include:

a. Prime - subordinate data segmentation for storage and reporting.

b. Issuance of varying badge templates.

7. DOS operates and maintains multiple logical access environments (e.g, Department

OpenNet, Foreign Affairs Network (FAN), Mobile, etc.). Derived credentials will be required in the future.

8. See Classified Annex for additional information.

These unique operational environment factors are among those that underlie many of the objectives and constraints in the following sections.

C. Technical Background

The Department’s current HSPD-12 IDMS performs HSPD-12 credential management and identity management and lifecycle functions. It provides authentication of employee and contractor personnel, archives Personally Identifiable Information (PII) data, and issues the

Federal PIV card, and FAC and FLAC credentials. The IDMS is a system of record that provides

PII data that are used for personnel authentication and access authorization. Specifically, the One

Badge is used for entering the Department’s domestic facilities and accessing the Department’s unclassified IT networks. The current Department IDMS implementation uses the AuthentX line of HSPD-12 solutions (reference Appendix E, Current Notional Interface Summary).

IDMS provides the media for the domestic AACS and AlarmNet systems. As previously stated, the Department operates an AACS system overseas that requires a programmable magnetic strip.

The IDMS operates on the Department’s SBU network, known as OpenNet, and it interfaces with several systems, some of which operate entirely within closed boundaries, as well as an internally, IRM-owned and managed certificate authority (PKI - CA) (refer to 5 FAM 140, Acceptability and

Use of Electronic Signatures).

Within the Department, applicant vetting is conducted and adjudicated to an acceptable level before an individual is brought on-board, permitted to apply for a badge, or interacts with the

IDMS. All applicant vetting and background check activities are handled by a separate DOS entity and will remain outside the scope of this contract. Vetting functionality is handled through a system interface, and results are included in the automated badge request interface.

Diplomatic Security’s Domestic Operation’s (DO) Domestic Facility Protection (DFP) office currently serves as the enrollment and issuance authority for all domestic-based credential issuance partnering with the Bureau of Human Resources for enrollment activities and the Bureau of

Consular Affairs with delegated authority to some passport offices across the U.S. At DOS overseas missions, individual posts are responsible for the enrollment and issuance of credentials and the implementation of the One Badge initiative. The IDM Program provides infrastructure, policy consultation, service center, equipment, consumables and operational support for both domestic and overseas operations.

Currently, credentials issued by the Department contain the following FIPS 201-designated optional field items:

Front: clearance level, employee affiliation, escort authority, restricted access, and issuance location visual indicators.

Reverse: magnetic stripe and return address fields.

All cards contain the symmetric CAK option and FIPS 201-identified “optional” fields may be included on various card topologies.

The Department Enterprise Automated Physical Access control infrastructure includes HSPD-12 contact and contactless compliant readers as well as legacy magnetic strip physical access control technologies.

The IDMS creates, serves as the system of record for, and manages distribution and reconciliation of the State Global Identifier (SGID). The SGID is a unique set of ten numeric characters assigned to each individual’s identity within the IDMS, which include the following customers: direct-hire employee, local staff member, contractor, eligible family member, member of household and other potential applicants. The SGID serves as an individual’s cyber-identity and allows identification across Department systems without the use of social security numbers or other PII.

The Department currently uses a multi-tiered technical support model for its current One Badge program. The model builds upon a foundation of training and posted frequently asked questions

(FAQs) to allow card holders self-service access to information that helps them resolve basic issues on their own (Tier 0). Tier 1 support is provided by the DS Security Technology Assistant Center

(STAC) and the Network Operations Center (NOC). The STAC and NOC are not only responsible for providing initial support for basic customer issues, they determine if an identity-related issue warrants elevation to a higher tier. The Tier 1 specialist creates a service request by gathering and recording as much information as possible from the customer, determines the customer’s issue by analyzing the symptoms and isolating the underlying problem, and begins sorting through available solutions.

The IDM Program currently resolves all Tier 2 and above trouble tickets and issues. This procurement addresses training and documentation for resolution of Tier 1 and 2 issues to the

STAC, NOC, and IDM program resources as well as the resolution of Tier 3 issues.

The Department is currently using the Oberthur ID‐One PIV (Type A) V7 and V8.1 with 128K

EEPROM Storage and Cryptographic Processor and may upgrade to the next generation in the near future. Additionally, Version 7 cards contain a BLADE applet that is managed by

DOS-managed middleware and software. Issuance of the Version 7 card and management of the

BLADE applet is not a part of this contract.

IV. OBJECTIVES

A. Program Objectives

The Contractor shall:

1. Provide a worldwide standardized identity and card management solution that is compliant with all applicable Federal standards and regulations and that maintains cardholder identity and credential records and incorporates personnel enrollment, card issuance, and personnel authentication for physical and logical access to facilities and the Department’s SBU IT networks. As defined in FIPS 201-2, the solution shall be capable of interoperability with other federal agencies, including the Department of Defense (DoD).

2. Provide the capability to enroll personnel and issue PIV Cards, FLACs, and FACs to employees, members of other government agencies (OGA), LE Staff, EFMs, local contractors, and other U.S. Citizens or Non-U.S. Citizens who meet eligibility and vetting requirements, and who are authorized logical access to the Department’s unclassified IT network or entry to a U.S. diplomatic facility.

3. Provide the capability to print cards (e.g., PIV, FLAC, and FAC) locally and onsite at designated credentialing sites, with the ability to complete enrollment, card printing, and activation of the new credential during a single credentialing visit. The cards must provide for symmetric, asymmetric and magnetic strip operation.

4. Provide an efficient and transparent plan for transitioning existing identities, cards, and users to the new solution.

5. Provide a visitor management and temporary access capability that tracks identities and badge issuances based on customized applicant inputs, to include biometric and identity document collection, and allows for customizable badge templates. This system must be capable of reporting identity data, badges issued, system transactions, and modifications to stored identity information.

6. Provide the capability to read, authenticate, register and accept PIV cards issued by other

Federal organizations and DoD Common Access Cards (CACs) for use within DOS infrastructure.

7. Provide the capability to enroll and issue PIV cards, FLACs, and FACs for other Federal agencies (e.g., USAID and MCC).

8. Provide the capability to administer and manage identity, enrollment, and issuance data in accordance with the Department’s segmented data methodology in which DOS data is not visible or accessible by subordinate agencies (e.g. USAID and MCC).

9. Provide the capability to manage IDMS data to and from other DOS systems and outside agencies including DoD, Department of Homeland Security (DHS), USAID, and MCC.

B. Technical Objectives

The Contractor shall:

1. Provide a secure, scalable, role-based solution that operates in both normal and degraded network conditions with varying power characteristics (e.g., 220 V/50 Hz in certain overseas locations), quality, and data traffic capacity environments. The solution must be sufficiently robust to execute enrollment, issuance, and authentication functions throughout the global infrastructure. IDMS and badge transactions may reach over 5000 in a 24-hour period. Wide area network (WAN) connectivity will vary and may be limited to

120 kilobytes per second (kbps) with latency of 600 milliseconds (ms).

2. Provide a standardized, user-friendly card issuance workflow that predictably provides card issuance, regardless of badge content, format, type, applicant affiliation or other access variables, while minimizing the possibility of user error.

3. Provide a customizable template generator capable of complying with HSPD-12 templates and producing PIV, PIV-I and Non-PIV cards. Current card topologies will be provided upon award.

4. Provide a solution that captures all of an applicant’s personnel data, fingerprints, picture, and additional biometrics and manages anomalies.

5. Provide the capability to query the system, ensure uniqueness, and provide identity data and attributes using only a single fingerprint input, with the capability for additional biometric inputs.

6. Provide the capability to create with varying amounts of applicant data and manage the

SGID within the DOS infrastructure including the following:

i) Maintain the uniqueness of every SGID number including every existing record and all future records;

ii) Assign and manage a single SGID for each individual so that no person has multiple

SGID values; and,

iii) Reconcile and distribute corrections for duplicate SGIDs.

7. Provide the capability to detect potential duplicate records at enrollment, issuance, and when queried by other department systems (e.g., the Automated Badge Request (ABR) or

Enterprise ICAM solutions, HR); and initiate a resolution process.

8. Provide all hardware, software, middleware, associated peripherals, and technical services to accomplish a seamless transition from the current IDMS system and to maintain uninterrupted services, including management of existing issued cards, identity data, access control authentication, and interface capabilities while minimizing end user operational impact and cost.

9. Provide the capability to acquire and manage DOS PIV cards, including any personalization and department-specific attributes. This will include inventory control of

PIV cards from acquisition to termination/destruction of the card.

10. Provide the capability to expand the system to include additional enrollment and issuance locations, card lifecycle support solutions, system interfaces, reporting, and technical services.

11. Provide for One Badge post-issuance updates (e.g., certificates, keys, biometric data objects, and signed data objects) that can be performed without replacing the One Badge in cases when none of the printed information on the surface of the card is changed.

12. Provide for One Badge post-issuance updates to be issued locally (performed with the issuer in physical custody of the One Badge) or remotely (performed with the One Badge at a remote or centralized location).

13. Provide for One Badge verification data reset in a manner that allows Personal

Identification Number (PIN) resets to be performed in-person at the issuer’s facility or at an unattended self-service mechanism.

14. Provide capability to create and manage derived credential issuance in accordance with

NIST Special Publication 800-157, Guidelines for Derived Personal Identity Verification

(PIV) Credentials [SP 800-157] as well as applicable DOS policy. Ensure mechanisms exist to terminate all derived credentials issued to the cardholder when the cardholder's credential is terminated as specified in Section 2.4 of SP 800-157.

15. Provide a robust, comprehensive, intuitive reporting mechanism that produces the full spectrum of data reporting for all identity data and attributes for each identity within the system to include defined and ad-hoc functionality. The reporting solution should be accessed and operated onsite without additional complex programming or specialized staff.

16. Provide a capability for central management of updates and maintenance releases to all distributed peripherals in the IDMS infrastructure.

17. Provide a role-based solution for enrollment, issuance, and system administration providing various levels of configurable access for system administration and usage.

18. Provide an electronic card inventory and life cycle tracking mechanism.

19. Provide the capability for local and centralized printing of PIV, FLAC, and FAC credentials.

20. Provide the capability to issue credentials in accordance with approved Department card issuance procedures as identified in the One Badge Operations Plan (Reading Room), including:

i) Scanning and verifying identity source documents.

ii) Capturing flat or rolled fingerprints (type 14 records).

iii) Taking applicant pictures.

iv) Comparing live fingerprints to the IDMS and PIV card stored fingerprint template.

v) Downloading PKI certificates to the PIV card.

vi) Electronically activating the PIV card.

vii) Managing the PIV card personal identification number.

21. Provide for high assurance authentication to physical access control transactions and return response to the DOS Physical Access Control system (C•Cure 9000) for authorization and access deny functionality.

22. Provide a flexible and efficient interface capability with current and future DOS systems to share all requested One Badge data (e.g. web services, connectors, API)

23. Provide automatic revocation of relevant data and access to interfacing systems within the

DOS enterprise.

24. Provide for equipment life cycle management and technology refresh to sustain and enhance the solution’s availability and responsiveness throughout the period of performance.

C. Technical Support Services Objectives

1. Baseline, manage and enhance system performance. Produce and maintain a performance baseline of the Department’s IDMS solution and technical environment, including supported interfaces.

2. Provide mature configuration control, change control, and release management processes that enhance service reliability and comply with Department guidelines.

3. Provide on-demand technical advisory and engineering services to implement the solution from award through transition and full implementation, and to fully support and maintain the solution throughout the period of performance, including troubleshooting performance and interface issues, adapting the solution for new interfaces, and addressing evolving security requirements. Provide root cause analysis for all issues and problems, and upon government approval, implement appropriate mitigation steps.

4. Provide technical assistance and subject matter expertise at designated government sites in response to reported issues and problems.

5. Provide and maintain hardware-based or virtual environments to efficiently allow the following: development efforts, user acceptance testing (UAT), interface testing, training, production, and disaster recovery (DR).

6. Provide operations and maintenance in accordance with sound Systems Development Life

Cycle (SDLC) methodologies listed in 5 FAM 600. Information Technology Systems.

7. Provide effective continuity of operations (COOP) solutions to include planning and testing services as well as back-up, restoration, and disaster recovery capabilities.

8. Provide flexible configuration options for ordering and deploying hardware, system components, and consumables.

9. Provide flexible, comprehensive maintenance and warranty services.

10. Provide information assurance related technical support services to achieve and maintain the system accreditation throughout the period of performance.

D. Information Assurance Objectives

1. Provide and maintain assurance that the proposed solution provides adequate safeguards for the confidentiality, integrity, and availability of Department information and resources and is in full compliance with the applicable documents in Section VI of this SOO and be able to document this compliance through the provision of artifacts in accordance with

NIST publications listed in Section VI of this SOO and their successor documents.

2. Achieve, maintain, and continuously update full Authorization and Accreditation (A&A) for the solution and all interfaces. This includes all NIST and DOS A&A services and required technical documentation. The current accreditation level is HIGH.

E. Program Management Objectives

1. Execute the contract through development, deployment, operations, and phase-out that shall be based on four guiding principles: (1) limited risk to current and future continuity of service; (2) essentiality of communication, (3) flexibility and responsiveness, and (4) security of data.

2. Provide comprehensive program and project management for IDMS activities that are compliant with the Project Management Institute (PMI) Project Management Body of

Knowledge (PMBOK) or an industry-equivalent guidance document, including quality control and oversight, risk management, and communication management.

3. Provide flexible operations and maintenance strategies for IDMS domestic and global infrastructures.

4. Develop, document, and implement standard operating procedures.

5. Coordinate installations and upgrades, communicate with and manage multiple stakeholders, and work across DOS organizations and affiliates for project planning and execution with minimal government oversight.

6. Provide briefings to all stakeholders to apprise them of program objectives, plans, and status updates.

7. Provide clear government visibility into program cost, schedule, technical performance, and risk; provide periodic reports detailing these items.

8. Provide, maintain, and periodically update full life cycle documentation for the solution and all interfaces. Refer to the documentation and interface requirements in the following

DOS references:

a. 5 FAM 861, Configuration Management,

b. 5 FAM 116, Role of Governance and Policy (GP) in IT Management

c. 5 FAH-5 H-520, Lifecycle Management.

9. Provide and maintain a release schedule that will set the timeframe for change request identification, requirements elicitation, development, testing, flaw remediation, system and program documentation updates, and deployment.

10. Provide configuration management and quality control to ensure that planned hardware and software, database, and operating configuration changes are documented, tested in the appropriate environments, and approved IAW Department-approved SOPs prior to each release.

11. Report all qualified assets through DS/ST’s Computerized Maintenance Management

System (CMMS). All trouble shooting, maintenance and repair actions must be reported on CMMS. CMMS training will be provided by the USG.

12. Develop and deliver a phase-out performance plan that can be consumed by other systems using non-proprietary protocols, and provide subject matter expertise to assist in transition.

Provide technical responses to government inquiries within a reasonable timeframe. The plan must include a method to export all IDMS data to industry standard data and card exchange formats as well as provide schema documentation.

F. User Support and Training Objectives

1. Provide end user support, curriculum development, training services, and train-the-trainer services (e.g., courseware, content, tracking, and certification) for the following activities:

system functional and capability updates; enrollment, issuance, and system administration user training; system set-up and configuration; Tier 1 and 2 and general workflow trouble shooting and resolution; and One Badge overseas workflow.

2. Provide a documentation package with all system modifications that includes impacted material, courseware, and process changes.

3. Provide the capability for receiving, tracking, and resolving user inquiries, outages, issues, and problems to include documentation updates.

4. Provide a One Badge global deployment workflow, standard operating procedures (SOPs), and testing materials (e.g. system operations testing).

V. SCOPE

The Contractor shall provide all labor, hardware, software, interfaces, cards, consumables, and services necessary to provide the Department with an end-to-end identity and credential management solution which meets all federal government requirements and approvals concerning the HSPD-12 mandate by OMB, NIST, GSA, DHS, and DOS to accomplish the objectives and operate within the constraints described herein.

VI. CONSTRAINTS AND APPLICABLE DOCUMENTS

A. Constraints

The IDMS solution and related deliverables shall be compliant with the standards and specifications herein.

1. The solution must:

Comply with FIPS 201-2 and its supporting special publications (SPs), applicable

Department policy, and all other federal standards for information security.

Use components on the GSA FIPS 201 Evaluation Program Approved Product List.

Comply with, and be able to document compliance via appropriate artifacts, Department IT security requirements for physical and network security of each enrollment and issuance system as documented in the Authority to Operate (ATO) and physical security documentation.

Provide card lifecycle and technical data maintenance and certificate re-issuance capabilities.

2. All cards produced must meet the NIST requirement and contain a symmetric CAK to permit both asymmetric and symmetric operations. Additionally, the One Badge magnetic stripe shall be programmable for the currently operational legacy Automated Access

Control System (AACS).

3. Data transfers must be secure and comply with all privacy act requirements in accordance with 5 FAM 460 (The Privacy Act and Personally Identifiable Information), 12 FAH-10

H-170 (Remote Access and Remote Processing), and OMB M-07-16 (Safeguarding

Against and Responding to the Breach of Personally Identifiable Information).

4. All Government Furnished Information (GFI) and PII must be stored in an open source

(non-proprietary) format and must be encrypted in transit and at rest in accordance with current Department Chief Information Officer (CIO) directives, to include 5 FAM 469.4

(Avoiding Technical Threats to PII). This data will remain property of the USG.

5. The uniqueness of every SGID must be maintained and managed within the solution and transmitted to future solutions in perpetuity.

6. The Contractor must comply with all applicable Department guidelines, including

Managing State Projects for Information Technology (MSP-IT) guidance; 5 FAM 860, Hardware and Software Maintenance; and FAH-5 H-210, Managing Department of State

Projects. The DOS will have approval of customization and system changes once the system is deployed.

7. All solutions must operate in strict accordance with Federal and Department IT security guidelines, including those systems that include or rely on one or more of the following concepts: Federal Risk and Authorization Management Program (FEDRAMP) certification, remote administration, Department cloud-based and virtualization guidelines.

8. Post-issuance updates must be performed with issuer security controls equivalent to those applied during PIV Card issuance.

9. Solution equipment, both test and production, must reside solely in DOS facilities.

Government will provide space accordingly.

10. All connections related to the One Badge system must remain within the DOS security boundaries other than (1) those information export connections required for reporting entity status or (2) those explicitly approved by the government.

11. Onsite staff must possess a SECRET security clearance, at a minimum.

12. Key Personnel and anyone with access to the system must possess a TOP SECRET security clearance.

13. The IDMS must interface with a DOS-operated Entrust-based certificate authority (CA) using Entrust Authority Security Toolkit for Java. The interface must support common certificate management operations, to include certificate issuance, certificate revocation, certificate update, and certificate recovery. In addition, the interface must support the retrieval of archived encryption keys, at a minimum, via the certificate recovery mechanism. These operations must be performed in compliance with FIPS 201-2, associated NIST special publications, and FPKI policies.

14. The IDMS must be capable of requesting varying numbers of personal identity verification certificates, to include pivAuth and cardAuth as well as pivAuth, cardAuth, keyMgt, and digSig. The IDMS must also support requesting non-PIV certificates from the CA.

15. The IDMS must store all keys in FIPS 140-2 validated key stores and implement FIPS validated algorithms and cryptographic service providers. To interface with the CA, the

IDMS must implement the Entrust ASH, PKIX-CMP, and XAP protocols (the protocols will be implemented via the Entrust Authority Security Toolkit for Java).

16. NIST SP 800-53 classification level of HIGH confidentiality, HIGH integrity and

MEDIUM availability.

17. Personnel with system access must be:

a. Industry-trained and manufacturer-certified (when a certificate is available) on

IDMS software and hardware, both currently deployed and to be upgraded as a part of system compliance requirements.

b. Certified through the Secure Technology Alliance (formerly Smart Card Alliance)

Certified Smart Card Industry Professional-Government (CSCIP/G) program not later than six months after award.

18. Authorization and Accreditation documentation must be provided within 60 days of contract award.

19. The IDMS solution must have the capability to interface and share real-time data with the

DOS on-premise and cloud-based identity authentication and authorization system

(ICAM – currently Radiant Logic and SailPoint)

B. Applicable Documents

This document list references the current versions of applicable documents. All future versions of these documents shall apply and be incorporated into the solution. Changes to the solution to meet standards compliance will follow the standard configuration management process when financial impact is determined and approved in advance, subject to the Changes clause of the contract. The

Department will establish timeframes for completing system changes based on new policies or future versions of current policies and standards with input from the contractor.

1. FISMA of 2002, http://csrc.nist.gov/drivers/documents/FISMA-final.pdf

2. FISMA of 2014, https://www.congress.gov/bill/113th-congress/senate-bill/2521

3. NIST SP 800-53 rev 4, Security and Privacy Controls for Federal Information Systems and Organizations, http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-

53r4.pdf

4. FIPS Publication 201-2, Personal Identity Verification for Federal Employees and

Contractors, September 5, 2013, http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-

2.pdf

5. NIST SP 800-157, Guidelines for Derived Personal Identity Verification (PIV)

Credentials, http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-157.pdf

6. NIST SP 800-73-4, Interfaces for Personal Identity Verification (3 Parts), http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-73-4.pdf

7. NIST SP 800-85A-4, PIV Card Application and Middleware Interface Test Guidelines, http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-85A-4.pdf

8. NIST SP 800-85B, PIV Data Model Test Guidelines, http://csrc.nist.gov/publications/nistpubs/800-85B/SP800-85b-072406-final.pdf

9. Privacy Act of 1974, http://www.gpo.gov/fdsys/pkg/USCODE-2012-title5/pdf/USCODE-2012-title5-partI-chap5-subchapII-sec552a.pdf

10. Electronic and Information Technology Accessibility Standards (36 CFR 1194), http://www.gpo.gov/fdsys/pkg/CFR-2012-title36-vol3/xml/CFR-2012-title36-vol3-part1194.xml http://csrc.nist.gov/drivers/documents/FISMA-final.pdf https://www.congress.gov/bill/113th-congress/senate-bill/2521 http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-157.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-73-4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-85A-4.pdf http://csrc.nist.gov/publications/nistpubs/800-85B/SP800-85b-072406-final.pdf http://www.gpo.gov/fdsys/pkg/USCODE-2012-title5/pdf/USCODE-2012-title5-partI-chap5-subchapII-sec552a.pdf http://www.gpo.gov/fdsys/pkg/USCODE-2012-title5/pdf/USCODE-2012-title5-partI-chap5-subchapII-sec552a.pdf http://www.gpo.gov/fdsys/pkg/CFR-2012-title36-vol3/xml/CFR-2012-title36-vol3-part1194.xml http://www.gpo.gov/fdsys/pkg/CFR-2012-title36-vol3/xml/CFR-2012-title36-vol3-part1194.xml

11. HSPD-12, http://www.dhs.gov/homeland-security-presidential-directive-12

12. Federal Travel Regulation (FTR), www.gsa.gov/federaltravelregulation

13. NIST SP 800-64, Security Considerations in the Information System Development Life

Cycle http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-64r2.pdf

14. NIST SP 800-79-2, Guidelines for the Authorization of Personal Identity Verification

Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI), http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-79-2.pdf

15. NIST and GSA security policies and procedures for FIPS 199 security impact level of

HIGH, http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf

16. Section 508 of the U.S. Rehabilitation Act of 1973, https://www.fcc.gov/encyclopedia/section-508-rehabilitation-act

17. FPC 65, http://www.wrc.noaa.gov/wrso/oep-coop/fpc-65.pdf

18. HSPD-20/NSPD-51, http://www.fema.gov/pdf/about/org/ncp/nspd_51.pdf

19. National Continuity Policy Implementation Plan (NCPIP), https://www.fema.gov/media-library-data/1384886826028-729844d3fd23ff85d94d52186c85748f/NCPIP.pdf

20. 5 U.S.C. 552a (i) Records maintained on individuals, http://uscode.house.gov/view.xhtml?req=(title:5%20section:552a%20edition:prelim)

21. HSPD 12 Implementation, https://www.idmanagement.gov/IDM/servlet/fileField?entityId=ka0t00000008OeiAAE& field=File__Body__s

22. GSA Information Technology (IT) Security Policy, http://www.gsa.gov/portal/mediaId/252231/fileName/CIO_P_21001I__CHGE_1_GSA_I nformation_Technology_(IT)_Security_Policy__(Signed_on_10-20-2015).action

23. OMB Memorandum M-11-11, https://www.whitehouse.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf

24. OMB M-07-16 Safeguarding Against and Responding to the Breach of Personally

Identifiable Information, May 22, 2007 https://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2007/m07-16.pdf

25. FedRAMP, https://www.fedramp.gov/files/2015/03/fedrampmemo.pdf

26. WS-Security 1.1 (Mutual Certificate authentication; Transport and Message encryption), https://www.oasis-open.org/committees/download.php/16790/wss-v1.1-spec-os-

SOAPMessageSecurity.pdf

27. WS-Trust February 2005, http://specs.xmlsoap.org/ws/2005/02/trust/WS-Trust.pdf

28. WS-Secure Conversation February 2005, http://specs.xmlsoap.org/ws/2005/02/sc/WS-

SecureConversation.pdf

29. WS-Security Policy 1.1, http://specs.xmlsoap.org/ws/2005/07/securitypolicy/ws-securitypolicy.pdf

30. Basic Security Profile 1.0, http://www.ws-i.org/Profiles/BasicSecurityProfile-1.0.html

31. SOAP/XML 1.2, http://www.w3.org/TR/2001/WD-soap12-20010709/

32. WS-Addressing August 2004, http://xml.coverpages.org/WS-Addressing200408.pdf http://www.dhs.gov/homeland-security-presidential-directive-12 http://www.gsa.gov/federaltravelregulation http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-64r2.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-79-2.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf https://www.fcc.gov/encyclopedia/section-508-rehabilitation-act http://www.wrc.noaa.gov/wrso/oep-coop/fpc-65.pdf http://www.fema.gov/pdf/about/org/ncp/nspd_51.pdf https://www.fema.gov/media-library-data/1384886826028-729844d3fd23ff85d94d52186c85748f/NCPIP.pdf https://www.fema.gov/media-library-data/1384886826028-729844d3fd23ff85d94d52186c85748f/NCPIP.pdf http://uscode.house.gov/view.xhtml?req=(title:5%20section:552a%20edition:prelim) https://www.idmanagement.gov/IDM/servlet/fileField?entityId=ka0t00000008OeiAAE&field=File__Body__s https://www.idmanagement.gov/IDM/servlet/fileField?entityId=ka0t00000008OeiAAE&field=File__Body__s http://www.gsa.gov/portal/mediaId/252231/fileName/CIO_P_21001I__CHGE_1_GSA_Information_Technology_(IT)_Security_Policy__(Signed_on_10-20-2015).action http://www.gsa.gov/portal/mediaId/252231/fileName/CIO_P_21001I__CHGE_1_GSA_Information_Technology_(IT)_Security_Policy__(Signed_on_10-20-2015).action https://www.whitehouse.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf https://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2007/m07-16.pdf https://www.fedramp.gov/files/2015/03/fedrampmemo.pdf https://www.oasis-open.org/committees/download.php/16790/wss-v1.1-spec-os-SOAPMessageSecurity.pdf https://www.oasis-open.org/committees/download.php/16790/wss-v1.1-spec-os-SOAPMessageSecurity.pdf http://specs.xmlsoap.org/ws/2005/02/trust/WS-Trust.pdf http://specs.xmlsoap.org/ws/2005/02/sc/WS-SecureConversation.pdf http://specs.xmlsoap.org/ws/2005/02/sc/WS-SecureConversation.pdf http://specs.xmlsoap.org/ws/2005/07/securitypolicy/ws-securitypolicy.pdf http://specs.xmlsoap.org/ws/2005/07/securitypolicy/ws-securitypolicy.pdf http://www.ws-i.org/Profiles/BasicSecurityProfile-1.0.html http://www.w3.org/TR/2001/WD-soap12-20010709/ http://xml.coverpages.org/WS-Addressing200408.pdf

33. OMB Circular A-130, Appendix III, https://www.whitehouse.gov/omb/circulars_a130_a130appendix_iii

34. NIST SP 800-76-2, Biometric Specifications for Personal Identity Verification, http://dx.doi.org/10.6028/NIST.SP.800-76-2

35. NIST SP 800-78-4, Cryptographic Algorithms and Key Sizes for Personal Identity

Verification, http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-78-4.pdf

36. NIST SP 800-156, Representation of PIV Chain-of-Trust for Import and Export, http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-156.pdf

37. NIST SP 800-166, Derived PIV Application and Data Model Test Guidelines, http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-166.pdf

38. 5 FAM 460, The PRIVACY ACT and Personally identifiable information http://arpsdir.a.state.gov/fam/05fam/05fam0460.html

39. 5 FAM 600, Information Technology Systems http://arpsdir.a.state.gov/fam/05fam/05fam0610.html

40. 5 FAM 1060, Information Assurance Management https://fam.state.gov/FAM/05FAM/05FAM1060.html

41. 5 FAH-5 H-200, Project Management http://fam.a.state.gov/fam/05fah05/05fah050210.html#H210

42. 5 FAM 140, Acceptability and Use of Electronic Signatures https://fam.state.gov/FAM/05FAM/05FAM0140.html

43. 5 FAM 116, Role of Governance and Policy (GP) in IT Management https://fam.state.gov/FAM/05FAM/05FAM0110.html

44. 5 FAM 861, Configuration Management https://fam.state.gov/FAM/05FAM/05FAM0860.html

45. 5 FAH-5 H-520, Lifecycle Management https://fam.state.gov/FAM/05FAH05/05FAH050520.html

46. 12 FAH-10 H-170, Remote Access and Remote Processing http://fam.a.state.gov/fam/12fah10/12fah100170.html

12 FAH-10 H-700, File Transfer Procedures Using Removable Media http://fam.a.state.sbu/fam/12fah10/12fah100710.html#H710 https://www.whitehouse.gov/omb/circulars_a130_a130appendix_iii http://dx.doi.org/10.6028/NIST.SP.800-76-2 http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-78-4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-156.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-166.pdf http://arpsdir.a.state.gov/fam/05fam/05fam0460.html http://arpsdir.a.state.gov/fam/05fam/05fam0610.html https://fam.state.gov/FAM/05FAM/05FAM1060.html http://fam.a.state.gov/fam/05fah05/05fah050210.html#H210 https://fam.state.gov/FAM/05FAM/05FAM0140.html https://fam.state.gov/FAM/05FAM/05FAM0110.html https://fam.state.gov/FAM/05FAM/05FAM0860.html https://fam.state.gov/FAM/05FAH05/05FAH050520.html http://fam.a.state.gov/fam/12fah10/12fah100170.html http://fam.a.state.sbu/fam/12fah10/12fah100710.html#H710