Drone Services Attachment C - Requirements.v1.pdf

May 24, 2024 1 of 5

Attachment C RFP#357835

Functional and Technical Requirements Drone Services

ATTACHMENT C - TECHNICAL REQUIREMENTS

Updated July 8, 2024

(A) Req. Id

(B) Domain Area

(C) Description

(D) Type of

Requirement

(E) Priority

(F) Conforms

(Y/N)

(G) Reference to

Proposal Page # 1 Infrastructure Automatically recharge drone batteries Technical Must-have

2 Infrastructure Download video from port Technical Must-have

3 Infrastructure Temperature-controlled port with weather station/anemometer (safe to launch?)

Technical Must-have

4 Infrastructure Camera on drone port for security Technical Must-have

5 Infrastructure Is the port fenced and/or secure from tampering? Technical Must-have

6 Infrastructure Pad requirement and footprint (hardstand, gravel, concrete)

Technical Must-have

7 Infrastructure Network and power requirements Technical Must-have

8 Infrastructure Software? (Cybersecurity risk assessment approval) Technical Must-have

9 Infrastructure Port footprint (size?) Technical Must-have

10 Infrastructure Maintenance/repair/warranty program? Technical Must-have

11 Infrastructure Approved by DOE (components not made in China) Technical Must-have

12 Infrastructure Cameras capable of Thermal, Zoom, Lidar, etc. Technical Must-have

13 Infrastructure Size and payload limit Technical Must-have

14 Infrastructure Remote ID (FAA requirement 09/16/2023) Technical Must-have

15 Infrastructure Safety features (collision avoidance, etc.) Technical Must-have

16 Infrastructure Ability to aid first responders with a live look at the scene before their arrival

Technical Must-have

17 Infrastructure Live feed for privileged users Technical Must-have

18 Infrastructure Can take over control remotely if necessary Technical Must-have

May 24, 2024 2 of 5

(A) Req. Id

(B) Domain Area

(C) Description

(D) Type of

Requirement (E)

Priority

(F) Conforms

(Y/N)

(G) Reference to

Proposal Page

19 Infrastructure 10 sq. miles of site – Battery capacity and flight duration

Technical Must-have

20 Infrastructure Time for full battery recharge Technical Must-have

21 Infrastructure Maintenance/repair/warranty/exchange or upgrade program?

Technical Must-have

22 Security All network communications involving authentication must be encrypted.

Technical Must-have

23 Security Data must be encrypted at rest and in transit Technical Must-have 24 Security Must have sufficient security to prevent un-authorized users from accessing the system.

Technical Must-have

25 Security Vendor must be responsible for remediating security vulnerabilities in their solution.

Technical Must-have

26 Security Vendor must certify that they have processes in place to provide Fermilab with prompt notification of any potential data breaches (e.g., Fermilab is required to report any potential loss of PII to the Department of Energy within one hour).

Technical Must-have

27 Security Vendor must provide a detailed description of physical and logical security controls that are in place to ensure that only authorized personnel can access and manage applications, services and data.

Technical Must-have

28 Security Must have the capability to integrate with Fermilab’s existing Single Sign-On infrastructure to authenticate users. This authentication will be verified using the SAML 2 protocol and Fermilab’s Identity Provider.

Technical Must-have

29 Security Should support multifactor authentication. Technical Should-have 30 Security The solution vendor and all of its data storage facilities where Fermilab data will reside, including production and non-production tenants and those for Disaster Recovery, must be located in the United States.

Technical Must-have

31 System Must be able to assign an individual and backup to each incident category.

Technical Must-have

32 System Must have incident file search capabilities. Technical Should-have 33 System Must have the ability to assign individuals to investigative teams by incident category Technical Must-have

34 System Must have the ability to implement role-based access controls.

Technical Must-have

May 24, 2024 3 of 5

(B) Domain Area

(C) Description

(D) Type of

Requirement

(E) Priority

(F) Conforms

(Y/N)

(G) Reference to

Proposal Page

35 System Must provide controls so that users are only able to access information and data that are relevant to their role, and necessary to carry out their responsibilities

Technical Must-have

36 System Must provide the ability for Fermilab to retrieve its data and move off of chosen software.

Technical Must-have

37 System Must allow access from mobile devices such as iPad, Windows Tablet, Android, and Apple compatible with data display via supported web browsers.

Technical Must-have

38 System Must have configurable and customizable real time reporting capabilities.

Technical Must-have

39 System Must have the ability to configure internal workflow processes that define and track investigative processes, review/approval processes, and resolution status.

Technical Must-have

40 System Vendor must either have an existing Master Service Agreement (MSA) with Fermi Research Alliance, LLC (FRA) or be willing to negotiate and sign an interconnection agreement describing how access to data will be controlled and how data will be protected.

Technical Must-have

41 System Vendor must provide operations and configuration support for the system.

Technical Must-have

42 System Vendor must provide regular updates and patches to keep up with new technology and computing security issues.

Technical Must-have

43 System Must have the ability to add incident categories to the pre-defined category list.

Technical Must-have

44 Cybersecurity and Privacy The solution should provide capabilities for auditing the system (e.g. changes to the system, changes to the data, user role and responsibility reports for segregation of duties, access logs, etc.).

Technical Should-have

45 Cybersecurity and Privacy All solution Vendor(s) should have obtained Federal Risk and Authorization Management Program (FedRAMP) authorization OR be willing to commit to securing FedRAMP authorization or meet Fermilab cybersecurity standards associated with NIST by the Project go-live date

Technical Should-have

46 Cybersecurity and Privacy Disaster recovery must be the vendor's responsibility. Technical Must-have

May 24, 2024 4 of 5

(B) Domain Area

(C) Description

(D) Type of

Requirement (E)

Priority

(F) Conforms

(Y/N)

(G) Reference to

Proposal Page

47 Cybersecurity and Privacy The solution Vendor should execute a disaster recovery test on its service no less than once each year with a recovery point objective of one hour and a recovery time objective of twelve hours.

Technical Should-have

48 Cybersecurity and Privacy The solution Vendor must have policies defined for maintaining privacy and non-disclosure of any information collected.

Technical Must-have

49 Cybersecurity and Privacy The solution Vendor must inform Fermilab with sufficient details of a security plan and any certifications and audits that assure that their services are managed at an appropriate level of security.

Technical Must-have

50 Cybersecurity and Privacy Fermilab must complete a security risk assessment document and receive authority to operation on the selected product. The solution Vendor must be willing to work with Fermilab or be willing with appropriate documentation to share with Fermilab sufficient details of a risk assessment and security plan such as SOC2 report for their application and platform services that are used to comprise the service to assure that the services are managed at a level of security equivalent to that secured by using the recommended moderate level major application controls described in NIST Publication 800-53.

Technical Must-have

51 Data Fermilab must retain ownership of its data. Technical Must-have

52 Data The solution Vendor must address how Fermilab data can be exported from the system in the event of contract nonrenewal.

Technical Must-have

53 Data The solution Vendor must provide a standards-based capability to export laboratory data needed to support other systems, provide a backup of the data or obtain a full extract (e.g., SOAP, JSON, SQL, flat .csv file import, XML file import, database interface tables).

May 24, 2024 5 of 5

(B) Domain Area

(C) Description

(D) Type of

Requirement

(E) Priority

(F) Conforms

(Y/N)

(G) Reference to

Proposal Page

54 Data Access The solution Vendor must identify all parties who will have access to our data, including during upgrades and maintenance windows.

Technical Must-have

55 Integration The solution Vendor should deliver a standard out of the box integration (CCB Cloud Connect roles, etc.)

Technical Should-have

56 Service Design The solution Vendor must have an availability SLA of at least 98%.

Technical Must-have

57 Service Design The solution Vendor should have an SLA with well-defined response time, resolution time, and a specific procedure for handling incidents and requests. Please provide a copy of your standard SLA as part of your RFP Response

Technical Should-have

58 Service Design The proposed solution should use common application code and data definitions so that all clients running the same version of the solution are using the same code base.

Technical Should-have

59 Service Design The core SaaS services must be owned, delivered, and managed by the vendor. Support for the system software, databases, upgrades, and development are the responsibility of the vendor.

Definitions:

CCB – Cloud to Cloud Backup DOE – Department of Energy EG – For Example ETC – Et. Cetera FAA – Federal Aviation Administration ID – Identification JSON- JavaScript Object Notation NIST – National Institute of Standards and Technology PII – Personal Identifying Information RFP – Request for proposal SAML – Security Assertion Markup Language SaaS – Software as a service SLA – Service level agreement SOAP – Simple Object Access Protocol

SOC – Security Operations Center SQL – Structured query language XML – Extensible markup language