A1b PWS DCMA Cybersecurity Req.pdf

DCMA Security Cybersecurity Requirements for Air-Gapped Systems Version 2.0, May 2019.

1. General:

1.1. Vendor shall work with the DCMA Program Manager and DCMA Cyber security division and utilize the

DOD common Risk Management Framework (RMF).

1.2. For any components or appliances that require network switchgear or access points, the use of the DCMA network switchgear or access points is prohibited. Any networked components must be segregated and air-gapped from the DCMA/DoD network.

1.3. Annunciation and access for the Intrusion Detection System shall be provided via Plain Old Telephone System (POTS) of which there will be line(s) installed in the alarm head-end space.

1.4. Any software, patches, and updates for the systems shall be performed via optical media. Attachment of removable optical readers to facilitate this is permitted. NOTE: Contractor shall not connect any removable media to DoD networked computers without express, written consent from the Director, DCMA Cyber Security Division. (not applicable to security air-gapped systems

1.5. The contractor shall ensure that appropriate Security Technical Implementation Guides (STIGs) are followed for the device types and risk management framework categorization. STIG information can be found at [https://iase.disa.mil/stigs/pages/index.aspx]

1.6. If multiple electronic security systems require switchgear, they are all permitted to be installed on the same security-segregated network (e.g. 1 larger PoE switch being used for card readers, AV Intercoms, and CCTV cameras vs. 3 small PoE switches for each sub-system).

1.7. For devices such as Network Video Recorder (NVRs) and network switches, unused switches shall be disabled. Port security and firewalls shall be enabled on devices with the capability (e.g. NVRs)

1.8. No default logins or passwords will be used on any devices or components.

1.9. IT systems shall feature up-to-date virus scanning capability and appropriate fully-tested system and software patches. Virus definitions and patches shall be installed with every PM visit at the interval described in primary statement of work.

2. Testing and Test Management:

2.1. The goal of testing and test management is to ensure continued system functionality. System and software patches shall be tested in the test environment prior to deployment.

2.2. For new hardware purchases of networked systems, vendor shall furnish at DCMA expense, and maintain a test environment. This environment must mimic the system(s) deployment in all practical ways, however minor deviations such as different storage capacity on NVRs and servers are permissible in the interest of cost reduction.

2.3. The hardware within this test environment is considered government property and at the termination of this effort, shall be turned over to the government for disposition.

2.4. The vendor shall maintain the test environment at no future additional cost to the government for items such as storage space and utilities.

3. Documentation and Training:

3.1. The contractor shall prepare or update documentation that captures the depth and scope of the change. The contractor shall generate, maintain, and update both new and existing system documentation related to the impacted applications and database. Documentation for application and database changes shall include:

3.1.1. Implementation Plan (detailed plan for implementing/integrating designed solution into DCMA environments)

3.1.2. Installation Procedure/Manual (directions for installing the designed solution into a DCMA environment, also includes instructions regarding script execution, job scheduling, application and BI dependencies for all scheduled database jobs)

3.1.3. Test Plan (with test cases, scenarios and performance metrics)

3.1.4. Disaster Recovery and High Availability Plan

3.1.5. Roll-back Plan (plan to back out of implementation in case of catastrophic error and restore to previous state)

3.1.6. User/Admin Training Guide (designed solution training information for users and system maintainer

3.1.7. Security Plan (security configuration details designed to ensure compliance and reduce security risk) for controls deemed relevant and achievable.

3.1.8. Data Flow Diagram (provide data flow between internal systems and inbound/outbound traffic between DCMA’s network and remote locations)

3.1.9. Ports, Protocols, Services Management List (PPSM)(PPS required by the system to function effectively within DCMA environments)

3.1.10. Risk Assessment Questionnaire (Security risk assessment information)

3.1.11. STIG/SRG Checklist (Application, Database, web, etc.)

3.1.12. System Scan Reports (vulnerability scans of application, database, web, etc.) - remediation of findings

3.1.13. Outstanding Vulnerabilities Plan of Actions and Milestones (POAM) for addressing any outstanding vulnerabilities—particularly high and critical)

3.2. Documentation also consists of developing and managing application training materials and operational guides, and ad hoc guidance for application administration. Written correspondence shall be accomplished IAW DoD Manual for Written Material 5110.04-M-V1.

3.3. Typically, Design/Implementation Packages require most of the documents noted above for each environment based on system complexity unless otherwise exempted by the Government and are due 5 business days prior to RFC submission for entry into that environment. The government has up to three business days to review all submitted documentation and provide comment. The contractor corrections/changes must be accomplished within a reasonable period of time to prevent delays extending past the base statement of work’s period of performance goals.

3.4. Enterprise Architecture information exchange of the design implementation design packages are required during design implementation and no later than 15 business days after implementation into production.

Deliverables:

3.4.1. Design Plans

3.4.2. Implementation Plans

3.4.3. Installation Procedures/Manuals

3.4.4. Disaster Recovery and High Availability Plans

3.4.5. Roll Back Plans

3.4.6. User/Admin Training Guides

3.4.7. Security Plans

3.4.8. Data Flow Diagrams

3.4.9. Ports, Protocols, Services Management List

3.4.10. Risk Assessment Questionnaires

3.4.11. Training Materials