6973GH_19_R_00106_SIR_Phase_I_Attachment_2_CDRLS_DIIDs.pdf

NETWORK OPERATIONS CENTER (NOC)

AND

SECURITY OPERATIONS CENTER (SOC)

ATTACHMENT TO STATEMENT OF WORK (SOW)

CONTRACT DATA REQUIREMENTS LISTS

(CDRLs)

DATA ITEM DESCRIPTIONS

(DIDs)

FAALC_DID_012_Centralized_NOC‐SOC_Test Plan.docx Page 5

DATA ITEM DESCRIPTION

10. PREPARATION INSTRUCTIONS (Continued)

10.1.9 Appendixes: Appendixes may be used to provide information published separately for convenience in document maintenance (e.g., charts, classified data). As applicable, each appendix will be referenced in the main body of the document where the data would normally have been provided. Appendixes may be bound as separate documents for ease in handling. Appendixes will be lettered alphabetically (A, B, etc.)

10.1.10 All electronic deliveries must be without restrictions that would prevent the Government from reproducing or editing the information. Electronic deliveries submitted will be compatible with:

1) Microsoft Office Word

2) Microsoft Project

3) Adobe Acrobat .pdf searchable or native format

DATA ITEM DESCRIPTIONS

(DIDs)

FAALC_DID_001_Centralized_NOC-SOC_Standard Operating Procedures.docx Page 1

1. TITLE

Standard Operating Procedures

2. IDENTIFICATION NUMBER (CM Assigns)

FAALC_DID_001

3. DESCRIPTION/PURPOSE

3.1 The vendor must create a Network Operations Center (NOC)/Security Operations Center (SOC) and Customer Care Center (CCC) Standard Operating Procedures (SOPs) that detail problem resolution, describe priority classification, and tier level support.

4. APPROVAL DATE (YYMMDD) 5. OFFICE OF PRIMARY RESPONSIBILITY (OPR)

FAALC PM

6. DTC APPLICABLE

No

7. APPLICATION/INTERRELATIONSHIP

7.1

8. APPROVAL LIMITATION

See FAALC-CDRL001

9. REFERENCES

10. PREPARATION INSTRUCTIONS

10.1 The contractor must provide and maintain the SOPs for NOC/SOC functions necessary to comply with applicable National Institute of Standards and Technology (NIST), Customs and Border Protection (CBP), and Department of Homeland Security (DHS) policies. This includes, but is not limited to, procedures for the following:

1) NOC/SOC, CCC, In-Service Management Authority (IMSA)/Software Support Authority (SSA), and Facility

Security Risk (FSR) Roles and Responsibilities

2) NOC/SOC, CCC Administrative Procedures

3) Shift Opening and Shift Handoff System Checks

4) NOC/SOC, CCC, Federal Aviation Administration Logistic Center (FAALC), and FSR Notification, Escalations, and Communications

5) NOC Event/Incident Handling Procedures (i.e., corrective actions in response to system events must be initiated within 300 seconds of event isolation, 99.99% of the time).

6) NOC Analyst Troubleshooting Procedures

7) NOC Analyst Ticketing Procedures

8) NOC Escalation and Handoff Procedures

9) SOC Event/Incident Handling Procedures

10) SOC Analyst Troubleshooting Procedures

11) SOC Analyst Ticketing Procedures

12) SOC Escalation and Handoff Procedures

13) CCC Event/Incident Handling Procedures

14) CCC Analyst Troubleshooting Procedures

15) CCC Analyst Ticketing Procedures

16) CCC Escalation and Handoff Procedures

17) Daily System Checks

18) Service Request Procedures (i.e., User account requests)

19) Backup and Recovery Procedures

FAALC_DID_001_Centralized_NOC-SOC_Standard Operating Procedures.docx Page 2

10. PREPARATION INSTRUCTIONS (Continued…)

FAALC_DID_002_Centralized_NOC-SOC_Troubleshooting Desktop Instructions.docx Page 1

1. TITLE

Troubleshooting Desktop Instructions

2. IDENTIFICATION NUMBER (CM Assigns)

FAALC_DID_002

3. DESCRIPTION/PURPOSE

3.1 The troubleshooting Desktop Instructions (DI) for the Northern Border (NB) Area of Responsibility (AoR) as well as for the Southwestern Border (SWB) AoR will be initially supplied to the vendor, however the vendor must maintain these documents. The vendor must develop and deliver the DI for the California Coastal AoR.

4. APPROVAL DATE (YYMMDD)

5. OFFICE OF PRIMARY RESPONSIBILITY (OPR)

FAALC PM

6. DTC APPLICABLE

No

7. APPLICATION/INTERRELATIONSHIP

8. APPROVAL LIMITATION

See FAALC-CDRL002

9. REFERENCES

10. PREPARATION INSTRUCTIONS:

10.1 At a minimum, the DI must contain the following:

1) Requirements

2) Observed Errors

3) Procedures

4) User Accounts

FAALC_DID_002_Centralized_NOC-SOC_Troubleshooting Desktop Instructions.docx Page 2

10. PREPARATION INSTRUCTIONS (Continued)…

FAALC_DID_003_Centralized_NOC-SOC_Project Management Plan.docx Page 1

Project Management Plan

2. IDENTIFICATION NUMBER (CM Assigns)

FAALC_DID_003

3. DESCRIPTION/PURPOSE

3.1 The Program Management Plan: Describes the contractor’s organization, assignment of functions, duties, and responsibilities, management procedures and policies, and reporting requirements for the conduct of contractual-tasks, projects or programs.

6. DTC APPLICABLE

No

7.1

See FAALC-CDRL003

10. PREPARATION INSTRUCTIONS

10.1 The Project Management Plan: Must consist of the organizational structure, the assignment of functions, duties, and responsibilities, the procedures and policies and the reporting requirements that are established for the initiation, monitoring, control, completion, test and verification, and reporting of contractual tasks, projects, and programs

10.2 Specific Contents: The Project Management Plan must cover the organizational structure, program management methodology, personnel, security, and the reports as described herein. Other subjects to be included are as follows:

1) Configuration Control

2) Standardization

3) Quality Assurance

4) Control of Government Property

5) Risk Management Plan contained in a separate report

6) Phase-In Plan, contained in a separate report, including written notification upon completion of all phase-in milestones (which should also be referenced in the IMS).

7) Phase-Out Plan contained in a separate report

10.3 Project Management: The plan must present an organizational chart and supporting narrative describing the management office the contractor establishes to manage the contractual commitments. The plan must define the direct lines of control, responsibilities, functional relationships, and authority between the management office and the contractor’s other organizational elements. The plan must also describe all interfaces between the contractor and the all involved government entities and between the contractor and other contractors which are necessary and pertinent to the accomplishment of contractual tasks, projects and program

10.4 Methodology: The plan include a narrative description of the technical approach or methods the contractor will employ to accomplish contractual tasks, projects, and programs, including, as applicable, tests, construction, installation, logistics support, training, maintenance documentation, and configuration controls. The plan must include a milestone chart graphically depicting the schedule of events associated with accomplishing each contractual commitment.

FAALC_DID_003_Centralized_NOC-SOC_Project Management Plan.docx Page 2

10. PREPARATION INSTRUCTIONS (Continued…)

10.5 Personnel: The plan must list the personnel staffing of the contractor’s management office that directs the contractual tasks, projects, and programs and assist in completing the contract. The listing must include the education, training, skills, experience, and security clearance that personnel require to fill each such position and must state the identity, background, and work experience of the personnel assigned to fill these position.

The plan must also describe the staffing required for proper accomplishments of each contractual task define, in Section C of RFP, by skill type, skill level, number of personnel, and security clearance. The plan must state how many such personnel are currently available and how many new hires are required to staff fully to accomplish each task as scheduled.

10.6 Descriptive Material: As may be needed to clarify or explain matters in the text, the plan may include descriptive material, sketches, drawings, photographs, tables, forms, graphs, worksheets, charts, etc.

10.7 Table of Contents and Index: Plans of more than 30 pages in length must contain a table of contents. Plans more than 120 pages in length must also include an Index.

10.8 Legibility: The document must be legible and reproducible.

FAALC_DID_004_Centralized_NOC-SOC_Monthly Program Management Report.docx Page 1

Monthly Program Management Report

2. IDENTIFICATION NUMBER (CM Assigns)

FAALC_DID_004

3. DESCRIPTION/PURPOSE

3.1 The contractor must conduct and support a Monthly Program Meeting. Prepare and submit Monthly Program Management Report (PMR), to the Contracting Officer Representative (COR), FAA Program Manager or designated representative.

6. DTC APPLICABLE

No

See FAALC-CDRL004

10.1 At a minimum, the report must contain the following:

1) Activity summary

2) Major milestones

3) Open action items

4) Program risks and response/actions to be taken to reduce/eliminate risks

5) Schedule performance to Baseline: Variance analysis and impact

6) Status of baseline changes

7) Non-conformances and resolutions

8) Customer Call Center (CCC) Metrics:

a) Average call wait time at the service desk

b) Maximum call wait time

c) Average time to respond to Trouble Tickets submitted via the portal

d) Maximum time to respond to Trouble Tickets submitted via the portal

e) Mean Time to Repair Trouble Tickets requiring assistance from Tier II/III or service providers

f) Mean Time to Repair Trouble Tickets not requiring assistance from Tier II/III or service providers

g) Average latency of service desk portal information

h) Maximum latency of service desk portal information

i) Service desk portal availability

j) Mean time to fulfill reset password requests

10.2 Tasks that are late must be listed on monthly PMR with an explanation of why they are late and a discussion of remediation actions planned to alleviate the schedule delay.

FAALC_DID_004_Centralized_NOC-SOC_Monthly Program Management Report.docx Page 2

FAALC_DID_005_Centralized_NOC-SOC_Integrated Master Schedule.docx Page 1

1. TITLE

Integrated Master Schedule

2. IDENTIFICATION NUMBER (CM Assigns)

FAALC_DID_005

3. DESCRIPTION/PURPOSE

3.1 The Integrated Master Schedule (IMS) is a business tool to allow for on-going insight into the program status by both the Government and the contractor, helping to mitigate risks, improve day-to-day program management and execution, and increase the probability of program success.

4. APPROVAL DATE (YYMMDD) 5. OFFICE OF PRIMARY RESPONSIBILITY (OPR)

FAALC PM

6. DTC APPLICABLE

No

7. APPLICATION/INTERRELATIONSHIP

7.1

8. APPROVAL LIMITATION

See FAALC-CDRL005

9. REFERENCES

10. PREPARATION INSTRUCTIONS

10.1 At a minimum, the Integrated Master Schedule (IMS) must contain the following:

1) The IMS must be traceable to the Statement of Work (SOW), the contract, and the Risk Management System

2) The development of the IMS must be in accordance with the Government scheduling management processes and procedures. For additional guidance in developing the IMS, the contractor must reference the latest versions of the Department of Defense (DoD) Integrated Master Schedule Preparation and User Guide,” the Office of Technology Innovation and Acquisition (OTIA)/Office of Acquisitions (OA) Program Management Office (PMO) Scheduling Standards, and the DoD standard IMS Data Item Description (DID), DI-MGMT- 81650.

3) The IMS must include durations for each discrete work package and planning package (or lower level task or activity), along with predecessor and successor relationships, and any constraints that control the start or finish of each work package and planning package (or lower level task or activity). (Note: When Level of Effort (LOE) work packages, tasks, or activities are included in the IMS, they must be clearly identified as such, and must never drive the critical path(s)).

4) Examples of discrete work packages would be establishment of identification of available facilities, purchase of IT equipment, etc.

FAALC_DID_005_Centralized_NOC-SOC_Integrated Master Schedule.docx Page 2

FAALC_DID_006_Centralized_NOC-SOC_Basic Monthly Financial Report.docx Page 1

Basic Monthly Financial Report

2. IDENTIFICATION NUMBER (CM Assigns)

FAALC_DID_006

3. DESCRIPTION/PURPOSE

3.1 The contractor must provide a basic monthly financial report.

6. DTC APPLICABLE

No

7. APPLICATION/INTERRELATIONSHIP

7.1.

8. APPROVAL LIMITATION

See FAALC_CDRL_006

10.1 The Contractor preferred format is acceptable.

FAALC_DID_006_Centralized_NOC-SOC_Basic Monthly Financial Report.docx Page 2

FAALC_DID_007_Centralized_NOC-SOC_Annual Program Review.docx Page 1

Annual Program Review

2. IDENTIFICATION NUMBER (CM Assigns)

FAALC_DID_007

3. DESCRIPTION/PURPOSE

3.1 The contractor must host an annual program review at the vendor’s facility.

6. DTC APPLICABLE

No

See FAALC_CDRL_007

PREPARATION INSTRUCTIONS:

10.1 The Contractor must host an annual program review at the vendor's facility.

10.2 The Contractor preferred format is acceptable.

FAALC_DID_007_Centralized_NOC-SOC_Annual Program Review.docx Page 2

FAALC_DID_008_Centralized_NOC-SOC_RVSS Vulnerability Reports.docx Page 1

NOC/SOC Vulnerability Reports

2. IDENTIFICATION NUMBER (CM Assigns)

FAALC_DID_008

3. DESCRIPTION/PURPOSE

3.1 The contractor must perform monthly NESSUS, WebInspect, and AppDetective scans and associated vulnerability reports on the Remote Video Surveillance System (RVSS) network/system devices. The contractor must send the scan files and associated vulnerability reports to the Customs and Border Protection (CBP) Office of Acquisitions (OA) Information Systems Security Officer (ISSO).

6. DTC APPLICABLE

No

See FAALC_CDRL_008

10.1 System Access Logs

1) Time, Date, and workstation for each user login

10.2 Monthly System Scan results

1) Nessus scan of all system assets

2) AppDetective scan of all system assets

3) WebInspect scan of all system assets

10.3 Audit Review

1) User Account Modifications (password changed, account locked, etc.)

a) Password Change Attempts by Non-owner

i) Date/Time, Computer, Domain, User Account, Changed By

b) Accounts Locked

i) Date/Time, Domain, User Account

2) Unsuccessful Logins (Failed user login events)

a) User, IP Address, Computer, Logon Process, Auth Package, Logon Type, Count

3) USB Events (unauthorized external devices)

a) Computers with USB Storage Devices

i) Device Manufacturer, Quantity

b) Computers with Mass Storage Devices

10.4 User Account Modifications (Password changed, account locked, etc.)

10.5 Unsuccessful Logins (Failed user login events)

10.6 USB Events (unauthorized external devices)

FAALC_DID_008_Centralized_NOC-SOC_RVSS Vulnerability Reports.docx Page 2

10. PREPARATION INSTRUCTIONS (Continued)

10.7. Audit Log Storage (Summary of audit log storage usage)

11. ISVM Compliance (table of all maintenance and security updates received applicable to the system including status)"

12. Patching and Vulnerabilities Status

13. Security Training (CBP required initial/annual CSAT training)

14. System and Privileged Users

14.1 User Account Total

14.2 New User Account Request

14.3 User Account Deactivation Request

14.4 System and Privileged User Accounts by Role and Application Access

15. User Account Role and Application Access Matrix

15.1 Privileged User Report

15.2 Deactivated User Report

15.3 Account Lockout per User

16. Media Sanitization - Report on all media sanitization actions"

16.1 System Security Incidents (New, open, or resolved security incidents within the system)"

1) Device Manufacturer, Quantity

16.2 Audit Log Storage (Summary of audit log storage usage)

1) Summary_of_All_Computers

a) Computer Name, Domain/Workgroup, ConfigMgr Site Name, Top Console User, Operating System, Service Pack Level, Serial Number, Asset Tag, Manufacturer, Model, Memory (KBytes), Processor (GHz), Total Disk Space (MB), Free Disk Space (MB)

1) System_Integrity_Audit_Failure

a) Computer, Date/Time

16.3 ISVM Compliance, Patching, and Vulnerabilities Status

1) ISVM Description, Release Date, Compliance Due Date, Is ISVM applicable RVSS-U?, If not applicable, why?, Obsolescence issue, Resolvable during upgrade?, Planned Compliance Date, Actual RVSSU Compliance Date, Actual ISVM Implementation Date, Modified By, Notes

16.4 Security Training

1) User name, Training Course Title, Training Course Number, Date, Completion Status

16.5 User Account Total

1) First Name, Last Name, User Name, Group, Role, Account Status (Active/Disabled/Suspended), Last Password Set DAYS, Last Password Set Date, Last Logon Time Stamp DAYS, Last Logon Timestamp Date

16.6 New User Accounts Created

1) Date/Time, First Name, Last Name, User Name, Account ID, Created By, Computer

16.7 User Account Deleted

1) Date/Time, First Name, Last Name, User Name, Account ID, Deleted By, Computer

16.8 User Account Disabled

1) Date/Time, First Name, Last Name, User Name, Account ID, Disabled By, Computer

FAALC_DID_008_Centralized_NOC-SOC_RVSS Vulnerability Reports.docx Page 3

10. PREPARATION INSTRUCTIONS (Continued)

16.9 User Account Role and Application Access

1) User Role Definition

Role Name, Description, Type, Modified By, Modified Date

2) User Application Access

a) First Name, Last Name, User Name, Account ID, Description, Roles, Modified Date, Application 1, Application 2, Application 3 (Fill in application name for each application for which the user has been granted access)

3) Privileged User Report

a) First Name, Last Name, User Name, Account ID, Description, Job Title, Type, Modified Date

4) Report on All Media Sanitization Actions

a) Date/Time, Device Type, Device Name, Serial Number, Asset Number, Point of Contact, Location, Resource Assigned

5) System Security Incidents

a) Date/Time, Ticket Number, Type of Incident, Severity, System Impacted, Incident Description, Reporting User, Resolution Date

FAALC_DID_009_Centralized_NOC-SOC_Version Description Document.docx Page 1

Version Description Document (VDD)

2. IDENTIFICATION NUMBER (CM Assigns)

FAALC_DID_009

3. DESCRIPTION/PURPOSE

3.1. The Version Description Document is required of the solution providers. It is designed to supply version control features and pertinent version data regarding key system components, functions, hardware and software for each system version or baseline.

FAALC PMO

6. DTC APPLICABLE

No

7. APPLICATION/INTERRELATIONSHIP

7.1.

8. APPROVAL LIMITATION

See FAALC_CDRL_009

10.1. Use/relationship: The Version Description Document provides complete procedures for describing the supply version control features and pertinent version data regarding key system components, functions, hardware and software for each version and baseline.

1) This Data Item Description (DID) contains the preparation instructions for the content and format of the

Version Description Document.

2) It is not intended that all the requirements contained herein be applied to every program or program phase. Any individual data requirement contained in this DID is subject to deletion tailoring.

10.2. Requirements:

1) Format: The contractor format is acceptable. Standard digital data, when specified, must be in compliance with the content and format requirements specified in the Department of Homeland Security (DHS) Data Architecture (DDA).

2) General Instructions:

a. Documentation: The Version Description Document (VDD) and all other documentation to be provided for use in hardcopy form will be provided in Microsoft Word format, and will be provided in both hardcopy and on soft media, preferably compact disk (CD).

b. Machine readable data: Data used internally by computer (e.g., software, files, database, etc.)

will be provided in a form capable of being loaded and used.

c. Title page or identifier: The VDD will include a title page containing, as applicable: security markings or other restrictions on the handling of the document; date; document title; name, abbreviation, and any other identifier for the system, subsystem, or item to which the document applies; name and address of the preparing organization; and distribution statement.

d. Table of content: The document will contain a table of contents providing the number, title, and page number of each titled paragraph, figure, table, and appendix.

FAALC_DID_009_Centralized_NOC-SOC_Version Description Document.docx Page 2

10. PREPARATION INSTRUCTIONS (Continued)

e. Page numbering and labeling: Each page will contain a unique page number and display the version and date as applicable.

f. Response to tailoring instructions: If a paragraph is tailored out, the document will contain the corresponding paragraph number and title, followed by "This paragraph has been tailored out."

g. Multiple paragraphs and subparagraphs: Any section, paragraph, or subparagraph may be written as multiple paragraphs or subparagraphs to enhance readability.

h. Standard data descriptions: If a required data description has been published in a Department of Homeland Security (DHS) standard data element dictionary, reference to an entry in that dictionary is preferred over including the description itself.

10.3. Content requirements: Content requirements begin on the following page. The numbers shown designate the paragraph numbers to be used in the VDD.

1) Scope: Divide this section into the following paragraphs.

a. Identification: This paragraph will contain the project ID, release precedence, release number, and a full identification of the system and the software, including, as applicable, identification number(s), title(s), abbreviation(s), and version number(s). It will also identify the intended recipients of the VDD.

b. System overview: This paragraph will provide a brief system overview. It will describe the general nature of the system, identify current and planned operating sites, and list other relevant documents.

c. Referenced documents: This section will list the number, title, revision, and date of all documents referenced in this document. This section will also identify the source for those documents not available through normal Government channels.

2) Version description: Divide this section into the following paragraphs.

a) Inventory of materials released: This paragraph will list, by identifying numbers, titles, abbreviations, dates, version numbers, and release numbers, as applicable, all physical media (for example, listings, tapes, disks) and associated documentation that make up the software version being released. It will include applicable security and privacy considerations for these items, safeguards for handling them, such as concerns for static and magnetic fields, and instructions and restrictions regarding duplication and license provisions.

b) Inventory of software contents: This paragraph will list, by identifying numbers, titles, abbreviations, dates, version numbers, and release numbers, as applicable, all computer files that make up the software version being released. Any applicable security and privacy considerations will be included.

c) Changes installed: This paragraph will provide a brief overall summary of the changes incorporated into this release. This paragraph will identify, as applicable, Discrepancy Reports (DRs), System Advisory Notices (SANs), and Heads Up Messages (HUMs) cleared by the release, any modifications and enhancements incorporated, and the effects, if any, of each change on the end user, system operation and on interfaces with other hardware and software as applicable. This paragraph does not normally apply to the initial release of the software for a system.

d) Adaptation data: This paragraph will identify or reference all unique to s¬ite data contained in the software version. For software versions after the first, this paragraph will describe changes made to the adaptation data.

e) Related documents: This paragraph will list by identifying numbers, titles, abbreviations, dates, version numbers, and release numbers, as applicable, all documents pertinent to the software version being released but not included in the release.

f) Installation instructions: This paragraph will provide or reference the following information, as applicable:

i) Instructions for installing the release

ii) Identification of other changes that have to be installed for this version to be used, including site-unique adaptation data not included in the software version

iii) Security, privacy, or safety precautions relevant to the installation

iv) Procedures for determining whether the version has been installed properly

v) A point of contact to be consulted if there are problems or questions with the installation

FAALC_DID_009_Centralized_NOC-SOC_Version Description Document.docx Page 3

10. PREPARATION INSTRUCTIONS (Continued)

3) Possible problems and known errors: This paragraph will identify any possible problems or known errors with the software version being released, and instructions (either directly or by reference) for recognizing, avoiding, correcting, or otherwise handling each one. The information presented will identify and be appropriate for those impacted.

4) Notes: This section will contain any general information that aids in understanding this document (e.g., background information, glossary, rationale). This section will include an alphabetical listing of all acronyms, abbreviations, and their meanings as used in this document and a list of any terms and definitions needed to understand this document.

a) Appendixes: Appendixes may be used to provide information published separately for convenience in document maintenance (e.g., charts, classified data). As applicable, each appendix will be referenced in the main body of the document where the data would normally have been provided. Appendixes may be bound as separate documents for ease in handling. Appendixes will be lettered alphabetically (A, B, etc.).

11. DISTRIBUTION STATEMENT

DISTRIBUTION STATEMENT A: Approved for public release; distribution is unlimited.

FAALC_DID_010_Centralized_NOC-SOC_Network Description Document.docx Page 1

Network Description Document (NDD)

2. IDENTIFICATION NUMBER (CM Assigns)

FAALC_DID_010

3. DESCRIPTION/PURPOSE

3.1 The Network data item describes the necessary requirements to document the design of a Network. In this case, we are concerned with the design of the network associated with the NOC/SOC, its’ connectivity to One Net, or any other connections it has within the design of the NOC/SOC system.

6. DTC APPLICABLE

No

7. APPLICATION/INTERRELATIONSHIP

7.1 This Data Item Description (DID) contains the content requirements for the data product generated by specific and discrete task requirements as delineated in the contract.

7.2 This DID is used when the contractor is tasked to develop and record the Network Design associated with the contractor provided NOC/SOC system.

See FAALC_CDRL_010

Content Requirements for Each Network

10.1.1 The contactor must provide the network topology for those connections with the NOC/SOC.

10.1.2 The contactor must provide bandwidth utilization forecasts for the network connected to the NOC/SOC.

10.1.3 The contactor must address how the applications associated with NOC/SOC will use the network interface(s) in the immediate and future timeframe using an information flow diagram specifying the entirety of ports, protocols and services used by these applications.

10.1.4 The contactor must describe their capability and any tool(s) used to discover network devices. (e.g.

NMap, ZenMap).

10.1.5 The contactor must describe the NOC/SOC capability and any tool(s) used to scan the network for vulnerabilities (e.g. Nessus).

10.1.6 The contactor must use the domain name(s) for each site provided by the government.

10.1.7 The contractor must follow the naming convention for hostnames and device name provided by the government. The naming convention of the devices and domain will conform to the two documents below:

1) The United States Customs and Border Protection (CBP) Unified Technology Naming Standards, October 2009.

2) Department of Homeland Security (DHS) Domain Name System (DNS) Naming Standard v1.4

2011-02-01, February 1, 2011.

FAALC_DID_010_Centralized_NOC-SOC_Network Description Document.docx Page 2

10.1.8 The contractor To apply for LAN IP addresses from The United States Border Patrol (USBP) the contractor must provide the network design which must include:

1) A Network Logical Architecture (NLA) that provides an accurate and complete depiction of the

Network associated with the NOC/SOC. A sample template is provided in Appendix A. The contactor must use this template as guidance to accurately depict the Network design. The NLA must include:

a) Switch port table

b) Network Management Configuration parameters

c) Information on tunnels, routers, loopbacks, trunks, virtual local area networks (VLANs), connector information

i) Network schema, which is a set of tables defining the type of Internet Protocol (IP) addresses (unicast/multicast) and the number of IP addresses required per site with justification for current and future use.

ii) Network device configuration and image files including backup copies of the startup configuration file for routers, system image files (e.g., Cisco Internetwork Operating System (IOS) software system image file) for routers, and configuration files for switches (e.g., VLAN.dat).

iii) Network segments that are not discoverable, proprietary IP addresses and dynamic IP addresses.

iv) Any external interfaces. (External interfaces include interfaces to OneNet, BigPipe, Internet Service Provider (ISP) networks etc.)

10.1.9 The contractor must describe how the implemented network design supports the following:

1) Network Management: Fault, Configuration, Accounting, Performance, Security (FCAPS )

a) Fault Management

i) Network redundancy and fault tolerance

ii) Recognize, isolate, correct, and log faults

b) Configuration Management

i) Gather and store configurations from network devices

ii) Simplify the configuration of the device

iii) Track changes that are made to the configuration

iv) Configure circuits or paths

v) Plan for future expansion and scaling

c) Account Management

i) User Statistics

ii) Network utilization

d) Performance Management

i) Diagnostics

ii) Optimization.

e) Security Management

i) Network Admission Control (NAC)

ii) Authentication, Authorization, and Accounting (AAA)

iii) Network Encryption (e.g., Federal Information Processing Standards (FIPS) 140-2 & FIPS

197 compliance

iv) Network Services

v) Network Identity (Dynamic Host Configuration Protocol/DNS Dynamic Host Control

Protocol (DHCP)/DNS)

vi) Time Synchronization

vii) Wide Area Network Operations

viii) Unified Communications & Collaboration

ix) All VLANs in the Network

x) Quality of Service capabilities

xi) Real-time (RT) streaming

FAALC_DID_010_Centralized_NOC-SOC_Network Description Document.docx Page 3

10.1.10 Pre-deployment [Refer to Contractor Deliverable Requirements List/Contract (CDRL) Network

Description Document (NDD) at Block 10 & 12], the contactor must provide for Government review:

1) Network inventory table which specifies the all Network devices used by the system, host name, device, etc. If a domain name is required, the contactor must use the domain provided by the government.

10.1.11 Post-deployment [Refer to the CDRL NDD at 2nd Submission], the contactor must provide:

1) An updated Network inventory table which specifies the all Network devices used in the system, with LAN IP Address, host name, device, etc. (Appendix B specifies the required data - a report from a Network Discovery Tool will suffice )

2) An updated NLA depicting the actual LAN IP addresses and hostname assignment to each device as applicable.

11. Notes: This section must contain any general information that aids in understanding this document (e.g., background information, glossary, rationale). This section must include an alphabetical listing of all acronyms, abbreviations, and their meanings as used in this document and a list of any terms and definitions needed to understand this document.

11.1 Appendices: Appendices may be used to provide information published separately for convenience in document maintenance (e.g., charts, classified data). As applicable, each appendix must be referenced in the main body of the document where the data would normally have been provided. Appendixes may be bound as separate documents for ease in handling. Appendixes must be lettered alphabetically (A,B, etc.).

11.2 Acronyms

Acronym Description AAA Authentication, Authorization, and Accounting CBP Customs and Border Protection CDRL Contractor Deliverable Requirement List DHCP Dynamic Host Control Protocol DHS Department of Homeland Security DID Data Item Description DNS Domain Name System FCAPS Fault, Configuration, Accounting, Performance, Security FIPS Federal Information Processing Standard IP Internet Protocol IOS Internetwork Operating System ISP Internet Service Provider NAC Network Admission Control NLA Network Logical Architecture OTIA Office of Technology Innovation and Acquisition QoS Quality of Service RT Real-Time USBP United States Border Patrol VLAN Virtual Local Area Network

FAALC_DID_010_Centralized_NOC-SOC_Network Description Document.docx Page 4

11.3 Glossary

1) Authentication, Authorization, and Accounting: Authentication identifies an individual, usually based on a username and password. Authorization grants or denies a user access to network resources once the user has been authenticated through the username and password.

The amount of information and the amount of services the user has access to depend on the user's authorization level. Accounting keeps track of a user's activity while accessing the network resources, including the amount of time spent in the network, the services accessed while there and the amount of data transferred during the session. Accounting data is used for trend analysis, capacity planning, billing, auditing and cost allocation.

2) BigPipe: The real-time video stream, known as Big Pipe, is a video distribution system that CBP provides to federal, state and local law enforcement agencies so that responders have access to real-time video and still imagery. The images can be viewed anywhere there is an internet connection, including smart-phones.

3) Diagnostics: Diagnostics refers to the ability to diagnose and correct application and network performance issues utilizing on demand deep packet captures originating from a field site.

4) Fault Tolerance: Fault Tolerance is the ability to tolerate a fault.

5) Internet Protocol address: An Internet Protocol address (IP address) is a numerical label assigned to each device (e.g., computer, printer) participating in a computer network that uses the Internet Protocol for communication. An IP address serves two principal functions: host or network interface identification and location addressing.

6) Network Admission Control (NAC): NAC integrates posture end-point checking and automatic remediation processes into the network systems, allowing the network infrastructure to work together to ensure the information system is operating securely before interoperability is allowed.

7) Network Identity (DHCP/DNS)

8) Dynamic Host Configuration Protocol (DHCP): DHCP enables users to dynamically and transparently assign reusable IP addresses to clients. Domain Name System (DNS) is the hierarchical naming system used for any resource connected to CBP’s enterprise network.

This system is used for the resolution of forward and reverse domain name lookups.

9) Quality of service (QoS): QoS is the overall performance of a network, particularly the performance seen by the users of the network. To quantitatively measure QoS, several related aspects of the network service are often considered, such as error rates, bit rate, throughput, transmission delay, availability, jitter, etc. Page 5 of 11

10) Redundancy: Redundancy is the inclusion of extra components that are not strictly necessary to functioning, in case of failure in other components, the service can be recovered. Fault tolerant systems are usually designed by using redundant components.

11) Time Synchronization: Time Synchronization in computer networks time synchronization is critical because every aspect of managing, securing, planning, and debugging a network involves determining when events happen. Time provides the only frame of reference between all devices on the network.

12) Topology: Network topology is the arrangement of the entirety of the various elements (links, nodes, etc.) of a computer network.

13) Unified Communications & Collaboration is a technological architecture whereby communication tools are integrated into one common service instead of individually managed technology silos.

14) VLAN: A VLAN is a group of devices on one or more LANs that are configured to communicate as if they were attached to the same wire, when in fact they are located on a number of different LAN segments.

FAALC_DID_010_Centralized_NOC-SOC_Network Description Document.docx Page 5

Appendix A: Sample Templates

FAALC_DID_010_Centralized_NOC-SOC_Network Description Document.docx Page 6

11.5 Appendix B: Sample Templates (Continued)

FAALC_DID_010_Centralized_NOC-SOC_Network Description Document.docx Page 7

11.6 Appendix C: Sample Templates (Continued)

11.7 Appendix D: Network Inventory Table

Hostname OS_ family

OS_

Name

OS_

Version

Ip_ address

Mac_ Address

Equipment_ Class

Manufacturer Model Serial_No Visual_ID Description Equipment Classification

Device name following CBP naming convention (e.g., sajo014a021) e.g., Windows e.g., Server e.g., R2 Static logical network identifier (e.g., 10.1.1.1)

Physical network identifier (e.g., 00-1A- A0-D0-7A- 1A)

Type of equipment (e.g., workstation, router, etc.)

OEM

(e.g., IBM) e.g., BladeCenter

HX5

Serial number of the device (if available)

Other visual ID (if available)

Device function, purpose, location and URL for product spec

Not necessary as input to

IACS -

determined within the system

FAALC_DID_011_Centralized_NOC-SOC_System Description Document.docx Page 1

System Description Document (SDD)

2. IDENTIFICATION NUMBER (CM Assigns)

FAALC_DID_011

3. DESCRIPTION/PURPOSE

3.1. The purpose of this System Description Document (SDD) is very similar to another artifact more commonly found in the Department of Homeland Security (DHS) SELC, the System Design Document. The Data Item Description (DID) for this SDD will include an over-view of its systems functions and logic, a summary of its typical operational environment, and a basic assessment of the proposed design alternatives that the solution provider recommends for Customs and Border Protection’s (CBP’s) production environment. The SDD will also cover such factors as: physical characteristics, mechanical and other internal interfaces, electrical interfaces, data interfaces, and any known software interfaces.

6. DTC APPLICABLE

No

7. APPLICATION/INTERRELATIONSHIP

7.1. The SDD is intended for use primarily by the system evaluation, source selection, and testing SME’s during their individual efforts throughout the SELC. The SDD will include a configuration items list subject to configuration management and quality control procedures. After the document has been accepted by the Government and baselined, the program Configuration Control Board must approve any further changes, ensuring that they follow the intent from both the program Configuration Management and Quality Assurance Plans.

See FAALC_CDRL_011

PREPARATION INSTRUCTIONS

A description of the technical approach and security features used during the development of your technical solution; along with any specific architecture reference materials that are included in your solution.

An identification of all programs and other hardware and software component associated with your application.

Some description for how the programs within your solution architecture interact with each other.

Each Solution provider should address as many sections in the standard DHS System Design Document template as possible. It is also recommended that the SDD include a compliance matrix that demonstrates any known interdependencies or alignments the system or its components have with the DHS or CBP EA reference models. Additionally the solution providers should:

1) Address any known design constraints at a high-level or further detail, as appropriate, regarding the subsystem/component level.

2) Address at a high-level the database design within the system. If this information (outlined in the

DHS SDD template, section 3) already exists in previously approved CDRL documentation, then the solution provider will discuss it in brief within the SDD and provide separate reference details (ie page #, paragraph, figure/table, etc.) as to where the information is found in the appropriate CDRL documentation.

FAALC_DID_011_Centralized_NOC-SOC_System Description Document.docx Page 2

FAALC_DID_012_Centralized_NOC‐SOC_Test Plan.docx Page 1

1. TITLE

Test Plan

2. IDENTIFICATION NUMBER (CM Assigns)

FAALC_DID_012

3. DESCRIPTION/PURPOSE

3.1. The Test Plan describes plans for testing systems. It identifies the tests to be performed, describes the test environment to be used for the test, provide requirements traceability for each test, and provides detailed schedules and resources for test activities.

4. APPROVAL DATE (YYMMDD) 5. OFFICE OF PRIMARY RESPONSIBILITY (OPR)

FAALC PM

6. DTC APPLICABLE

No

7. APPLICATION/INTERRELATIONSHIP

7.1 This Data Item Description (DID) contains the content requirements for the data product generated by specific and discrete task requirements as delineated in the contract.

7.2 This DID is used when the contractor is tasked to develop and record plans for conducting qualification, integration or acceptance testing

8. APPROVAL LIMITATION

See FAALC_CDRL_031

9. REFERENCES

See Block 10.

10. PREPARATION INSTRUCTIONS

10.1 Content Requirements:

10.1.1 Scope: This section will be divided into the following paragraphs.

10.1.1.1 Identification: This paragraph will contain a full identification of the system and the hardware/software to which this document applies, including, as applicable, identification number(s), title(s), abbreviation(s), version number(s), and release number(s). Identification will specify what hardware/software goes on the NOC and the SOC and includes any updates or changes to the NOC/SOC System as of the time this Test Plan is prepared.

10.1.1.2 System overview: This paragraph will briefly describe the objectives of the test plan, including milestones, personnel participation, locations, schedules, and security measures to be observed. Briefly state the purpose of the system to which this test plan applies. Describe the general nature of the system and hardware/software; summarize the history of the system’s development, operation, and maintenance; identify the project sponsor, acquirer, user, contractor, and support agencies; identify current and planned operating sites; and list other relevant documents.

10.1.1.3 Document overview: This paragraph will summarize the purpose and contents of this document and will describe any and all security or privacy considerations associated with its use.

10.1.1.4 Relationship to other plans: This paragraph will describe the relationship, if any, of the plan to related project management plans, security plans, or other plans to which the system applies

10.1.2 Reference documents: This section will list the number, title, revision, and date of all documents referenced in this plan. This section will also identify the source for all documents not available through normal Government stocking activities.

FAALC_DID_012_Centralized_NOC‐SOC_Test Plan.docx Page 3

10. PREPARATION INSTRUCTIONS (Continued)

10.1.4.9 Continued

1) Test objective

2) Test level

3) Test type or class

4) Qualification

5) Identifier of the system or subsystem requirements and, if applicable, software system requirements addressed by this test.

6) Special requirements (for example, 48 hours of continuous facility time, weapon simulation, extent of test, use of a special input or database)

7) Type of data to be recorded

8) Type of data recording/reduction/analysis to be employed

9) Assumptions and constraints, such as anticipated limitations on the test due to system or test conditions - timing, interfaces, equipment, personnel, database, etc.

10) Safety, security, and privacy considerations associated with the test.

10.1.5 Test environment: This section will be divided into the following paragraphs to describe the software test environment at each intended test site.

10.1.5.1 (Name of test site(s)): This paragraph will identify one or more test sites to be used for the testing, and will be divided into the following subparagraphs to describe the test environment at the site(s). If all tests will be conducted at a single site, this paragraph and its subparagraphs will be presented only once. If multiple test site sites use the same or similar test environments, they may be discussed together. Duplicative information among site descriptions may be reduced by referencing earlier descriptions.

10.1.5.2 Software items: This paragraph will identify by name, number, and version, as applicable, the software items (e.g., operating systems, compilers, network/communications software, related applications software, databases, input files, code auditors, dynamic path analyzers, test drivers, preprocessors, test data generators, test control software, other special test software, post-processors) necessary to perform the planned testing activities at the test site(s). This paragraph will describe the purpose of each item, describe its media (tape, disk, etc.), identify those that are expected to be supplied by the site, and identify any classified processing or other security or privacy issues associated with the software items.

10.1.5.3 Hardware and firmware items: This paragraph will identify by name, number, and version, as applicable, the computer hardware, interfacing equipment, network/communications equipment, test data reduction equipment, apparatus such as extra peripherals (tape drives, printers, plotters), test message generators, test timing devices, test event records, etc., and firmware items that will be used in the test environment at the test site(s). This paragraph will describe the purpose of each item, state the period of usage and the number of each item needed, identify those that are expected to be supplied by the site, and identify any classified processing or other security or privacy issues associated with the items.

10.1.5.4 Other materials: This paragraph will identify and describe any other materials needed for the testing at the test site(s). These materials may include manuals, software listings, and media containing the software to be tested, media containing data to be used in the tests, sample listings of outputs, and other forms or instructions. This paragraph will identify those items that are to be delivered to the site and those that are expected to be supplied by the site. The description will include the type, layout, and quantity of the materials, as applicable. This paragraph will identify any classified processing or other security or privacy issues associated with the items.

10.1.5.5 Proprietary nature, acquirer’s rights, and licensing: This paragraph will identify the proprietary nature, acquirer’s rights, and licensing issues associated with each element of the test environment.

FAALC_DID_012_Centralized_NOC‐SOC_Test Plan.docx Page 2

10. PREPARATION INSTRUCTIONS (Continued)

10.1.3 Test overview: This section will be divided into the following paragraphs to describe a system test overview including system components, and system requirements to be verified.

10.1.3.1 System Verification: This paragraph describes the testing that will be conducted to evaluate how well the system satisfies the approved requirements. A description of system components (e.g., hardware, software, communications) that compose the system test in which to verify requirements. Describe how the test will verify system functionality, performance and interoperability with external systems, including any legacy systems/components. Provide a table of requirements to be verified during the conduct of the test.

10.1.3.2 Test system flow diagrams: This paragraph will provide flow diagrams that reflect a functional description of the test program using a block diagram portrayal of the functions that must be met to satisfy the total test program.

10.1.4 Test identification: This section will be divided into the following paragraphs to identify and describe each test to which the Test Plan applies.

10.1.4.1 General information: This paragraph will be divided into subparagraphs to present general information applicable to the overall testing to be performed.

10.1.4.2 Test levels: This paragraph will describe the levels at which testing will be performed, for example, system, or subsystem level.

10.1.4.3 Test classes: This paragraph will describe the types or classes of tests that will be performed (for example, timing tests, erroneous input tests, maximum capacity tests) and requirements that will verified.

10.1.4.4 General test conditions: This paragraph will describe conditions that apply to all of the tests or to a group of tests. For example:

1) Each test will include nominal, maximum, and minimum values

2) Each test of type x will use live data

3) Execution size and time will be measured for each CSCI

4) Included will be the statement of the extent of testing to be performed and rationale for the extent selected

5) The extent of testing will be expressed as a percentage of some well-defined total quantity, such as the number of samples of discrete operating conditions or values or other sampling approach

6) Also included will be the approach to be followed for retesting/regression testing

10.1.4.5 Test progression: In cases of progressive or cumulative tests, this paragraph will explain the planned sequence and progression of tests.

10.1.4.6 Data recording, reduction, and analysis: This paragraph will identify and describe the data recording, reduction, and analysis procedures to be used during and after the tests identified in the Test Plan.

These procedures will include, as applicable, manual, automatic, and semi-automatic techniques for recording test results, manipulating the raw results into a form suitable for evaluation, and retaining the results of data reduction and analysis

10.1.4.7 Planned tests: This paragraph will be divided into the following subparagraphs to describe the total scope of the planned testing.

10.1.4.8 (Item(s) to be tested): This paragraph will…