Repsonses to Questions 79 to 97.pdf

70Z02320RAPB02300 Q&A #4

Question 79. CLIN 0001 Design and Test (Based period/9 months) is overly aggressive. Our experience in Design and Test of a new CMS is in the order of 18 to 24 months.

Please advise on the flexibility to this requirement.

Government Response: The base period must be completed within 9 months.

Question 80. Attachment B Requirement 3.4.8.7 states “Users shall be logged out after 15 minutes of inactivity.” Please clarify how this requirement differs from Requirement 4.4.8.6.

Please define what constitutes inactivity.

Government Response: Inactivity means no input from the keyboard or pointing device.

Refer to NIST SP 800-53 Rev4, Security and Privacy Controls for Federal Information Systems and Organizations, paragraph AC-11, Session Lock and paragraph AC-12, Session Termination for difference between session lock and termination. See revised Attachment B.

Question 81. Attachment B Requirement 3.4.8.10 states “Systems shall protect audit information from unauthorized access.” Does this requirement imply that a SYSLOG server is required? If yes, who is responsible for providing the SYSLOG server and functionality?

Government Response: No.

Question 82. Attachment B Requirement 3.4.8.12 states “The system shall implement replay-resistant authentication mechanisms for network access to privileged accounts.” Is this requirement referring to “man-in-the-middle”? If so, will TLS be adequate to address the replay?

Please define what the Government intends by privilege accounts.

Government Response: Refer to STIG Application Security and Development Security

Technical Implementation Guide and CCI -001942 for clarification of replay resistant and the role of TLS. Refer to NIST SP 800-53 Rev4, Security and Privacy Controls for Federal

Information Systems and Organizations, paragraph IA-2 Identification and Authentication for definitions of privileged accounts and users.

Question 83. 96. Attachment B Requirement 3.4.8.16 states “The Administrator role shall have full administrative rights throughout the host operating system” Can a user with administrator privileges modify the privileges of another user with administrator privileges?

Government Response: Yes.

Question 84. Attachment B Requirement 3.4.8.17 states “The system shall limit the number of invalid login attempts to three within a 15 minute period of time.” What action does the Government require being taken after the third invalid login attempt?

Government Response: See attachment B 3.4.8.18.

Question 85. 98. Attachment B Requirement 3.4.8.18 states “After three invalid login attempts within a 15 minute period, systems shall implement a 5 second pause between login attempts.” What is the purpose of the pause? What action does the Government intend the system to take during the pause?

Government Response: See NIST SP 800-53 Rev4, Security and Privacy Controls for

Federal Information Systems and Organizations, paragraph AC-7 Unsuccessful Logon Attempts.

See revised Attachment B.

Question 86. Attachment B Requirement 3.4.9.6 states” Systems shall include a configurable password management system.” Please define what the Government intends by configurable password management system.

Government Response: A system that discovers, manages, audits, and monitors passwords and sessions, and uses automated mechanisms to reduce the risk of credential misuse.

See revised Attachment B.

Question 87. Attachment B Requirement 3.4.10.1 states “Software control mechanisms shall be implemented on hosts to ensure only authorized, documented software is installed and/or executed.” Please define what the Government intends by authorized and documented software.

Who is responsible for authorizing the software?

Government Response: Software that has been approved by the government.

Documented refers to the written information necessary for configuration control of software items. See revised Attachment B.

Question 88. Attachment B Requirement 3.4.10.11 states “Any unauthorized attempt to modify system configuration shall generate an alarm or alert.” Where is the alarm/alert to be sent?

Government Response: Alarm/Alerts will be sent to a Security Information Event

Management (SIEM) system. See revised Attachment B.

Question 89. Attachment B Requirement 3.4.12.1 states “The System shall support interfacing to and monitoring by a Security Information Event Management (SIEM) system.”

Who is responsible for supplying and hosting the SIEM?

Government Response: The SIEM is part of the shipboard networks, detailed information will be provided per Attachment E.

Question 90. Attachment B Requirement 3.4.12.5.12 states “Events when system host firewall or network Access Control List (ACLs) block traffic.” Who is responsible providing and/or hosting the host firewall and the ACL list?

Government Response: The Offeror.

Question 91. Attachment B Requirement 3.5.3 states “The CMS shall be designed, verified, and integrated to meet the requirements of MIL-STD- 461 and MIL-STD-464. The following equipment is exempt from MIL-STD-461 compliance verification testing.” By verified, is the Government requiring testing or is analysis sufficient?

Government Response: Analysis is not sufficient. Formal testing must either be conducted, or a certificate of prior testing must be provided. See revised Attachment B.

Question 92. Attachment B Requirement 3.6.6.2.1 states” The network’s switch architecture shall have fault tolerant pathways between switches.” Please define what the

Government intends by fault tolerant pathways. Does this requirement imply that the CMS has its own networks that connect to but are separate from the Unclassified and Classified Networks?

Government Response: Fault tolerant means rerouting network traffic avoiding failed or failing pathways. Yes. See revised Attachment B.

Question 93. 114. Attachment B Requirement 3.6.6.2.2 states “The switches shall have fault tolerant connections both within the backbone and to the user connection environments.”

Please define what the Government intends by fault tolerant connections. Please define what the

Government intends by user connection environment.

Government Response: Fault tolerant means rerouting network traffic avoiding failed or failing pathways. User Connection Environment pertains to the CMS application users on the

UNCLASSLAN and CLASSLAN. See revised Attachment B.

Question 94. Attachment B Requirement 3.4.10.2 states “Systems shall employ whitelisting methods to deny-all, permit-by exception for system communications and software configuration.” Please define what the Government intends by whitelisting. Please identify what system communications that this requirement applies to?

Government Response: Whitelisting refers to restricting the use of information inputs, controlling which devices are allowed to join a network, designating specific software programs or entire categories of software programs authorized to execute on organizational systems, and preventing the execution of unauthorized software programs. It applies to all software and systems furnished by the offeror. See revised Attachment B.

Question 95. Attachment B Requirement 3.4.10.9 states” Systems shall allow scanning and active monitoring by Defense Information Systems Agency (DISA) Host-Based Security

System (HBSS) and by Assured Compliance Assessment Solution (ACAS) software.” Who is responsible for furnishing and hosting HBSS and ACAS?

Government Response: The Offeror.

Question 96. Attachment B Requirement 3.4.12 “Auditing” Where are the audit and event logs to be sent?

Government Response: Stored on a hard drive that is part of Offeror's CMS. See revised

Attachment B.

Question 97. Attachment B Requirement 3.4.10.6 states “Systems shall be configured in accordance with the applicable Security Requirements Guide (SRGs) and Security Technical

Implementation Guide (STIGs).” Who is responsible for selecting and/or approving selection of the SRGs and STIGs?

Government Response: SRGs and STIGS shall be those that apply to the offeror’s proposed solution and are published by DISA as of the date of contract award. These will be identified by the offeror per Attachment D, DI-009 and approved by the government. See revised

Attachment B.