SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802).pdf

UNITED STATES

DEPARTMENT OF STATE

DEPARTMENT OF STATE (DOS) PUBLIC KEY

INFRASTRUCTURES (PKIS)

STATEMENT OF WORK (SOW)

FOR PKI AUDIT SERVICES

Version 1.0 August 2, 2023

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 2 of 32 8/2/23

DOCUMENT HISTORY

Version Date Author(s) Reason For Change

1.0 August 2023 L. Shomo Initial Document

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 3 of 32 8/2/23

TABLE OF CONTENTS

1 INTRODUCTION

1.1 ORGANIZATION REQUIRING AUDIT SERVICES

1.2 BACKGROUND

1.3 TYPES OF AUDIT SERVICES REQUIRED

1.3.1 Background Information

1.3.2 Full PKI Compliance Audits for PKIs

1.3.3 Zero Day and Initial PKI Compliance Audits

1.3.4 Witnessing Key Generation Ceremonies

1.3.5 Termination and Archive of Operational CAs

1.3.6 Special Audits

1.4 DEPARTMENT OF STATE PKIS

1.4.1 Department of State PKI (DOS PKI)

1.4.2 Department of State Internal PKI (DOS IPKI)

1.4.3 National Security Systems (NSS) PKI – DOS ClassNet PKI (DOS CPKI)

1.4.4 Department of State ClassNet Internal PKI (DOS CIPKI)

1.4.5 Department of State GrayNet PKI (DOS GPKI)

1.4.6 Department of State Machine Readable Travel Document PKI (MRTD PKI)

1.5 ADDITIONAL GUIDANCE ON PKI COMPLIANCE AUDITS

1.6 PKI FACILITY VISITS REQUIRED FOR PKI COMPLIANCE AUDITS

2 CONTRACT PERIOD OF PERFORMANCE

2.1 PERIOD COVERED BY THIS SOW

2.2 TYPICAL DURATION OF AUDIT SERVICES BY TYPE

3 AUDIT SERVICES FOR CONTRACT YEAR 2023

3.1 REQUIRED AUDIT SERVICES FOR CONTRACT YEAR 2023

3.2 OPTIONAL AUDIT SERVICES FOR CONTRACT YEAR 2023

4 PRICING AUDIT SERVICES

4.1 PRICING FOR REQUIRED AND OPTIONAL AUDIT SERVICES

4.2 UNANTICIPATED REQUIREMENTS

5 AUDITOR QUALIFICATIONS

6 ANNUAL PKI COMPLIANCE AUDIT REQUIREMENTS

6.1 AUDIT METHODOLOGY

6.2 DOCUMENTATION REVIEW

6.3 REVIEW OF OPERATIONS

6.4 USE OF SAMPLING

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 4 of 32 8/2/23

6.5 PRIOR AUDIT FINDINGS AND CORRECTIVE ACTIONS

6.6 AUDIT OPINION LETTER

6.7 AUDIT REPORT

7 AUDITOR DELIVERABLES

8 SCHEDULES

TABLE OF TABLES

Table 1-1 Facility Visits Required to Perform PKI Compliance Audits

Table 2-1 Period Covered by this SOW

Table 2-2 Typical Duration for Each Type of Audit Service

Table 3-1 DOS PKI Audit Services Required for Contract Year 2023

Table 3-2 DOS CPKI Audit Services Required for Contract Year 2023

Table 3-3 DOS CIPKI Audit Services Required for Contract Year 2023

Table 3-4 DOS GPKI Audit Services Required for Contract Year 2023

Table 3-5 DOS MRTD PKI Audit Services Required for Contract Year 2023

Table 3-6 Optional Audit Services for Contract Year 2023

Table 6-1 Audit Opinion Letter Compliance Checklist

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 5 of 32 8/2/23

STATEMENT OF WORK (SOW)

FOR PKI AUDIT SERVICES FOR DOS PKIS

1 INTRODUCTION

1.1 ORGANIZATION REQUIRING AUDIT SERVICES

This SOW describes Public Key Infrastructure (PKI) Audit services required by the Systems Integrity Division:

United States Department of State (DOS) Information Resources Management Bureau (IRM) Office of Foreign Operations (FO) Information Technology Infrastructure (ITI) Systems Integrity Division (SI)

1.2 BACKGROUND

The DOS has implemented Public Key Infrastructures (PKIs) to support its missions.

These PKIs include:

• DOS PKI (DOS PKI) that consists of a Root Certification Authority (CA) and Subordinate CAs that issue certificates to Person Entities (PEs) and Non- Person Entities (NPEs). The DOS PKI is cross certified with the Federal PKI’s (FPKI’s) Common Policy Root CA. It is used to secure the Sensitive But Unclassified (SBU) fabric.

• DOS Internal PKI (DOS IPKI) consists of Root CAs and Subordinate CAs that issue NPE certificates that are Only Locally Trusted (OLT) within the DOS. The DOS IPKI is used to secure the Sensitive But Unclassified (SBU) fabric internal to the DOS.

• DOS ClassNet PKI (CPKI) consists of CAs that issue certificates to Person Entities (PEs) and Non-Person Entities (NPEs). Its CAs are subordinated to the National Security Systems PKI (NSS PKI) Root CA. It is used to secure the SECRET fabric.

• DOS ClassNet Internal PKI (CIPKI) consists of a Root CA and Subordinate CA that issue NPE certificates that are Only Locally Trusted (OLT) within the DOS.

The DOS CIPKI is used to secure the SECRET fabric internal to the DOS.

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 6 of 32 8/2/23

• DOS GrayNet PKI (GPKI) consists of a Root CA and Subordinate CA that issue NPE certificates that are Only Locally Trusted (OLT) within the DOS. The DOS FPKI is used to secure an outer encryption tunnel connecting end-user devices (EUDs) to the DOS ClassNet.

• Machine Readable Travel Document PKI (MRTD PKI) that consists of a Country Signing CA (CSCA) that issues certificates to NPE Document Signers, Master List Signers, and Deviation List Signers. It supports the Travel Document Issuance System (TDIS), in coordination with the International Civil Aviation Organization (ICAO).

The DOS requires audit services to conduct independent audits to ensure that its PKIs are operating in compliance to the requirements specified in the governing Certificate Policies (CPs) and Memoranda of Agreement (MOAs), and in conformance with the associated Certification Practices Statements (CPSs) governing the PKI’s Certification Authorities (CAs).

Each year both the Federal PKI (FPKI) and National Security Systems PKI (NSS PKI) review their relationship with each cross-certified PKI or subordinated CAs to ensure the continuing integrity of the FPKI and NSS PKI trust environments, respectively. The FPKI and NSS PKI utilize the results of independent PKI compliance audits submitted by each cross-certified or subordinated PKI as the primary mechanism to ensure that participating PKIs are operating in compliance with the requirements specified in the FPKI and NSS PKI CPs and Memoranda of Agreement (MOAs), respectively.

1.3 TYPES OF AUDIT SERVICES REQUIRED

The following types of audit services are required:

• Full PKI Compliance Audits for a PKI,

• Zero-Day or Initial PKI Compliance Audits for a new Certification Authority

(CA),

• Witnessing a Key Generation Ceremony,

• Termination and Archive of an Operational CA, and

• Special Audits

1.3.1 Background Information

Each PKI is governed by one or more CPs that establish the requirements that must be met for operating and managing the PKI, to include the operations and management of the CAs, Registration Authorities (RAs), Repositories, Credential Status Services (CSSs), SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 7 of 32 8/2/23 and related security-relevant ancillary components such as Hardware Security Modules (HSMs) and Card Management Systems (CMSs).

Each CA has a Certification Practices Statement (CPS) that specifies the practices employed to operate and manage the CA and its components to comply with the requirements mandated by the governing CP’s and MOAs. Each CA in the PKI may have its own CPS, or a single CPS may cover multiple CAs in the PKI.

Currently the registration practices for a CA are addressed in the CPS for the CA. (In the future there may be a requirement for a separate Registration Practices Statement (RPS) to address the Registration Authority activities performed by a satellite organization using CA services.)

Currently the key recovery practices for a CA are addressed in the CPS for the CA. (In the future there may be a requirement for a separate Key Recovery Practices Statement (KRPS) to address the key recovery activities performed by a satellite organization using CA services.)

A Key Generation Ceremony (KGC) is a witnessed performance of a carefully scripted process documenting the secure generation, storage, and backup, of a highly sensitive cryptographic key. Adherence to the KGC script is documented and witnessed in real time by an independent auditor and/or other official witnesses. Once completed, this witnessed KGC document provides a basis for future Auditors to attest to the initial integrity of the cryptographic key. KGCs are performed to document the generation of a CA signing key for a new CA, and to document the generation of a new CA signing key when an existing CA is re-keyed.

1.3.2 Full PKI Compliance Audits for PKIs

Full PKI Compliance Audits include the following audit services:

• Making a presentation at an Audit Kickoff Meeting between the Auditor, DOS PKI management and audit participants discussing the audit approach, schedule, and logistics,

• Providing a letter(s) to the DOS requesting PKI documentation required for the audit, and tracking and reporting on the status of delivery of the requested documentation,

• Evaluating the compliance of the practices for each CA in the PKI, as specified by the applicable CPS(s), with the requirements of the governing CP(s) and MOA(s) [Not required for DOS CPKI Audits. For Full and Initial NSS PKI Compliance Audits, Auditor performance of a CPS-to-CP and MOA mapping is not required, since the NSS PKI Member Governing Body is responsible for reviewing and approving CPS-to-CP and MOA mappings.],

• Evaluating the operations of each CA in the PKI and their compliance with the practices stated in the governing CPS(s), SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 8 of 32 8/2/23

• Reviewing changes implemented to address previous compliance audit findings,

• Providing early identification of significant Audit Findings as the audit is in process,

• Providing a draft CPS-to-CP and MOA compliance mapping report, for each CA’s CPS, listing findings and recommendations [Not required for DOS CPKI Audits.],

• Providing a draft Audit Report listing findings and recommendations,

• Providing a draft Audit Opinion Letter,

• Reviewing the responses and POA&Ms submitted by the DOS addressing the Audit findings and recommendations,

• Providing a final CP-CPS mapping report [Not required for DOS CPKI Audits.],

• Providing a final Audit Report,

• Providing a final Audit Opinion Letter, and

• Providing support to the DOS during the FPKI or NSS PKI MGB review of the relevant Audit Opinion Letter or its content.

1.3.3 Zero Day and Initial PKI Compliance Audits

Zero Day (the FPKI name) and Initial (the NSS PKI name) Audits are required for new CAs before they commence operations to determine if the CA is prepared to operate in compliance with all governing CP and MOA requirements, and CPS practices.

The audit services required for Zero Day and Initial Audits are the same as the audit services specified for Full Compliance Audits in Section 1.3.2, with the following difference. The audit of operations is limited due to the absence of any operational records for the new CA.

1.3.4 Witnessing Key Generation Ceremonies

The requirement to witness Key Generation Ceremonies includes the following audit services:

• Reviewing the KGC Script provided by DOS and recommending improvements,

• Witnessing the KGC, i.e., the execution of the KGC Script, and

• Authoring and signing a KGC Report to the DOS PKI Operational Authority and DOS PKI Program Manager providing a summary evaluation of the execution of the KGC and its results.

1.3.5 Termination and Archive of Operational CAs

The following audit services are required for termination and archive of operational CAs:

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 9 of 32 8/2/23

• Reviewing the termination and archive plan, checklists and any scripts and recommending improvements.

The following optional services may also be required on a case-by-case basis:

• Witnessing the termination and archiving activity

• Authoring and signing a Termination and Archive Report for the CA to the DOS PKI Operational Authority and DOS PKI Program Manager providing a summary evaluation of the execution of the termination and archive activity.

1.3.6 Special Audits

When required, Special Audit requirements will be defined on a case-by-case basis.

1.4 DEPARTMENT OF STATE PKIs

The Department of State (DOS) operates multiple PKIs and Certificate Authorities (CAs), that may require PKI Compliance Audit Services addressed by this SOW.

1.4.1 Department of State PKI (DOS PKI)

General: The DOS PKI is a hierarchical PKI operated by the DOS that enables the use of strong cryptographic security services to support securing information and systems on the Department’s Sensitive But Unclassified (SBU) networks.

Root and Subordinate CAs: The DOS PKI consists of the Active Directory Root CA (AD Root CA) and three subordinate CAs, i.e., the Active Directory High Assurance CA (AD HACA), the Personal Identity Verification (PIV) CA2 (PIV CA2), and the Derived PIV Credential CA (DPC CA).

Governing CPs: The DOS PKI is a Federal Legacy PKI that has its own Certificate Policy (CP), i.e., the DOS PKI CP. In order to maintain its trust relationship with the Federal PKI, the DOS PKI CP is required to map to the Federal Bridge CA (FBCA) CP, and the DOS PKI is cross-certified with the U.S. Federal PKI (FPKI) via a cross-certificate issued to the DOS AD Root CA by the Federal Common Policy Root CA (FCPCA). The DOS is a member of the FPKI Policy Authority (FPKIPA).

The DOS’s AD Root CA and AD HACA subordinate CA operate solely under the DOS PKI CP. The DOS PKI’s subordinate PIV CA2 operates under the DOS PKI CP when issuing certificates for non-PIV credentials but operates under the Federal Common Policy Framework CP (FCPF CP) when issuing certificates for PIV credentials. The DOS DPC CA operates under the FCPF CP when issuing certificates for Derived-PIV credentials, and under the DOS PKI CP if it issues credentials derived from DOS non- PIV credentials.

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 10 of 32 8/2/23

Governing CPSs: The AD Root CA, AD HACA, PIV CA2 and DPC CA are governed by the single DOS PKI Certification Practices Statement (CPS) (DOS PKI CPS).

1.4.2 Department of State Internal PKI (DOS IPKI)

General: The DOS IPKI is a hierarchical PKI operated by the DOS that enables the use of strong cryptographic security services to support securing information and systems on the Department’s Sensitive But Unclassified (SBU) networks. The DOS IPKI is a hierarchical PKI that is used to issue Only Locally Trusted (OLT) certificates to Non- Person Entities (NPEs).

Root and Subordinate CAs: The IPKI is a hierarchical PKI that consist of an IPKI Root Certification Authority (IPKI Root CA) and one or more subordinate CAs (IPKI Subordinate CAs) operated by the DOS.

Governing CPs: The governing CP for the DOS IPKI is the DOS IPKI Certificate Policy (DOS IPKI CP), that is under development.

Governing CPSs: The IPKI Root CAs and the IPKI CAs will be governed by a single DOS IPKI Certification Practices Statement (CPS) (DOS IPKI CPS), that is under development.

1.4.3 National Security Systems (NSS) PKI – DOS ClassNet PKI (DOS CPKI)

General: The NSS PKI is a hierarchical PKI, with a Root Certificate Authority (CA) operated by the National Security Agency (NSA) on behalf of the Committee on National Security (CNSS). The DOS CPKI consists of a DOS CPKI CA that is subordinated to the NSS PKI Root CA. The NSS PKI provides certificates for use on Secret networks to protect resources while achieving interoperability and controlled information sharing.

The DOS is a member of the CNSS.

Root and Subordinate CAs: The DOS CPKI consists of a DOS CPKI SHA-256 CA that is subordinated under the NSS PKI SHA-256 Root CA. This CA replaces the earlier DOS CPKI SHA-1 CA that was subordinated under the NSS PKI SHA-1 Root CA, and which has been shut down and scheduled for termination.

Governing CPs: The governing CP for the NSS PKI is CNSSI 1300 Instruction for Secret NSS PKI X.509 Certificate Policy.

Governing CPSs: The DOS CPKI CPS is developed and maintained by the DOS and must be submitted to the NSS PKI Member Governing Body (MGB) for review and recommendation to the NSS PKI Policy Management Authority for approval. The single DOS CPKI CPS governs all DOS CPKI CAs.

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 11 of 32 8/2/23

1.4.4 Department of State ClassNet Internal PKI (DOS CIPKI)

General: The DOS CIPKI is a hierarchical PKI operated by the DOS that enables the use of strong cryptographic security services to support securing information and systems on the Department’s SECRET networks. The DOS CIPKI issues Only Locally Trusted (OLT) certificates to Non-Person Entities (NPEs).

Root and Subordinate CAs: The DOS CIPKI is a hierarchical PKI that consists of the DOS CIPKI Root Certification Authority and one or more subordinate CAs (CIPKI Subordinate CAs) operated by the DOS.

Governing CPs: The governing CP for the DOS CIPKI is the DOS X.509 Certificate Policy for the DOS GrayNet PKI and DOS ClassNet Internal PKI.

Governing CPSs: The DOS CIPKI Root CA and DOS CIPKI Subordinate CAs are governed by the DOS X.509 CPS for the DOS GrayNet PKI and DOS ClassNet Internal

PKI.

1.4.5 Department of State GrayNet PKI (DOS GPKI)

General: The DOS GPKI is a hierarchical PKI operated by the DOS that issues NPE certificates that are used to secure an outer encryption tunnel connecting end-user devices (EUDs) to the DOS ClassNet. The GPKI issues Only Locally Trusted (OLT) certificates to Non-Person Entities (NPEs).

Root and Subordinate CAs: The DOS GPKI is a hierarchical PKI that consists of the DOS GPKI Root Certification Authority and a subordinate CA (CIPKI Subordinate CA) operated by the DOS.

Governing CPs: The governing CP for the DOS GPKI is the DOS X.509 Certificate Policy for the DOS GrayNet PKI and DOS ClassNet Internal PKI.

Governing CPSs: The DOS GPKI Root CA and DOS GPKI Subordinate CA are governed by the DOS X.509 CPS for the DOS GrayNet PKI and DOS ClassNet Internal

PKI.

1.4.6 Department of State Machine Readable Travel Document PKI (MRTD PKI)

General: The DOS MRTD PKI consists of a Root CA that issues certificates to NPE Document Signers, Master List Signers, and Deviation List Signers. It supports the Travel Document Issuance System (TDIS), in coordination with the International Civil Aviation Organization (ICAO).

Root and Subordinate CAs: The DOS MRTD PKI is a single Root Country Signing CA (CSCA) operated by the DOS. There are no subordinate CAs.

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 12 of 32 8/2/23

Governing CPs: The governing CP for the DOS MRTD PKI is the DOS Machine Readable Travel Document X.506 Certificate Policy.

Governing CPSs: The DOS MRTD PKI Country Signing CA (CSCA) is governed by the DOS Machine Readable Travel Document PKI Certificate Authority CPS.

1.5 ADDITIONAL GUIDANCE ON PKI COMPLIANCE AUDITS

Additional information on the PKI Compliance Audits required for the specific PKIs identified in this document, is provided in the Certificate Policies governing those PKIs, and in supplementary information developed by central policy authorities who require the audits to perform their oversight responsibilities.

For DOS PKI:

• Current version of U.S. Department of State (DOS) Public Key Infrastructure (PKI) X.509 Certificate Policy (available from DOS PKI Program Manager)

• Current version of X.509 Certificate Policy for the U.S. Federal PKI Common Policy Framework, (https://www.idmanagement.gov)

• Current version of Federal Public Key Infrastructure (FPKI) Annual Review Requirements (https://www.idmanagement.gov)

For DOS IPKI:

• Current version of U.S. Department of State (DOS) Internal Public Key Infrastructure (IPKI) X.509 Certificate Policy (available from DOS PKI Program Manager once an approved version becomes available)

For DOS CPKI:

• Current version of CNSSI 1300 Instruction for National Security Systems Public Key Infrastructure X.509 Certificate Policy (https://www.cnss.gov)

• Current version of National Security Systems (NSS) Public Key Infrastructure (PKI) Member Governing Body (MGB) Bylaws (available from DOS PKI Program Manager)

For DOS CIPKI:

• Current version of DOS X.509 Certificate Policy for the DOS GrayNet PKI and DOS ClassNet Internal PKI (available from DOS PKI Program Manager)

For DOS GPKI:

• Current version of DOS X.509 Certificate Policy for the DOS GrayNet PKI and DOS ClassNet Internal PKI (available from DOS PKI Program Manager)

For DOS MRTD PKI:

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 13 of 32 8/2/23

• Current version of DOS Machine Readable Travel Document X.506 Certificate Policy (available from DOS PKI Program Manager)

1.6 PKI FACILITY VISITS REQUIRED FOR PKI COMPLIANCE AUDITS

Table 1-1 identifies Datacenter locations hosting DOS PKI systems and operations, and locations hosting Registration Services. Auditor visits to these locations are required to perform the PKI Compliance Audits.

Table 1-1 Facility Visits Required to Perform PKI Compliance Audits

Type of Facility Name and Location

Datacenter Location Hosting PKI Systems and Operations

Beltsville Information Management Center (BIMC) Facility (Beltsville, MD)

Datacenter Location Hosting PKI Systems and Operations

Enterprise Server Operations Center West (ESOC W) Facility (Denver, CO)

Datacenter Location Hosting PKI Systems and Operations

State Annex 7B (SA-7B) PKI Strong Room - Remote Administration (Springfield, VA)

Datacenter Location Hosting PKI Systems and Operations

PIV Card Management System (IDMS/CMS) Facility (Alexandria, VA) [Only required for DOS PKI Audits]

Datacenter Location Hosting PKI Systems and Operations

PIV Card Management System (IDMS/CMS) Location (Arlington, VA) [Only required for DOS PKI Audits]

Location Hosting Registration Services Registration Services - State Annex 7B (SA-7B) (Springfield, VA)

Locations Hosting Registration Service PIV Card Issuing Facility (PCIF) (Washington, DC Metropolitan Area) [Only required for DOS PKI Audits]

Locations Hosting Registration Service Derived PIV Card Issuing Facility (DPCIF) (Washington, DC Metropolitan Area) [Only required for DOS PKI Audits]

Locations Hosting Registration Service IT Mart - (Rosslyn, VA)

Locations Hosting Registration Service IT Mart - Harry S. Truman (HST) Facility (Washington, DC)

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 14 of 32 8/2/23

2 CONTRACT PERIOD OF PERFORMANCE

2.1 PERIOD COVERED BY THIS SOW

This Statement of Work covers a period of five (5) years. The audit services specified for each Contract Year must be delivered during the following U.S. Federal Government Fiscal Year as indicated in Table 1-1 below

Table 2-1 Period Covered by this SOW

Contract Year

Time Period During Which the Contracted Audit Services Must be Delivered

Fiscal Year From To

2023 FY 2024 October 1, 2023 September 30. 2024

2024 FY 2025 October 1, 2024 September 30. 2025

2025 FY 2026 October 1, 2025 September 30. 2026

2026 FY 2027 October 1, 2026 September 30. 2027

2027 FY 2028 October 1, 2027 September 30. 2028

2.2 TYPICAL DURATION OF AUDIT SERVICES BY TYPE

The typical duration for each type of Audit Service is provided in Table 2-2 below. The typical durations indicated in the table reflect the DOS’s past experience on the total period of time these activities take to complete, given all the steps in each activity and the numerous interactions between the DOS and the audit services provider. The actual time of involvement of the audit services provider is significantly less.

Table 2-2 Typical Duration for Each Type of Audit Service

Audit Service Type Typical Duration

Full PKI Compliance Audits for a PKI 9 months from the start date

Zero-Day or Initial PKI Compliance Audits for a new

CA

6 months from the start date

Witnessing a Key Generation Ceremony 4 months from the start date

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 15 of 32 8/2/23

Audit Service Type Typical Duration

Termination and Archive of an Operational CA 4 months from the start date

Special Audits To be determined based on Audit requirement

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 16 of 32 8/2/23

3 AUDIT SERVICES FOR CONTRACT YEAR 2023

3.1 REQUIRED AUDIT SERVICES FOR CONTRACT YEAR 2023

The Audit Services required for Contract Year 2023 are identified in Tables 3-1 through 3-5 below.

Table 3-1 DOS PKI Audit Services Required for Contract Year 2023

PKI

Audited Certificate Authority

(CA)

Governing Certificate Policy (CP)

Governing Certification

Practices Statement

(CPS)

Audit Service Required

Operational Period

Covered by Audit

Comments

FPKI FULL COMPLIANCE AUDIT OF FY 2023

DOS PKI AD Root CA DOS PKI CP DOS PKI CPS (Single CPS governs all DOS PKI CAs)

Full PKI Compliance Audit

FY 2023 This Audit Service will be initiated during FY 2024 and have a typical duration of 9 months.

AD HACA DOS PKI CP DOS PKI CPS

(Single CPS governs all DOS PKI CAs)

Full PKI Compliance Audit

FY 2023

PIV CA2 FCPF CP (for

PIV)

and

DOS PKI CPS

(Single CPS governs all DOS PKI CAs)

Full PKI Compliance Audit

FY 2023

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 17 of 32 8/2/23

PKI

Audited Certificate Authority

(CA)

Governing Certificate Policy (CP)

Governing Certification

Practices Statement

(CPS)

Audit Service Required

Operational Period

Covered by Audit

Comments

DOS PKI CP

(for non-PIV)

DPC CA FCPF CP (for Derived-PIV)

DOS PKI CPS

(Single CPS governs all DOS PKI CAs)

Full PKI Compliance Audit

FY 2023

DOS PKI PIV CA2 RE-KEY KEY GENERATION CEREMONY AUDIT

DOS PKI PIV CA2 FCPF CP (for

PIV)

and

DOS PKI CP

(for non-PIV)

DOS PKI CPS

(Single CPS governs all DOS PKI CAs)

CA Re-key Key Generation Ceremony Audit

N/A

(KGC)

This Audit Service will be initiated during FY 2024 duration of 4 months.

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 18 of 32 8/2/23

Table 3-2 DOS CPKI Audit Services Required for Contract Year 2023

Audited Certificate Authority

(CA)

Governing Certificate Policy (CP)

Governing Certification

Practices Statement

(CPS)

Audit Service Required

Operational Period

Covered by Audit

Comments

NSS PKI FULL COMPLIANCE AUDIT OF FY 2023

DOS

CPKI

CPKI SHA-

256 CA

NSS PKI CP

DOS CPKI CA

CPS

(Single CPS governs all CPKI CAs)

Full PKI Compliance Audit

FY 2023 This Audit Service will be initiated during FY 2024 duration of 9 months.

NSS PKI TERMINATION & ARCHIVE OF DOS CPKI SHA-1 CA

DOS

CPKI

CPKI SHA-1

CA

NSS PKI CP

DOS CPKI CA

(Single CPS governs all CPKI CAs)

Termination and Archive of CA

N/A (Termination & Archive))

This Audit Service will be initiated during FY 2024 duration of 4 months.

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 19 of 32 8/2/23

Table 3-3 DOS CIPKI Audit Services Required for Contract Year 2023

Audited Certificate Authority

(CA)

Governing Certificate Policy (CP)

Governing Certification

Practices Statement

(CPS)

Audit Service Required

Operational Period

Covered by Audit

Comments

DOS CIPKI FULL COMPLIANCE AUDIT OF FIRST YEAR OF OPERATIONS

CIPKI

CIPKI Root

DOS GPKI

and CIPKI CP and CIPKI

CPS

(Single CPS governs all CIPKI CAs)

Full PKI Compliance Audit

First Year of Operation (December 2022 through December 2023)

This Audit Service will be initiated during FY 2024 and have a typical duration of 6 months, when combined with the DOS GPKI Full Compliance Audit below.

CIPKI CA DOS GPKI

CPS

(Single CPS governs all CIPKI CAs)

Full PKI Compliance Audit

First Year of Operation (December 2022 through December 2023)

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 20 of 32 8/2/23

Table 3-4 DOS GPKI Audit Services Required for Contract Year 2023

Audited Certificate Authority

(CA)

Governing Certificate Policy (CP)

Governing Certification

Practices Statement

(CPS)

Audit Service Required

Operational Period

Covered by Audit

Comments

DOS GPKI FULL COMPLIANCE AUDIT OF FIRST YEAR OF OPERATIONS

GPKI

GPKI Root

CPS

(Single CPS governs all CIPKI CAs)

Full PKI Compliance Audit

First Year of Operation (December 2022 through December 2023)

This Audit Service will be initiated during FY 2024 and have a typical duration of 6 months, when combined with the DOS CIPKI Full Compliance Audit below.

GPKI CA DOS GPKI

CPS

(Single CPS governs all CIPKI CAs)

Full PKI Compliance Audit

First Year of Operation (December 2022 through December 2023)

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 21 of 32 8/2/23

Table 3-5 DOS MRTD PKI Audit Services Required for Contract Year 2023

Audited Certificate Authority

(CA)

Governing Certificate Policy (CP)

Governing Certification

Practices Statement

(CPS)

Audit Service Required

Operational Period

Covered by Audit

Comments

DOS GPKI FULL COMPLIANCE AUDIT OF FIRST YEAR OF OPERATIONS

DOS

MRTD

MRTD Root

CSCA CA

DOS MRTD

CP

DOS MRTD

(Single CPS governs all CIPKI CAs)

Full PKI Compliance Audit

FY 2023 This Audit Service will be initiated during FY 2024 duration of 6 months,

3.2 OPTIONAL AUDIT SERVICES FOR CONTRACT YEAR 2023

Optional Audit Services that may be required for Contract Year 2023 are identified in Table 3-6 below.

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 22 of 32 8/2/23

Table 3-6 Optional Audit Services for Contract Year 2023

PKI

Audited Certificate Authority

(CA)

Governing Certificate Policy (CP)

Governing Certification

Practices Statement

(CPS)

Audit Service Required

Operational Period

Covered by Audit

Comments

DOS CIPKI NEW CA KEY GENERATION CEREMONY AUDIT

CIPKI

CIPKI Root

CPS

(Single CPS governs all CIPKI CAs)

Key Generation Ceremony – New

CA

N/A

(KGC)

This Audit Service may be initiated during FY 2024 and have a typical duration of 4 months, CIPKI CA DOS GPKI

CPS

(Single CPS governs all CIPKI CAs)

Key Generation Ceremony – New

CA

N/A

(KGC)

DOS GPKI NEW CA KEY GENERATION CEREMONY AUDIT

DOS

GPKI

GPKI Root

CA

CPS

(Single CPS governs all CIPKI CAs)

Key Generation Ceremony – New

CA

N/A

(KGC)

This Audit Service may be initiated during FY 2024 duration of 4 months, SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 23 of 32 8/2/23

Audited Certificate Authority

(CA)

Governing Certificate Policy (CP)

Governing Certification

Practices Statement

(CPS)

Audit Service Required

Operational Period

Covered by Audit

Comments

GPKI CA DOS GPKI

CPS

(Single CPS governs all CIPKI CAs)

Key Generation Ceremony – New

CA

N/A

(KGC)

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 24 of 32 8/2/23

4 PRICING AUDIT SERVICES

4.1 PRICING FOR REQUIRED AND OPTIONAL AUDIT SERVICES

During each Contract Year the DOS will specify:

• The Required Audit Services for that contract year, and

• The Optional Audit Services that may be required for that contract year.

The Bidder will submit a proposed price for each Required Audit Service identified for that contract year identified in Table 3-1 through Table 3-5 above.

In addition, the Bidder will submit a proposed price for each Optional Audit Service identified for that contract year identified in Table 3-6 above. The DOS may choose to acquire or not acquire any of the optional audit services during the fiscal year.

4.2 UNANTICIPATED REQUIREMENTS

During any contract year, there may be unanticipated requirements for additional audit services during that contract year.

When this situation occurs, the DOS will provide a SOW for the additional audit services, and the Bidder will submit a proposed price for the additional services. The DOS may choose to accept the proposal or reject it and may contract for the additional services via a separate contract with another party.

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 25 of 32 8/2/23

5 AUDITOR QUALIFICATIONS

The Auditor(s) providing the audit services specified in this SOW must meet the following qualifications:

• Perform audits as a regular ongoing business activity,

• Demonstrate competence in the field of PKI compliance audits - there must be a history of performing PKI compliance audits that spans several years,

• Be thoroughly familiar with the requirements of the CP(s) and CPS(s) associated with the audit performed,

• Provide attestations of independence from the audited organization, and

• Have the required active Department of Defense (DoD) Secret clearance.

To ensure independence from the audited organization, the compliance auditor shall either be a private firm that is independent from the entity responsible for the DOS PKIs or shall be sufficiently separated organizationally from the entity responsible for the DOS PKIs to provide an unbiased, independent evaluation. The compliance auditor shall not have participated in the operations of the DOS PKIs nor in the development or maintenance of the DOS PKI policies, practices or procedures that will be audited.

Note:

• The Federal PKI Policy Authority (FPKIPA) reserves the right to review the qualifications and experience of any auditor whose opinion letter is submitted as part of a DOS PKI Compliance Audit Review.

• The NSS PKI MGB reserves the right to review the qualifications and experience of any auditor who performs an audit of DOS CPKI CAs as part of a DOS CPKI Compliance Audit Review.

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 26 of 32 8/2/23

6 ANNUAL PKI COMPLIANCE AUDIT REQUIREMENTS

The Auditor(s) providing the audit services specified in this SOW shall comply with the requirements stated in this section.

6.1 AUDIT METHODOLOGY

This SOW does not specify the audit methodology to be used; however, if a specific methodology is used, it must be identified in the Audit Opinion Letter.

6.2 DOCUMENTATION REVIEW

Regardless of the audit methodology used, the following documentation shall be included in the review:

• Current CP(s) and CPS(s): The auditor shall verify that each CPS defines practices that implement the requirements of the governing CP(s) in a satisfactory manner.

Deficiencies found shall be identified in the Audit Report. [For the DOS CPKI, the NSS MGB determines the compliance of the DOS CPKI CA CPS with the CNSSI 1300

(NSS PKI CP.]

• PIV Test Reports: For PIV Issuers, a sample production card for each configuration issued must successfully pass the General Services Administration (GSA) Federal Information Processing Standards (FIPS) FIPS 201 Evaluation Program annual card testing. The auditor shall obtain and document what test reports were provided as evidence that this testing was satisfactorily performed during the 12-month audit period. [Applies to audits of the DOS PKI.]

• Current Memorandum of Agreement (MOA): The auditor shall verify that a current MOA has been executed between the DOS PKI and the FPKIPA, and that the DOS PKI is complying with all provisions and obligations detailed in the MOA. A statement to this effect should be included in the Audit Opinion Letter. [Applies to audits of the DOS PKI.] o Note: If any DOS PKI maintains MOA(s) with other organizations, these are also within the audit scope and must be reviewed for compliance.

• Last Previous Annual Audit Opinion and Findings: All audits shall include a review of the previous annual audit opinion and findings, and verification that the remediation of the findings was completed satisfactorily.

6.3 REVIEW OF OPERATIONS

The Auditor shall review PKI operations for conformity to applicable CPS(s). Deficiencies found shall be identified in the Audit Report. This review should include onsite inspection of facilities, observation of the performance of operational activities, interviews with operational personnel, inspection of operational documentation and records (e.g., manuals, training materials, forms, logs, etc.), and management of records.

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 27 of 32 8/2/23

6.4 USE OF SAMPLING

Sampling may be used as allowed by policy, provided that the details of the sampling are agreed to in writing by the DOS PKI Program Manager/Agency NSS PKI Management Authority for the DOS CPKI and the Auditor. If the auditor uses sampling, all PKI components, PKI component managers, and operators to which the sampling applies shall be considered in the sample. All such samples will vary on an annual basis, such that the entire complement of components, managers and operators undergoes auditing within a timeframe to be established in the applicable CP/CPS/MOA. Each year, previous sampling results will be reviewed, with an emphasis on determining whether discrepancies and deficiencies have been rectified.

6.5 PRIOR AUDIT FINDINGS AND CORRECTIVE ACTIONS

The auditor shall review previous compliance audit findings with an emphasis on determining whether the findings have been addressed and satisfactorily rectified.

6.6 AUDIT OPINION LETTER

The audit opinion letter shall comply with the following checklist:

Table 6-1 Audit Opinion Letter Compliance Checklist

Category Requirement Description

General Signature The Audit Opinion Letter shall be addressed to the participating PKI Policy Management Authority (PMA)/Agency NSS PKI Management Authority (ANMA) and shall be signed by the auditor.

NOTE: The signature may be the corporate signature of the audit firm or the signature of the head of the independent office within the participating PKI organization (e.g., the organization’s Inspector General)

Auditor Background Information

Identity Identity of the Auditor(s) and the individuals performing the audit.

Competence Competence of the Auditor(s) to perform compliance audits as required by the applicable CP(s) and CPS(s).

Experience Experience of the individuals performing the audit in auditing PKI systems as required by the applicable CP(s) and CPS(s).

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 28 of 32 8/2/23

Table 6-1 Audit Opinion Letter Compliance Checklist

Category Requirement Description

Objectivity Relationship of the Auditor(s) to the participating PKI and the organization operating the component(s) being audited. This relationship must clearly demonstrate the independence of the Auditor(s) as required by the applicable CP(s) and CPS(s) and this

SOW.

Audit Scope Date Performed The audit performance start and completed date

Period of Performance The period of performance the audit covers.

Audit Methodology Whether a particular methodology was used, and if so, what methodology.

Note: If a “Web Trust for CA” audit methodology was used, a statement regarding management assertions must also be included.

PKI Components in Scope

Which entity PKI component(s) were audited (CAs, CSSs, CMSs, and RAs).

Documents Reviewed Which documents were reviewed as a part of the audit, including document dates and version numbers.

If portions of the PKI Policy are documented separately from the CP (e.g. a separate Key Recovery Policy & Practice Statement) these documents must also be reviewed as part of the audit.

Audit Results

Statements Concerning the Audit

A statement that the operations of the audited component(s) were evaluated for conformance to the requirements of its CPS.

A statement that CPS was evaluated for conformance to the associated CP. [Not required for audits of the DOS CPKI, unless specifically requested by the

DOS.]

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 29 of 32 8/2/23

Category Requirement Description

If applicable (always applicable for the cross-certified PKI’s Principal CA), a statement that the operations of the component(s) were evaluated for conformance to the requirements of all cross-certification Memorandum of Agreement (MOAs) executed by the participating PKI with other entities.

Audit Results (Continued)

Findings Report any and all findings related to the evaluation of the operational conformance of the audited component(s) to the applicable CPS(s).

Report any and all findings related to the evaluation of the CPS(s) for conformance to the associated CP(s).

If applicable (always applicable for the cross-certified PKI’s Principal CA), report any and all findings related to the evaluation of the component(s) conformance to the requirements of all cross-certification MOAs executed by the participating PKI.

Report whether sufficient documentary evidence was obtained, reviewed, and included with the audit package. [E.g., for audits of the DOS PKI:

• Delta Mapping

• Annual Certificate Testing

• FIPS 201 Evaluation Program annual PIV/PIV-I

Card Testing

• Current MOA]

Closure of Previous Audit Cycle Findings

If applicable (always applicable if there were any findings reported the previous audit), state that any findings from the previous audit were reviewed for closure.

Summary of Changes If applicable (most likely applicable if there were any change proposals to the corresponding CP (e.g., FCPF CP, NSS PKI CP), state whether a summary of changes from the previous year was provided.

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 30 of 32 8/2/23

Category Requirement Description

Opinion Provide an audit opinion concerning the sufficiency of the PKI operations in relation to the corresponding CP(s) and CPS(s).

6.7 AUDIT REPORT

The Auditor shall submit a comprehensive Audit Report that documents the Audit and identifies and describes all findings and recommendations in detail.

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 31 of 32 8/2/23

7 AUDITOR DELIVERABLES

The Auditor Deliverables for each Full, Zero Day, and Initial PKI Compliance Audit are:

• Presentation for Audit Kick-off Meeting for the Contract Year,

• Letter to the DOS Requesting PKI Documentation,

• Initial Identification of Audit Findings and Recommendations,

• Draft CP-CPS mapping report*,

• Draft Audit Report,

• Draft Audit Opinion Letter,

• Final CP-CPS mapping report*,

• Final Audit Report,

• Final Audit Opinion Letter, and

• Support to DOS during the FPKI or NSS PKI MGB review of the relevant Audit

Opinion Letter.

* Note: For Full and Initial NSS PKI Compliance Audits of DOS CPKI CAs, Auditor performance of CP-CPS mappings are not required since the NSS PKI Member Governing Body is responsible for reviewing and approving CP-CPS mappings.

The same set of Auditor Deliverables are required for Full PKI Compliance Audits, for Zero Day Audits, and Initial Audits, except that the audit of operations will be limited for Zero Day Audits and Initial Audits due to absence of an operational history and records for the new CAs.

The deliverables for Witnessing Key Generation Ceremonies are:

• Review of the Key Generation Ceremony Script

• Witnessing the Key Generation Ceremony Document

• Key Generation Ceremony Report

The deliverables for Termination and Archive of an Operational CA are:

• Review of the shutdown and archive plan, checklists and any scripts

• Witnessing the shutdown and archiving activity (if required)

• Shutdown and Archive Report (if required)

SOW for 2023-2027 DOS PKI Audit Services Contract v1.0 (20230802) Page 32 of 32 8/2/23

8 SCHEDULES

Once the contract for the Contract Year is awarded, the DOS PKI Program Manager in consultation with the Auditor will establish target start and completion dates for each audit services action/event/deliverable. The resulting schedule will be maintained by the DOS and used to track progress of the delivery of audit services. If unanticipated factors impact adherence to this schedule, the DOS in consultation with the Auditor shall revise this schedule document, as required.

The DOS will make all personnel, facilities, documentation, and other resources available to the Auditor in a timely manner.

Local facility procedures, DOS policies, and Auditor policies shall permit the Auditor access to the relevant DOS facilities and personnel.