A. 26 HID CMS Statment of Objective.pdf

Federal Energy Regulatory Commission

(FERC)

Statement of Objective

HID Global ActivID Credentialing Management System Server Maintenance and Support

Prepared by Federal Energy Regulatory Commission

Office of Exective Director

Contents Background Purpose Scope Task 1: Software, Licenses, Installation Service, Maintenance and Support Task 2- (Optional) Upgrade and Migrate to a new server Requirements Software requirement Deliverables Period of performance Place of Performance/Location of Work

Background

The Federal Energy Regulatory Commission (FERC or the Commission) is an independent agency that regulates the transmission and wholesale sale of electricity and natural gas in interstate commerce and regulates transportation of oil by pipelines in interstate commerce. FERC also reviews proposals to build interstate natural gas pipelines, natural gas storage projects, and liquefied natural gas (LNG) terminals, and FERC licenses non-federal hydropower projects. Congress assigned these responsibilities to FERC in various laws enacted over nearly 100 years, such as the Federal Power Act, Public Utility Regulatory Policies Act, Natural Gas Act, and Interstate Commerce Act. More recently, as part of the Energy Policy Act of 2005, Congress gave FERC additional responsibilities to protect the reliability and cybersecurity of the bulk-power system through the establishment and enforcement of mandatory reliability standards, as well as additional authority to enforce FERC regulatory requirements through the imposition of civil penalties and other means.

FERC utilizes the HID Global ActivID Credential Management System to issue and manage Personal Identity Verification (PIV) cards and PIV-Interoperable cards (HID Global Crescendo Smart Cards) in compliance with FIPS-201. The CMS Administrative Services incorporates issuance, device life cycle management, PIN management, certificate management, One-Time Password (OTP) management, user management, and configuration. FERC requires the ability to manage our authentication devices, data, and digital credentials (including PKI certificates) through the entire lifecycle. FERC also requires the ability to update user access in real-time, without additional costs or resources.

Purpose

The objective of this requirement is to renew the ActivID Global CMS licenses and services provided to the Federal Energy Regulatory Commission (FERC) to support FERC’s needs for Logical Access to our IT environment. PIV Cards are used to meet the requirements of the Homeland Security Presidential Directive 12: Policy for a Common Identification Standard for Federal Employees and Contractors.

Current configuration is represented below:

FERCs currently utilizes logical access cards for primary users issued by FedIDcard.gov USACCESS program and temporary logical access cards issued as alternate credentials (stopgap,) until the receipt of permanently issued FedIDCard, via secondary internal CA infrastructure via ActivID CMS virtual Appliance integrated with FERC’s PKI infrastructure. Credentials are used for logical and physical access, digital signing, and access to encrypted data on hard drives.

FERC OnPrem CA Infrastructure

PKI solution with Microsoft Certificate services and ncipher HSM. The PKI environment includes 3 tier CA infrastructure with 2 Offline CAs (Root and Policy) and one Online Issuing CA

The Secondary credential card’s primary purpose is to mitigate employee downtime should a user forget, lose, or damage their PIV cards or if longer access terms are required. Cards are temporary with no photo on the card and required to be returned upon receipt of the new primary access card (government PIV credential). The secondary credential shall afford the user the same privileges as the primary to include physical access, logical access and elevated administrative rights. The secondary use is for Privileged users admin accounts.

Scope

Task 1: Software, Licenses, Installation Service, Maintenance and Support

1. Renew existing 350 HID ActivID licenses.

2. Provide software maintenance and support services

Including access to security updates, patches, and vendor technical support.

Provide software, licenses, installation and configuration service, maintenance and support for the CMS appliance and products as defined in the table below.

CLIN Quantity Part Number Description

0001 350 CMSXXXXLCM4 ANNUAL ACTIVID CMS

PER USER STANDARD

SUPPORT &

MAINTENANCE

0002 5 ACCXXXXLCM5 ANNUAL HID ACTIVID

ACTIVCLIENT PER USER

LICENSE

Optional up to 300 CMSXXXXLC HID ACTIVID CMS PER

USER LICENSE

Optional HID ActivID

CMS Per Standard Setup

N/A HID ACTIVID

ACTIVCLIENT USAGE

TRACKING SOFTWARE

Migration of current software to new server Service Hours HID ACTIVID

PROFESSIONAL

SERVICES - MIGRATION

Optional installation of tracking software

Service Hours HID ACTIVID

PROFESSIONAL

SERVICES - USAGE

TRACKING SOFTWARE

Task 2- (Optional) Upgrade and Migrate to a new server

• Identify and plan for the replacement of legacy FIPS 140-2 cards that will no longer be compliant

• Identity if hardware\virtual server replacement is required (tokens, smart cards, HSMs) may be required to meet compliance o Deliver migration plan including:

• Transition from FIPS 140-2 to FIPS 140-3 validated modules.

• Integration with Active Directory / Entra ID / Azure AD.

• Testing of approved algorithm suites as per NIST SP 800-131A Rev. 2 transition guidance.

• Pilot, cutover, and rollback strategy.

Requirements

1. The OFFEROR must be an authorized HID reseller/partner

2. The OFFEROR must provide implementation, testing, and migration of all services and components

3. The OFFEROR must provide support for future migration efforts of the existing ActivID configurations to new managed appliance(s)

4. The OFFEROR must provide continued support of CMS and PKI integration and updates

5. The OFFEROR must provide executable options to all the tracking of issuance and use of temporary cards

6. The OFFEROR must provide an additional license when needed

7. The OFFEROR must possess all capabilities or provide trained personnel, consultancy advice, understanding of various equipment, activation of licenses, different authentication technologies to supply products and perform services as specified under this RFQ.

Software requirement

Card Management System

CMS must be able to:

1. Card Issuance

2. Card Update

3. Requests

Deliverables Offeror shall provide a written Statement of Work that addresses how Performance Objectives will be accomplished and how FERC will assess work performance against identified Performance Objects.

The Offeror must provide the required deliverables as outlined below in native formats such as MS Word, Excel or Visio format.

Deliverable Completion Date Provide a system design document.

The Offeror must provide support for Security team required documentation for obtaining internal ATO

Supply necessary functional SOPs for day 2 operations

Site Survey Acceptance Documentation

4. Credential maintenance

5. PIN Reset

6. Recycle cards 7.Self Service Portal for end user to reset PIN and update

System infrastructure

Provide the following:

7. FedRAMP and or FISMA / NIST compliance

8. NIST 800-53 and 800-32 standards

9. Validated at FIPS 140-2 level 3 or higher

10. The Solution Must maintain integration with FERC’s current Personnel Access Control System and IT network.

11. The Solution Must be configurable FIPS 140-2 ciphers with TLSv1.3

12. Compatible with USGCB compliant Windows 11 Enterprise workstations

13. The Solution Must Configure Active Directory authentication with Role Based Access Control with specific AD group

14. Compatible with Microsoft Active Directory and Entra ID

15. Able to issue certificates for user authentication

Optional Card Use Tracking

1. Provide user-friendly reports to be run by the badging office staff

2. Reports shall provide names and permissions of all issued cards by card number

3. Provide card usage information by card number

Requirements document Migration plan Testing Plan and Test Cases Acceptance Testing Procedures (ATP) Pre-Deployment Guide (PDG) Low-Level Design (LLD) System Design Document (based on FERC’s requirements)

As-Built Documentation Standard Operating Procedures The Offeror must configure and complete within 30 calendar days from issuing a Purchase Order.

Please note Deliverable table should be included in final proposal with completion dates.

Period of performance

Base: January 27, 2026 – January 26, 2027 Option Year 1: January 27, 2027 – January 26, 2028 Option Year 2: January 27, 2028 – January 26, 2029 Option Year 3: January 27, 2029 – January 26, 2030

Place of Performance/Location of Work Support will be required at the following FERC location(s):

FERC HQ

888 First Street NE, Washington DC 20426.