A1.03_Sources_Sought_Attach2_Architecture_Design_26Sep22.pdf

SEC

Office of the Information Technology (OIT) Technical Review Board

DPS Detailed Architecture Design

DPS Detailed Architecture Design Page 1 of 32

Architecture Design Disgorgement and Penalty System (DPS)

Office Of infOrmAtiOn technOlOgy (Oit)

DPS Detailed Architecture Design Page 2 of 32

TABLE OF CONTENTS

1 Introduction

1.1 SUMMARY DETAILS

2 Scope

3 Assumptions

4 Proposed Infrastructure

4.1 PHYSICAL SERVERS

4.2 VIRTUALIZATION

4.3 SOFTWARE COMPONENTS

4.4 STORAGE REQUIREMENTS

4.5 NETWORKING

5 Network Architecture

5.1 NETWORK ARCHITECTURE AND DESIGN DESCRIPTION

5.2 NETWORK ENHANCEMENTS / CHANGES

5.3 COMMUNICATIONS AND PERFORMANCE

5.4 DATA FLOWS AND NETWORK PROTOCOLS

5.5 NETWORK TRAFFIC

6 Database Architecture (DPS databases in the Cloud)

6.1 DATABASE BRAND

6.2 DATABASE TYPE

6.3 INITIAL SIZE OF DATABASE

6.4 ANTICIPATED ANNUAL GROWTH

6.5 LOGICAL DATA MODEL (COTS EXEMPT)

6.6 PHYSICAL DATA MODEL (COTS EXEMPT)

6.7 DATA DICTIONARY (COTS EXEMPT)

6.8 DATABASE FEATURES

6.9 DATABASE ENVIRONMENT

6.10 DATABASE CONNECTION ACCOUNT TYPE

6.11 STORED PROCEDURES

6.12 CLUSTERING

6.13 DATABASE NORMALIZATION

6.14 DATA RETENTION

7 Principles for Availability and Maintenance

8 Security

8.1 INFORMATION SECURITY CLASSIFICATION

8.2 THREAT MITIGATION PLAN

8.3 SAR APPLICATION SECURITY

8.4 DATABASE SECURITY

8.5 CRYPTOGRAPHY AND KEY MANAGEMENT

9 Monitoring

10 Enterprise Backup and Recovery

10.1 BACKUPS

DPS Detailed Architecture Design Page 3 of 32

10.2 DISASTER RECOVERY

11 Enterprise Management and Capacity Planning

12 Risks

13 Deviations

13.1 TECHNOLOGY BRICKS

DPS Detailed Architecture Design Page 4 of 32

1 Introduction

1.1 Summary Details

PROJECT IDENTIFIER DESCRIPTION OF IDENTIFIER

Project Name Disgorgement and Penalty System (DPS)

Project Description Disgorgement and Penalty System (DPS) using Momentum, a Commercial Off-the-Shelf (COTS) software product, and it’s Document Management solution, OpenText Content Server (OTCS), procured from OpenText corporation. IQ Business Group (IQBG) assists VENDOR in the configuration of items in OTCS and support VENDOR in the development and implementation of the Bridge to deliver the required solution functionality.

Momentum is a Web-based system, developed using object-oriented design methodologies and development techniques. It provides the tools needed to effectively manage the financial and administrative operations of a Federal agency. Momentum provides comprehensive Federal financial management capabilities, document and records management, and an automated workflow engine. Momentum also features a scalable, system integration platform based on industry standards.

OpenText Content Server is a document management solution that provides the foundational repository and information governance backbone for the DPS.

The DPS effectively supports the tracking and management of financial obligations related to disgorgements, penalties, fees, and associated interest (DPFI). It supports DPFI processes related to recording debtors and their associated debts/obligations. The DPS identifies payments submitted by debtors and appropriately allocate those payments to their debts, facilitate the referral of relevant overdue debtors/obligations for collection, and appropriately and correctly support financial reporting processes, to include the generation of debtor payment history and payoff balance reports.

The DPS is hosted in a FedRAMP certified IaaS cloud. A vendor provides Infrastructure Operations and Application Maintenance and Support to manage the DPS Hosted Solution.

DPS Detailed Architecture Design Page 5 of 32

2 Scope The scope of DPS project is to implement a solution for SEC’s unique requirements to manage the financial transactions related to DPFI leveraging COTS products and other technology capabilities available in the industry to perform design, configuration, testing, training, and production deployment of the DPS in accordance with SEC OIT’s Service Delivery Framework (SDF) and associated procedures.

The business requirements for this project include enabling the SEC to manage the receivables and payments associated with Judiciary Awards resulting from federal district courts as well as SEC’s administrative proceedings. SEC is currently using a workflow-based system, manual processes, and associated spreadsheets to complete disgorgement and penalties tracking and management activities, with the resulting accounting entries posted to the Agency’s Financial System, ESC/Delphi. The previous system, based on the ImageNow platform, is used to generate accounts receivable (AR) forms for manual entry into Delphi.

SEC awarded a contract on September 28, 2016 to provide the DPS solution hosted on a FedRAMP certified IaaS Cloud. The DPS is designed to support the following key business processes (FIGURE 1 - DPS KEY BUSINESS PROCESSES):

• Efficiently accommodate unique relationships between obligators and the specific elements of a Judgment/Order. Capture payments in receivable accounts and Track multi-payment schedules spanning for specific period of time.

• Provide interfaces with various systems including, but not limited to, CourtLink/PACER, Delphi, Administrative Proceeding (AP) Drive, Treasury Collection Information Repository (CIR), Treasury FedDebt, and Treasury Offset Program (TOP).

• Provide integrated workflow/document management capability.

FIGURE 1 - DPS KEY BUSINESS PROCESSES

DPS Detailed Architecture Design Page 6 of 32

3 Assumptions The following assumptions and constraints have been clarified or identified post-award:

• The DPS solution must comply with Federal regulations and SEC policies.

• The DPS solution must be implemented according to the SEC’s OIT Service Delivery Framework.

• The DPS solution must integrate with external systems using the established standards supported by those systems.

• SEC provides timely access to DPS subject matter experts in support of all the phases of implementation, as needed.

• SEC provides timely review feedback to deliverables according to milestones defined in the project schedule.

• SEC facilitates communications with OIT teams and external systems stakeholders.

• SEC works with vendor to create and modify the needed Inter-agency Security Agreement (ISA) / Memorandum of Understanding (MOU) and set up connectivity from SEC as well as DPS’s external interfaces to the Primary Data Center (PDC) in a timely manner adhering to the project schedule.

• SEC’s Domain Name System (DNS) server is leveraged to create URLs to access DPS Non-Production and Production environments. SEC provides SSL certificates for those URLs too.

• SEC’s Active Directory Federation Services (ADFS) is used to configure Single Sign ON (SSO) for DPS.

• Sensitive PII data is stored in DPS Production externally hosted in the VENDOR FedRAMP certified IaaS Cloud.

• External System data is either directly (via API) or indirectly (manual file transfer) accessible from the VENDOR FedRAMP certified IaaS Cloud.

• Files are downloaded manually and placed in a location available to DPS for systems which do not have APIs or for which vendor proposed a manual or hybrid integration.

• External Systems implement security measures for authentication, authorization and secure connection.

• Files for Data Migration are pushed from SEC to the FedRAMP certified IaaS Cloud.

• SEC FEEDS server pulls and pushes the data and files from DPS hosted in the FedRAMP certified IaaS Cloud. No data and file transfers is initiated from DPS hosted in the FedRAMP certified IaaS Cloud to SEC.

DPS Detailed Architecture Design Page 7 of 32

4 Proposed Infrastructure

The DPS solution is implemented in the FedRAMP certified Cloud using VENDOR’s Momentum Financials version 7.9.4, a COTS Product, which provides the Federal Financials as well as Documents and Records Management capabilities.

DPS Application components are inter-connected using industry standard Web Services. FIGURE

2 - DPS APPLICATION ARCHITECTURE DIAGRAM describes various logical layers within the DPS solution as follows:

FIGURE 2 - DPS APPLICATION ARCHITECTURE DIAGRAM

• JEE Application Server: Oracle WebLogic is used as the JEE container where the presentation, Web Services support and some of the business services (logic) reside.

• C++ Application Server: Oracle Tuxedo is used to implement majority of the business services.

• WebMethods Platform: Software AG WebMethods is used to provide integration and workflow capability. DPS primarily leverages the workflow engine provided by WebMethods.

• Reporting Servers: Business Intelligence Reporting Tool (BIRT) is used for built-in reports and Pentaho Business Intelligence Server for ad hoc reporting.

• Database: Oracle 19c is used as the database management system.

• OpenText: OpenText 21.4, a fully featured content server based solution, is used to provide

Enterprise Content Management (ECM) with Records Retention, Disposal and Management capabilities.

DPS Detailed Architecture Design Page 8 of 32

• The middleware component of the Document Management Module (DMM) known as the “Bridge” is developed by IQBG. The Bridge includes user interface elements and proxy communication between Momentum and OpenText Content Server (OTCS) to facilitate the complex data capture, business rules, and validation requirements of business processes.

The Bridge proxies all calls to and from Momentum and OTCS, and vice versa. It is comprised of a standard ASP.Net Model-View-Controller (MVC) Entity Framework application. This handles the entire proxy among form/user interface (UI) presentation, workflow calls to OTCS workflows, data capture, and web service integration to post transaction to OTCS and Momentum.

Following are the core components of the OpenText Documents and Records Management System for DPS:

OpenText Content Server (OTCS): OTCS consists of the OpenText Content Server web front-end and OpenText Content Server Index Server. The web front-end server component is responsible for handling web requests from the end-users as well as from the other server components. The Index Server (Admin Server) is responsible for indexing all documents added to the OTCS System as well as being the core Search Engine to handle search requests from end-users.

OpenText Directory Services (OTDS): OTDS is a repository of user information and a collection of services to manage this user information. Directory Services is synchronized with your identity provider to pull user and group information from your identity provider automatically. Directory Services pushes these users and groups to OpenText components automatically and incrementally. This synchronization of user and group data across OpenText components allows Directory Services to enable single sign on and secure access to all OpenText components.

Brava! Enterprise: Brava! Enterprise software is a web application for the sharing and collaboration of all file types including Raster, CAD, PDF, and office documents. The primary Brava! Enterprise components are the Brava! Server, Brava! Client(s), Brava!

License, and Job Processor.

Internet Information Services (IIS): IIS is a flexible, secure and easy-to-manage Web server for hosting anything on the Web. From media streaming to web application hosting, IIS’s scalable and open architecture is ready to handle the most demanding tasks.

Apache Tomcat: Tomcat is an open source servlet container developed by the Apache Software Foundation (ASF). Tomcat implements the Java Servlet and Java Server Pages (JSP) specifications from Oracle Corporation, and provides a "pure Java" HTTP web server environment for Java code to run.

Oracle Database: Oracle database delivers industry leading performance, scalability, security and reliability on a choice of clustered or single-servers. It provides comprehensive features to easily manage the most demanding transaction processing, business intelligence, and content management applications.

4.1 Physical servers

The Cloud platform is built on VMware running on the Cisco Unified Computing System (UCS) platform using Cisco B200 M3/M4 Blades. It leverages vCloud Director in order

DPS Detailed Architecture Design Page 9 of 32 to manage IaaS architectures by monitoring and controlling various cloud-computing components, such as Security, VM provisioning, Self-service access etc.

In addition, the following Physical servers are set up and configured for the DPS Database Encryption effort which was mandated by SEC OIT Security:

• 6 Physical servers (Dell PowerEdge R740) for Oracle Key vault (OKV) – 2 for

Production, 2 for Non-Production and 2 for Disaster Recovery (DR) environment

• 3 Physical Database servers (Dell PowerEdge R740) – 1 for Production, 1 for Non-

Production and 1 for DR environment

• 6 Hardware Security Module (HSM) LUNA SA appliances – 2 for Production, 2 for

Non-Production and 2 for Disaster Recovery (DR) environment

4.2 Virtualization

Does this system support virtualization? Yes No

4.3 Software components

4.3.1 Operating System

The Operating system for DPS Web Server, SFTP server and Application servers in Non-Production environments (Development, Data Migration, System Test, Integration Testing, and UAT/Staging), Production and DR environments is Windows Server 2016.

The Operating system for DPS Database servers in Non-Production, Production and DR environments is Red Hat Enterprise Linux (RHEL) 7.9.

The Operating system for DPS OKV servers in Non-Production, Production and DR environments is Oracle Linux 7.9 OS.

The Operating system for DPS HSM appliances in Non-Production, Production and DR environments is CentOS.

5.3.2 Databases

Oracle 19c (19.16.0.0.0) databases are used for all DPS Non-Production, Production and DR environments.

4.4 Storage Requirements

The DPS VMs details including Storage, CPU, RAM, OS, Hard Disk type and Hosting Software for 6 Non-Production environments externally hosted at PDC are included in FIGURE 3 - DPS VMS DETAILS FOR NON-PRODUCTION ENVIRONMENTS. One instance of DMM (OTCS and Bridge) is created for each non-prod environment (Development, Data Migration, System Test, Integration Testing, UAT/Staging, and Training).

Development Application VM at Vendor’s external facility:

DPS Momentum DPS DMM (OpenText and Bridge)

Server Type VM VM

DPS Detailed Architecture Design Page 10 of 32

Server Count 1 1

CPU Intel Xenon CPU E5-2695 V2 @2.4GHz (8 CPUs)

Intel Xenon CPU E5-2695 V2 @2.4GHz (8 CPUs)

RAM 32 GB 32 GB

HD Type Hitachi Class 1 Enterprise Storage SAN

Hitachi Class 1 Enterprise Storage SAN

C:\ drive storage 80 GB 80 GB

D:\ drive storage 350 GB 120 GB

E:\ drive storage 200 GB 350 GB

F:\ drive storage 20 GB

Hosting Software version

Momentum 7.9.4 OpenText Content Server 21.4 OpenText Directory Services Brava!

DPS Bridge

OS (Name/Version) Windows Server 2016 Windows Server 2016

Data Migration Application VM at Vendor’s external facility:

Server Type VM VM

Server Count 1 1

CPU Intel Xenon CPU E5-2695 V2 @2.4GHz (8 CPUs)

Intel Xenon CPU E5-2695 V2 @2.4GHz (8 CPUs)

RAM 32 GB 32 GB

HD Type Hitachi Class 1 Enterprise Storage SAN

Hitachi Class 1 Enterprise Storage SAN

C:\ drive storage 80 GB 80 GB

D:\ drive storage 300 GB 120 GB

E:\ drive storage 250 GB 350 GB

F:\ drive storage 20 GB

Hosting Software version

Momentum 7.9.4 OpenText Content Server 21.4 OpenText Directory Services Brava!

UAT/Staging Application VMs at Vendor’s external facility:

Server Type VM VM

Server Count 1 1

CPU Intel Xenon CPU E5-2695 V2 @2.4GHz (8 CPUs)

Intel Xenon CPU E5-2695 V2 @2.4GHz (8 CPUs)

RAM 32 GB 32 GB

HD Type Hitachi Class 1 Enterprise Storage SAN

Hitachi Class 1 Enterprise Storage SAN

C:\ drive storage 80 GB 80 GB

D:\ drive storage 300 GB 120 GB

DPS Detailed Architecture Design Page 11 of 32

E:\ drive storage 350 GB

F:\ drive storage 20 GB

Hosting Software version

Momentum 7.9.4 OpenText Content Server 21.4 OpenText Directory Services Brava!

System Test Application VMs at Vendor’s external facility:

Server Type VM VM

Server Count 1 1

CPU Intel Xenon CPU E5-2695 V2 @2.4GHz (8 CPUs)

Intel Xenon CPU E5-2695 V2 @2.4GHz (8 CPUs)

RAM 32 GB 32 GB

HD Type Hitachi Class 1 Enterprise Storage SAN

Hitachi Class 1 Enterprise Storage SAN

C:\ drive storage 80 GB 80 GB

D:\ drive storage 300 GB 120 GB

E:\ drive storage 350 GB

F:\ drive storage 20 GB

Hosting Software version

Momentum 7.9.4 OpenText Content Server 21.4 OpenText Directory Services Brava!

Database, Oracle Key Vault (OKV) and Hardware Security Module (HSM) Servers/Appliances for All Non-Production Environments at Vendor’s external facility:

DPS Momentum and DMM Databases

Oracle Key Vault

(OKV)

Hardware Security Module (HSM)

Server Type Physical Server Physical Server Physical Appliances

Server Count 1 2 2

CPU 2 (8 cores per cpu) 2 (24 cores per cpu) N/A

RAM 64 GB 96 GB N/A

HD Type Hitachi Class 1 Enterprise Storage

SAN

Hitachi Class 1 Enterprise Storage

SAN

N/A

HD storage 11,300 GB 1500 GB N/A

Database (Name/Version)

Oracle 19c (19.16.0.0.0)

N/A N/A

OS

(Name/Version)

RHEL 7.9 Oracle Linux 7.9 OS version

CentOS

Web server VM for all Non-Production Environments at Vendor’s external facility:

DPS Momentum and DMM Server Type VM

DPS Detailed Architecture Design Page 12 of 32

Server Count 1

CPU Intel Xenon CPU E5-2695 V2 @2.4GHz (2 CPUs)

RAM 6 GB

HD Type Hitachi Class 1 Enterprise Storage SAN

C:\ drive storage 80 GB

D:\ drive storage 90 GB

E:\ drive storage

F:\ drive storage 20 GB

Hosting Software version IIS 10 Web server

OS (Name/Version) Windows Server 2016

FIGURE 3 - DPS VMS DETAILS FOR NON-PRODUCTION ENVIRONMENTS

The DPS VMs details including Storage, CPU, RAM, OS, Hard Disk type and Hosting Software for Production environment at PDC and Disaster Recovery (DR) environment are included in FIGURE 4 - DPS VMS DETAILS FOR PRODUCTION AND DR ENVIRONMENTS:

Production Web Server and Application VMs at Vendor’s external facility:

Web Servers

Momentum Tuxedo

Momentum WebLogic

Momentum WebMethods

Content Server Front- End and Admin

Brava! BRIDGE

Server Type VM VM VM VM VM VM VM

Server Count 2 2 2 2 2 1 1

CPU Intel Xenon

CPU E5-

2695 V2 @2.4GHz

(2 CPU)

Intel Xenon

CPU E5-

2695 V2 @2.4GHz (5 CPUs)

Intel Xenon

CPU E5-

2695 V2 @2.4GHz (8 CPUs)

Intel Xenon

CPU E5-2695

V2 @2.4GHz (4 CPUs)

Intel Xenon

CPU E5-

2695 V2 @2.4GHz (8 CPUs)

Intel Xenon

CPU E5-

2695 V2 @2.4GHz (8 CPUs)

Intel Xenon

CPU E5-

2695 V2 @2.4GHz (4 CPUs)

RAM 6 GB 12 GB 24 GB 8 GB 32 GB 32 GB 8 GB

HD Type Hitachi Class 1 Enterprise Storage

SAN

Hitachi Class 1 Enterprise Storage

SAN

Hitachi Class 1 Enterprise Storage

SAN

Hitachi Class 1 Enterprise Storage SAN

Hitachi Class 1 Enterprise Storage

SAN

Hitachi Class 1 Enterprise Storage

SAN

Hitachi Class 1 Enterprise Storage

SAN

C:\ drive storage

80 GB 80 GB 80 GB 80 GB 80 GB 80 GB 80 GB

D:\ drive storage

90 GB 150 GB 150 GB 150 GB 120 GB 150 GB 120 GB

E:\ drive storage

850 GB

(On 1

VM)

F:\ drive storage

20 GB (On

1 VM)

5 GB (On 1

VM)

80 GB (On 1

Hosting Software version

Web Server –

IIS 10

Momentum

7.9.4 - Tuxedo 19cR2 64-bit (12.1.3)

Momentum CoreIdp 7.9.4 Momentum

7.9.4 –

Momentum

7.9.4 – webMethods

9.8 for Workflow

OpenText Content Server 21.4 OpenText

OpenText Content Server 21.4

Brava!

DPS Detailed Architecture Design Page 13 of 32

WebLogic 19c 64-bit (12.1.3)

BIRT 4.5.0

Pentaho 6.0.1.0- 386+ webMethods

9.8 for Interfaces Integration

Directory Services (on 1st of the 2)

DPS

Bridge on 2nd one

OS

(Name/Version)

Windows Server

Windows Server

Windows Server

Windows Server 2016

Windows Server

Windows Server

Windows Server

Database, OKV and HSM Servers/Appliances for Production Environment at VENDOR’s external facility:

DPS Momentum and DMM Databases

Oracle Key Vault (OKV) Hardware Security Module (HSM)

Server Type Physical Server Physical Server Physical Appliances

Server Count 1 2 2

CPU 2 (8 cores per cpu) 2 (24 cores per cpu) N/A

RAM 32 GB 96 GB N/A

HD Type Hitachi Class 1 Enterprise Storage SAN

Hitachi Class 1 Enterprise Storage SAN

N/A

HD storage 10,300 GB 1500 GB N/A

Database (Name/Version) Oracle 19c (19.16.0.0.0) N/A N/A

OS (Name/Version) RHEL 7.9 Oracle Linux 7.9 OS

DR Web Server and Application VMs at VENDOR’s external facility:

Web Servers

Momentum Tuxedo

Momentum WebLogic

Momentum WebMethods

Content Server Front- End and Admin

Brava! BRIDGE

Server Type VM VM VM VM VM VM VM

Server Count 2 2 2 2 2 1 1

CPU Intel Xenon

CPU E5-

2695 V2 @2.4GHz

(2 CPU)

Intel Xenon

CPU E5-

2695 V2 @2.4GHz (5 CPUs)

Intel Xenon

CPU E5-

2695 V2 @2.4GHz (8 CPUs)

Intel Xenon

CPU E5-2695

V2 @2.4GHz (4 CPUs)

Intel Xenon

CPU E5-

2695 V2 @2.4GHz (8 CPUs)

Intel Xenon

CPU E5-2695

V2 @2.4GHz (8 CPUs)

Intel Xenon

CPU E5-2695

V2 @2.4GHz (4 CPUs)

RAM 6 GB 12 GB 24 GB 8 GB 32 GB 32 GB 8 GB

HD Type Hitachi Class 1 Enterprise Storage

SAN

Hitachi Class 1 Enterprise Storage

SAN

Hitachi Class 1 Enterprise Storage

SAN

Hitachi Class 1 Enterprise Storage SAN

Hitachi Class 1 Enterprise Storage

SAN

Hitachi Class 1 Enterprise Storage SAN

Hitachi Class 1 Enterprise Storage SAN

C:\ drive storage

80 GB 80 GB 80 GB 80 GB 80 GB 80 GB 80 GB

D:\ drive storage

90 GB 150 GB 150 GB 150 GB 120 GB 150 GB 120 GB

E:\ drive storage

850 GB

(On 1

F:\ drive storage

20 GB (On

1 VM)

5 GB (On 1

VM)

80 GB (On 1

DPS Detailed Architecture Design Page 14 of 32

Hosting Software version

Web Server –

IIS 10

Momentum

7.9.4 - Tuxedo 19cR2 64-bit (12.1.3)

Momentum CoreIdp 7.9.4 Momentum

7.9.4 – WebLogic 19c 64-bit (12.1.3)

BIRT 4.5.0

Pentaho 6.0.1.0- 386+

Momentum

7.9.4 – webMethods

9.8 for Workflow webMethods

9.8 for Interfaces Integration

OpenText Content Server 21.4 OpenText Directory Services (on 1st of the 2)

DPS

Bridge on 2nd one

OpenText Content Server 21.4

Brava!

OS

(Name/Version)

Windows Server

Windows Server

Windows Server

Windows Server 2016

Windows Server

Windows Server 2016

Windows Server 2016

Database, OKV and HSM Servers/Appliances for DR Environment at VENDOR’s external facility:

DPS Momentum and DMM Databases

Oracle Key Vault (OKV) Hardware Security Module (HSM)

Server Type Physical Server Physical Server Physical Appliances

Server Count 1 2 2

CPU 2 (8 cores per cpu) 2 (24 cores per cpu) N/A

RAM 32 GB 96 GB N/A

HD Type Hitachi Class 1 Enterprise Storage SAN

Hitachi Class 1 Enterprise Storage SAN

N/A

HD storage 10,300 GB 1500 GB N/A

Database (Name/Version) Oracle 19c (19.16.0.0.0) N/A N/A

OS (Name/Version) RHEL 7.9 Oracle Linux 7.9 OS

FIGURE 4 - DPS VMS DETAILS FOR PRODUCTION AND DR ENVIRONMENTS

VENDOR performs availability and performance monitoring of the DPS Non-Production and Production VMs at PDC, including resources like CPU, Memory and disk space.

Additionally, server availability monitored through ping and /or service monitoring. A warning/alert is generated when the resource usage reaches certain threshold of the maximum capacity.

4.5 Networking

The VENDOR IaaS Cloud Service (VENDOR IaaS Cloud) provides virtual machine and web hosting services in the cloud enabling scalable, redundant, dynamic computing services. The VENDOR IaaS Cloud allows Federal agencies to procure and provision computing services and Web hosting services online via the Internet. The VENDOR IaaS Cloud also allows users to securely load systems and data onto the VENDOR IaaS Cloud remotely from the Internet.

The VENDOR IaaS Cloud is designed to be scalable to permit a customer to request computing services and capacity on-demand and provision services and capacity dynamically. The VENDOR IaaS Cloud provides a high-availability infrastructure through hardware with redundant internal components and a redundant architecture that enables

DPS Detailed Architecture Design Page 15 of 32 automatic failover of the infrastructure components that operate the VENDOR IaaS Cloud.

VENDOR's IaaS Cloud provides Federal Information Security Management Act (FISMA) compliance for Low and Moderate Impact systems, and is FedRAMP certified (FedRAMP P-ATO and Defense Information Systems Agency (DISA) P-ATO).

DPS Non-Production and Production environments are hosted in the VENDOR FedRAMP certified Cloud. The Web servers, SFTP servers, Application servers and Database required for DPS are installed on the Virtual Machines (VMs) on separate VLANs for Non-Production and Production environments in the VENDOR FedRAMP Cloud. The VMs for Web and SFTP servers are provisioned in the De-Militarized Zone

(DMZ).

5 Network Architecture

5.1 Network Architecture and Design Description

DPS doesn’t have any non-standard networking requirements. DPS system is hosted in the VENDOR FedRAMP certified Cloud in PDC and is accessed by the internal SEC users. The maximum number of concurrent users for the system is expected to be 50- 75.

An IPSec VPN tunnel is established between SEC and PDC to allow the SEC users to be able to access the Disgorgement and Penalty System (DPS) via a dedicated secure connection. The information transmitted over this IPSec VPN tunnel is encrypted using AES-256-bit encryption.

DPS interacts with the following systems internal and external to SEC as depicted in

FIGURE 7 - DPS TOUCHPOINTS DIAGRAM:

• DPS interfaces directly with CourtLink. This is a batch interface and DPS pulls files from CourtLink via SFTP.

• DPS has interfaces directly with Delphi for GL Extract and Reconciliation. DPS uses the SFTP protocol to pull/push the files from/to DPS hosted in the VENDOR FedRAMP Cloud at PDC and push/pull them to/from ESC over the IPsec VPN tunnel set up between ESC and PDC.

• DPS interfaces directly with Treasury CIR. This is a batch interface developed using webMethods and DPS pulls files from CIR using HTTPS protocol.

• DPS interfaces directly with Board of Governors of Federal Reserve System (FRS) to download a file using HTTPs URL.

• DPS has a direct interface with Treasury FedDebt and TOP for Collections and Referrals data. This is a batch interface developed using webMethods and DPS pulls/pushes files from/to Treasury FedDebt and TOP using SFTP protocol.

DPS Detailed Architecture Design Page 16 of 32

• DPS has a batch interface with SEC FEEDS servers for HUB. MicroStrategy pulls the data from HUB in a CSV file which is then pushed by SEC FEEDs servers to DPS via SFTP protocol over the IPSec tunnel set up between SEC and PDC.

• DPS has a batch interface with SEC FEEDS servers for Treasury Referral Authorizations and Returns/Recalls via SFTP protocol over the IPSec tunnel set up between SEC and PDC.

• DPS has a batch interface with AP Drive through SEC FEEDS servers. SEC FEEDS server pushes the files form AP Drive to the VENDOR FedRAMP Cloud at PDC via SFTP over the IPsec VPN tunnel set up between SEC and PDC.

FIGURE 5 - DPS TOUCHPOINTS DIAGRAM

5.1.1 DPS Interface File Transfer Architecture

DPS application is located within the DPS Trusted Layer in the VENDOR FedRAMP certified IaaS Cloud which is separated from the Internet by the DPS Demilitarized Zone (DMZ). The DMZ is comprised of two firewalls, an Inner Firewall which separates the DMZ from the trusted layer, and an Outer Firewall which separates the DMZ from the Internet. In this architecture the Inner Firewall only allows connections that originate from the trusted layer into the DMZ. The Outer Firewall allows connections in both directions.

DPS Detailed Architecture Design Page 17 of 32

File transfers are categorized according to the origin of the connection request – Internal (i.e. from within the trusted layer) or External (i.e. originating from the Internet). File transfers to/from CIR, TOP, FedDebt, Federal Reserve Board (FRB), ESC/Delphi and CourtLink has Internal connection origins. File transfers to/from SEC Feeds has External connection origins. All External Connections terminate at DPS DMZ Server. Internal Connections are either to the DPS DMZ server or directly to the external entity. The firewall is configured to allow the trusted layer to connect to trusted external servers.

FIGURE 6 - DPS INERFACE FILE TRANSFER CONNECTION ORIGINS

All connections are secured through SFTP or HTTPS to ensure that files are:

• Transferred only to/from with authenticated, trusted entities

• Encrypted and have protected integrity during transport

All credentials and security configurations are stored within the DPS Trusted Layer. SSH keys and x.509 certificates are generated and maintained within the DPS Trusted Layer.

5.1.1.1 Internal Connection Origin File Transfers

DPS uses Internal Connection Origins to transfer files with CIR, FedDebt, TOP, CourtLink, ESC/Delphi and FRB. CIR and FRB use HTTPS to share files while FedDebt, TOP, and CourtLink use SFTP. The DPS DMZ firewall rules are configured to allow connections from the middleware server in the trusted layer.

The middleware server has both SFTP and HTTPS client capabilities.

DPS Trusted LayerInternet DPS

DMZ

DPS DMZ

Server

Internal Connection

Origin

DPS Trusted Server

External Connection

Origin

External ServerExternal Server Trusted External Servers

External ServerExternal Server Trusted External Servers

In ne r F ire w al l

O ut er F ire w al l

DPS Detailed Architecture Design Page 18 of 32

FIGURE 7 - DPS INTERNAL CONNECTION ORIGIN FILE TRANSFERS

5.1.1.2 External Connection Origin File Transfers

SEC requires that SEC FEEDs establish connections for file transfers to and from SEC. Therefore, DPS uses External Connection Origin to transfer files using SEC FEEDs over SFTP. The DPS DMZ firewall rules are configured to only allow external SSH connections from SEC FEEDs over the IPSec VPN tunnel set up between SEC and the DPS DMZ SFTP server at PDC. Files transfers to/from SEC FEEDs includes Administrative Proceeding (AP) Drive, Treasury Referral Authorizations, and HUB file exports.

FIGURE 8- DPS EXTERNAL CONNECTION ORIGIN FILE TRANSFERS

To prevent files at rest in the DMZ, the architecture uses a reverse proxy SSH tunnel into the DPS Trusted Layer. The DPS Trusted SSH/SFTP Server uses IP Whitelist, Non-Standard Ports, and SSH keys to secure the connection to the SEC FEEDs server.

US Department of the Treasury

CIR

DPS

DMZ

DPS Trusted Middleware

Server (webMethods)

External DMZ Firewall Rules allow outbound connection requests From DPS Trusted Layer to Treasury, CourtLink, and Federal Reserve Board

Internal DMZ Firewall Rules only allow connection requests from DPS Trusted Client

DPS Trusted Layer DPS Trusted SSH/SFTP Client Uses IP/Subnet

Whitelist, SSH Keys, and Certificate Truststore to secure connections to trusted entities.

FedDebt

TOP

CourtLink

Internet

SSH Tunnel

SSH Tunnel

SSH Tunnel

Federal Reserve Board

HTTPS

Legend SSH Tunnel

SFTP Connection

HTTPS Connection

CIR Designated HTTPS Client

HTTPS

SEC

SEC Feeds DPS Trusted

SSH/SFTP

Server

DPS Trusted LayerInternet External DMZ Firewall Rules only allow inbound connection requests

From SEC Designated Subnet

Internal DMZ Firewall Rules only allow connection requests from DPS Trusted Layer

DPS

DMZ

DPS

DMZ

SSH/SFTP

Server

VPN Trusted SSH Server Uses IP/Subnet Whitelist, Non-

Standard port, and SSH Keys to secure connections from SEC Feeds Server.

SSH Tunnel Reverse Proxy SSH Tunnel

Legend

SSH Tunnel

SFTP Connection

VPN Connection

DPS Detailed Architecture Design Page 19 of 32

5.1.1.3 Reverse Proxy Architecture

The reverse proxy architecture is implemented using:

• SSH SFTP Server in the DPS DMZ

• SSH/SFTP Client and SSF/SFTP Server in the DPS Trusted Layer

FIGURE 9- DPS EXTERNAL CONNECTION ORIGIN FILE TRANSFERS

The DPS Trusted SSH/SFTP Client establishes a persistent connection to the DPS DMZ SSH/SFTP Server. The Inner Firewall is configured with a rule to allow this connection. The client also establishes a persistent connection to the DPS Trusted SSH/SFTP Server. DPS Trusted SSH/SFTP Client is configured with the Port Forwarding Rules to establish a SSH tunnel from the DMZ SSH/SFTP Server to the DPS Trusted SSH/SFTP Server. This tunnel is secured via SSH keys, whitelisted IP addresses, non-standard ports, and firewall rules.

When the SEC Feeds server connects to the DMZ SSH/SFTP Server the port forwarding connects SEC FEEDs to the DPS Trusted SSH/SFTP Server, which uses SSH keys for authentication. The SEC Feeds SSH key is associated with a local Windows account with least privileges to read/write to the appropriate AP Drive, HUB, and Treasury Referral Authorization folders.

5.1.1.4 Architecture Components

Within the Trusted Layer, the SFTP Clients and Servers are located on the same machine.

• webMethods is used for the DPS Trusted Middleware Server for all internal originating SFTP and HTTPS connections.

• Bitvise SSH Server is used for the DPS DMZ SSH/SFTP Server and the DPS Trusted SSH/SFTP Server. It is also be used to generate the Server SSH Keys.

• Bitvise Client (Tunnelier) is used for the DPS Trusted SSH/SFTP Client. It is also be used to generate the reverse proxy client SSH keys.

• Bitvise Client and Server components are used to create their own respective SSH keys.

DPS Detailed Architecture Design Page 20 of 32

5.1.1.5 Bitvise Authentication and Authorization

Bitvise uses SSH key authentication to associate a login with a Domain Windows Account for OS level permissions. This account is configured with least privileges. In the case of the DMZ SSH server, it has read only access to the sftp folder on the designated drive. In the case of the Trusted SSH Server in the Application Layer, it has read/write access to the file transfer folders on the designated drive.

Bitvise provides the ability to create Windows Groups and assign the Domain Windows Account to the groups. This simplifies the management of permissions across multiple accounts.

Bitvise also has the concept of Virtual Groups and Virtual Accounts. These accounts can be associated with the Domain Windows accounts and provide finer layers of security beyond OS permissions.

5.1.2 DPS Database Encryption using OKV and HSM

The original proposal for DPS included the Standard version of Oracle 19c database without any tablespace level encryption. Upon subsequent review from the SEC OIT Security team, VENDOR has been mandated by SEC OIT Security team to implement the tablespace level encryption using OKVs and HSMs. Per this revised requirement, the Oracle databases in all DPS Production, Non- Production and DR environments are encrypted at the tablespace level using the Transparent Data Encryption (TDE) available in Oracle 19.16.0.0.0 Enterprise Edition with the Oracle Advance Security feature. The TDE encryption is set up using OKV and HSM to store the TDE Master Encryption Key as described in

FIGURE 12 - ORACLE TDE USING ORACLE KEY VALUT AND SAFENET HSM:

DPS Detailed Architecture Design Page 21 of 32

FIGURE 10 - ORACLE TDE USING ORACLE KEY VALUT AND SAFENET HSM

The Production (PROD) VLANs and Non-Production (TST) VLANS in the above diagram communicate through PDC firewalls to the SEC Network via IPSec tunnels between PDC and SEC Primary (D2) and DR (D1) sites. The existing DMZ, Application and Database VLANs in both Production and Non-Production environments are leveraged to manage the communication between the PDC and the SEC network. The HSM appliances are added to the existing Database VLANs in both Production and Non-Production environments.

5.2 Network Enhancements / Changes

Are network enhancements / changes required? Yes No

DPS does not require any Network related hardware changes. But Firewall rules need to be created for:

• DPS application URL access from SEC Users’ workstations connected to SEC

Network

• DPS application URL access from SEC Users’ workstations connected to SEC VPN

• SEC FEEDS servers to push/pull files to/from the VENDOR FedRAMP Cloud at

PDC.

DPS Detailed Architecture Design Page 22 of 32

The URLs and corresponding SSL certificates to access DPS applications in the VENDOR Cloud at PDC are provided by SEC. The SEC DNS server entries corresponding to those URLs need to be resolved to the private VENDOR Cloud IPs configured for DPS applications.

5.3 Communications and Performance

Communications between SEC and Vendor Cloud at PDC are described in Section 6.5.

The Service Level Agreement (SLA) agreed upon by SEC and VENDOR for DPS is applicable.

5.4 Data Flows and Network Protocols

Source Destination Port(s) / Protocols

Encrypted or Not

Encrypted Description

Estimated Number of

Connections Between Untrusted Zone (Internet) and Public Access Zone (DMZ)

Within Public Access Zone (DMZ)

Between Public Access Zone (DMZ) and Production Zone (Restricted)

Within Production Zone (Restricted) – Over IPSec VPN between SEC and VENDOR Cloud at PDC

SEC FEEDS

(AP Files, Treasury Referrals, HUB CSV files)

DPS Encrypted Treasury Referrals and Collections related Info

SEC Users

(OFM, ENF)

DPS Encrypted DPS application access

Between VPN and Production Zone (Restricted) SEC Users

(OFM, ENF)

DPS Encrypted DPS application access

TABLE 1 - DATA FLOW INBOUND AND OUTBOUND, NETWORK PROTOCOLS

5.5 Network Traffic

DPS Detailed Architecture Design Page 23 of 32

Identify the location of the users of the application the network access required.

TABLE 2 - USER LOCATIONS

Identify the types of data objects that is passed between the user and the application, and the anticipated size.

The table below offers a sample list of data objects. For more information, consult the Network Engineering Branch.

Type of Object Size in Kbytes Terminal Screen 4

E-Mail Message 10

Web Page 50

Spreadsheet 100

Word Document 200

Graphical Terminal 500

Presentation Document 2000

High-Resolution Image 50,000

Multimedia Object 100,000

TABLE 3 - SAMPLE DATA OBJECT LIST

Type of Object Size in Kbytes E-Mail Message 10

Web Page 50

Spreadsheet 100

Word Document 200

TABLE 4 - DATA OBJECT LIST

Site Number of

Users at Location

Local Area Network

Wide Area Network Internet

SEC Headquarters and Regional Offices 120

DPS Detailed Architecture Design Page 24 of 32

6 Database Architecture (DPS databases in the Cloud)

6.1 Database Brand

Oracle SQL Server Sybase Netezza Hadoop

6.2 Database Type

Transaction Reporting Analytical data feed Other (explain)

6.3 Initial Size of Database

3000 GB

6.4 Anticipated Annual Growth

600__ GB

6.5 Logical Data Model (COTS exempt)

Yes No N/A

6.6 Physical Data Model (COTS exempt)

Yes

6.7 Data Dictionary (COTS exempt)

Yes

6.8 Database Features

Select all that apply:

Primary Keys (all tables) Triggers Indices (including foreign keys) Views Foreign Key Constraints Private Database Links Stored Procedures Public Database Links Transactions Global Database Links

DPS Detailed Architecture Design Page 25 of 32

6.9 Database Environment

Must the database server run in a physical environment? Yes No

6.10 Database Connection Account Type

Individual user accounts Shared user accounts

6.11 Stored Procedures

Are stored procedures used? Yes No

6.12 Clustering

Is database clustering being used? Yes No

6.13 Database Normalization

Does the database conform to third normal form or above? Yes No

DPS is a COTS based solution.

6.14 Data Retention

Will the data in the system be defined as Federal records, per the Federal Records Act?

Yes.

DPS complies with all sub-items listed here. The records in DPS shall be cut off at the end of the calendar year after debt is paid in full, compromised, or discharged, or 15 years have elapsed with no financial activity other than recurring post judgment interest, whichever comes first, and shall be systematically deleted 10 years after cut-off, in accordance with DAA-0266-2017-0009-0001.

7 Principles for Availability and Maintenance

• DPS is used by internal SEC users only. It’s a multi-tiered application that is deployed with adequate redundancy in the server-tier to improve availability. The application tier is deployed using clustering support provided by the application server systems software. The application server systems software includes IIS, Tuxedo, and WebLogic. Also, for Records Management, two instances of OpenText Content Server and OpenText Directory Services Server are installed on additional VMs for high availability.

• VENDOR performs the maintenance of DPS Application software and Cloud infrastructure including Databases and VMs. VENDOR applies the needed patches and enhancements to the DPS application software adhering to SEC OIT’s Change Management and Version control process. VENDOR also provides maintenance support and perform patching for the VM Operating Systems and Databases during the scheduled Cloud maintenance windows.

The production application or service operate in a High Availability (HA) configuration

Check all that apply https://www.archives.gov/about/laws/disposal-of-records.html https://www.archives.gov/about/laws/disposal-of-records.html

DPS Detailed Architecture Design Page 26 of 32

Active\Active across geographically dispersed data centers Active\Passive across geographically dispersed data centers Active\Active in each data center and across geographically dispersed data centers Active\Active in one data center, but not across geographically dispersed data centers Active\Passive in one data center, but not across geographically dispersed data centers

8 Security

8.1 Information Security Classification

TABLE 5 - INFORMATION SECURITY CLASSIFICATION

8.2 Threat Mitigation Plan

DPS project code development and release management program and procedures emphasize security throughout the development lifecycle, especially the use of coding techniques that prevent cross-site scripting (XSS) and cross-site request forgery

(CSRF).

The components used in the DPS solution undergo regular security testing for any security vulnerabilities including detection of Open Web Application Security Project (OWASP) Top 10 vulnerabilities.

8.3 SAR Application Security

8.3.1 Roles

Roles are created for DPS to support the principle of least privilege and segregation of duties. Roles are created with the following privileges:

• Administrative privileges to create, modify and delete users

• System privileges for starting/stopping services and view/modify rights to audit and logging files.

8.3.2 Authentication Authorization and Access Control

DPS supports federated identity services that are compliant with Microsoft’s Active Directory Federation Services 3.0 (ADFS 3.0), which includes support for standards such as SAML 2.0 for exchanging authentication data. DPS is configured to use SEC’s ADFS for Single Sign On (SSO) and SEC is able to implement their policies and procedures for the Authentication and Account

High Medium Low Unclassified

Confidentiality X

Integrity X

Availability X

DPS Detailed Architecture Design Page 27 of 32

Management. Access control and Authorization in DPS are controlled by system administrators using role-based security groups.

8.3.3 Account and Password Management

Are OIT “Password Management” and “Application Account Management” standards being followed? Yes No

8.3.4 Session Management

• For DPS solution, Session objects are stored in memory.

• Use session ID is generated by WebLogic server and is tied through browser cookie.

• Session timeout and duration are set.

• Number of concurrent sessions for a particular user is configurable.

8.3.5 Cached Data / Temporary Files

Cached data for DPS application is in memory and security checks are performed when the cache resolver loads the data in cache. The cached memory is cleared when the system is restarted. All application related temporary files are locally stored on the servers in the VENDOR Cloud with the restricted access. For Documents and Records Management, documents are uploaded to a directory on the server at PDC and those documents are cleared from that directory once the upload is complete.

8.3.6 Application Logging

DPS is hosted in the FedRAMP certified Cloud at PDC. Access to the application log files is restricted to users having Administrative and System privilege at the Cloud AD level.

• DPS Application logs are generated including startup/shutdown and other application related activities.

• Successful and failed logins, Password changes and Exceptions are stored in the Event log table in the application database.

• The application can also be configured to generate Audit logs to capture

Change of rights/privileges, Addition/removal of user accounts, and Updates to information for which Audit logging is turned ON.

• Administrative activity, Backup and Restore is captured in the Event logs at the OS level. All logged events are accompanied, as appropriate, by event ID, user ID, timestamp, application generating event and resource reference at a minimum.

• Data imports and exports generate corresponding logs.

• For Documents and Records Management, DPS has extensive Audit capabilities to capture successful and failed logins, changes in user privileges, creation and removal of accounts, modifications to document

DPS Detailed Architecture Design Page 28 of 32 information including classifications and Data that is added to the system.

System logging captures warnings and errors as well as start-ups and shutdowns.

8.3.7 Infrastructure and Network Security

The IaaS Cloud holds a Joint Authorization Board Provisional Authorization to Operate (JAB Provisional ATO) which meets NIST 800-53 rev. 4 requirements up to FISMA moderate. The Firewalls utilize packet filtering to deny-all packets by default and only valid firewall rules process packets through a firewall rule request with approvals and security review to be activated. SourceFire provides perimeter and internal Intrusion Detection System (IDS)/ Intrusion Prevention System (IPS) monitoring capabilities for the IaaS Cloud, and provides an additional layer of virus detection. IaaS provides test plans to FedRAMP ISSO for JAB approval prior to testing. Monthly scans are conducted by on its infrastructure/OS, of its web servers, databases, and application servers. In addition, vendor conducts selected vulnerability scans of systems to confirm changes, when it identifies new vulnerabilities affecting the system, suspicious activity, or other reported vulnerabilities.

8.3.8 Separation of Administrative and User Traffic

System Administration requires VENDOR Cloud VPN access and Remote Desktop (RDP) connectivity to the VMs. DPS application users do not have VENDOR Cloud VPN access and RDP connectivity to VMs. Users will access DPS application using HTTPS URLs from their browser.

8.3.9 Operating System Accounts and Privileges

Operating System Accounts and Privileges are integrated with the VENDOR Cloud Active Directory (AD). VENDOR Cloud AD uses a Super Admin Domain model for all Management and privileged access.

8.3.10 Server Hardening

Will the servers be built per SEC/OIT approved image and if needed hardened per Security Team’s recommendation? Yes No

The servers in VENDOR Cloud are hardened to current CIS baselines with Patching and Vulnerability scanning conducted on a monthly basis.

8.4 Database Security

8.4.1 Description

Role based security is implemented for DPS databases. Access to resources is based on the role assigned to a user. The database administrator assigns a user to a role that has certain predetermined right and privileges. Because of the user's association with the role, the user is able to access certain resources and perform specific tasks.

DPS Detailed Architecture Design Page 29 of 32

8.4.2 Local User Management

The database accounts are issues to authorized Database Administrators (DBAs). The DBAs must first logon to the VENDOR IaaS Cloud multi-factor VPN in order to access the databases.

8.4.3 Database Logging

DPS is hosted in the VENDOR FedRAMP certified Cloud at PDC. Access to the database log files is restricted to users having Administrative and System privilege at the Cloud AD level.

VENDOR leverages Splunk to generate audit log reports and alerts on significant events based on correlation rules. The configuration of the Splunk is coordinated with support groups within VENDOR to enhance mutual support and to enhance the selection of auditable events as necessary. Database logging can be set for the specific requirements pertaining to DPS such as logging events like execution of the DDL statements.

8.4.4 Database Link Privileges

Currently there are no plans to create any Database links in the DPS databases.

8.5 Cryptography and Key Management

8.5.1 Appropriate Use of Encryption

Is encryption used within application? Yes No FIPS 140-2 validated crypto module for encryption is used. DPS application also provide support for TLS 1.2.

Is database encryption used? Yes No Data is stored on Storage Area Network (SAN). SAN is encrypted per the Federal Information Processing Standard (FIPS) Publication 140-2 (FIPS PUB 140-2)

In addition, the Oracle databases in all DPS Production, Non-Production and DR environments is encrypted at the tablespace level using TDE available in Oracle 19.16.0.0.0 Enterprise Edition with the Oracle Advance Security feature.

The TDE encryption is set up using OKV and HSM as described in Section

6.1.2 DPS Database Encryption using OKV and HSM.

Is network encryption used? Yes No

IPSec VPN tunnel is set up between SEC and the VENDOR Cloud. SEC users access DPS application using HTTPS over this IPSec tunnel and all user traffic is encrypted using SSL. The data files are transferred from SEC and External systems via SFTP.

DPS Detailed Architecture Design Page 30 of 32

Is data-at-rest encryption used? Yes No

SAN level encryption is used per FIPS PUB 140-2.

Is backup encryption used? Yes No

VENDOR utilizes Iron Mountain as the offsite archival storage and transport custodial partner. Backup tapes are written and stored using AES 256-bit encryption, and are transported outside of the facility in encrypted state. Tapes are degaussed or destroyed if tapes are leaving the Data Centers to be discarded.

8.5.2 Digital Certificate Management

Are X.509 certificates being used? Internal External X.509 certificates are used for SAML Authentication and TLS connection.

9 Monitoring

Does the system / application require monitoring?

Yes No (No further action is required. Proceed to Section 11.0)

DPS is hosted on the VENDOR FedRAMP Cloud at PDC and does not need any monitoring from SEC OIT. VENDOR performs availability and performance monitoring of the DPS Non- Production and Production VMs in the VENDOR Cloud, including resources like CPU, Memory and disk space. Additionally, server availability is monitored through ping and /or service monitoring. A warning/alert is generated when the resource usage reaches certain threshold of the maximum capacity.

10 Enterprise Backup and Recovery

10.1 Backups

Does the backup strategy adhere to the processes defined in the Guidelines and Best Practices for OIT? Yes No

VENDOR does, in alignment with SEC policy, implement an agreed-upon backup strategy, capabilities, and procedures that address the extent (e.g., full or differential/ incremental), frequency, offsite storage, testing, physical and environmental protection, restoration, and encryption of backups.

The standard backup strategy for the…