Appendix D - Security Requirements .pdf
PDF 75 KB Posted
- Attached to
- Managed Print Services
- Solicitation number
- TI-24-388
- Issued by
- California
About this file
This is a security requirements document from a City of Long Beach Request for Proposal (RFP) concerning print device procurement and configuration standards. The RFP outlines mandatory security features and compliance requirements for proposed copier and printer equipment that will be utilized by the city's law enforcement and criminal justice departments. The document specifies that proposers must identify which proposed equipment meets National Information Assurance Partnership (NIAP) Certification Level 2 standards and comply with California Law Enforcement Telecommunications System (CLETS) Policies, Practices and Procedures 1.6.4 regarding the confidentiality of information accessed through CLETS terminals.
The security requirements mandate comprehensive technical controls including secure boot processes, data-at-rest and network encryption (TLS/SSL, IPSec, WPA2), restricted administrative access limited to primary and secondary administrators, secure print functionality with pull printing or badge/PIN/password protection, disabled call-home manufacturer monitoring features, and strict configuration management practices. Additional requirements include enabling identification and authentication mechanisms, event logging and auditing capabilities, memory dump on reboot, anti-tampering mechanisms, and periodic security assessments with vulnerability scanning. The proposed equipment must comply with multiple regulatory frameworks: CLETS Policies and Procedures, Healthcare (HIPAA), PCI DSS, and NIST Cybersecurity Framework 2.0. All vendor default passwords must be changed to comply with City of Long Beach password policy, and unused physical and network ports must be disabled to minimize attack surfaces.
View the file
Other files
Show all 19
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Security Requirements as pulled from RFP
- Proposers shall outline which proposed equipment is National Information Assurance
Partnership (NIAP) Certified Level 2 equipment.
- Comply with California Law Enforcement Telecommunications System (CLETS)
Policies, Practices and Procedures 1.6.4 Confidentiality of Information from the CLETS.
Only authorized law enforcement, criminal justice personnel or their lawfully authorized designees may use a CLETS terminal. Any information from the CLETS is confidential and for official use only. Access is defined as the ability to hear or view any information provided through the CLETS.
• Additional information can be found using the following link:
https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center
- Security Features: To protect sensitive information, the copier/printer includes advanced security features such as data encryption, secure print release, and user authentication, ensuring that only authorized personnel can access and utilize the device.
- Security Features: To protect sensitive information, the device includes security features such as secure print, PIN printing, and optional hard disk encryption, ensuring that only authorized personnel can access and utilize the device.
Applicable Regulatory Requirements or Frameworks
- California Law Enforcement Telecommunications System (CLETS) Policies, Practices and Procedures
- Healthcare (HIPAA)
- PCI DSS
- NIST CSF 2.0
RFP Question Response Question - What are the minimum-security features required for print devices?
Answer:
- Review and apply the manufacturer-recommended secure configuration as appropriate/if available o Actively communicate with the original equipment manufacturer (OEM) as necessary to calibrate and configure the device o Isolate the device from other systems until it is calibrated and securely configured o Remove unwanted applications from the device, e.g., internet browsers, games o Remove or disable insecure and unnecessary protocols that may be enabled by default (http, Telnet, FTP)
- Secure Boot Process: Ensure printers undergo a secure boot process to verify the integrity of the firmware and detect any unauthorized modifications
- Enable and configure encryption o Data-at-Rest Encryption: Encrypt data stored on the printer's hard drive or memory
- Enable network encryption protocols, e.g., TLS/SSL, IPSec, WPA2 o Require encrypted connections when accessing the printer administrative control panel (https://)
- Encrypt passwords and other configuration settings
- Configure encryption for nonvolatile storage
- Limit/Restrict Access o Limit administrative/privileged access to a primary and secondary administrator o Restrict users from being able to change the configuration settings o Disable any call-home features, e.g., do not allow monitoring of usage by the manufacturer o Limit or disable file sharing o Disable unused physical and network ports
- Enable identification and authentication o Require identification and authentication for privileged access o Change vendor default passwords to comply with City of Long Beach Password policy o Implement authenticated retrieval for users, i.e., push/pull printing
- Secure Print o Pull Printing: Requiring users to authenticate at the printer before the document prints, preventing unauthorized access to printed documents.
o Badge, PIN, or Password Protection: Releasing printed documents only after using Badge, PIN, or password at the printer
- Enable auditing, i.e., event logging
- Configure monitoring/error handling capabilities o Dump memory on reboot o Alert administrator of errors o Enable time-out of queued or stored jobs
- Configuration Management: Apply strict configuration management practices to maintain a secure and standardized setup across all printers in the network.
- Anti-Tampering Mechanisms: Incorporate anti-tampering features to detect and prevent unauthorized modifications to printer hardware or software components
- Security Auditing o Periodic Assessments: Perform scheduled audits to evaluate printer security configurations, access controls, and compliance with security policies o Vulnerability Scanning/Assessments: Identify potential vulnerabilities within the printer infrastructure and address them promptly
File details come from the government source that posted it. Updated .