2-2--ADOT_ECD_DLSSU_RFP--NEC_Solution_Adherence_FINAL_2022-04-18.pdf

An NEC Response to the Arizona Department of Transportation – Enforcement and Compliance Division ECD Drivers License Security Software RFP – BPM004292

Section 2 – Solution Adherence

Page 2-1

2 Solution Adherence RFP Reference: APP Portal, Financial Questionnaire, Proposal Requirements for Method of Approach, Solution Adherence

Standards form the basis for ensuring solution quality, interoperability, and security. In support of the goal of providing our customers the best-in-class solutions, NEC has obtained several core formal certifications relative to the ADOT solution, as well as incorporated multiple national and international technical standards as part of our core development.

NEC has also reviewed the policies listed at https://aset.az.gov/policies-standards-and-procedures. NEC will work with ADOT to determine which standards are relevant to the ADOT solution and ensure we comply as part of our implementation and support services. Based upon our perusal these include the following, at a minimum:

• 1100 Cloud First

• 1250 Website and Application Design

• 1300 Accessibility of Electronic or Information Technology

• 1360 Information Technology Planning

• 4465 State-Owned Cloud Data

• 8120 Information Security Program

• 8210 Security Awareness Training and Education

• 8230 Contingency Planning

• 8280 Acceptable Use

• Arizona NIST Baseline Security Controls

2.1 Formal Certifications

As part of NEC’s continuous improvement process as well as our dedication to customer satisfaction and data security, NEC has undergone formal ISO certification for both quality management (ISO 9001) and Information Security Management (ISO 27001) as certification of our secure hosting services through SOC 2. These certifications ensure we have established and follow the best industry practices as part of our development, implementation, and support services.

2.1.1 ISO 9001:2015 Quality Management System Certification

NEC’s belief in continual process improvement has led to the implementation of our ISO 9001:2015 Quality Management System (QMS). NEC’s implementation of QMS provides oversight, control, and management of quality across all aspects of our MBIS deliveries. NEC uses documented processes against pre-defined quality metrics to ensure high quality deliverables are produced. Furthermore, NEC's QMS is driven by customer insight, improvement, and engineering excellence.

https://aset.az.gov/policies-standards-and-procedures

Page 2-2

In conjunction with our Integrated Quality Management (IQM) initiative, NEC sought independent verification of our quality process improvements. Engaging outside industry consultants, NEC revamped, streamlined, and improved our processes for software delivery. The result of this year-long effort was the successful completion of multiple audits by an ISO registrar and our certification as an ISO 9001:2015–certified company on January 13, 2020.

The scope of NEC's QMS will directly govern the implementation of the ADOT ECD DLSS project.

Table 2-1: NEC's QMS Scope

Area Scope

Organization NEC Corporation of America, Advanced Recognition Systems division

Location Rancho Cordova, California

Customers The QMS will support commercial, state, local, and municipal clients.

Processes The core processes included within the Product Development Lifecycle phases include Solutions Engineering, Documentation, Training, Systems Engineering, Development, Quality Assurance, and Project Management.

Products Integra-ID® and NeoFace® platforms

While other vendors have leverage outdated ISO 9001:2008 certifications from their manufacturing facilities, NEC took a purist approach to quality verification. Our processes were designed with the current ISO standards for quality: ISO 9001:2015. These processes went live in August 2019 and have proven beneficial to customer satisfaction. The QMS provides our biometrics organization the ability to consistently provide products and services that meet customer and applicable statutory and regulatory requirements, while enhancing customer satisfaction.

The effective application of the QMS, including processes for improvement of the system and the assurance of conformity to customer requirements, results in the highest levels of customer satisfaction. An overview of NEC’s QMS process is shown in the following figure.

Page 2-3

* * * B E G I N C O N F I D E N T I A L I N F O R M A T I O N * * *

Figure 2-1: ARS Quality Management System

* * * E N D C O N F I D E N T I A L I N F O R M A T I O N * * *

2.1.2 ISO 27001:2013 Information Security Management Systems

Certification

The protection of information assets is vital to the success of each project. To this end, NEC has established an ISO 27001:2013-compliant Information Security Management System (ISMS) that ensures all customer data is protected. The ISMS is continually improved to meet evolving business needs by setting new objectives and regularly reviewing our processes. All ARS activities are governed by NEC corporate-level security policies and procedures. It is ARS's policy to adhere to these standards and to proactively ensure compliance.

Page 2-4

2.1.3 SOC 2 Certification

Beginning in 2016, NEC sought independent verification of its Hosting and Service Delivery product offerings to ensure that NEC fulfills all requirements for customer data security and protects the interests of customer organizations and the privacy of our clients. NEC worked with outside industry consultants for review and process improvement and development. In 2017, NEC engaged an independent certified audit agency to review and verify NEC’s processes and commitment for the purpose of SOC 2 certification. Auditors assessed NEC’s compliance with five key trust principles based on the systems and processes in place. To achieve this compliance, NEC was measured against approximately 120 different metrics as applied to the five key trust principles:

• Security

• Availability

• Processing Integrity

• Confidentiality

• Privacy

Since 2017, NEC has participated in annual independent audits and been found 100% compliant with all SOC 2 metrics.

2.2 Technical Standards and Compliance

In addition to NEC’s formal certifications, NEC’s proposed solution incorporates the inclusion of national and international standards covering the ability to transmit, receive, process, and store biometric records and personally identifiable information (PII) data. The following is a list of relevant standards that we adhere to.

Biometric Capture and Image Processing Standards:

• American National Standards Institute/National Institute of Standards and Technology (ANSI/NIST), "NIST Special Publication 500-290, Edition 3 (2015), ANSI/NIST-ITL 1-2011 Update: 2015, American National Standard for Information Systems – Data Format for the Interchange of Fingerprint, Facial & Other Biometric Information," dated December 2015 and approved July 2016.

• International Organization for Standardization and International Electrotechnical Commission, Joint Photographic Experts Group (JPEG), "ISO/IEC 10918-1:1994, Information technology – Digital compression and coding of continuous-tone still images: Requirements and Guidelines," dated February 1994.

• International Organization for Standardization and International Electrotechnical Commission, Joint Photographic Experts Group (JPEG), “ISO/IEC 15444-1:2019, Information technology – JPEG 2000 image coding system – Part 1: Core coding system,” dated October 2019.

• NIST Best Practice and Face Pose Value Documents, “Best Practice Application Level 30 (Informative): Best Practice Recommendation for the Capture of Mugshots Version 2.0,” dated September 23, 1997.

• National Information Exchange Model (NIEM) – Information Exchange Package Documentation (IEPD) Specification Version 5.1, December 2021.

• American National Standards Institute, International Committee for Information Technology Standards, “ANSI/INCITS 385-2004[R2014]: Information Technology – Face Recognition Format for Data Interchange,” approved November 21, 2014.

https://www.nist.gov/publications/data-format-interchange-fingerprint-facial-other-biometric-information-ansinist-itl-1-1 https://www.nist.gov/publications/data-format-interchange-fingerprint-facial-other-biometric-information-ansinist-itl-1-1 https://www.nist.gov/publications/data-format-interchange-fingerprint-facial-other-biometric-information-ansinist-itl-1-1 https://www.iso.org/standard/18902.html https://www.iso.org/standard/18902.html https://www.iso.org/standard/78321.html https://www.iso.org/standard/78321.html https://www.nist.gov/system/files/documents/2021/03/18/ansi-nist_archived_2010_best_practice_face_pose_value.pdf https://www.nist.gov/system/files/documents/2021/03/18/ansi-nist_archived_2010_best_practice_face_pose_value.pdf http://niem.github.io/niem-releases/5.1/ http://niem.github.io/niem-releases/5.1/ https://standards.incits.org/apps/group_public/project/details.php?project_id=876

Page 2-5

• National Institute of Standards and Technology, “NIST Special Publication 500-280, Mobile ID Device Best Practice Recommendation, Version 2.1,” dated September 2016.

Encryption Standards:

• U.S. Department of Commerce, National Institute of Standards and Technology, “Federal Information Processing Standards (FIPS) Publication 140-3: Security Requirements for Cryptographic Modules,” dated March 22, 2019.

• U.S. Department of Commerce, National Institute for Standards and Technology, "NIST Special Publication 800- 52, Revision 2: Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations," dated August 2019.

• U.S. Department of Commerce, National Institute of Standards and Technology, “NIST Special Publication 800- 57 Part 1, Revision 5: Recommendation for Key Management – Part 1: General," dated May 2020.

• U.S. Department of Commerce, National Institute of Standards and Technology, "NIST Special Publication 800- 57 Part 2, Revision 1: Recommendation for Key Management: Part 2 – Best Practices for Key Management Organizations," dated May 2019.

• U.S. Department of Commerce, National Institute of Standards and Technology, “NIST Special Publication 800- 57 Part 3, Revision 1: Recommendation for Key Management, Part 3: Application-Specific Key Management Guidance,” dated January 2015.

• U.S. Department of Commerce, National Institute of Standards and Technology, "NIST Special Publication 800- 111: Guide to Storage Encryption Technologies for End User Devices," dated November 2007.

https://www.nist.gov/publications/mobile-id-device-best-practice-recommendation-version-21 https://www.nist.gov/publications/mobile-id-device-best-practice-recommendation-version-21 https://csrc.nist.gov/publications/detail/fips/140/3/final https://csrc.nist.gov/publications/detail/fips/140/3/final https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-57-part-2/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-57-part-2/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-57-part-2/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-57-part-3/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-57-part-3/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-57-part-3/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-111/final https://csrc.nist.gov/publications/detail/sp/800-111/final

2.2 Technical Standards and Compliance