J.6 Contractor Furnished Property.docx

Attachment J.6 Contractor Furnished Property

RFP # 75FCMC19R0041

Disk space: 100 MB available Memory: 1 GBrowser: Internet Explorer 10 (or higher version) NOTE: More than one instance of NGD open at a time is not supported.

Monitor: 21”

1. Pointing device: mouse with scroll

2. Network interface: network interface card compatible with the call center Local Area Networks (LAN), which will ultimately allow workstation access to CMSNET

3. Word processor: Microsoft Word 2010 (or higher version) — required only for generation of correspondence.

4. Viewers: Microsoft Word Viewer and Adobe Acrobat Reader are required

Non-CMS-issued computers are not supported by the Centers for Medicare & Medicaid Services (CMS) Information Technology (IT) Service Desk. If your organization’s IT service professional has determined that a particular problem is not related to your hardware or software, and is directly related to CMS application access or functionality, your organization’s IT service professional should contact the CMS IT Service Desk for assistance.

1.2 Additional Hardware Requirements

The CMS Virtual Private Network (VPN) client requires a token to be registered and activated by Leidos, or a CMS Personal Identity Verification (PIV) Card to be issued by the Badging Office, for each contractor to access the VPN. The token authorized for use on the CMS VPN is the Rivest, Shamir, & Adleman (RSA) Model SID800.

1.3 Additional Software Requirements

The CMS AnyConnect VPN client installation attempts to install the various components on the C:\ drive of the target machine.

Any other VPN client software (i.e., SafeNet, Nortel, etc.) must be removed from the target machine before installation of the Cisco VPN client. If a different version of Cisco AnyConnect is installed, it may still be used, but the Contractor assumes responsibility for any conflicts related to the non-CMS version being used.

The following software is required:

It is assumed that the Program Files/Program Files (x86) folder is located on the C: drive.

Microsoft Windows 7 (32-bit or 64-bit), Windows 8/8.1, or Windows 10 must be used.

Microsoft Transmission Control Protocol (TCPP)/ Internet Protocol (IP) must be installed (normally this is installed by default).

Anti-virus software must be present, running, and current. Although Cisco advertises support for a wide array of A/V products, the following five enterprise anti-virus products have been tested and are known to work with the CMS VPN: McAfee, Norton, Trend Micro, CA, and Panda. The most current version should be used, unless otherwise advised to be incompatible with the current CMS National Advocacy Center (NAC) environment.

All current Microsoft service packs, hotfixes, and patches must be installed.

All installed software must be current with security patches.

If the VPN gateway detects that anti-virus software or security patches are either missing or outdated, access to the CMS network will be denied. The user is responsible for obtaining updated software. See Section 2.5 for additional detail.

1.4 Computer Security Requirements

The following security requirements must be met:

A separate operating system partition (dual boot) or a dedicated computer must be used for CMS VPN access. Virtual machines may be used, but are not supported by CMS.

Federally-mandated Federal Desktop Core Configuration (FDCC) settings must be adhered to as specified in CMS’s Minimum Security Configuration Standards for Operating Systems document.

The CMS Wireless Client Access Policy must be adhered to.

The hard drive(s) of the machine used for VPN connection must be encrypted using software that is compliant with Federal Information Processing Standard (FIPS) 140-2 requirements. In addition, the system must encrypt any data transferred to removable media (also via FIPS 140-2 compliant encryption software).

After 30 minutes of inactivity, the VPN connection must be terminated. If the computer is left unattended, the screen must be locked.

CMS retains the right to request that a contractor computer pass verification testing. As part of the verification, CMS will verify that all of the hardware, software, and security requirements have been met.

Prior to logging into the CMS network via the VPN, contractors shall submit a signed copy of the CMS Rules of Behavior document titled “Centers for Medicare and Medicaid Services (CMS) Rules of Behavior (ROB) Security Agreement for Interconnection to CMS Networks.”

The VPN machine cannot be connected to a corporate domain when connected to the CMS VPN.

Laptops must be physically secured (i.e. locked to a desk with a cable lock) at all times unless being transported by the user, in which case it must remain in the user’s possession.

The CMS password policy must be adhered to for all accounts used to access the CMS VPN. Federal Information Security Management Act of 2002 (FISMA)/ United States Government Configuration Baseline (USGCB)/ Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) requirements must be met for the local administrator account.

Two-factor token-based user authentication plus Active Directory authentication must be used.

A Secure Sockets Layer (SSL) tunnel will be used for data confidentiality.

Split tunneling will be disabled when connected to the CMS VPN if connecting from any network other than the CMS Central Office network.

All non-VPN traffic will be blocked by the VPN client when connected. This may cause some processes to run slowly or not at all.

The contractor shall monitor and adhere to all Information Technology (IT) policies, standards, procedures, directives, templates, and guidelines that govern the CMS Information Security Program. CMS IT Security Policy documents (such as the Acceptable Risk Safeguards (ARS), Policy for the Information Security Program (PISP), and Minimum Security Configurations, Wireless Access Policy) can be accessed at Information Security (http://www.cms.gov/informationsecurity).

1.5 Validation of Secure Computer

The Cisco Identity Service Engine (ISE) provides the ability to check security requirements on client computers and laptops. The AnyConnect ISE Posture Module will be installed on the computer during the client installation to facilitate communication with the ISE on the CMS VPN network. The ISE automatically updates itself daily to ensure client machines are checked against the most recent hot fixes and virus signature files. The ISE evaluates all requirements to determine whether access should be granted.

1.6 Pre-installation Requirements

Prior to installing this product and attempting to use it, please ensure that the following conditions are met:

Your machine is running the Microsoft Windows 7, Windows 8/8.1, or Windows 10 operating systems.

A separate operating system partition (dual boot) or a dedicated computer is being used for VPN access. Note: Machines imaged with a corporate image have proven problematic in the past, especially if a security suite (Trend Micro, Symantec, etc.) has been installed. If you are having trouble installing the Cisco AnyConnect VPN client on a corporate-imaged machine, please revert to a machine or boot partition running a “vanilla” copy of the OS.

All firewalls, including the Microsoft firewall, have been disabled. You can and should re-enable them after the installation is complete.

The VPN machine is not connected to a corporate network/domain.

No other VPN clients are installed on your computer.

You have verified that your Internet connection is functioning properly, and that Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) port 443 is permitted.

You have successfully completed the CMS VPN request process and you are approved to use CMS VPN services. See Section 1.1 of this document for full details regarding obtaining access to the CMS VPN.

You have an authorized RSA Token activated by Leidos, or a CMS-issued PIV Card.

You have administrator access to your local machine’s operating system (i.e. Windows 7, Windows 8/8.1, or Windows 10).

You have the latest Operating System (Windows 7, Windows 8/8.1, or Windows 10) security updates/patches.

Your anti-virus software and signature files are up to date (within 3 days of connection time).

Note:

Currently, the Cisco AnyConnect VPN Client for Windows 7 and Windows 8/8.1 have been fully tested for use on the CMS VPN. The Cisco AnyConnect VPN Client for Windows 10 OS is known to also function on the CMS VPN, but has not been fully vetted.

Certain security requirements will be validated and enforced by Cisco’s AnyConnect Identity Service Engine (ISE) Posture module (System Scan). If the machine does not meet the security requirements, it will be denied access until all requirements are met.

1.7 Computer System Requirements

The CMS AnyConnect VPN Client minimum system hardware requirements are as follows:

Intel Pentium-class processor or greater (or Advanced Micro Devices' (AMD) equivalent)

512 MB RAM

100 MB of available hard disk space Ethernet card and/or high speed connection (i.e., T1, Digital Subscriber Line (DSL), Cable Modem) to the Internet Microsoft Internet Explorer 7.x or later Super Video Graphics Array (VGA) (800 × 600) or higher-resolution video adapter CD-ROM or DVD drive RSA SID800 Token OR CMS-issued PIV Card

January 10, 2019 Page 5 of 5