Appendix 1- Threshold Requirements for NCODE Pilot.pdf

Appendix 1- Threshold Requirements for NCODE Pilot

The following information should be used in the calculation of a “Rough Order of Magnitude” cost estimate for NCODE environments. Note that all requirements should meet FAR and DFARS clauses, with particular interest to DFARS 252.204-7012. The below system characteristics are intended to highlight some of the requirements outlined in these clauses, and in certain cases, add additional requirements.

Operational Concept: NCODE should deploy as a combination of commercial services with government monitoring and response.

a. The NCODE Platform optimally consists of a Virtual Desktop Interface (VDI) connected to a private cloud instance. Users at various small businesses should be able to log into one of two environments; a Small Business (SB)-only environment, which allows only the SMB employees, and a separate collaboration environment which allows contractor and government personnel affiliated with a DoD contract to integrate and share data in a secure cloud-based platform.

b. NCODE should also provide access to cloud compute resources to allow for software development or modeling and simulation or other specialized software. Delivery models should be as secure as possible, while allowing for sufficient usability of the users. Compute resources should also be segregated in a way that allows for “SB-Only” access or “Contract Wide” access.

c. A NCODE environment shall be configured to maximize the number of NIST SP 800-171 security requirements and NIST SP 800-171A assessment objectives for which the service/solution provider is responsible and partially responsible to reduce the burden on DIB small businesses. The service/solution provider should be assessed by an authorized C3PAO to establish the body of evidence that DIB small businesses who participate in the pilot can employ to simplify their own CMMC assessments and reduce assessment costs.

System Characteristics:

a. Authentication: An NCODE environment shall utilize Federal Information Processing Standard (FIPS) 140-2 compliant Multi-Factor Authentication (MFA) for regular users. An NCODE environment should also be capable of accommodating DoD CACs to allow government oversight and project personnel to interact directly with vendors in the same secure environment without having to procure or implement additional MFA. In addition to the regular user MFA requirements, superusers/system administrators in the environment shall utilize phishing-resistant MFA, as outlined by NIST SP 800-63-4.

b. Workspace: Each vendor shall have separate virtual workspaces inaccessible to other vendors for the purpose of protecting intellectual property. In addition, a collaboration environment shall be available for multiple vendors, including government personnel. Government and vendors shall have the ability to share files from their secure space to other vendors as directed by government sponsors. Lastly, a desired capability is for access to NCODE through a delivery model that minimizes controls required on the customer endpoint and ideally considers the endpoint out-of-scope of the CMMC 2.0 Level 2 objectives. Such an approach may include Virtual Desktop Interface (VDI) to maximize security, especially for vendors for which DoD is not the major component of their business. Users should be able to import/export sensitive data – to include CUI -- in bulk from/to other secure enclaves in a secure manner that ensures the data is protected during transfer. Capabilities may include an enterprise browser and/or other secure browser technologies.

c. Monitoring: Critical monitoring and logging data shall be available for third-party or government monitoring, alerting, and warning. A hybrid approach to monitoring between the provider and the Army may minimize the resources required by the Army to process and analyze alerts.

d. Security Compliance: NCODE environment shall meet a maximum number of NIST SP 800- 171 controls in order to assist DIB small businesses achieve CMMC 2.0 Level 2 certification.

Providers shall include a shared responsibility matrix (SRM) detailing whether NIST SP 800-171 controls and the related CMMC 2.0 Level 2 assessment objectives are fully met or shared across the participating parties, to include the cloud service provider, managed service provider, the vendor, and any other relevant parties involved in the creation of the NCODE environment. The NCODE environment shall offload a minimum of 80% of the NIST SP 800-171 and CMMC 2.0 Level 2 assessment objectives from the vendor, as detailed in the SRM. The environment should also meet ITAR compliance requirements and therefore be US-based. Cloud infrastructure and applications used on that infrastructure should meet a minimum of FedRAMP moderate baseline.

If the candidate NCODE environment also meets DoD Zero Trust activities and NIST SP 800- 172 controls, these shall be documented.

e. Information Security: Clear policy and/or security guidelines for data sharing and protection of intellectual property and CUI shall be available. These shall include sufficient logging to capture access and manipulation of CUI data.