5-SCADA Appendix A, B and C.pdf

I .1 Appendix Ay- City of Dallas Technology Reference Architectureof Dallas Enterprise Reference Architecture | High Level Reference Diagram – V04 00

Technology Optimization & Transformation

Technology Transformation Services

Technology Technology Strategy Planning Governance

Service Service

Emerging Technology Emerging

Technology Best Practices &

Guidelines

Artificial Intelligence &

Machine Learning

IoT 5G Natural Language Understanding

5G Virtual Agent &

Technology Optimization Services

Business Relationship Management

Service

Business Requirements

Analysis Service

Enterprise Architecture

(EA)

Technology Reference Architecture Best Practices &

Guidelines

Technology Roadmap

Service Catalog

Architecture Governance

Standards & Guidelines

Project Management Office

(PMO)

Project Management

Project Frameworks

Project Metrics

Resource Capacity Mgmt

Remediation

November 2019

Structured Data

DATA SERVICES

Unstructured Data Data Governance

Business Intelligence

Data Analytics

Business Intelligence

Data Analytics

Master Data Management Data Quality

Data Visualization

Data Distribution

Data Visualization

Data Distribution Data Standards Data Security

Data Storage Enterprise GIS Service Data

Storage Data Operations

DIGITAL SERVICES

Web/Portal Services

Customer Service Platform** Enterprise Service Platform

Collaboration Chatbot

Digital Channels End Points

IoT Devices CRM Business to Business

Search Messaging Natural Language Business to Mobile Portable Devices

Email Video Customer Profile Peer to Peer Fixed Devices

Interfaces Application Services

Application Lifecycle Integration Middleware

**For example but not limited to these services

ENTERPRISE TECHNOLOGY INFRASTRUCTURE SERVICES

Network Services On‐Prem/Colocation Infrastructure Cloud Infrastructure Desktop

Virtualization Application

Virtualization Network

Virtualization Storage Virtualization

Block Based Virtualization

Cloud Service

Network Segmentation

Network Availability

Local File‐Based Virtualization Cloud Deployment

Model

Object‐Based Virtualization Portability and Interoperability

Server Virtualization Storage Virtualization Network Virtualization

Server Virtualization Network Build Block Based Virtualization

Cloud Provider

DataCenter Architecture

& Design

LAN File‐Based Virtualization

OS TPM

Virtualization Virtualization Session Based

WAN Object‐Based Virtualization OS TPM Virtualization Virtualization Session Based

Cloud Business Continuity and

Disaster Recovery

Network Space Virtualization Virtual Machine (Host based) Virtual Machine (Host based)

Server Application Streaming

Network Space Virtualization Client Application

Streaming Remote

Enterprise Information Security Services

IDENTIFY

Business Environment Governance

Risk Mgmt Strategy Risk Assessment

Asset Management

PROTECT

Access Control

Awareness Training

Information Protection Process and Procedures Maintenance

Data Security

DETECT

Anomalies and Security Events Monitoring

Detection Processes

RESPOND

Response Planning Communications

Analysis Mitigation

Improvements

RECOVER

Recovery Planning Communications

Improvements

IT Service Management

Service Strategy

Service Strategy Service Portfolio Management

Demand Mananagement

Business Relationship Management

Service Design

Service Level Management

IT Service Continuity

Disaster Recovery

Patch Mgmt

Service Transition

Change Release &

Management Deployment Management

Service Validation &

Testing

Improvement Strategy

Quality Assurance

Service Operation and Support

Access Management

Request Fulfillment

Incident Management

Problem Management

Event Management

Resource Management

Configuration Management

Knowledge Management

1.2 Appendix B - City of Dallas RFCSP Enterprise Security Framework and Standards

Enterprise Security Framework and Standards

To enable a common understanding of the security needs of the City of Dallas, an enterprise security framework was constructed. The framework relies upon readily recognizable operational security principles to facilitate communication.

Security Principles

IDENTIFY

PROTECT

DETECT

The security principles upon which the Enterprise Security Framework organize basic cybersecurity activities at their highest level. The principles are Identify, Protect, Detect, Respond, and Recover.

These principles were selected to aid an organization in expressing its management of cybersecurity risk by organizing information, enabling risk management decisions, and addressing threats.

City of Dallas Security Principles

To assist in communication, these principles have been defined as follows:

• Identify - Develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities

• Protect - Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services

• Detect - Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event

• Respond - Develop and implement the appropriate activities to take action regarding a detected cybersecurity event

• Recover - Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event

1. Enterprise Security Framework

The Enterprise Security Framework relies upon a generalized layered approach to focus attention to areas of concern to the City of Dallas. The four domains of the Security Framework are illustrated as follows:

2020 I Version 4.1 Technology Acquisition RFCSP

Structured Data

N�ril:Sl!rvkes

DAT., MAN.:\GEMENT SERVICES

Unstructured Data

Em,erpri.eSHwee'1«fonn

I .. ._ ........ l I .. _ ....... l I -�- l tnd,oina

�-�-�,_-a� ,�-..._-� l"erl.lll10-.. ( S,,,.,,tAp,pk>,t,or'6 I

I .... ,_a I Applc:ation Set'Yices

Appllallon 1.Jltcy'C11 1n1ea:r.11tlon M1ddltwart

On--Prem/Colocatlan Infrastructure Ooud Infrastructure security Management

Sen,lc:es

IDENTIFY

PROTtCT

DETECT

RESPOND

RECOVfR

( :::.� H�- l

• Data Management Services is dedicated to focusing on and protecting organizational data. All proposed technology solutions must map their data-centric security mechanisms to this layer as appropriate.

► Structured Data ► Untructured Data ► Data Governance

• Business Applciation Services is focused upon the secure and authorized delivery of data and information to achieve desired business outcomes. All proposed technology solutions that address infrastructure elements must map their security mechanisms to this layer as appropriate.

► Presentation Services ► Presentation Platforms ► Application Services

• Infrastructure Services is dedicated to the protection of infrastructure elements supporting business applications. All proposed technology solutions that address infrastructure elements must map their security mechanisms to this layer as appropriate.

► Network Services ► OnPrem/Colocation Infrastructure ► Cloud Infrastructure

• Security Services is focused upon the governance, management and operation of security mechanisms within the City. Standards and Compliance Services performs those activities such as risk assessment and risk management, threat and vulnerability management, infrastructure protection and security monitoring. All proposed technology solutions directly impacting or complementing security activities must map their security mechanisms to this layer as appropriate.

► Identify ► Protect ► Detect ► Respond ► Recover

All four domains of the Enterprise Security Framework are directed to the one goal of the protection of data and information. As with most security frameworks, the primary information security goals of the framework are Confidentiality, Integrity and Availability. These terms are defined as:

• Confidentiality - preserving authorized restrictions on access and disclosure, including means for protecting privacy and proprietary information.

• Integrity -guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity.

• Availability -ensuring timely and reliable access to -and use of- information.

When mapping security mechanisms to a domain, Proposers are encouraged to provide responses within the context of the previously identified security principles which underpin the City's Enterprise Security Framework.

2. Enterprise Security and Privacy Standards

Enterprise Security and Privacy Standards have been identified as necessary elements of any Security and Privacy Program for the City of Dallas and as such are designated as appropriate standards for use at the City of Dallas.

The following enterprise security standards are categorized by major frameworks or groupings for the convenience of Proposers that provide solutions and services within known frameworks or groupings of standards. All standards noted are applicable to all solution and services deployed and operated for the benefit of the City of Dallas.

FedRAMP NIST Standards

• SP 500-292: NIST Cloud Computing Reference Architecture

• SP 800-34 Revision I: Contingency Planning Guide for Federal Information Systems

• SP 800-37 Revision I: Guide for Applying the Risk Management Framework to Federal

Information Systems: Security Life Cycle Approach

• SP 800-39: Managing Information Security Risk: Organization, Mission, and Information

System View

• SP 800-53 Revision 4: Security and Privacy Controls for Federal Information Systems and Organizations

• SP 800-53a Revision 4: Guide for Assessing the Security Controls in Federal Information Systems and Organizations, Building Effective Security Assessment Plans

• SP 800-60 Revision I, Volume 1: Guide for Mapping Types of Information and Information Systems to Security Categories

• SP 800-60 Revision 1, Volume 2: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories

• SP 800-61 Revision 2: Computer Security Incident Handling Guide

• SP 800-86: Guide to Integrating Forensic Techniques into Incident Response

• SP 800-92: Guide to Computer Security Log Management

• SP 800-94: Guide to Intrusion Detection and Prevention Systems (!DPS)

• SP 800-115: Technical Guide to Information Security Testing and Assessment

• SP 800-122: Guide to Protecting the Confidentiality of Personally Identifiable

Information (PII)

• SP 800-128: Guide for Security-Focused Configuration Management of Information

Systems

• FIPS 140-2: Federal Information Processing Standard (FIPS) 140-2: Security

Requirements for Cryptographic Modules

• FIPS 199: Standards for Security Categorization of Federal Information and Information

Systems

• FIPS 200: Minimum Security Requirements for Federal Information and Information

Systems

• FIPS 201: Personal Identity Verification (PIV) of Federal Information and Information

Systems

• 0MB A-130: Office of Management and Budget (0MB) A-130

City of Dallas Extensions to FedRAMP

• SP 800-30, Revision 1: Risk Management Guide for Information Technology Systems

• SP 800-31 : Intrusion Detection Systems

• SP 800-35: Guide to Information Technology Security Services

• SP 800-50: Building an Information Technology Security Awareness and Training

Program

• SP 800-55, Revision 1: Performance Measurement Guide for Information Security

• SP 800-64: Security Considerations in the Information System Development Life Cycle

• SP 800-82: Guide to Industrial Control Systems (!CS) Security

• SP 800-83: Guide to Malware Incident Prevention and Handling for Desktops and

Laptops

• NISTIR 8062 (DRAFT): Privacy Risk Management for Federal Information Systems

1.3 Appendix C - City of Dallas RFCSP Data Management Strategy

Data Management Strategy

The City of Dallas requires access to its data whether stored on site, in a hosted or cloud-based solution or maintained by a third party. To this end, the City requires compliance with data management standards and requirements to facilitate continued cost-effective access to all forms of City data.

Data Management Standard Framework:

The City has adopted the Data Management Association's Guide to Data Management Body of Knowledge (DM BOK) as its data management framework.

Data Governance

Data Governance aspects for all data managed on-site or off-site must minimally include consideration for:

• Data Operations including backup, recovery, monitoring, performance, Disaster Recovery, and Business Continuity as related to database activity.

• Data Security including access control, encryption as required, data upload, data download, HIPAA, PII, CJIS, and other possible administrative or legal requirements

• Data Quality including use of City Geo verification, City GIS districts, use of City Shape files, and overall data consistency and integrity

• Data Master Data including use of standard look up data

• Data Meta Data including providing a Data Dictionary, an Entity Relation Diagram, and relevant data descriptions

• Data Availability including data reporting, extraction, inspection, review, migration, End of Contract data resolution, and identification and agreement regarding the final disposition of City data end of contract.

• Data Architecture

Database Management Systems

The City requires, where needed, that the vendor provide an industry standard Relational Database Management System that meets the needs of all other requirements within this document. These include but are not limited to:

• Security

• Data Integrity

• Backup and recovery ability to meet provided requirements for SLA and Disaster

Recovery

• Backup and Recovery to within SLA for data incidents where data recovery is required

• Performance characteristics to meet the required application SLAs as provided

• The ability to provide scheduled and ad hoc data extract requests

• The ability, if requested, to provide a periodically updated full copy of the database solution for storage and full data access at a location of the City's choosing

• The data should be available at the end of the contract period as an industry standard supported backup file type to allow the City to recover the data on a City location and have full access and use of the data within the database system.

The City understands that there is a multiplicity of database types now available that are not considered to be standard Relational Database Management Systems. These "NoSQL" or non relational systems may be presented as part of the proposal where their function is required to provide the required City service.

The City requires Proposers to provide:

• An Entity Relationship Diagram (ERO)

• A Data Dictionary including table name, column name, data type, length, any constraints, and default values, primary key/foreign key (to what tables and columns), how used in support of the solution.

Depending on data access parameters, other database technology solutions may be considered, if City data is accessible to its employees and delegates.