Attachment B - Technical Specification Amend 003.pdf

United States Coast Guard

Technical Specification to

Communications Management System Request for

Proposals

CMS RFP, Technical

Specification

1. INTRODUCTION.

The United States Coast Guard (USCG) Polar Security Cutter (PSC) Communications

Management System (CMS) is a system that provides the operator with a unified system that interconnects and manages the various aspects of external communications on the PSC. It also connects to the PSC’s Internal Voice Network to facilitate communications over radios from multiple locations within the cutter. It consists of these major components: The External

Communication System (XCS) RED AND BLACK Switching System, the Common End User

Terminals (CEUT), and The Communications Management Software.

As an integrated subsystem of the XCS, the CMS remotely manages the configuration of the radios through the radios’ remote control portals to the extent of the remote control capabilities of each radio. The CMS also supports remote programming and configuration of its components such as the CEUTs. The CMS also manages the routing and internal distribution of CLASSIFIED and UNCLASSIFIED data to the appropriate user terminals through the XCS RED AND BLACK

Switching System, ship interior Local Area Networks (LANs), and the Internal Voice Network.

It is also interoperable with the CLASSIFIED (red) and UNCLASSIFIED (black) digital voice recorders to the extent that communication voice circuits are assigned and routed to the appropriate voice recorders’ channels.

1.1. SCOPE

This Technical Specification provides design parameters, technical capabilities, and testing requirements for the XCS RED AND BLACK Switching System, CEUTs, and Communications

Management Software for the USCG PSC. Together, the three provide point-to-point connections for information flow between radios, modems, cryptographic equipment, voice/data processors, classified communication capable user terminals, recording devices and Internal

Voice Network equipment.

2. REFERENCES.

2.1. Reserved

2.2. List of Abbreviations.

AM Amplitude Modulation

BLOS Beyond Line Of Sight

2.3. Definitions.

2.3.1. Common End User Terminal (CEUT) - A terminal that interfaces with internal voice communications, and with exterior voice communications such as satellite, tactical radios, maritime radios, and in port shorelines. The CEUT interfaces with the CMS Switching System and the Communications Management Software, allowing for voice communications over radios. The CEUT interfaces with the Internal Voice Network, allowing it to communicate with shipboard interior voice communications such as telephones, general alarm systems, announcing systems, sound-powered circuits, and wireless voice circuits.

C2 Command and Control

C4ISR Command, Control, Communications, Computer, Intelligence, Surveillance, and Reconnaissance

CTV Closed Circuit Television

CEUT Common End User Terminal

CLASSLAN Classified Local Area Network

CMS Communication Management System

COMSATCOM Commercial Satellite Communications

DHS Department of Homeland Security

DoD Department of Defense

DSC Digital Selective Calling

EHF Extremely High Frequency

FM Frequency Modulation

IVN Internal Voice Network

LMR Land Mobile Radio

LOS Line Of Sight

MHz Mega-Hertz

MILSATCOM Military Satellite Communications

NDDS Navigation Data Distribution System

NMS Network Management System

ORD Operational Requirements Document

OTH Over The Horizon

PSC Polar Security Cutter

RTCM Radio Technical Commission for Maritime Services

SOLAS Safety of Life at Sea

STCS Shore Tie Communication System

SVR Steel Vessel Rules

TIF Test and Integration Facility

UHF Ultra-High Frequency

USCG United State Coast Guard

USN United States Navy

UNCLASSLAN Unclassified Local Area Network

VHF Very High Frequency

XCS Exterior Communication System

2.3.2. Internal Voice Network - The Internal Voice Network provides internal voice communications on the ship, including ship’s announcing systems, ship’s alarms, telephones, and interfaces to the sound powered phones, CEUTs, the Red and Black Switching System, the CMS, and the Shore

Tie Communication System.

2.3.3. Exterior Communications System - Composed of the antennas, couplers , amplifiers, transmitters, receivers, switching, baseband, cryptographic equipment, message processing, quality monitoring, CMS, Message Processing System and equipment required to sustain Line-of-Sight (LOS) and Beyond-Line-of-Sight (BLOS) external communications in the High

Frequency (HF), Very High Frequency (VHF), Ultra High Frequency (UHF), Extremely High

Frequency (EHF) Military SATCOM (MILSATCOM), Military Satellite, and Commercial

Satellite frequency bands.

2.3.4. Whitelisting - restricting the use of information inputs, controlling which devices are allowed to join a network, designating specific software programs or entire categories of software programs authorized to execute on organizational systems, and preventing the execution of unauthorized software programs.

2.4. Order of Precedence.

2.4.1. Unless otherwise noted herein or in the contract, in the event of a conflict between the text of this Technical Specification and the references cited herein, the text of this Technical

Specification takes precedence. Nothing in this Technical Specification, however, supersedes applicable laws and regulations unless a specific exemption has been obtained.

2.4.2. Where a referenced standard or specification itself references another standard or specification not explicitly enumerated in this contract, that secondary specification or reference shall be considered to be guidance, and not a contract requirement.

2.4.3. Referenced standards, specifications, and other documents within Data Item Descriptions (DIDs) in the Contract Data Items Requirements List (CDRL) shall be considered to be fully required by this contract.

3. CMS TECHNICAL REQUIREMENTS.

3.1. General.

3.1.1. Human Factors Engineering.

3.1.1.1. Reserved

3.1.2. Reliability

3.1.2.1. Reserved

3.1.3. Physical Rack Requirements.

3.1.3.1. All equipment, excepting the CEUTs, shall be mountable into an Electronic Industries

Alliance (EIA) standard rack.

3.2. Red and Black Switching System.

3.2.1. The XCS shall have a Red Switching system for classified traffic and a Black Switching system for unclassified traffic; that provide point-to-point connections for information flow between radios, modems, cryptographic equipment, processing, and user terminals.

3.2.2. The XCS Black Switching system shall establish interconnections of voice between Internal

Voice Network equipment and XCS cryptographic equipment and radios

3.2.3. The XCS Red and Black Switching System shall convert non-Voice over IP (VoIP) voice radio outputs to IP-based voice transmission formats.

3.2.4. The CMS shall include host systems for the Communications Management Software and shall provide for the interfacing to the RED and BLACK Switching Systems.

3.2.5. The XCS Red Switching System shall have a Gigabit Ethernet interface for outputting IP- based voice protocols via an 802.3 Gigabit Ethernet connection to the Cutter’s CLASSLAN.

3.2.6. The XCS Black Switching System shall have a Gigabit Ethernet interface for outputting IP-based voice protocols via an 802.3 Gigabit Ethernet to the Cutter’s UNCLASSLAN.

3.2.7. Red and Black Switch System connections shall consist of an equal number of balanced and single ended connections.

3.2.7.1. Black Switches shall provide for at least 30 connections (total) for the following radio or equipment types:

3.2.7.1.1. VHF - FM Tactical

3.2.7.1.2. HF

3.2.7.1.3. VHF - Amplitude Modulation (AM)

3.2.7.1.4. Military UHF SATCOM

3.2.7.1.5. Military UHF LOS

3.2.7.1.6. Tactical UHF 400 MHz

3.2.7.1.7. Tactical UHF 700/800 MHz

3.2.7.1.8. Cryptologic equipment

3.2.7.1.9. Black Digital Voice Recorder

3.2.7.2. Red Switches shall provide for at least 30 connections (total) for the following radio or equipment types:

3.2.7.2.1. VHF - Amplitude Modulation (AM)

3.2.7.2.2. Military UHF SATCOM

3.2.7.2.3. Military UHF LOS

3.2.7.2.4. Cryptologic equipment

3.2.7.2.5. Red Digital Voice Recorder

3.2.7.2.6. AN/URC-154

3.2.7.2.7. AN/UYQ-120

3.2.8. The Red and Black Switching System shall comply with MIL-STD-167-1A Type 1 vibration.

3.2.9. Common End User Terminals.

3.2.9.1. The CEUT shall serve as a terminal for voice communications aboard ship.

3.2.9.2. The CEUTs shall interface with the Internal Voice Network for connectivity to the shipboard announcing systems, ships alarms, telephones, sound powered phones, and the

STCS.

3.2.9.3. The CEUT shall interface with the UNCLASSLAN and CLASSLAN for connectivity to the XCS audio channels that the terminal is authorized for connection.

3.2.9.4. Radio Channel Monitoring. The CEUT shall be able to shall interface with the

UNCLASSLAN and CLASSLAN for connectivity to receive any XCS audio channel that the terminal is authorized for connection.

3.2.9.5. There shall be 30 CEUTs provided for the UNCLASSLAN.

3.2.9.6. There shall be 3 CEUTs provided for the CLASSLAN.

3.2.9.7. The CEUT shall be configured by the Communications Management Software.

3.2.9.7.1. Configuration shall consist of: authorized operators and their allowances, authorized channel accesses, PSTN connectivity, active channels, and channel capabilities, and

Settings to include; network IP address, connectivity status, and interface status

3.2.9.8. The CEUTs shall interface with the Communications Management Software through the

Ship’s Networks.

3.2.9.9. The CEUT shall be capable of connecting to both classified and unclassified networks at the same time.

3.2.9.9.1. The Red CEUT shall be able to transmit and receive on classified networks.

3.2.9.9.2. The Black CEUT shall be able to transmit and receive on unclassified networks.

3.2.9.9.3. The CEUT shall operate in accordance with CNSSAM TEMPEST 01/13 Red and

Black Installation Guidance.

3.2.9.10. The CEUT shall capable of assigning any of its audio channels to an Assignable

Loudspeaker.

3.2.9.10.1. The CEUT shall be able to assign classified audio channels to classified assignable speakers, and unclassified audio channels to unclassified speakers.

3.2.9.10.1.1. The interface to the RED speakers will be 2-wire balanced 600 ohms.

3.2.9.10.1.2. The interface to the RED speakers will be via the IVN.

3.2.9.10.2. The CEUT shall not allow the operator to assign classified audio channels to unclassified speakers.

3.2.9.10.3. The CEUT shall not allow the operator to assign unclassified audio channels to classified speakers.

3.2.9.10.3.1. The CEUTs shall allow activating groups of the loudspeakers.

3.2.9.10.3.1.1. The groups shall be labeled TOPSIDE, CREW, ENGINEERING

SPACES, COMMAND AND CONTROL, and LOUDHAILER 6MC, respectively.

3.2.9.10.3.2. Reserved.

3.2.9.10.4. CEUTs shall provide for independent or simultaneous operation of the designated speaker groups except for the loudhailer.

3.2.9.10.4.1. RED channels shall not be assignable to the loudhailer,

3.2.9.10.4.2. The CEUT shall not control the volume of the loudhailer.

3.2.9.11. The 1MC announcing circuit shall be accessible from any CEUT.

3.2.9.12. The alarms shall be able to be activated from any CEUT.

3.2.9.12.1. The CEUT shall be able to activate the General alarm, Chemical alarm, Collision alarm and Flight Crash alarm via the 1MC.

3.2.9.13. The CEUT shall be capable of transmitting and receiving over sound powered telephone circuits via the Internal Voice Network.

3.2.9.14. CEUT XCS Radio Interfaces.

3.2.9.14.1. Each CEUT shall be capable of configuring (i.e. select radio frequency, transmission power, and radio mode of transmission) and monitoring radio circuits.

3.2.9.14.2. The CEUT shall be able to transmit over any XCS audio channel that it is authorized to connect to.

3.2.9.14.3. Reserved

3.2.9.14.4. The CEUT shall be able to monitor at least 10 XCS audio channels simultaneously.

3.2.9.14.5. The CEUT shall be able to transmit and receive over the XCS HF radios.

3.2.9.14.5.1. The CEUT shall be able to control (i.e. frequency selection, channel selection, output power, and squelch control. per 3.3.1.11) the XCS HF radios.

3.2.9.15. The CEUT shall be able to transmit and receive over the XCS VHF FM Tactical transceivers.

3.2.9.15.1. The CEUT shall be able to control (i.e. frequency selection, channel selection, output power, and squelch control. per 3.3.1.12) the XCS VHF FM Tactical transceivers.

3.2.9.16. The CEUT shall be able to transmit and receive over the XCS VHF AM radio.

3.2.9.16.1. The CEUT shall be able to control (i.e. frequency selection, channel selection, output power, and squelch control. per 3.3.1.15) the XCS VHF AM radio.

3.2.9.17. The CEUT shall be able to transmit and receive over the XCS Tactical UHF 400 MHz transceivers.

3.2.9.17.1. The CEUT shall be able to control (i.e. frequency selection, channel selection, output power, and squelch control. per 3.3.1.16) the XCS Tactical UHF 400 MHz transceivers.

3.2.9.18. The CEUT shall be able to transmit and receive over the XCS Tactical UHF 700/800

MHz transceivers.

3.2.9.18.1. The CEUT shall be able to control (i.e. frequency selection, channel selection, output power, and squelch control. per 3.3.1.17) the XCS Tactical UHF 700/800 MHz transceivers.

3.2.9.19. The CEUT shall be able to transmit and receive over the XCS MIL UHF LOS radios.

3.2.9.19.1. The CEUT shall be able to control (i.e. frequency selection, channel selection, output power, and squelch control. per 3.3.1.14) the XCS MIL UHF LOS radios.

3.2.9.20. The CEUT shall be able to transmit and receive over the XCS UHF MILSATCOM radios.

3.2.9.20.1. The CEUT shall be able to control (i.e. frequency selection, channel selection, output power, and squelch control. per 3.3.1.13) the XCS UHF MILSATCOM radios.

3.2.9.21. The full range of a selected radio’s squelch shall be selectable from the CEUTs if the selected radio provides the feature.

3.2.9.22. The CEUT shall have a volume control for the audio at the organic speaker or connected handset.

3.2.9.23. The CEUT shall be configurable to monitor multiple (up to ten active) radio circuits simultaneously with less than 2 user actions for each radio circuit.

3.2.9.24. The CEUT shall be capable of monitoring and controlling (i.e. manage, command, direct, and regulate the behavior of the listed systems per the requirements of section 3.2.9) a selected radio with less than two user actions.

3.2.9.25. The CEUT shall have the requisite cross talk isolation (red/black) US Navy certification to control CLASSIFIED (secure) and UNCLASSIFIED (non-secure) radio circuits simultaneously in accordance with CNSSAM TEMPEST 01/13 Red/Black Installation

Guidance Section 3.4 Table-2.

3.2.9.26. CEUT HMI Features

3.2.9.26.1. Reserved

3.2.9.26.2. The CEUT shall have either a touch panel or lighted key switches to select circuits and/or CEUT operations.

3.2.9.26.3. The CEUT operator controls shall be operable by hands wearing Outdoor Research

Incorporated of Seattle WA, Cage 096Y0, Alti Severe Cold Weather Gloves, P/N

71881.

3.2.9.26.4. The CEUT shall support operation and simultaneous monitoring by supervisor via a separate supervisor handset/headset.

3.2.9.26.5. Six CEUTs shall have a foot switch jack for the Push to Talk (PTT) function.

3.2.9.26.6. The CEUT shall have a PTT function in each handset/headset jack.

3.2.9.26.6.1. Reserved.

3.2.9.26.7. The CEUT shall have an internal speaker capable of audio volume from 0 decibels to 85 decibels.

3.2.9.26.7.1. The CEUT shall have audio volume controls for each ear of the headset.

3.2.9.26.7.2. The CEUT shall have audio volume controls for the internal speaker and assigned external speakers.

3.2.9.26.8. The CEUT shall have a prominent visual indicator when a CLASSIFIED or

UNCLASSIFIED circuit has been selected to operate.

3.2.9.26.9. The CEUT’s visual display shall be readable from four (4) feet or the distance of the operator(s) using a corded handset or headset whichever is longer.

3.2.9.26.10. The CEUT’s visual display brightness shall be adjustable by the operator.

3.2.9.26.10.1. The screen brightness shall be adjustable to zero.

3.2.9.26.10.2. The screen brightness control shall be via a physical control.

3.2.9.26.11. The CEUT’s visual display shall be readable (per MIL-STD-1472) under different ambient light conditions from total darkness to bright sunlight.

3.2.9.26.11.1. Only two CEUTs will be exposed to direct sunlight.

3.2.9.27. CEUT Physical Characteristics

3.2.9.27.1. The CEUT shall have a compact size no greater than 12” high, 12” wide, and 8” deep.

3.2.9.27.2. The basic CEUT enclosure shall be operable in relative humidity conditions of 0-

95%, non-condensing.

3.2.9.27.3. The CEUT shall be drip proof in accordance with MIL-DTL-2036E.Reserved

3.2.9.27.4. The CEUT shall be operable in temperatures ranging from – 15 degrees Fahrenheit to +95 degrees Fahrenheit. This requirement may be met by an enclosure that mitigates the CEUT exposure to the environmental extremes.

3.2.9.27.5. Reserved.

3.2.9.27.6. The CEUT shall be configurable through Original Equipment Manufacturer (OEM) supplied accessories/kits for console mounting, bulkhead mounting, and for weather deck bulkhead mounting or in a watertight enclosure per the National Electrical

Manufacturers Association (NEMA) publication NEMA 250-2014.

3.2.9.27.6.1. Only two of the CEUTs will be installed in NEMA 250-2014 enclosures.

3.2.9.27.7. The CEUT shall be powered by 24 Volt Direct Current (VDC).

3.2.9.27.7.1. The CEUT shall comply with Type 1 MIL-STD-167-1 vibration.

3.2.9.27.7.2. The CEUT shall comply with MIL-STD-461 for conducted and radiated susceptibility to electronic emissions.

3.2.9.27.8. Computer-aided alarm activation interfaces shall consist of individual single-action operator controls to trigger and secure General Announcing (GA) alarm announcements, except the General alarm.

3.2.9.27.9. The General alarm shall have a single-action operator control for alarm activation and automatically secure 15 seconds after activation.

3.2.9.27.10. Computer-aided alarm activation interfaces shall prominently display each GA alarm.

3.2.9.27.11. Alarm activation shall not exceed three discreet operator actions.

3.2.9.27.12. The CEUTs shall provide GA alarm controls distinguishable and operational under dark space conditions (per MIL-STD-1472 paragraph 5.5.3.1.6.d).

3.3. Software.

3.3.1. Communications Management Software.

3.3.1.1.1. The CMS shall have software applications to provide control (i.e. manage, command, direct, and regulate the behavior of the listed systems) of the XCS radios, the RED switching system, the BLACK Switching System, the CEUTs.

3.3.1.2. The Communications Management Software shall be user accessible from at least 15 distinct workstations that run Microsoft Windows 10.

3.3.1.3. The Communications Management Software shall be simultaneously user accessible from at least 5 user workstations.

3.3.1.3.1. Only one workstation shall be in control at any given time, other workstations shall be in view only mode.

3.3.1.4. User Accounts.

3.3.1.4.1. User Accounts on the Communications Management Software shall have full access to the control and monitoring capabilities of the CMS

3.3.1.4.2. User Accounts shall be unique to each user.

3.3.1.4.3. User logins shall require two-factor authentication, utilizing Department of Defense

(DOD) Public Key Infrastructure (PKI) with Common Access Cards (CACs). This may be accomplished in conjunction with the middleware software and certificates that DOD and the USCG currently use on their information systems. Login to the baseline Operating System via Two Factor Authentication shall not be considered acceptable credentials.

3.3.1.5. The Communications Management Software shall allow only one workstation and one user to be in control at any given time.

3.3.1.6. The Communications Management Software shall interface with the Internal Voice

Network

3.3.1.7. The Communications Management Software and CEUT shall allow for provisioning of phone numbers to CEUTs from the Internal Voice Network.

3.3.1.8. The Communications Management Software shall configure the Black Switching System to allow VOIP phones from the Internal Voice Network to access unclassified radio voice channels.

3.3.1.9. The Communications Management Software shall configure the Black Switching System to provide authorized CEUTs with access to unclassified radio voice channels.

3.3.1.10. The Communications Management Software shall configure the Red Switching System to provide authorized CEUTs with access to classified radio voice channels.

3.3.1.11. The Communications Management Software shall be capable of remotely configuring, managing, and monitoring the performance of XCS HF radios to the extent implemented in the radio’s remote-control features by its OEM.

3.3.1.11.1. This shall include frequency selection, channel selection, output power, bandwidth, voice/data mode, modulation type, transmit inhibit, Automatic Link Establishment

(ALE), radio performance (health) and squelch control.

3.3.1.11.1.1. Squelch control includes that the full range of a selected radio's squelch control shall be able to be remotely changed via a CEUT and via the

Communications Management Software.

3.3.1.11.1.2. ALE functions shall include: ALE mode and set the 'Caller IDs' for the transmitting and receiving functions.

3.3.1.12. The Communications Management Software shall be capable of remotely configuring, managing, and monitoring the performance of XCS VHF FM radios to the extent implemented in the radio’s remote-control features by its OEM.

3.3.1.12.1. This shall include frequency selection, channel selection, output power, modulation type, transmit inhibit, radio performance (health) and squelch control.

3.3.1.12.1.1. Squelch control includes that the full range of a selected radio's squelch control shall be able to be remotely changed via a CEUT and via the

Communications Management Software.

3.3.1.13. The Communications Management Software shall be capable of remotely configuring, managing, and monitoring the performance of XCS UHF MILSATCOM radios to the extent implemented in the radio’s remote-control features by its OEM.

3.3.1.13.1. This shall include frequency selection, channel selection, output power, bandwidth, voice/data mode, modulation type, DAMA configuration, transmit inhibit, encryption key selection, encryption zeroization, and radio performance (health).

3.3.1.13.1.1. Squelch control includes that the full range of a selected radio's squelch control shall be able to be remotely changed via a CEUT and via the

Communications Management Software.

3.3.1.14. The Communications Management Software shall be capable of remotely configuring, managing, and monitoring the performance of XCS UHF LOS radios to the extent implemented in the radio’s remote-control features by its OEM.

3.3.1.14.1. This shall include frequency selection, channel selection, output power, bandwidth, modulation type, transmit inhibit, encryption key selection, encryption zeroization, radio performance (health) and squelch control.

3.3.1.14.1.1. Squelch control includes that the full range of a selected radio's squelch control shall be able to be remotely changed via a CEUT and via the

Communications Management Software.

3.3.1.15. The Communications Management Software shall be capable of remotely configuring, managing, and monitoring the performance of XCS VHF AM radios to the extent implemented in the radio’s remote-control features by its OEM.

3.3.1.15.1. This shall include frequency selection, channel selection, output power, bandwidth, modulation type, transmit inhibit, radio performance (health) and squelch control.

3.3.1.15.1.1. Squelch control includes that the full range of a selected radio's squelch control shall be able to be remotely changed via a CEUT and via the

Communications Management Software.

3.3.1.16. The Communications Management Software shall be capable of remotely configuring, managing, and monitoring the performance of XCS Tactical UHF 400MHz radios to the extent implemented in the radio’s remote-control features by its OEM.

3.3.1.16.1. Reserved

3.3.1.16.2. This shall include frequency selection, channel selection, output power, bandwidth, modulation type, transmit inhibit, encryption key selection, encryption zeroization, radio performance (health) and squelch control.

3.3.1.16.2.1. Squelch control includes that the full range of a selected radio's squelch control shall be able to be remotely changed via a CEUT and via the

Communications Management Software.

3.3.1.17. The Communications Management Software shall be capable of remotely configuring, managing, and monitoring the performance of XCS Tactical UHF 700/800 MHz radios to the extent implemented in the radio’s remote-control features by its OEM.

3.3.1.17.1. This shall include frequency selection, channel selection, output power, bandwidth, modulation type, transmit inhibit, encryption key selection, encryption zeroization, radio performance (health) and squelch control.

3.3.1.17.1.1. Squelch control includes that the full range of a selected radio's squelch control shall be able to be remotely changed via a CEUT and via the

Communications Management Software.

3.3.1.18. The Communications Management Software shall be capable of remotely controlling (i.e.

manage, command, direct, and regulate the behavior of the listed systems) the XCS Switch

System

3.3.1.19. The Communications Management Software shall control the Voice Recorders to the extent of remote-control features by its OEM.

3.3.1.20. The Communications Management Software shall configure the Voice Recorders to the extent of remote-control features by its OEM.

3.3.1.21. Reserved.

3.3.1.22. The Communications Management Software shall grant and restrict user access to features and functions based on role.

3.3.1.23. The Communications Management Software shall provide the user with the ability to create Communications Plans, which are the specific configurations of all the XCS radios, Switching System channel assignments, CEUT configurations, and Voice Recorder configurations.

3.3.1.24. The Communications Management Software shall provide the user with the ability to save Communications Plans

3.3.1.25. The Communications Management Software shall provide the user with the ability to edit

Communications Plans

3.3.1.26. The Communications Management Software shall provide the user with the ability to delete Communications Plans

3.3.1.27. The Communications Management Software shall provide the user with the ability to archive Communications Plans

3.3.1.28. The Communications Management Software shall provide the user with the ability to restore Communications Plans

3.3.1.29. The Communications Management Software shall provide the user with the ability to activate Communications Plans

3.3.1.30. The Communications Management Software shall provide the user with the ability to save Communications Plans

3.3.1.31. The Communications Management Software shall provide the user with the ability to modify an established circuit in the active Communications Plan

3.3.1.32. The Communications Management Software shall provide the user with the ability to deactivate Communications Plans

3.3.1.33. The Communications Management Software shall provide the user with the ability to display the equipment status (e.g. up, down/failed, off/disabled, and standby) of the XCS in a:

3.3.1.33.1. Single view; A graphical representation of all CMS components and all connected radios in a single diagram using color coding to represent the equipment status.

3.3.1.33.2. Hierarchical view (e.g. HF, VHF, UHF); A graphical representation by type of component of all CMS components and all connected radios in a single diagram using color coding to represent the equipment status.

3.3.1.33.3. Circuit centric view (e.g. links, networks); A graphical representation by type of circuit of all CMS components and all connected radios in a single diagram using color coding to represent the equipment status.

3.3.1.34. The Communications Management Software shall log changes to Communications

Plans.

3.3.1.35. The Communications Management Software shall log changes in equipment status.

3.3.1.36. The Communications Management Software log entries shall include a time stamp.

3.3.1.37. The Communications Management Software shall provide frequency management rules

(i.e. prevent a radio from being tuned to the same frequency as another radio, or a frequency not allowed under the current communications plan) to prevent unauthorized or duplicate settings.

3.3.1.38. The Communications Management Software shall monitor the performance (health) of the XCS radios and Communications Management Software major components as implemented by the radio and equipment OEMs.

3.3.1.39. The Communications Management Software shall support IEEE 802.3 communication protocols through the hosting computer/server, and Operating Systems.

3.3.1.39.1. The Communications Management Software HMI shall be user accessible from the

Communications Management Software equipment rack(s).

3.3.1.40. The Communications Management Software HMI shall run as an application on top of the operating system.

3.3.1.40.1. The Communications Management Software HMI shall run on the Defense

Information System Agency (DISA) Secure Host Baseline (SHB) version of

Microsoft® Windows™ 10.

3.3.1.41. Communications Management Software updates shall be capable of being installed in the field by the user.

3.3.1.42. The Communications Management Software shall support reinstallation via third party imaging servers and software.

3.4. Cybersecurity.

3.4.1. This section contains additional requirements for an integrated approach to Cybersecurity and

Information Systems Security, Assessment and Authorization (A&A), including applicable standards and policies, general identification of secure areas, personnel security, physical security, TEMPEST and Force Protection.

3.4.2. The CMS shall employ physical, personnel, and procedural security features to provide protection adequate to handle, control, process, and store information utilizing the Risk

Management Framework (RMF) defined in DODI 8510.01 for DoD Information Technology

(IT).

3.4.2.1. Under the RMF CMS is categorized as High Confidentiality, High Integrity, and High

Availability with Cross Domain Solution Overlay

3.4.3. Definitions

3.4.3.1. Classified Information Processing Systems (CLIPS) - Any system or equipment that processes information at a Collateral or SCI/SAP level.

3.4.3.2. Collateral Information - Information identified as National Security Information (NSI)

(CONFIDENTIAL through TOP SECRET information) under the provisions of Executive

Order 13526 but which is not subject to enhanced security protection required for Special

Access Program (SAP) or other compartmented information.

3.4.3.3. Whitelisting - Methods used to control which devices are allowed to join a network. This term is also used to designate allowed software to be run on systems.

3.4.3.4. Authentication - Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in an information system.

3.4.4. Policies and Standards.

3.4.4.1. The following shall apply:

3.4.4.2. COMDTINST M2241.6 (FOUO), U.S. Coast Guard TEMPEST Program.

3.4.4.3. COMDTINST M5500.13F (FOUO), U.S. Coast Guard CyberSecurity Manual.

3.4.4.4. COMDTINST M5530.1C, Physical Security and Force Protection Program.

3.4.4.5. Reserved.

3.4.4.6. DoN CIO IA Pub 5239-31 Information Assurance Shipboard Red/Black Installation

Publication.

3.4.4.7. Reserved.

3.4.4.8. CNSSAM 01/13 Red/Black Installation Guidance.

3.4.4.9. Reserved.

3.4.4.10. DoDI 8510.01 Risk Management Framework (RMF) for DOD Information Technology

(IT).

3.4.4.11. Reserved.

3.4.4.12. Reserved.

3.4.4.13. Reserved.

3.4.4.14. DOD 5200.08-R DOD PHYSICAL SECURITY PROGRAM.

3.4.4.15. NIST SP 800-53 Rev4, Security and Privacy Controls for Federal Information Systems and Organizations.

3.4.4.16. Reserved.

3.4.4.17. Reserved.

3.4.4.18. DoDI 8540.01 Cross Domain Policy.

3.4.5. The CMS shall be designed to provide only essential capabilities.

3.4.6. The CMS shall use the principle of least privilege, allowing only authorized accesses for users or processes acting on behalf of users which are necessary to accomplish required system functions.

3.4.7. Wireless access shall not be allowed.

3.4.8. Wireless features for system hardware shall be physically and logically disabled. 3.4.9 Access

Control.

3.4.8.1. System hosts and network appliances shall be configured to prevent remote access from outside the system boundary. The system boundary is the offeror’s CMS.

3.4.8.2. Systems shall provide the capability to uniquely identify and authenticate users.

3.4.8.3. When a user is logged into the systems, a banner shall be displayed at the top of the screen indicating the user's name and role.

3.4.8.4. During system login, the user shall be presented with the terms of use banner and prompted for consent before access is granted.

3.4.8.4.1. The consent banner shall contain the following terms of use: “You are accessing a

U.S. Government (USG) Information System (IS) that is provided for USG authorized use only. Unauthorized access to this system is prohibited by Title 18 USC

Section 1030. By using this IS (which includes any device attached to this IS), you consent to the following conditions: Information system usage may be monitored, recorded, and subject to audit. Unauthorized use of the information system is prohibited and subject to criminal and civil penalties; and Use of the information system indicates consent to monitoring and recording."

3.4.8.4.2. The Administrator role shall have the ability to modify the terms of use banner.

3.4.8.5. The systems banner shall display a logout message for 30 seconds following a user logout.

3.4.8.6. The system shall lock user sessions after 5 minutes of inactivity per NIST SP 800-53 Rev4, Security and Privacy Controls for Federal Information Systems and Organizations, paragraph AC-11, Session Lock.

3.4.8.7. Users shall be logged out after 15 minutes of inactivity per NIST SP 800-53 Rev4, Security and Privacy Controls for Federal Information Systems and Organizations, paragraph AC-

12, Session Termination.

3.4.8.8. Systems shall invalidate session identifiers upon user logout or other session termination.

3.4.8.9. Systems shall enforce access restrictions and support auditing of the enforcement actions.

3.4.8.10. Systems shall protect audit information from unauthorized access.

3.4.8.11. The System shall provide users with the means to log out.

3.4.8.11.1. When users log out a message confirming the logout shall be displayed.

3.4.8.12. The system shall implement replay-resistant authentication mechanisms for network access to privileged accounts.

3.4.8.13. The systems shall be configured to require multi-factor authentication for account access.

3.4.8.14. Reserved.

3.4.8.15. Reserved.

3.4.8.16. The Administrator role shall have full administrative rights throughout the host operating system.

3.4.8.17. The system shall limit the number of invalid login attempts to three within a 15 minute period of time.

3.4.8.18. After three invalid login attempts within a 15 minute period, systems shall implement a

5-second pause between login attempts per NIST SP 800-53 Rev4, Security and Privacy

Controls for Federal Information Systems and Organizations, paragraph AC-7

Unsuccessful Logon Attempts.

3.4.8.19. The system shall generate a unique session identifier for each session, and recognize only system-generated session identifiers.

3.4.9. Account Management.

3.4.9.1. The System shall allow for the creation of Emergency Administrator accounts.

3.4.9.1.1. Emergency Administrator accounts login shall be via username and password instead of multi-factor authentication.

3.4.9.2. Emergency Administrator accounts shall never expire.

3.4.9.3. Emergency Administrator accounts shall never be automatically disabled.

3.4.9.4. Emergency Administrator accounts shall be marked as "Emergency Administrator

Account" within the system.

3.4.9.5. The Administrator role shall have the ability to configure the inactivity time period associated with automatically disabling accounts.

3.4.9.6. Systems shall include a configurable password management system that discovers, manages, audits, and monitors passwords and sessions, and uses automated mechanisms to reduce the risk of credential misuse.

3.4.9.7. The Administrator role shall be allowed to change password management system configuration settings.

3.4.9.8. The system shall enforce the following default password complexity:

3.4.9.9. Passwords shall be case-sensitive.

3.4.9.9.1. Passwords shall have at least one upper-case letter.

3.4.9.9.2. Passwords shall have at least one lower-case letter.

3.4.9.9.3. Passwords shall have at least one number.

3.4.9.9.4. Passwords shall have at least one special character.

3.4.9.9.5. Password shall have a minimum password length of 15 characters.

3.4.9.10. Systems shall enforce at least eight changed characters when new passwords are created.

3.4.9.10.1. Systems shall be configured to prevent previous password re-use for a specified number of passwords.

3.4.9.10.1.1. The system shall allow only the Administrator role to set the specified number of previous passwords that cannot be re-used.

3.4.9.11. Systems shall require a temporary password to be immediately changed at first login.

3.4.9.12. Systems shall cryptographically protect stored passwords.

3.4.9.13. Systems shall cryptographically protect transmitted passwords.

3.4.9.14. Passwords on system hardware shall be changed from the factory defaults.

3.4.9.15. Unencrypted static authenticators shall not be embedded in applications or access scripts or stored on function keys.

3.4.9.16. Systems shall prohibit the use of cached authenticators.

3.4.9.17. Systems shall obscure feedback of authentication information during the user authentication process to protect the information from possible exploitation.

3.4.10. System Configuration.

3.4.10.1. Software control mechanisms shall be implemented on hosts to ensure that only approved software can be installed or executed.

3.4.10.2. Systems shall implement whitelisting methods to deny-all, permit-by-exception for system communications and software configuration.

3.4.10.2.1. System network appliances shall be configured to allow only communication required for the operation of the system.

3.4.10.2.2. System hosts shall be configured to only allow communication and processes required for the operation of the system.

3.4.10.3. Systems shall use authorized ports, protocols, and services (PPS) listed in the DoDi

8551.01 referenced Category Assignments List (CAL). DoDI 8551.01.

3.4.10.3.1. Unused ports and services shall be disabled.

3.4.10.4. Systems shall be configured to only use Static IP addresses.

3.4.10.5. IP addresses shall be configurable by the Administrator.

3.4.10.6. Systems shall be configured in accordance with the Security Requirements Guides

(SRGs) and Security Technical Implementation Guides (STIGs) that apply to the Offeror’s proposed solution and have been published as of the date of contract award.

3.4.10.7. Systems shall isolate security functions from non-security functions. Physical ports and input/output devices not required for system operation or maintenance shall be disabled.

3.4.10.8. Unused software on system hardware shall be removed or disabled.

3.4.10.9. Systems shall allow scanning and active monitoring by Defense Information Systems

Agency (DISA) Host-Based Security System (HBSS) and by Assured Compliance

Assessment Solution (ACAS) software.

3.4.10.9.1. The System shall support these activities both locally from the same host, and remotely from another computing resource on the same network.

3.4.10.10. Systems shall operate in a predictable manner when invalid inputs are received.

3.4.10.11. An alert shall be sent to the Security Information Event Management system for any unauthorized attempt to modify system configuration.

3.4.11. Verification

3.4.11.1. Systems shall verify the integrity of the boot process of system hosts.

3.4.11.2. Systems shall incorporate integrity verification of software components.

3.4.11.2.1.1. In the event of a failure of a startup integrity check systems shall suspend the startup and display a warning message.

3.4.11.3. The system shall include a means of detecting changes to the configuration baseline that occur in an unauthorized manner.

3.4.11.3.1. Changes to the system baseline configuration shall result in a system alarm or alert, as applicable.

3.4.11.4. Systems shall utilize integrity verification mechanisms to detect changes to host and network firmware components.

3.4.11.4.1. Integrity check failures shall be alarmed.

3.4.11.4.2. Validation shall include, but is not limited to, ensuring that inputs are within expected ranges and are using correct formats.

3.4.12. Auditing

3.4.12.1. The System shall support interfacing to and monitoring by a Security Information Event

Management (SIEM) system.

3.4.12.2. System hosts and applicable network appliances shall store audit records on fixed media that contain event details to include: event type, time, location, source, outcome, user and identity of any associated subjects, and additional fields as configured by the ISEA

Administrator or Administrator.

3.4.12.3. The systems shall prevent the deletion or alteration of audit log records, with the exception of overwriting old records when storage capacity is reached.

3.4.12.4. The Administrator role shall have access to audit log records.

3.4.12.5. At a minimum, systems shall maintain an audit log that records the following system events:

3.4.12.5.1. Event type, time, location, source, outcome, user and identity of any associated subjects.

3.4.12.5.2. Host operating system account creation, deletion, enabling, disabling, and modification events.

3.4.12.5.3. User account changes.

3.4.12.5.4. Successful and unsuccessful authentication and access attempts.

3.4.12.5.5. Host startup and shutdown.

3.4.12.5.6. Application startup and shutdown.

3.4.12.5.7. Application failures.

3.4.12.5.8. Changes from the qualified/certified baseline configuration, to include software, firmware, and runtime behavior.

3.4.12.5.9. Privileged activities and system level access.

3.4.12.5.10. File or object creation, access, deletion, and modification.

3.4.12.5.11. Import or export of data.

3.4.12.5.12. Events when system host firewall or network Access Control Lists (ACLs) block traffic.

3.4.12.5.13. Integrity check verification failures for system software, firmware, and configuration.

3.4.12.5.14. Any unauthorized attempt to modify system configuration.

3.4.12.6. The audit information stored on systems hardware shall be protected from unauthorized access, deletion, or modification.

3.4.12.7. Systems shall, at a minimum, store 270 days of system audit information. 3.4.15.7.1.

When the storage limit is reached, the audit system shall overwrite the oldest information with the new records.

3.4.12.8. Systems shall have the capability to backup audit data onto an external storage device

/media in a comma separated values (CSV) format.

3.4.12.8.1. Systems shall provide the capability to specify the date and time range for the data being exported up to including the entire set of available logs.

3.4.12.9. Audit management and configuration of system components shall require an

Administrator login, as applicable.

3.4.12.10. The Administrator role shall have the system privileges required to select types of audited events.

3.4.12.11. Host-Based Protection

3.4.12.11.1. Hosts shall have host-based firewall mechanisms that allow only authorized network connections and communications.

3.4.12.11.2. System hosts shall incorporate malicious code protection mechanisms.

3.4.12.11.3. Malicious code protection mechanisms shall have the capability of being updated.

3.4.12.11.4. Hosts shall prevent unauthorized additions, removals, and modifications to the underlying file system and critical files and directories.

3.4.12.11.5. Hosts shall prevent the download of unauthorized mobile code.

3.4.12.11.6. Hosts shall prevent the execution of unauthorized mobile code.

3.4.12.11.7. Hosts shall prevent the automatic execution of mobile code that is not part of the system as designed.

3.4.12.12. Recovery

3.4.12.12.1. The system shall support recovery in the event of a cyber-security event or system failure.

3.4.12.12.1.1. The Administrator role shall have the ability to perform actions required to accomplish system recovery.

3.4.12.12.1.2. The Administrator account role shall have the ability to re-image system software.

3.4.12.12.2. In the event of a loss and subsequent restoration of power, the system shall reboot all hosts and network appliances, restore communications, and take no other automatic actions.

3.4.12.13. Physical Security

3.4.12.13.1. Each of the CMS systems shall have an Administrator account type.

3.4.12.13.2. The systems shall be configured to require multi-factor authentication for

Administrator account access.

3.4.12.13.3. Communications between Classified and Unclassified systems shall utilize a validated Cross Domain Solution (CDS) when available and appropriate, such as hosts managed by the Unified Cross Domain Services Management Office described in DoDI 8540.01.

3.4.12.14. Account Management

3.4.12.14.1. The system shall provide for an account management functionality.

3.4.12.15. System Configuration

3.4.12.15.1. The Administrator role shall be allowed to install, update, configure, and remove software.

3.4.12.15.2. The network shall be constructed from components approved on DISA's DoD

Information Network (DoDIN) Approved Products List (APL).

3.5. Electromagnetic Environmental Effects (E3).

3.5.1. Definitions

3.5.1.1. Below Deck Areas - Areas in the ship that are surrounded by a metallic structure such as the hull or superstructure.

3.5.1.2. Electromagnetic Environment (EME) - The resulting product of the power and time distribution , in various frequency ranges, of the radiated or conducted electromagnetic emissions levels which may be encountered by a military force, system, or platform in an intended operational environment

3.5.1.3. Electromagnetic Interference (EMI) - Any electromagnetic disturbance which interrupts, obstructs, or otherwise degrades or limits the effective performance of electronics/electrical equipment. It can be induced intentionally, as in some forms of electronic warfare, or unintentionally, as a result of a spurious emissions and responses, intermodulation products, and the like. Additionally, EMI may be caused by atmospheric phenomena, such as lightning and precipitation static and non- telecommunication equipment, such as vehicles and industry machinery.

3.5.1.4. Exposed Below Deck Areas - Areas within the ship that have large openings, which when open expose the equipment and cables in those spaces to the external electromagnetic environment. This can also include spaces that are surrounded by material that does not have at least as much shielding effectiveness as the structure. Examples of these areas may include the Pilothouse, hangar, boat bay, mooring stations, and intakes and uptake trunks.

3.5.1.5. Grounding Effectiveness - The effectiveness of metallic penetrations bonded at the ship's hull to direct currents induced on these penetrations by topside EMI to the ship's ground.

These metallic penetrations include pipes, waveguides, cables, and metal tubing.

3.5.1.6. Shield/shielding - A metal barrier of solid, screen, or braid construction used to protect electronic components, wires, or cables from EM energy; or used to reduce the emission of

EM energy from components, wires, or cabling.

3.5.1.7. Shield grounding adapter (SGA) - A device that provides 360 degrees grounding of a cable shield at a metal connection box or shipboard point of entry (POE) such as a stuffing tube or kick-pipe.

3.5.2. The CMS shall be electromagnetically compatible within itself such that system operational performance requirements are met.

3.5.3. The CMS shall be designed, verified, and integrated to meet the requirements of MIL-STD- 461 and MIL-STD-464. The following equipment is exempt from MIL-STD-461 compliance verification testing:

3.5.3.1. Equipment that was previously qualified with the applicable requirements of MIL-STD-

464 and MIL-STD-461G or later.

3.5.3.2. Equipment included in the Standard Electrical Symbol List, MIL-HDBK-290.

3.5.4.Grounding

3.5.3.3. Equipment and cable installation, shielding, and grounding shall meet the requirements of

MIL-STD-1310.

3.5.3.4. Shield Grounding Adapters (SGAs), Assemblies, Back-shells and Conduit Systems.

SGAs, shield ground assemblies, connector, EMI backshells, and conduit systems shall provide shielding without violating the structural integrity of the cable or conduit shields.

SGAs, shield ground assemblies, back-shells, and conduit systems shall provide at least 60 dB of grounding effectiveness.

3.5.4. Cables

3.5.4.1. Shielded cable shall have a surface transfer impedance no greater than 100 milliohms/m from 100 kHz to 600 MHz.

3.5.4.2. Add-on shielding, such as conduit and cable trunks, shall cover the entire length of unshielded cables.

3.5.4.3. Cable shielding shall be grounded 360 degrees at connector backshells, connection boxes, fixtures, cable trunks, and at ship points of entry in accordance with MIL-STD-1310.

3.6. Networking.

3.6.1. Unclassified CMS Network hosts and assets shall be capable of being internally interconnected via the ship’s unclassified LAN.

3.6.2. Unclassified CMS Network assets shall be managed and configured by the Unclassified

Network’s Network Management System

3.6.3. Network Media

3.6.3.1. The cabling for switch-to-switch cabling shall be single mode optical fiber.

3.6.3.2. Unless otherwise approved, single ferrule connectors shall be of the ST connector type per

MIL• DTL-83522/16. ST-to-ST adapters shall be per MIL-DTL-83522/17. Multiple termini connectors shall be per MIL-PRF-28876 and use the MIL-PRF- 29504/14 and /15 type termini.

3.6.3.3. Cables, connectors, and other fittings shall be in accordance with Defense Supply Center

Columbus (DSCC• VQP) Fiber Optic (FO) Qualified Products List (QPL), FO Military

Specification components.

3.6.4. User Cable Requirements

3.6.4.1. Where local cable for user connections is fiber optic cable, user connections shall be conventional…