DNTS SIR Sect M2 - VRTM for Evaluation.pdf

Dedicated Network Telecommunications System (DNTS) SIR # 693KA8-24-R-00007

Shall Number

FAA-P-2978

Paragraph

Requirement Evaluation Sub-Factor

Verification Category

Test Case Impact

Categorization

1 3.1.a

The Dedicated Network Telecommunications System (DNTS) equipment shall(1) be scalable with options to configure any mix of interfaces from sections 3.1.2, 3.1.3 and/or Section 3.1.4 up to the aggregate capacity of the specified SONET Optical Interface.

1.1 Analyses A AOCX Critical

2 3.1.b The DNTS shall(2) provide an optional configuration providing a limited set of capabilities to include SONET OC-3, 100 BaseT, and any mix of Low Speed interfaces from 3.1.4.

1.1 Analyses A AOCX Critical

3 3.1.1.a The DNTS shall(3) be compliant with Telcordia GR-253 and ANSI T1.105 SONET specifications.

1.1 Analyses A AOCX Critical

4 3.1.1.b The DNTS shall(4) have optional configurations to function at the SONET OC-3 line rate.

1.1 Analyses A AOCX Critical

5 3.1.1c The DNTS shall(5) have optional configurations to function at the SONET OC-12 line rate.

1.1 Analyses A AOCX Critical

6 3.1.1.d The DNTS shall(6) have optional configurations to function at the SONET OC-48 line rate.

1.1 Analyses A AOCX Critical

7 3.1.1.e The DNTS shall(7) support transmission over single-mode fiber as specified in FAA-E-2761c.

1.1 Analyses A AOCX Critical

8 3.1.1.f The DNTS shall(8) support UPSR as specified in GR-1400. 1.1 Analyses A ACFG Critical

9 3.1.1.g The DNTS shall(9) operate with one or both optical transmitter/receivers enabled.

1.2 OCT Conduct D DFDC Critical

10 3.1.1.h When both transmitter/receivers are enabled the DNTS shall(10) provide for auto reconfiguration in accordance with UPSR.

1.1 Analyses A ACFG Critical

11 3.1.1.i In the event of loss of physical layer connectivity on one path between nodes with redundant fiber paths, the system shall(11) restore communications within 60 milliseconds.

1.2 OCT Conduct D DFDC Critical

12 3.1.1.j The transmitter’s peak emission wavelength shall(12) be 1310 nm ± 50 nm.

1.1 Analyses A ATEW Critical

13 3.1.1.k.1 The dynamic range of the transmitter/receiver shall(13) not be less than 13 dB for short or intermediate reach transmitter/receivers.

1.1 Analyses A ATEW Critical

14 3.1.1.k.2 The dynamic range of the transmitter/receivers shall(14) not be less than 25 dB for long reach transmitter/receivers.

1.1 Analyses A ATEW Critical

15 3.1.1.k.3 The maximum transmitter optical power output shall(15) not exceed the maximum allowable input power level of the receiver for short and intermediate reach transmitters.

1.1 Analyses A ATEW Major

16 3.1.2.a The DNTS shall(16) provide Structure-Agnostic Time Division Multiplexing (TDM) over Packet (SAToP) in accordance with IETF RFC 4553. 1.1 Analyses A AETH Major

17 3.1.2.b The DNTS shall(17) provide Circuit Emulation Service over Ethernet (CESoETH) in accordance with MEF 3

1.1 Analyses A AETH Major

18 3.1.2.c The DNTS shall(18) provide Circuit Emulation Service over Ethernet (CESoETH) in accordance with MEF 8.

1.1 Analyses A AETH Major

19 3.1.2.d The DNTS shall(19) provide Circuit Emulation Service over Packet Switched Network (CESoPSN) in accordance with IETF RFC 5086.

1.1 Analyses A AETH Major

20 3.1.2.e The DNTS shall(20) provide Multi-Protocol Label Switching – Transport Profile (MPLS-TP) in accordance with IETF RFC 5654.

1.1 Analyses A AETH Major

21 3.1.2.f The DNTS shall(21) provide Ethernet Linear Protection Switching (ELPS) in accordance with ITU-T G.8031. 1.1 Analyses A AETH Major

22 3.1.2.g The DNTS shall(22) provide Ethernet Ring Protection Switching (ERPS) in accordance with ITU-T G.8032. 1.1 Analyses A AETH Major

23 3.1.2.h The DNTS shall(23) provide Operation, Administration and Maintenance (OAM) in accordance with IEEE 802.3-2018.

1.1 Analyses A AETH Critical

24 3.1.2.i The DNTS shall(24) have the option to terminate a minimum of ten IEEE

802.3 10/100/1000BaseT circuits, each circuit independently configurable as Layer 1 or Layer 2.

1.2 OCT Conduct I PCTK Critical

25 3.1.2.j The DNTS shall(25) have optional configurations to provide a minimum of four Optical Gigabit Ethernet (GbE) circuits. 1.2 OCT Conduct D DCFG Critical

Attachment M-2- VRTM for Evaluation

M2-1

Number

FAA-P-2978

Paragraph

Requirement Evaluation Sub-Factor

Verification Category

Test Case Impact

Categorization

Attachment M-2- VRTM for Evaluation

26 3.1.2.k The DNTS shall(26) provide MSTP in accordance with IEEE 802.1q Clause 13.

1.1 Analyses A AETH Critical

27 3.1.2.l The DNTS shall(27) provide VLAN-aware bridging capability in accordance with IEEE 802.1q Cluase 5.

1.1 Analyses A AETH Critical

28 3.1.2.m Reserved #N/A

29 3.1.2.n

The DNTS shall(29) provide Virtual Bridged Local Area Networks in accordance with IEEE 802.1q Cluase 7. 1.1 Analyses A AETH Critical

30 3.1.2.o The DNTS shall(30) provide Hierarchical Quality of Service (QoS) in accordance with IEEE 802.1p.

1.1 Analyses A AETH Critical

31 3.1.2.p The DNTS shall(31) provide Unicast to Multicast conversion using Protocol Independent Multicast – Sparse Mode (PIM-SM) in accordance with IETF RFC 7761.

1.1 Analyses A AETH Critical

32 3.1.2.q The DNTS shall(32) support IPv6 for management functions and interfaces in accordance with IETF RFC 8200 and 8504.

1.1 Analyses A AETH Critical

33 3.1.2.r The DNTS shall(33) support IPv6 for packet transport in accordance with IETF RFC 8200 and 8504.

1.1 Analyses A AETH Critical

34 3.1.3.1 The DNTS shall(34) terminate a minimum of two ITU-T G.991.2 compliant SHDSL circuits.

1.2 OCT Conduct D DDIF Major

35 3.1.3.2.a The DNTS shall(35) terminate a minimum of four ANSI T1.403 compliant DS1 circuits.

1.2 OCT Conduct D DDIF Critical

3.1.3.2.b The T1/DS1 interfaces shall(36) provide Extended Super Frame (ESF) format as defined by ANSI T1.403.

1.2 OCT Conduct D DDIF Critical

37 3.1.3.2.c The T1/DS1 interfaces shall(37) provide Bipolar with 8-zero substitution (B8ZS) line code as defined by ANSI T1.403.

1.2 OCT Conduct D DDIF Critical

38 3.1.4.1.a The DNTS shall(38) provide ANSI/EIA/TIA-232F Type D compliant interfaces supporting Synchronous and Asynchronous communications.

1.2 OCT Conduct D DDIF Critical

39 3.1.4.1.b The DNTS ANSI/EIA/TIA-232F Interface Type D shall(39) be configurable to allow for any combination of control signals to be forced on, enabled or disabled.

1.2 OCT Conduct D DDIF Critical

40 3.1.4.1.c The DNTS ANSI/EIA/TIA-232F interface shall(40) use the 25-pin connector where Transmit Signal Element Timing (DTE – pin 24) is passed through the DNTS independent of the DNTS Timing.

1.2 OCT Conduct D DDIF Critical

41 3.1.4.2.a The DNTS shall(41) provide ANSI/EIA/TIA-422/530 compliant interfaces supporting Synchronous and Asynchronous communications. 1.2 OCT Conduct D DDIF Critical

42 3.1.4.2.b

The DNTS shall(42) provide ANSI/EIA/TIA-422 compliant interfaces using the 25 pin connector (EIA-530) where Transmit Signal Element Timing (DTE Source – pins 11 and 24) is passed through the DNTS independent of the DNTS Timing.

1.2 OCT Conduct D DDIF Critical

43 3.1.4.3 The DNTS shall(43) provide Digital Data Service (DDS) interfaces as defined by Telcordia PUB 62310.

1.2 OCT Conduct D DDIF Critical

44 3.1.4.4.a The DNTS shall(44) bridge one simplex ANSI/EIA/TIA-232F synchronous input to a minimum of five simplex ANSI/EIA/TIA-232F synchronous output circuits on the same DNTS (Figure 3-1).

1.2 OCT Conduct D DDIF Major

45 3.1.4.4.b

The DNTS shall(45) bridge one simplex ANSI/EIA/TIA-232F synchronous input over the network to output a minimum of 5 simplex ANSI/EIA/TIA- 232F synchronous output circuits on any node in the same ring (Figure 3- 2).

1.2 OCT Conduct D DDIF Major

46 3.1.4.5.a The DNTS shall(46) provide Ear and Mouth (E&M) Voice Frequency interfaces as defined by Telcordia PUB 43801.

1.2 OCT Conduct D DE&M Critical

47 3.1.4.5.b The DNTS shall(47) provide Foreign Exchange Service (FXS) Voice Frequency interfaces as defined by Telcordia PUB 43801.

1.2 OCT Conduct D DVFI Critical

48 3.1.4.5.c The DNTS shall(48) provide Foreign Exchange Office (FXO) Voice Frequency interfaces as defined by Telcordia PUB 43801.

1.2 OCT Conduct D DVFI Critical

49 3.1.4.5.d The DNTS shall(49) provide Private Line Automatic Ring down (PLAR) Voice Frequency interfaces as defined by Telcordia PUB 43801.

1.2 OCT Conduct D DVFI Critical

M2-2

Number

FAA-P-2978

Paragraph

Requirement Evaluation Sub-Factor

Verification Category

Test Case Impact

Categorization

Attachment M-2- VRTM for Evaluation

50 3.1.4.5.e.1 FXO and FXS interfaces shall(50) be configurable to 600 or 900 ohm impedance.

1.2 OCT Conduct D DVFI Critical

51 3.1.4.5.e.2 E&M interface shall(51) provide 600 ohm impedance.

1.2 OCT Conduct D DVFI Critical

52 3.1.4.5.f The audio transmission level for the E&M interfaces listed below shall(52) be adjustable over a range of –16.0 dBm to +7 dBm for 2-Wire circuits. 1.2 OCT Conduct D DE&M Critical

53 3.1.4.5.g The audio transmission level for the E&M interfaces listed below shall(53) be adjustable over a range of –16.0 dBm to +7 dBm for 4-Wire circuits. 1.2 OCT Conduct D DE&M Critical

54 3.1.4.5.h.1 The E&M interface shall(54) provide Type I signaling as defined by SR- 2275.

1.2 OCT Conduct D DE&M Minor

55 3.1.4.5.h.2 The E&M interface shall(55) provide Type II signaling as defined by SR- 2275.

1.2 OCT Conduct D DE&M Critical

56 3.1.4.5.h.3 The E&M interface shall(56) provide Type III signaling as defined by SR- 2275.

1.2 OCT Conduct D DE&M Minor

57 3.1.4.5.h.4

4) The E&M interface shall(57) provide Type IV signaling as defined by SR- 2275.

1.2 OCT Conduct D DE&M Critical

58 3.1.4.5.h.5 The E&M interface shall(58) provide Type V signaling as defined by SR- 2275.

1.2 OCT Conduct D DE&M Critical

59 3.1.4.5.i.1 The Voice Frequency Interfaces attenuation distortion shall(59) have a tolerance of -0.5 to 1.5 dB in the frequency range of 404 – 2804 Hz.

1.2 OCT Conduct D DE&M Critical

60 3.1.4.5.i.2 The Voice Frequency Interfaces attenuation distortion shall(60) have a tolerance of -0.5 to 4.5 dB in the frequency ranges of 304 – 403 and 2805 – 3004 Hz.

1.2 OCT Conduct D DE&M Critical

61 3.1.4.5.j The frequency shift for the Voice Frequency Interfaces shall(61) be less than or equal to 1.0 Hz.

1.2 OCT Conduct T TVFI Critical

62 3.1.4.5.k The envelope delay distortion for the Voice Frequency Interfaces shall(62) be less than or equal to 650 μsec. 1.2 OCT Conduct T TVFI Critical

63 3.1.4.5.l.1 The phase jitter for the Voice Frequency Interfaces shall(63) be less than or equal to 8° in the frequency range of 4 – 300 Hz.

1.2 OCT Conduct T TVFI Critical

64 3.1.4.5.l.2 The phase jitter for the Voice Frequency Interfaces shall(64) be less than or equal to 3° in the frequency range of 20 – 300 Hz.

1.2 OCT Conduct T TVFI Critical

65 3.1.4.6.a The DNTS shall(65) provide dry contact closure with output current rating of ≥ 1A

1.2 OCT Conduct D DDCC Critical

66 3.1.5.a

The DNTS system shall(66) provide an optional Primary Reference Source (Stratum 1) timing and synchronization compatible with the DNTS equipment and in accordance with:

1) ATIS-0900001

2) ATIS-0900101.2013

3) ATIS-0900105.09.2013

1.1 Analyses A ATMG Critical

67 3.1.5.b The DNTS shall(67) include a Stratum 3 or better internal clock. 1.1 Analyses A ATMG Critical

68 3.1.5.c The DNTS shall(68) accept timing from a Building Integrated Timing System (BITS) interface per GR-1244.

1.1 Analyses A ATMG Critical

69 3.1.5.d The DNTS shall(69) accept timing from a OC-N interface per GR-1244. 1.1 Analyses A ATMG Critical

70 3.1.5.e The DNTS shall(70) accept timing from an incoming DS1 interface per GR- 1244.

1.1 Analyses A ATMG Critical

71 3.1.5.f The DNTS DS1 interfaces shall(71) be synchronized with the selected timing source.

1.1 Analyses A ATMG Critical

72 3.1.6.a The DNTS shall(72) synchronize internal clocks every 24 hours with a common time source. 1.2 OCT Conduct D DCLK Major

73 3.1.6.b The DNTS shall(73) synchronize internal clocks to the common time source when the time difference is greater than 6 seconds.

1.2 OCT Conduct D DCLK Major

74 3.1.6.c The DNTS shall(74) support NTP.

1.2 OCT Conduct D DCLK Critical

M2-3

Number

FAA-P-2978

Paragraph

Requirement Evaluation Sub-Factor

Verification Category

Test Case Impact

Categorization

Attachment M-2- VRTM for Evaluation

75 3.1.7

It shall(75) be possible to network, in a ring configuration via optical fiber, as few as two and as many as sixteen DNTSs.

1.1 Analyses A AOCX Critical

76 3.1.8.a The DNTS shall(76) be configurable, using an IEEE 802.3 10/100/1000BaseT interface, by the FAA without manufacturer intervention.

1.2 OCT Conduct D DCFG Critical

77 3.1.8.b The DNTS shall(77) provide for additional circuits to be added by the FAA without manufacturer intervention. 1.2 OCT Conduct D DCFG Critical

78 3.1.9.a If the DNTS is software configurable, the configuration data shall(78) be preserved within the DNTS such that no single module failure will require the reentry of configuration files.

1.2 OCT Conduct D DCFG Critical

79 3.1.9.b The DNTS shall(79) internally preserve configuration data where in the event of a power failure the DNTS will fully restore services when power is restored.

1.2 OCT Conduct D DCFG Critical

80 3.1.9.c The DNTS shall(80) allow for the storage of configuration data to an external device that is not part of the DNTS, such as a hard drive on a laptop, for backup and restoral purposes.

1.2 OCT Conduct D DCFG Critical

81 3.1.9.d The DNTS shall(81) be capable of restoring configuration data from an external device.

1.2 OCT Conduct D DCFG Critical

82 3.1.10 The nominal BER attributable to the DNTS shall(82) be 1 x 10-9 or better. 1.2 OCT Conduct T TBER Critical

83 3.1.11 The DNTS shall(83) be fully functional, with all interfaces working within normal operating ranges, when the BER of the transport layer is no

1.2 OCT Conduct T TBER Major

84 3.1.12.a The DNTS shall(84) include built in self-test (BIST) functionality and provide results via SNMP, trap and queries

1.2 OCT Conduct D DBIT Minor

85 3.1.12.b BIST data shall(85) be identified by the network address of the unit to which it applies.

1.2 OCT Conduct D DBIT Minor

86 3.1.12.c The DNTS shall(86) have ability to discover node adjacencies.

1.2 OCT Conduct D DCFG Critical

87 3.1.12.d

The DNTS shall(87) failover to alternate processing equipment for any failure that affects system operations preserving normal or degraded operations.

1.2 OCT Conduct D DFDC Critical

88 3.1.13.a The DNTS shall(88) provide status via SNMP V3, both traps and SNMP Queries. 1.2 OCT Conduct D DCFG Critical

89 3.1.13.b The DNTS shall(89) indicate a minor alarm when a failure in any power supply module, in which the failure does not cause an outage. 1.2 OCT Conduct D DBIT Critical

90 3.1.13.c The DNTS BIST shall(90) provide status when optical received power is insufficient to sustain a BER of 1x10-6 or better.

1.2 OCT Conduct D DBIT Critical

91 3.1.13.d The DNTS BIST shall(91) indicate an I/O module failure status.

1.2 OCT Conduct D DBIT Critical

92 3.1.13.e The DNTS BIST shall(92) indicate a Node failure status.

1.2 OCT Conduct D DBIT Critical

93 3.1.13.f The DNTS BIST shall(93) indicate a Loss of Signal (LOS) status.

1.2 OCT Conduct D DBIT Critical

94 3.1.13.g The DNTS BIST shall(94) indicate a Loss of Frame (LOF) status.

1.2 OCT Conduct D DBIT Critical

95 3.1.13.h The DNTS BIST shall(95) indicate an Alarm Indication Signal (AIS) status.

1.2 OCT Conduct D DBIT Critical

96 3.1.13.j

As a minimum, the DNTS shall(96) accept, via contact closures, major and minor alarm inputs from external equipment connected to it. 1.1 Analyses A ACFG Major

M2-4

Number

FAA-P-2978

Paragraph

Requirement Evaluation Sub-Factor

Verification Category

Test Case Impact

Categorization

Attachment M-2- VRTM for Evaluation

97 3.1.14.a

The DNTS shall(97) generate audit logs for both Operating System and Application level events for local, non-local, and remote sessions. The following minimum events must be captured and recorded:

(1) Resource degradation alerts (e.g., 100% utilization, disk space full, volume full),

(2) Login and logout, successful and unsuccessful,

(3) Account creation/modification and permissions or configuration changes,

(4) Administrator level activities,

(5) Startup/Shutdown of System/Services/processes,

(6) Access to privileged functions (e.g., setting auditable event and intrusion detection devices) including maintenance,

(7) Results from malicious code protection (as capable),

(8) Access control list denials (as capable), and

(9) IDS signature based attacks (as capable).

1.2 OCT Conduct D DSEC Critical

98 3.1.14.b

The DNTS shall(98) generate audit records that contain the type of event, date, time, system source (asset name and IP address) where the event occurred, user/subject identification, outcome of the event (success/failure), and session ID if applicable; but do not contain sensitive information, such as passwords, actual system data, or privacy information.

1.2 OCT Conduct D DSEC Critical

99 3.1.14.c

The DNTS shall(99) allocate sufficient storage capacity to store 14 days of security-relevant audit records in online storage, and configure the system auditing capacity to reduce the likelihood of audit record storage capacity being exceeded (e.g., provide 25% capacity above estimated need).

1.1 Analyses A ASEC Major

100 3.1.14.d The DNTS shall(100) provide audit record warning notifications in accordance with defined thresholds. Systems must implement at least three levels of warning notifications (e.g., 50%, 75%, 90%).

1.2 OCT Conduct D DSEC Major

101 3.1.14.e The DNTS shall(101) not alter the original content or time ordering of audit records.

1.2 OCT Conduct D DSEC Critical

102 3.1.14.f The DNTS shall (102) provide accurate time stamps (including date, time, and UTC offset) in audit records.

1.2 OCT Conduct D DSEC Critical

103 3.1.14.g

The DNTS shall(103) time stamp audit records to within one second.

1.2 OCT Conduct D DSEC Critical

104 3.1.14.h

The DNTS shall(104) protect audit information and audit tools from unauthorized access, modification, and deletion by restricting access privileges to individuals who are responsible for performing auditing functions.

1.2 OCT Conduct D DSEC Critical

105 3.1.14.i The DNTS shall(105) be able to back up its audit records at least once per 24 hour period onto a syslog server.

1.2 OCT Conduct D DSEC Critical

106 3.1.14.j The DNTS shall(106) use cryptographic mechanisms to protect the integrity of audit record information and auditing tools.

1.1 Analyses A ASEC Critical

107 3.1.15.1.a

The DNTS shall(107) be able to integrate with automated mechanisms (e.g., Active Directory, TACACS, LDAP, RADIUS) to support the management (e.g., establishing, activating, modifying, deactivating, reviewing, and monitoring accounts; expiring unused accounts) of system accounts.

1.2 OCT Conduct D DSEC Major

108 3.1.15.1.b The DNTS shall(108) automatically disable or remove temporary and emergency user accounts within 24 hours after the need for the account is no longer valid, as determined by a system administrator.

1.2 OCT Conduct D DSEC Major

109 3.1.15.1.c The DNTS shall(109) automatically disable inactive user accounts (Operating System and Application) after 90 days of inactivity.

1.2 OCT Conduct D DSEC Major

110 3.1.15.1.d The DNTS shall(110) restrict account privileges to system administration, security administration, generic user, or super user.

1.2 OCT Conduct D DSEC Major

M2-5

Number

FAA-P-2978

Paragraph

Requirement Evaluation Sub-Factor

Verification Category

Test Case Impact

Categorization

Attachment M-2- VRTM for Evaluation

111 3.1.15.1.e

The DNTS shall(111) prevent non-privileged users from executing privileged functions including disabling, circumventing, or altering implemented security safeguards/countermeasures

1.2 OCT Conduct D DSEC Major

112 3.1.15.1.f The DNTS shall(112) enforce a limit of 5 consecutive invalid login attempts within a 15 minute period.

1.2 OCT Conduct D DSEC Major

113 3.1.15.1.g

The DNTS shall(113) be configured to either automatically:

1) Lock the account for 15 minutes, or

2) Lock the account until released by an administrator, when the maximum number of unsuccessful attempts is exceeded regardless of whether the login occurs via a local or network connection.

1.2 OCT Conduct D DSEC Major

114 3.1.15.1.h

The DNTS shall(114) be configured to restrict logical access to the specific users that are responsible for implementing configuration changes through roles and/or access privileges. Audit functions must be configured to log all configuration changes and privileged user access.

1.2 OCT Conduct D DSEC Major

115 3.1.15.1.i

The DNTS shall(115) perform the following verification and notification functions:

1) Verifies the correct operation of access controls and auditing functions;

2) Performs this verification upon system start-up, restart, and upon command by an authorized privileged user at least every 90 days;

3) Notifies system and/or security personnel of failed security verification tests; and

4) Implement the actions performed upon notification of failed security verification, including one of the following: system shut down, system restart, or notify system maintenance/security personnel.

1.2 OCT Conduct D DSEC Major

116 3.1.15.1.j The DNTS shall(116) support Network Access Controls (NAC) (e.g., NIC address, host name), Active Directory, and/or group policy for connecting devices on the network.

1.2 OCT Conduct D DSEC Major

117 3.1.15.1.k

The DNTS shall(117) generate error messages without revealing, in error logs or administrative messages, sensitive information (e.g., passwords, PII) or information that could be exploited by adversaries.

1.2 OCT Conduct D DSEC Critical

118 3.1.15.1.l The DNTS shall(118) restrict access to error messages and error logs only to authorized personnel via either physical or logical access controls. 1.2 OCT Conduct D DSEC Critical

119 3.1.15.2.a The DNTS shall(119) use multifactor authentication for remote and local access to privileged and non-privileged user accounts.

1.2 OCT Conduct D DSEC Critical

120 1.1.15.2.b The DNTS shall(120) implement replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.

1.2 OCT Conduct D DSEC Major

121 3.1.15.2.c

The DNTS shall(121) require passwords with the following characteristics:

a minimum of 8 characters with no complexity requirements when MFA is also employed, and a minimum of 12 characters requiring at least one non-alphabetic character otherwise. This follows CIS guidelines.

1.2 OCT Conduct D DSEC Major

122 3.1.15.2.d The DNTS shall(122) support annual password expiration following CIS guidelines.

1.2 OCT Conduct D DSEC Major

M2-6

Number

FAA-P-2978

Paragraph

Requirement Evaluation Sub-Factor

Verification Category

Test Case Impact

Categorization

Attachment M-2- VRTM for Evaluation

123 3.1.15.2.e

The DNTS shall(123) protect authenticator content (passwords, PIN, community strings) from unauthorized disclosure and modification in storage and in transmission. Authenticator content must use encryption for protection while in storage. Protection of authenticators in transmission may use either encryption or through isolation using a dedicated connection.

1.1 Analyses A ASEC Major

124 3.1.15.2.f The DNTS shall(124) enforce password lifetime restrictions to be a minimum of 2 days between password changes.

1.2 OCT Conduct D DSEC Major

125 3.1.15.2.g

The DNTS shall(125) enforce a 24 password change cycle reuse restriction.

1.2 OCT Conduct D DSEC Major

126 3.1.15.2.h The DNTS shall(126) enforce an immediate (at first login) password change when a temporary password is issued for account creation and for lost/compromised password replacement.

1.2 OCT Conduct D DSEC Major

127 3.1.15.2.i

The DNTS shall(127) obscure feedback of authentication information (e.g., masking passwords, prohibit passwords from being displayed) during the authentication process to protect the information from possible unauthorized exploitation/use.

1.2 OCT Conduct D DSEC Major

128 3.1.15.2.j The DNTS shall(128) only implement cryptographic modules that are FIPS 140-2 level 1 compliant for authentication.

1.1 Analyses A ASEC Major

129 3.1.15.3.a The DNTS shall(129) display a warning banner in accordance with FAA Order 1370.121, FAA Information Security and Privacy Program and Policy, as part of every system login.

1.2 OCT Conduct D DSEC Major

130 3.1.15.3.b The DNTS shall(130) display the notification message or banner on the screen until users take explicit actions to acknowledge the notification. 1.2 OCT Conduct D DSEC Major

131 3.1.15.3.c

The DNTS shall (131) prevent further access to the system by initiating a session lock (e.g., password protected screen saver), which conceals information, for local access sessions after 15 minutes of inactivity.

1.2 OCT Conduct D DSEC Major

132 3.1.15.3.d The DNTS shall(132) retain the session lock until the user re-authenticates.

1.2 OCT Conduct D DSEC Major

133 3.1.15.3.e The DNTS shall(133) automatically terminate a user initiated logical session after 30 minutes of user inactivity.

1.2 OCT Conduct D DSEC Major

134 3.1.16.1.a.i The DNTS shall(134) satisfy all requirements herein, in accordance with the input power conditions as specified in FAA-G-2100j, Section 3.1.1.6a, c and d. Input Power Conditions for AC 120 Volts 1 Phase.

1.1 Analyses A AELC Critical

135 3.1.16.1.a.ii The DNTS shall(135) operate within the range of -38.4 Volts DC to -57.6 Volts DC with < 5% AC Ripple. 1.2 OCT Conduct T TPWR Major

136 3.1.16.1.a.iii The DNTS shall(136) operate within the range of 19.2 Volts DC to 28.8 Volts DC with < 5% AC Ripple.

1.2 OCT Conduct T TPWR Major

137 3.1.16.1.b

In the instance that the primary input power parameters are out of the specified nominal voltage range, due to a power event or a loss of power, the DNTS shall(137) satisfy one of the following criteria:

1) Restore operation within six seconds (once input power returns to defined parameters), OR

2) Maintain operations for a minimum of fifteen seconds, after the power event or loss of power.

1.2 OCT Conduct T TPWR Critical

138 3.1.16.1.c The DNTS shall(138) have built in redundant power inputs. 1.2 OCT Conduct I PRPW Critical

139 3.1.16.1.d The DNTS equipment shall(139) incorporate reverse polarity protection to prevent damage to the DNTS equipment if the polarity of the DC input voltage is reversed.

1.2 OCT Conduct T TPWR Major

140 3.1.16.1.e The DNTS solution shall(140) provide a lead acid battery backup power option capable of providing power to the DNTS for a minimum of 8 hours.

1.1 Analyses A ABPW Major

M2-7

Number

FAA-P-2978

Paragraph

Requirement Evaluation Sub-Factor

Verification Category

Test Case Impact

Categorization

Attachment M-2- VRTM for Evaluation

141 3.1.16.2.a The DNTS equipment shall(141) meet the inrush current requirements listed in section 3.1.1.2.3 of FAA-G-2100j.

1.2 OCT Conduct T TBUS Major

142 3.1.16.2.b The DNTS equipment shall(142) meet the harmonic content requirements listed in section 3.1.1.2.1 of FAA-G-2100j.

1.2 OCT Conduct T TBUS Major

143 3.1.16.2.c The DNTS equipment shall(143) meet the power factor requirements listed in section 3.1.1.2.2 of FAA-G-2100j.

1.2 OCT Conduct T TBUS Major

144 3.1.16.3.a Current overload protection for the DNTS equipment shall(144) be provided by fuses, circuit breakers, or other protective devices for primary input AC and DC circuits.

1.1 Analyses A ACOP Major

145 3.1.16.3.b Overcurrent devices shall(145) be protected from damage due to a loss of power (AC or DC).

1.2 OCT Conduct D DRST Major

146 3.1.16.3.c Overcurrent protective devices shall(146) detect fault currents and provide fault isolation.

1.1 Analyses A ACOP Major

147 3.1.16.3.d Series combination system overcurrent protection shall(147) not be permitted.

1.1 Analyses A ACOP Major

148 3.1.16.4

All DNTS equipment shall(148) withstand static discharges as specified in FAA-G-2100j, paragraph 3.2.6, without resultant unit, assembly, or component failures.

1.1 Analyses A AEMI Major

149 3.1.16.5.a

The loss or variance of input voltage, including loss of voltage caused by activation of circuit protector devices, shall(149) not cause or induce any damage to any component in the DNTS or other interfacing equipment.

1.2 OCT Conduct T TPWR Major

150 3.1.16.5.b The loss or variance of input voltage, including loss of voltage caused by activation of circuit protector devices, shall(150) not result in loss of settings or data.

1.2 OCT Conduct T TPWR Major

151 3.1.17 Upon application of power to a node in a loop, end-to-end connectivity shall(151) be restored in less than 5 minutes. 1.2 OCT Conduct D DRST Critical

152 3.1.18.a The DNTS shall(152) be mountable in a 19 inch (482.6 mm) wide rack or cabinet compliant with EIA-310d section 1.

1.2 OCT Conduct I PMEC Major

153 3.1.18.b The DNTS shall(153) be mountable on a wall. 1.2 OCT Conduct I PMEC Major

154 3.1.19 The DNTS solution including all required external equipment and required ventilation shall(154) not exceed 18 inches in depth and 14.0 inches (eight 1.75-inch rack units) in height.

1.2 OCT Conduct I PMEC Major

155 3.1.20 The DNTS shall(155) meet or exceed NEBS level 3 requirements for operating temperature and humidity as specified in Telcordia SR-3580. 1.1 Analyses A AENV Major

156 3.1.21 The DNTS equipment shall(156) meet or exceed the NEBS level 3 requirements for altitude including criterion [76] in GR-63c. 1.1 Analyses A AENV Major

157 3.1.22 The DNTS equipment shall(157) meet or exceed the NEBS level 3 requirements for storage, transportation and handling temperature and humidity specified in Telcordia GR-63c criterion [69-71].

1.1 Analyses A AENV Major

158 3.1.23

The DNTS equipment shall(158) meet or exceed the NEBS level 3 requirements for storage, transportation and handling shock and vibration specified in Telcordia GR-63c criterion [107-109, 124].

1.1 Analyses A AS&V Critical

159 3.1.24 The DNTS equipment shall(159) meet or exceed the criteria for Earthquake zone 4 as specified in in Telcordia SR-3580.

1.1 Analyses A AS&V Critical

160 3.1.25 The DNTS equipment shall(160) meet the NEBS level 3 criteria for ESD and EMI specified in Telcordia SR-3580. 1.1 Analyses A AEMI Critical

161 3.1.26 The DNTS equipment shall(161) meet the NEBS level 3 criteria for Thermal Heat Dissipation specified in Telcordia SR-3580.

1.1 Analyses A ASAF Critical

162 3.1.27 The DNTS equipment shall(162) meet the NEBS level 3 criteria for Acoustic Noise specified in Telcordia SR-3580.

1.1 Analyses A ASAF Critical

M2-8

Number

FAA-P-2978

Paragraph

Requirement Evaluation Sub-Factor

Verification Category

Test Case Impact

Categorization

Attachment M-2- VRTM for Evaluation

163 3.2.1

After fabrication, parts and assembled equipment shall(163), be cleaned of smudges; loose, spattered, or excess solder; weld metal, metal chips and mold release agents; or any other foreign material that might detract from the intended operation, function, or appearance of the equipment.

1.1 Analyses A AMTL Minor

164 3.2.2 Screws, nuts and bolts shall(164) show no evidence of cross threading, mutilation, or detrimental or hazardous burrs, and be firmly secured.

1.2 OCT Conduct I PMEC Minor

165 3.2.3 Wires and cables shall(165) be positioned or protected to avoid contact with rough or irregular surfaces or sharp edges, to avoid damage to conductors or adjacent parts.

1.2 OCT Conduct I PMEC Minor

166 3.2.4.a Shielding on wires and cables shall(166) be secured in a manner that will prevent it from contacting or shorting exposed current-carrying parts.

1.2 OCT Conduct I PMEC Minor

167 3.2.4.b The ends of the shielding or braid shall(167) be secured to prevent fraying.

1.2 OCT Conduct I PMEC Minor

168 3.2.5.a The specifications of all materials and parts shall(168) have been derated to ensure that the equipment will operate as intended over the full range of environmental and power conditions.

1.1 Analyses A ARMA Minor

169 3.2.5.b The DNTS shall(169) be either fabricated from fungus-inert materials or conformably coated to provide an effective fungus resistant barrier.

1.1 Analyses A AMTL Minor

170 3.2.6 All metal surfaces on cabinetry, panels, and structural parts shall(170) be painted, plated, or anodized to provide protection from the environment.

1.1 Analyses A AMTL Minor

171 3.3.1 The MTBF for an LRU within the DNTS, including built-in test equipment, shall(171) not be less than 50,000 hours. 1.1 Analyses A ARMA Critical

172 3.3.2 The MTTR shall(172) not exceed 0.5 hours. 1.2 OCT Conduct D DMTR Critical

173 3.3.3 Preventive maintenance shall(173) not be required. 1.1 Analyses A ARMA Major

174 3.3.4 The equipment shall(174) be maintainable using standard commercially available equipment.

1.2 OCT Conduct D DMTR Major

175 3.4.a An equipment malfunction shall(175) in no way contribute to the destruction of the equipment or any part of its environment.

1.1 Analyses A ASAF Minor

176 3.4.b Safety shall(176) conform to the requirements of FAA-G-2100j, section 3.3.5, and associated subsections.

1.1 Analyses A ASAF Major

177 3.4.c

Any exposed or accessible area of the DNTS equipment that could pose a thermal contact hazard, as defined in 2016 FAA HF-STD-001b, section 5.10.10.1, shall (177) be clearly labeled on the top of the LRU as a Thermal Contact Hazard.

1.1 Analyses A ASAF Minor

178 3.4.d

Laser equipment and system design, installation, and written operational and maintenance procedures shall(178) conform to 21CFR1040, Food and Drug Administration, Department of Health and Human Services, Part 1040 Performance Standards for Light-Emitting Products.

1.1 Analyses A ASAF Critical

179 3.4.e The exact weight of the LRU shall(179) be clearly labeled on the top of the

LRU.

1.2 OCT Conduct I PMEC Minor

180 3.5.a The DNTS grounding requirements shall(180) be as specified in FAA-STD- 019F, sections 4.8, 5.6.5, 5.6.6, and their associated subsections.

1.1 Analyses A AGBS Critical

181 3.5.b The DNTS bonding requirements shall(181) be as specified in FAA-STD- 019F, section 4.2, and its associated Subsections.

1.1 Analyses A AGBS Critical

182 3.5.c The DNTS shielding protection requirements shall(182) be as specified in FAA-STD-019F, section 4.8, 5.6.7, and their associated subsections.

1.1 Analyses A AGBS Critical

M2-9

DNTS Evaluation