Attachment 0002 - AIE-NEXT PERFORMANCE SPECIFICATION.pdf

CUI

i

AUTOMATED INSTALLATION

ENTRY (AIE) NEXT

SYSTEM

PERFORMANCE

SPECIFICATION

22 July 2022

Version 1

Product Manager Force Protection Services (PM FPS)

5900 Putnam Road

Fort Belvoir, VA 22060-5420

DISTRIBUTION STATEMENT C: Distribution authorized to the Department of Defense and U.S. DOD contractors only by specific authority of AR 380-5; and date of determination is the approval date of this document. This publication is required for administrative and operational purposes. Other requests for this document shall be referred to ATTN: SFAE-IEW-TF, Product Manager Force Protection Systems 5900 Putnam Road, BLDG 365 Fort Belvoir, VA 22060.

ii

Intentionally Left Blank iii

PREPARED BY

MAJ STEPHEN J. LOMAN Date

Assistant Product Manager – Automated Installation Entry

Product Manager, Force Protection Systems

REVIEWED BY

MICHAEL V. DONEY Date

Program Officer, Installation Physical Security Systems

CONCURRENCE

CURTIS E. BROOKER Date

LTC, IN

iv

REVISION HISTORY

Version Date Revision History

0.1 28 May 2021 Preliminary Draft

0.2 14 Apr 2022 Verification Table

0.3 18 July 2022 OPMG Review v

Table of Contents

1 INTRODUCTION

1.1. PURPOSE

1.2. SCOPE

2 APPLICABLE DOCUMENTS

2.1 GENERAL

2.2 GOVERNMENT DOCUMENTS

2.2.1 Specifications, Standards and Handbooks

2.2.2 Other Government Documents, Drawings and Publications

2.3 NON-GOVERNMENT PUBLICATIONS

2.4 ORDER OF PRECENDENCE

3 REQUIREMENTS

3.1 REGISTRATION

3.1.1. Registration Process

3.1.2. Visitor Control Center (VCC) Registration

3.1.3. Kiosk

3.1.4. Online

3.2 ACCESS CONTROL POINT (ACP)

3.2.1 Vehicle Lane Operations

3.2.2 Tier 1

3.2.3 Tier 2

3.2.4 Cellular Wireless

3.2.5 Automatic and Visitor In Lane Registration

3.3 SERVER OPERATIONS

3.3.1 Enterprise Data Center

3.3.2 Local

3.3.2.1 Large Server

3.3.2.2 Cache Box

3.4 COMMUNICATION

3.4.1 Interfaces

3.4.2 Infrastructure

3.5 CYBERSECURITY

3.6 SUSTAINMENT

3.6.1 Reliability, Availability, Maintainability (RAM)

vi

3.6.2 Health and Status

3.7 CONTROL AND MONITORING

3.7.1 Dashboard

3.7.2 Reporting

3.7.3 Video Management

3.7.4 Data Mining

3.7.5 Data Analytics

3.7.6 Artificial Intelligence

3.8 SYSTEM CHARACTERISTICS

3.8.1 Safety

3.8.2 Physical

3.8.3 System Design

3.8.4 Environmental

4 REQUIREMENTS VERIFICATION MATRIX

5 DEFINITIONS

APPENDIX A - ACRONYMS AND ABBREVIATIONS

APPENDIX B – LIST OF AUTHORIZED CREDENTIALS

1 INTRODUCTION

1.1. PURPOSE

The objective of the Automated Installation Entry (AIE) Program is to provide a cost-effective system that enhances security of Installation Access Control Points

(IACPs), automates identity authentication and verification of authorized registered personnel entering the Installation, minimizes guard force requirements, maintains or increases pedestrian and vehicle throughput with enhanced security and allows for adaptation of increased authentication requirements at high threat levels.

AIE-3 consists of Fixed-Full (Tier 1) and Wireless Handheld configurations

(Tier 2). Fixed-Full configuration is typically installed at large installations after the

US Army Corps of Engineers (USACE) Access Control Point Equipment Program

(ACPEP) site preparation is complete. ACPEP design is described in the Access

Control Point (ACP) Standard and Standard Design document. The Handheld configuration is installed at small to medium sized installations that do not require the Fixed-Full configuration.

1.2. SCOPE

The AIE System will be installed at designated DoD/Army Installations and provide automated access control for vehicular traffic and pedestrians that have been enrolled in the system and are authorized access In Accordance With (IAW) the Department of Defense (DoD), Army and Installation Commander's policies.

The system will be modular and scalable to allow future extensions to other security, access control and force protection systems. The system will be configured in a flexible architecture to support future upgrades through incorporation of technical insertions. The AIE System will be used at US Military locations in Continental United States (CONUS) and Installations Outside the

Continental United States (OCONUS).

The system will be consistent with policy and strategic goals and objectives of Senior Commanders and Garrison Commanders/Installation

Commanders/Facility Directors for Installation physical access control to:

• Reduce risks to institutional missions;

• Minimize impacts to operational readiness by detecting potential Insider

Threats; and

• Support enterprise-level resource planning, programming activities and

Headquarters Department of the Army (HQDA) policy and program synchronization.

At the Installation level, Army security forces primarily consisting of

Department of the Army Civilian Police (DACP), Borrowed Military Manpower

(BMM), and Department of the Army Security Guards (DASG), will use AIE at IACP locations (to include Visitor Control Center (VCC) operations) to:

• Maintain the local site population database;

• Make fitness-for-access determinations;

• Take appropriate actions in response to unfavorable fitness determinations resulting from the presence of derogatory information from authoritative

Government databases (e.g., official personnel, industrial security, criminal justice information, non-criminal justice information data sources);

• Scan credentials (i.e., identification cards, driver licenses, etc.) to authenticate the identity and authorize access for individuals seeking

Installation access;

• Report consistent Installation access control data and system use information.

The figure below represents the system concept and operational planning aspects for AIE solutions:

2 APPLICABLE DOCUMENTS

2.1 GENERAL

The documents listed in this section are specified in section 3 of this specification. This section does not include documents cited in other sections of this specification or recommended for additional information or as examples. While every effort has been made to ensure the completeness of this list, document users are cautioned that they must meet all specified requirements of documents cited in section 3 of this specification, whether or not they are listed here.

2.2 GOVERNMENT DOCUMENTS

2.2.1 Specifications, Standards and Handbooks

The following specifications, standards and handbooks of the exact revision listed below form a part of this specification to the extent specified herein.

FIPS PUB 140-3 Security Requirements for Cryptographic Modules, March 22, FIPS PUB 201-2 Personal Identity Verification (PIV) of Federal Employees and Contractors, August 2013

Copies of these documents are available online at http://quicksearch.dla.mil/qsSearch.aspx or from the Standardization Document

Order Desk, 700 Robbins Avenue, Building 4D, Philadelphia, PA 19111-5094

2.2.2 Other Government Documents, Drawings and Publications

The following form a part of this specification to the extent specified herein.

Unless otherwise specified, anomalies are cited in the solicitation or contract.

DoD Directive 8500.01, Cybersecurity, March 14, 2014 (Incorporating Change 1, effective October 7, 2019)

DoDI 8510.01, Risk Management Framework (RMF) for DoD Information

Technology (IT), March 12, 2014

DoDI 5200.08 CE-03, Security of DoD Installations and Resources and the DoD

Physical Security Review Board (PSRB), Incorporating Change 3, 20

November 2015.

DOD 5200.08 Volume 3, Physical Security Program: Access to DOD Installations, http://quicksearch.dla.mil/qsSearch.aspx

Change 1, September 18, 2020

DoD 5200.08-R, Physical Security Program, Incorporating Change 2, October 19, Army Access Control Points Standard Design, September 2020

Army Regulation 25-1, Army Information Technology, July 15, 2019

Army Regulation 25-2, Army Cybersecurity, April 4, 2019

Army Regulation 190-13, Army Physical Security Program, June 27, 2019

Army Regulation 700-127, Integrated Product Support, October 22, 2018

Criminal Justice Information Services (CJIS) Electronic Biometric Transmission

Specification (EBTS) July 2, 2013

Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 6510.01F Information

Assurance (IA) and Computer Network Defense (CND) February 9, 2011

Federal Highway Administration (FHWA), Manual on Uniform Traffic Control Devices for Streets and Highways Rev 2, May 2012

American National Standard for Information Systems - Data Format for the

Interchange of Fingerprint, Facial, & Other Biometric Information – Part 1

ANSI/ITL 1-2011 Updated 2015

Unified Facilities Criteria (UFC) 4-022-01, Security Engineering: Entry Control Facilities/

Access Control Points

Unified Facilities Criteria (UFC) 4-022-02, Change 1, Electronic Security Systems, 11

September 2019

2.3 NON-GOVERNMENT PUBLICATIONS

The following specifications, standards and handbooks of the exact revision listed below form a part of this specification to the extent specified herein. Unless otherwise specified, anomalies are cited in the solicitation or contract.

Identity Matching Engine for Security and Analysis (IMESA) Interface Control Document

(ICD) 1.3v11

PM FPS Configuration Management Plan v4.1, June 4, 2020

2.4 ORDER OF PRECENDENCE

Unless otherwise noted herein or in the contract, in the event of a conflict between the text of this document and the references cited herein the text of this document takes precedence. Nothing in this document, however, supersedes applicable laws and regulations unless a specific exemption has been obtained.

3 REQUIREMENTS

The Government has an active AIE Enterprise Data Center solution that stores user records locally and in the Cloud. The AIE-NEXT System shall utilize and build upon the existing AIE-3 hardware and software to maintain and build upon existing capabilities. The primary objectives are:

• Maintain/Increase a high level of initial and continuous security vetting

• Improve ease of access while maintaining security

• Return on Investment.

The System shall provide reliable and timely vetting and registration of personnel and automatic processing of vehicle and pedestrian traffic at Army ACPs throughout Continental United States (CONUS) and Outside Continental United States (OCONUS). System shall continue to interface and be operational from Installation to Cloud AIE Enterprise Data Center.

The System is intended to support Army physical security Installation access control needs for at least the next 10 years. System size, capacity, functionality and flexibility must be sufficient to support the growth and changing needs of the Army.

Reference the diagram below for the notional AIE high-level functional architecture.

The System shall leverage a hybrid cloud solution of Network Enterprise Center

(NEC) and enterprise Cloud. This approach will provide the ability for the Installation to continue to operate during the loss of external communications, as well as minimizing the total number and size of the servers on the Installation. The architecture will include a cache box for smaller Installations, and for larger Installations, deploy more robust

Database/Domain Controller servers for continuity of operations. The larger Installation solution must be aligned to Army Directive 2016-38 to support technology to reduce data center footprint and Army’s future Cloud initiatives.

3.1 REGISTRATION

Each AIE Installation operates a Visitor Control Center (VCC) utilizing AIE registration stations for registering users. Also, within the VCC are freestanding visitor kiosks that can register visitors. Visitors may Pre-Register using an online web-based capability prior to arriving at the VCC. AIE also provides Automatic and Visitor In Lane

Registration (reference section 3.2.6) at the ACP lanes for specific individuals holding valid credentials. (See Appendix B for a list of authorized credentials.) Additionally, Portable Registration is used for remote registration of groups at pre-determined locations. During the registration process, the system collects unique personal identification information to include Name, photo, signature, fingerprint, Date of Birth

(DOB), expiration date of credential, and unit of assignment. This information is used to vet the individual against authoritative databases and then register the user upon successful vetting into IoLS for continuous vetting.

3.1.1. Registration Process

3.1.1.1 The System shall perform verification of the user's (user is defined as personnel presenting credentials to gain access onto an Installation) credentials when the user presents a valid credential during visitor vetting and AIE registration.

Verification will ensure the credential is valid by checking against authoritative databases.

3.1.1.2 The System shall vet DoD credentials against authoritative databases through IoLS including Defense Enrollment Eligibility Reporting System (DEERS), the local population database, NCIC Wants and Warrants, Terrorist Screening Database, and out to the Federal Bridge, and will populate registration fields without the operator having to re-key information.

3.1.1.3 The system shall vet visitor requests against NLETS, DMV, and State/local Government authoritative databases.

3.1.1.4 The System shall deny registration to personnel who receive negative results from authoritative databases and shall proceed with the registration process for those receiving positive results.

3.1.1.5 The System shall provide Administrator override capabilities to register personnel who have negative results from authoritative databases. The System shall be capable of reading and recording a Federal Information Processing Standard (FIPS)

Publication (PUB) 201 compliant credential for personnel access control during registration, vehicle lane operations and pedestrian portal operations.

3.1.1.6 The System shall be capable of reading information from a DoD Common

Access Card (CAC), Department of Defense (DD) Form 2 (all types), DD Form 1173, DD Form 1173-1 and DD Form 2765 cards (for reserve and retired, uniformed services privilege card, dependent card and DoD privilege card), Defense Biometric Identification

System (DBIDS), Uniformed Service ID (USID), Transportation Worker Identification

Card (TWIC), Veteran Health Identification Card (VHIC), and verifying credentials with

DEERS.

3.1.1.7 The System shall be capable of reading 1-D and 2-D bar-coded information issued by local Installations.

3.1.1.8 The System shall have the capability to limit locally issued credentials to access only Installations from which the credential was issued.

3.1.1.9 The System shall allow input at the time of registration of the Force

Protection Condition (FPCON) levels at which the individual is authorized to enter the facility.

3.1.1.10 The System shall be capable of identifying if individuals are allowed

Trusted Traveler (TT) privileges IAW Army Regulation (AR) 190-13 and applicable

Installation policies and regulations. The System shall include additional Trusted

Traveler types as signified:

a. B – Presidential Appointee

b. H – Medal of Honor Recipient

c. K – Non-Appropriated Funds (NAF) Employee

d. V – Reservist/National Guard

3.1.1.11 The Registrar shall be capable of designating a user's TT privileges based on applicable Installation policies and regulations.

3.1.1.12 The System shall be capable of linking multiple approved credentials to an individual user Personal Information Record (PIR).

3.1.1.13 The System shall be able to identify classes of users. Classes of users include US Military (Active, Guard and Reserve), Foreign Military, Civilian Government

Employee, Contractor, Dependent Resident, Survivor Access Card, Non-Resident and

Retiree (Military and Government Civilian).

3.1.1.14 The System shall allow individuals to belong to more than one class of users.

3.1.1.15 The System shall be capable of querying user for input, allowing user to enter information and collecting credential information, digital photo, signature and fingerprint data for all registrants.

3.1.1.16 The System shall allow registration of individuals with names up to 30 characters for first, middle, and last name.

3.1.1.17 The System shall store all valid forms of identification for users. The

System shall be able to electronically read an individual's driver's license or state issued identification card and display information embedded on the credential for the enrollment operator to visually compare and confirm against the data printed on the card.

3.1.1.18 The System shall provide a fully integrated capability for single sign-on for the registration station for registration activities.

3.1.1.19 The System shall have a portable registration station capability.

3.1.1.20 The System shall provide the capability for the registrar to select, from a list of all Installation ACPs and Pedestrian Gates, the ACP(s) and date/time that a user will be allowed to enter. Default configuration is access to all ACPs.

3.1.1.21 The System shall deny registration and visitor passes to personnel registering as visitors who receive negative results from authoritative databases and debarment lists and shall proceed with the registration process for those visitors receiving positive results.

3.1.1.22 The System shall electronically read and record information from an individual's passport, driver's license or state issued identification card into the System database and issue a visitor pass.

3.1.1.23 The System shall display captured information and populate fields required in a visitor pass.

3.1.1.24 The System shall allow the Registrar to manually enter and update user personal information into the Registration System including access denied and debarments.

3.1.1.25 The System shall electronically capture the signature of an individual and a digital photo for visual comparison with the signature and photo on the individual driver's license and store the signature and photo in the System database.

3.1.1.26 The system shall register the visitor into AIE and IoLS for continuous vetting.

3.1.1.27 The System shall generate long-term badges (plastic) and short-term visitor passes (paper) and allow Registrar to assign expiration date and time.

3.1.1.28 The System shall enable the unique enrollment of at least 5,000,000

(scalable up to 50,000,000) personal information records.

3.1.2. Visitor Control Center (VCC) Registration

3.1.2.1 The System shall provide a registration capability at the installation VCC staffed by approved registrars.

3.1.2.2 The System shall display information obtained from credentials along with a captured digital image of the credential holder to the enrollment operator.

3.1.2.3 The System shall be capable of reading fingerprints, recalling templates for each individual enrolled in the database and authenticating the individual's identity by their fingerprint with the registration database.

3.1.2.4 The System shall have the capability to accept no fingerprints and continue the enrollment process.

3.1.2.5 The System fingerprint collection subsystem shall conform to the

Electronic Fingerprint Transmission Specification (EFTS) derived from American

National Standards Institute/National Institute of Standards and Technology-ITL 1-2000.

3.1.2.6 The System shall print a visitor pass (paper and plastic). The pass shall print at the VCC registrar printer per local policy.

3.1.3. Kiosk

3.1.3.1 The System shall provide a self-contained, freestanding self-service visitor kiosk solution for Installations that experience high visitor throughput rates.

This system shall allow the user to complete the visitor request process within 2 minutes.

3.1.3.2 The System shall support an on-line integrated and automated registration kiosk for visitor requests made at a Visitor Center to increase registration throughput.

3.1.3.3 The System shall integrate with the existing AIE registration process to submit record, track, analyze and process visitor applications.

3.1.3.4 The System shall scan and read visitor identification credentials (REAL ID compliant driver’s license, enhanced driver’s license, or non-driver’s identification card issued by a State, territory, possession, or the District of Columbia) including capturing the applicant's photo and entering additional information to complete the registration process This feature must be customizable to support changes in policy and guidance.

3.1.3.5 The System shall allow visitors to be verified for a one-day or long-term pass (8 day).

3.1.3.6 The System shall provide visitors to be re-issued a (one-time) paper pass with the original expiration date when the Visitor Pass or AIE badge is forgotten or lost.

3.1.3.7 The System shall print a visitor pass (paper and plastic). The pass shall print at the kiosk or VCC registrar printer per local policy.

3.1.3.8 The System shall provide the visitor with visual status display/printed information at the completion of the interaction, and/or instructions.

3.1.3.9 The System shall notify visitors of request status and other informational details.

3.1.3.10 The System shall keep a kiosk transaction log.

3.1.3.11 The System shall interface with the National Law Enforcement

Telecommunications System (NLETS) to query visitor identification credentials against authoritative criminal justice information systems (National Crime Information Center –

Interstate Identification Index (NCIC-III) and driver record databases. The NLETS interface shall also provide a primary and secondary communication path to NCIC-III in support of fitness determination decisions.

3.1.3.12 The System shall incorporate biometric authentication (facial recognition) methods to support identify proofing. Visitor credential vetting shall include Department of Motor Vehicle (DMV) checks. Photo from the DMV is compared to photo of the individual presenting the credential at the kiosk. List of acceptable credentials are below:

a. Common Access Card (CAC)

b. USID

c. Non-CAC local or Regional DoD Credential issued by the local

Installation or region.

d. Non-CAC Local or Regional DoD Credential issued by another

Installation or region. (ex. DBIDS).

e. REAL-ID compliant driver’s license, enhanced driver’s license, or non-driver’s identification card issued by a State, territory, possession, or the

District of Columbia

f. US Passport

g. Transportation Worker Identification Card (TWIC)

h. Veterans Health Identification Card (VHIC)

i. Federal Personal Identity Verification (PIV)

j. Non-Federal PIV-I

3.1.3.13 The System shall include anti-counterfeiting analysis of credentials such as driver’s licenses and non-driver’s identification cards. Example of anti-counterfeiting may include a combination of physical verification of the credential and electronic verification through DMV.

3.1.3.14 The System shall be capable of detecting a REAL ID-state compliant driver’s license and request a second form of identification if not compliant. This feature must be customizable to support changes in policy and guidance.

3.1.3.15 The System shall print short-term visitor passes for visitors who successfully complete the visitor control process with an acceptable purpose and a duration <=8 days. The registrar shall receive denied access notification for further adjudication.

3.1.3.16 The System shall generate reports on kiosk usage data to support periodic and on-demand VCC reporting requirements. The reports shall include:

a. Number of registrants flagged for review due to facial recognition mismatches verified by the VCC agent.

b. Time required for a registrant to receive a visitor pass.

c. Total number of kiosk applicants by date and time (daily counts)

d. Total number of kiosk applicants denied a pass

3.1.3.17 The System shall re-issue visitor passes with the original expiration date when a user goes back to the kiosk to get a new pass that was lost/forgotten/stolen.

The Kiosk system shall automatically cancel the barcode of the previously issued pass when the new pass is issued.

3.1.3.18 The System shall send text messages or emails (online only) on pass application status (approvals, ready for pickup). Visitors are directed to contact the VCC upon denied access results.

3.1.3.19 The System shall provide the capability to print approved passes of online applicants that successfully complete the registration process when the applicant presents the credential at the kiosk.

3.1.3.20 The System shall interface with the online web registration solution that allows for administrative access to:

a. Customize the terms of service text on the kiosk

b. Customize the text messages/emails to visitor applicants

c. Customize reason for visit

d. View applications and revoke passes

e. Create transaction audit reports.

3.1.4. Online

3.1.4.1 The System shall provide a secure web-based visitor registration capability allowing visitors to submit a request for vetting and registration for a visitor pass via the internet.

3.1.4.2 The system shall integrate with the existing AIE registration process to submit record, track, analyze and process visitor applications.

3.1.4.3 The System shall provide the ability to route the request to a queue for the

CJIS certified Registrar to submit for vetting.

3.1.4.4 The System shall notify the applicant when the process is complete and allow the applicant to print a paper pass upon successful vetting. Applicants who receive a negative vetting result shall be directed to contact the VCC.

3.1.4.5 The System shall allow the local system administrator to modify the Visitor

Pass expiration date based on the Installation's Concept of Operations (CONOPS).

3.1.4.6 The system shall vet to NLETS for online registrations. Upon successful vetting results, the visitor shall be registered into the AIE database for continuous vetting and issued a visitor pass.

3.1.4.7 The system shall provide an administrative portal for AIE Installations to manage pre-registration settings.

3.1.4.8 The system shall query the visitor to confirm citizenship and allow the visitor to proceed to visitor request form to complete entry upon a positive response.

3.1.4.9 The system shall designate mandatory fields for data entry.

3.1.4.10 The system shall allow AIE Installations to designate sponsors.

3.1.4.11 The system shall allow designated sponsors to invite visitors.

3.1.4.12 The system shall provide for sponsored visitors to have their information validated by the sponsor before being submitted for background vetting.

3.1.4.13 The system shall include a Sponsor’s Certification Statement: “I certify that the applicant meets the justification requirements and that they require a PASS as indicated in order to perform assigned duties, conduct official business or visit family/friends. I understand my role as the sponsor and ensuring the PASS is retrieved upon expiration or prior to expiration if it is no longer required. If I fail to do so, my ability to be an approved sponsor can be removed.”

3.1.4.14 The system shall accept a valid Driver’s License (which complies with

Public law 109-13 (The REAL ID Act of 2005)) and user profile information, if the visitor is a U.S citizen.

3.1.4.15 The system shall accept a valid Passport (passenger) and user information if the visitor is a U.S citizen.

3.1.4.16 The system shall require manual verification of pre-registration visitor information before being submitted for background vetting by CJIS certified personnel.

3.1.4.17 The system shall vet visitor request against NLETS, DMV, and State/local

Government authoritative databases.

3.1.4.18 The system shall provide the capability for the site administrator to select a workflow that would upon successful vetting results, a) send a SMS (text Message) notification to the visitor to proceed directly to the gate and present their Driver License for the guard to scan, b) direct the visitor to come into the VCC for either a photo if one is not on the pass or verification of the pass, or c) print a pass. Upon negative vetting results, the visitor will be instructed to contact the VCC.

3.1.4.19 The system shall allow for up to six customizable reasons (Graduation, Hospital, MWR, Exchange/Comm, Work/Business, Other) for visit. If “Other” is specified as one of the reasons for visit, it shall require a specific reason to be entered of up to 30 characters. The reason selected shall allow the user to enter additional detail up to 30 characters.

3.1.4.20 The system shall allow each reason for visit to have a customizable pass duration of no longer than 8 days. The expiration date shall match the pass duration.

Visitors should be directed to the visitor center registrar for long-term passes.

3.1.4.21 The system shall provide for a post-registration survey to capture visitor feedback and allow for survey report generation. The survey report shall be stored in the enterprise data center and provided as Dashboard report.

3.2 ACCESS CONTROL POINT (ACP)

The ACP is a corridor at military Installation entrances through which all vehicles and pedestrians must pass when entering or exiting the Installation. The

ACP is responsible for the physical security and validation of all personnel entering

DOD Installations. Although verification and access challenges may vary from one

Installation to another, the AIE program establishes access control and validation processes that facilitate standardization of ACP operations. For Tier I, to accomplish ACP entry processing, vehicle lanes are equipped with several components to control credentials validation and vehicle movement. Lane traffic signals inform drivers which lanes are operating. A license plate camera, located on the rear of the traffic lane records a live image of the vehicle license plate.

Vehicle Pedestals, located at each lane, contain intercom, CAC readers, barcode readers, gate arms, and driver cameras. The Intercom provides two-way audio communication between the vehicle lane, the remote monitoring station and ACP guards.

Tier 2 is a hand-held system without the installation of fixed-lane equipment while providing the full functionality of authentication of registered personnel. The primary benefit of the Tier 2 approach is to provide AIE capability to Installations not requiring the full Tier 1 capability to achieve a level of AIE capability consistent with their Installation’s entry control requirements.

3.2.1 Vehicle Lane Operations

3.2.1.1 The System shall read Federal PIV credentials during vehicle lane and pedestrian portal operations.

3.2.1.2 The System shall provide the System Administrator the capability to select the FPCON level.

3.2.1.3 The System shall provide the Operators the capability to configure the

ACP and site using a selectable menu to increase the following access criteria for the

FPCON requirements: automatic registration, and Essential Personnel at any

FPCON Level.

3.2.1.4 The System shall provide the capability to produce and display all reports for Installations and ACPs from the central monitoring workstation.

3.2.1.5 The System shall provide the capability for a FIPS 201 compliant wireless

Handheld capable of reading PIV, PIV-1, CAC, DD Form 2, Defense Biometric

Identification System (DBIDs), state driver's license, Veteran Health Identification Card

(VHIC), Survivor Access Card, Transportation Worker Identification Card (TWIC) and displaying user data and image.

3.2.1.6 The System shall provide the capability for the wireless Handheld to operate continuously for 12 hours.

3.2.1.7 The Handheld device shall have a pistol grip.

3.2.1.8 The System shall provide the capability for digital/network video storage that allows transfer to removable media.

3.2.2 Tier 1

3.2.2.1 The System shall be capable of using fixed lane equipment and wireless handheld readers to perform credential verification functions at ACPs.

3.2.2.2 The System shall allow the operator from the Guard Booth or Gate House to switch to manual control of pedestrian and vehicular lane operations.

3.2.2.3 The System shall provide continuous digital/network video surveillance of pedestrian portal and vehicle lanes.

3.2.2.4 The System shall record digital/network video of all access control transactions that occur for 30 days and the ability to store 180 days of events requiring intervention.

3.2.2.5 The System shall provide simultaneous operation of pedestrian portal and vehicle lanes.

3.2.2.6 The System shall compare applicant information against the access denied list and display the result alerting gate guard when a denied individual attempts to gain access. The access denied list shall be automatically updated to each ACP upon status change.

3.2.2.7 The System shall prominently identify to the lane control guard whether the driver is allowed Trusted Traveler privileges.

3.2.2.8 The System shall prominently display information to the Gate House and

Guard Booth for all events where vehicle operator information does not match with registered information or are invalid and the guard is prompted to manually check or stop the vehicle.

3.2.2.9 The System shall display descriptive information to the Guard Booth, Gate

House and central remote location for all access denial events

3.2.2.10 The System shall provide an integrated traffic light (green, red).

3.2.2.11 The System shall provide a traffic hold capability that allows the Lane

Guard to hold all traffic and allow a vehicle to turn around.

3.2.2.12 The System gate arm shall not rise automatically, and traffic light remains red for drivers who are denied Trusted Traveler (TT) privileges.

3.2.2.13 The System shall be capable of lowering the traffic arm and shall take no more than one second in all required environmental conditions. Rising of the traffic arm shall take no more than three seconds in all required environmental conditions.

3.2.2.14 The traffic arm controller shall have a waterproof housing.

3.2.2.15 The traffic arm assembly shall be capable of manual override operation in the event of a malfunction due to mechanical failure, main power outage and/or backup power supply failure.

3.2.2.16 The traffic arm drive assembly shall be directly linked to the gear motor by a heavy-duty connecting rod. Override stops shall be provided to limit the gate arm travel in vertical or horizontal position and shall operate through 90 degrees.

3.2.2.17 The traffic arm assembly shall be capable of a minimum of 500 duty cycles per hour. The traffic arm assembly shall consist of a hollow aluminum, wood, steel or fiberglass material assembly with a minimum length of nine feet.

3.2.2.18 Each traffic arm shall be equipped with an obstruction detector that will automatically reverse the traffic arm motor when an obstruction is detected. The traffic arm shall be covered with retro reflective red and white sheeting. See FHWA SA-89-006 for proper orientation of sheeting.

3.2.2.19 The System shall digitally capture the front, driver and license tag of the vehicle.

3.2.2.20 The System shall provide the capability for archived video to be viewed at the Gate House and central monitoring workstation.

3.2.2.21 The System shall have the capability to login and display ACP transactions at the Gate House.

3.2.2.22 The System shall have the capability for ACP, lane and Pedestrian Portal monitoring and control at the Guard Booth.

3.2.2.23 The System shall have the capability at the Guard Booth and Gate House for selectable override control of all lanes and Pedestrian Portal per ACP.

3.2.2.24 The System shall have the capability for selectable override control of each ACP on the Installation at the central monitoring workstation.

3.2.2.25 The Tier 1 vehicle lane shall provide a minimum lane throughput of six authorized vehicles per minute.

3.2.3 Tier 2

3.2.3.1 The Tier 2 sites/ACPs/lanes shall be able to be upgraded to AIE Tier 1 sites/ACPs.

3.2.3.2 The System shall provide the capability for the wireless Handheld to operate continuously for 12 hours.

3.2.3.3 The Handheld device shall have a pistol grip, ruggedized casing, and protective shield over screen display.

3.2.3.4 The System shall provide the capability for a FIPS 201 compliant wireless

Handheld capable of reading PIV, PIV-1, CAC, DD Form 2, Defense Biometric

Identification System (DBIDs), state driver's license, VHIC, Survivor Access Card, Transportation Worker Identification Card (TWIC) and displaying user data and image.

3.2.3.5 The Tier 2 (handheld) vehicle lane operation shall provide a maximum response time of 2 seconds from credential scan to handheld display. This is for registered credentials and does not include in-lane registration.

3.2.4 Cellular Wireless

3.2.4.1 The System shall provide for a cellular access control point consisting of a cellular wireless bridge, firewall, Wireless Access Point (WAP), uninterruptible power supply (UPS), and associated cables. The cellular capability may be installed at a fixed location with insufficient communication infrastructure to support Tier 1 or Tier 2 configuration.

3.2.4.2 The System shall be capable of using First Net when available or other cellular service provider.

3.2.4.3 The System shall be able to maintain continuous connectivity.

3.2.4.4 The System shall provide a deployable cellular access control point in a pelican case with protective form containing one (1) each cellular wireless bridge, firewall, WAP, UPS, and associated cables.

3.2.4.5 The system shall be mobile, easily able to setup up and operational within

15 minutes.

3.2.4.6 The system shall be able to support wireless scanning, remote registration and emerging technologies (Facial Recognition).

3.2.5 Automatic and Visitor In Lane Registration

3.2.5.1 The System shall have the capability to allow CAC, Teslin card, and

DBIDS holders to use their authorized credential to automatically register at both Fixed

Full and Handheld vehicle lanes within <= 5 seconds.

3.2.5.2 The System shall have the capability to allow Driver’s License holders to use their authorized credential to vet and register at the Handheld vehicle lanes.

3.2.5.3 The System shall have the capability to allow the vehicle operator to present an authorized credential at the lane and retrieve the information from the CAC memory, 1D or 2D bar code and vet against authoritative databases.

3.2.5.4 The System shall have the capability to allow the vehicle operator to present an authorized credential at the lane, retrieve the information from the CAC memory, 1D or 2D bar code and vet against NCIC III.

3.2.5.5 The System shall provide the capability, upon positive vetting response, to query vehicle operator for photo if not provided via vetting process. This data will be stored with the user PIR data file.

3.2.5.6 The System shall deny registration for personnel who receive a negative response from vetting process.

3.2.5.7 The System shall display information obtained from credentials along with a captured digital image of the credential holder to the enrollment operator.

3.3 SERVER OPERATIONS

3.3.1 Enterprise Data Center

3.3.1.1 Cloud Server

3.3.1.1.1 The System shall leverage a hybrid cloud solution of Network

Enterprise Center (NEC) and enterprise Cloud operations.

3.3.1.1.2 The System shall consist of enterprise data center server capability to support cloud-hosted operations for fixed full and handheld configurations.

3.3.1.1.3 The System shall have failover capability for high availability.

3.3.1.1.4 The System shall host all AIE user data.

3.3.2 Local

3.3.2.1 Large Server

3.3.2.1.1 The System shall support site ACP server installed in the NEC to support ACP operations at large size sites.

3.3.2.1.2 The ACP site server shall contain a copy of the site user data required for access.

3.3.2.1.3 The site ACP site server shall be installed in the NEC to support ACP operations at large size sites.

3.3.2.2 Cache Box

3.3.2.2.1 The System shall support site ACP Cache Box installed in the NEC to support ACP operations at small to medium size sites.

3.3.2.2.2 The Cache Box shall contain a copy of the site user data required for access.

3.3.2.2.3 The site ACP Cache Box shall be installed in the NEC to support ACP operations at small to medium size sites.

3.4 COMMUNICATION

AIE is an Information System Enclave. AIE fiber/network architecture/topology infrastructure shall be designed for CONUS-OCONUS installations by logical separation to maintain Information System enclave posture and gain necessary approvals from the U.S Army Network Enterprise Technology Command (NETCOM) and other DoD managed networks to integrate into each designated Army CONUS-

OCONUS Installation site facility by logical separation to maintain Information System enclave posture. AIE enterprise network access to the NIPRNet will be IAW DoD and

Army policy and guidance. Currently, access is via the network Top-Level Architecture

(TLA)/ Joint Regional Security Stack (JRSS) managed by NETCOM and/or Joint

Department of Defense entities (National Guard/US Army Corp of Engineers/ Joint

Army-Air Force-Navy-Defense Information Systems Agency and any Non-Standard sites) to include computer network defense (CND) protection for AIE.

3.4.1 Interfaces

3.4.1.1 The System shall use standard communication protocols and communication links.

3.4.1.2 The System program software shall electronically connect with in-state and out-of-state law enforcement sources and local DMV databases.

3.4.1.3 The System program software shall electronically connect to the enterprise data center servers to transmit and receive user data

3.4.1.4 The System shall electronically connect to IoLS for access to authoritative databases.

3.4.1.5 The System shall request updates of user records through IoLS every 15 minutes.

3.4.1.6 The System shall provide the capability to selectively share access denied list/debarment lists with IoLS.

3.4.1.7 The System shall provide a local database that tracks the local population to support verification and security alerts obtained from the Continuous Information

Management Engine (CIME) via IoLS. Note: Locals are defined as persons that fall under any of that fall under any of the following three categories:

a. Does not have a digital identity in DoD-wide DEERS;

b. Does not have a DoD ID card;

c. Does not have a DoD Electronic Data Interchange Personal Identifier

(EDIPI).

Local persons include those non-DoD persons with credentials that can be federated to the DoD local access personnel that have not been issued a credential that can be federated and persons issued a local access card

3.4.1.8 The System shall provide the capability to electronically share local population information with other DoD and federal Systems.

3.4.1.9 The System program software shall electronically connect to in-state and out-of-state law enforcement and DMV data sources.

3.4.1.10 The System shall provide a web-based interface to support user database search for designated agencies. The information available to search shall include, but is not limited to, biographic and biometric identity information, credential information, physical access permissions information, security alert information, and access history

(“scan” or “swipe” history) information. Such access shall be read-only.

3.4.1.11 The System shall implement Internet Protocol version 6 (1Pv6) on public facing servers and services providing for dual stack operations of IPv4 and IPv6 in parallel.

3.4.2 Infrastructure

3.4.2.1 The System shall provide a network architecture compliant with Army standard network communication guidance. (i.e. Joint Regional Security Stack (JRSS)

Installation Campus Area Network (ICAN) modernization guidance)

3.4.2.2 The System shall establish system enclave utilizing Installation Network infrastructure only for transport purposes.

3.4.2.3 The System shall be designed to integrate with existing infrastructure and networks.

3.4.2.4 The System shall provide fiber optic cable from the ACP to the point of debarkation of Installation's fiber optic cable that is approximately 500 feet.

3.5 CYBERSECURITY

3.5.1 The System shall implement the National Institute of Standards and

Technologies Special Publication (NIST SP) security controls prescribed in DoD

Instruction (DoDI) 8510.01 Risk Management Framework for DoD IT, which are reflective of an overall security categorization as defined in Committee on National

Security Systems Instruction (CNSSI) 1253, and AR 25-2, (CS) and display a privacy act statement at appropriate user interfaces.

3.5.2 The System shall implement system security measures sufficient to attain and maintain Authorization to Operate (ATO) IAW DoDI 8510.01 Risk Management

Framework (RMF) for DoD Information Technology, AR 25-2 and pamphlets and the

Network Enterprise Technology Command (NETCOM) RMF: Assess and Authorize TIP dated 2 June 2016.

3.5.3 The System shall use secure encrypted communications over the NIPRNET network of at least AES-256.

3.5.4 The System shall encrypt data at rest IAW with DoD Policy Memorandum, “Encryption of Sensitive Unclassified Data At Rest on Mobile Computing Devices and

Removable Storage Media," dated July 7, 2007, DoDI 8100.2, "Use of Commercial

Wireless Devices, Services, and Technologies in the Department of Defense (DoD)

Global Information Grid (GIG)," dated April 24, 2007, as supplemented by ASD Nll/DoD

CIO memorandum, same subject, dated June 2, 2006, DoD Policy Memorandum, "Protection of Sensitive DoD Data at Rest on Portable Computing Devices," dated April

18, 2006.

3.5.5 The System shall ensure data concurrency of all System components among physical installations with secure network connectivity and be able to store encrypted data and eliminate duplicate information.

3.5.6 The System shall provide the capability to automatically install security patches IAW an approved DoD Patch Management Policies process utilizing

Information Assurance Vulnerability Management (IAVM).

3.5.7 The System shall provide Host Based Security System (HBSS), per JTF-GNO

CTO 07-12.

3.5.8 The System shall provide a hierarchical Organizational Unit (OU) structure that is adaptable and sustainable.

3.5.9 The System shall provide the capability to use PKI certificates (CAC logon) on workstations, servers and tools for managing, renewing, and revoking certificates and related services and support IAW DoD Policy for Public Key Infrastructure (PKI) and

Public Key (PK) Enabling.

3.5.10 The System shall remain current with the latest Army Gold Master standard.

3.5.11 The System shall provide a secure operating environment IAW Defense

Information System Agency (DISA) guidelines and standards.

3.5.12 The System shall provide WSUS, Solarwinds, and SPLUNK capabilities.

3.5.13 The System shall provide capabilities for monitoring/updating Information

System & Environment Changes, performing Corrective Actions, updating Security

Controls as needed, conducting periodic Security Control Assessments, conducting

Remediation Actions, accomplishing Security Status Reporting and ensuring Risk

Determination and Acceptance.

3.5.14 The system shall be configured and maintained IAW Defense Information

Systems Agency (DISA) Security Technical Implementation Guides (STIG).

3.5.15 The system shall utilize highest approved FIPS algorithm in place to encrypt all devices to include System logs.

3.5.16 The system shall be configured to use Secure File Transfer Protocol.

3.5.17 The system shall be configured and implement secure network implementation in accordance with DODI 8531.01 to include but not limited to support vulnerability assessment and analysis (network discovery, network and host vulnerability scanning, penetration testing).

3.5.18 The system shall implement Internal Network scanning and Monitoring/ update tools.

3.5.19 The system shall implement threat, vulnerability and attack notification, and take corrective action to mitigate potential vulnerabilities to the system and DODIN

(Department of Defense Information Networks) as part of Comprehensive Vulnerability

Management consisted with repeatable Vulnerability Management Process.

3.5.20 The system shall be configured and implemented IAW NIST 800-53, DoDI

8500.01, Cybersecurity, – DoDI 8510.01, Risk Management Framework (RMF) for DOD

Information Technology (IT), – DoDI O-8530.1 “Support to Computer Network Defense

(CND)”, – DoDI 8551.01, Ports, Protocols, and Services (PPSM).

3.5.21 The system shall be configured to comply with current and future Computer

Network Defense (CND) directives.

3.5.22 The system shall be configured IAW DoDI 8520.02, Public Key Infrastructure

(PKI) and Public Key (PK) Enabling and Public Key Encryption.

3.5.23 The system shall be configured to comply with DoD Network and Cyber

Security TASKORDs, ARCYBER OPORDS, FRAGOs, CTOs.

3.5.24 The System shall be configured and ready to meet DOT&E requirement for

Defense Business Systems such as Cooperative Vulnerability and Penetration

Assessment (CVPA). A CVPA is an overt and cooperative examination of the system to identify all significant cyber vulnerabilities and the level of capability required to exploit those vulnerabilities. CVPAs are conducted in the intended operational environment with representative system operators, system/network administrators, and local cyber defenders present to assist the test team in their evaluation.

3.5.25 The system shall be configured to meet Adversarial Assessment (AA) Protect, Detect, React, and Restore (PDRR) requirements. AA evaluate the ability to protect the system/data, detect threat activity, react to threat activity, and restore mission capability degraded or lost due to threat activity.

**To provide operational impact and comprehensive PDRR data collection, both local and non-local network defenders should participate during the AA. Systems which include continuity of operations (COOP) in system’s Concept of Operations should include a COOP demonstration as part of the restore evaluation. The AA shall be conducted in concert with other operational testing but might require dedicated test time or assets that do not compete for time or resources with other operational test objectives. A CVPA and AA will normally be required as part of any operational test or assessment that supports a fielding decision.

3.5.26 The System shall be configured and maintained to meet Command Cyber

Readiness Inspection (CCRI) with no or limited notice. The system is subject to any unscheduled inspections IAW DoD entity's cyber posture that includes a detailed assessment of its Information Assurance programs, the non-classified and classified IP networks, and the critical cyber and physical assets that support these networks.

3.6 SUSTAINMENT

Sustainment providers will support all product generations regardless of the final…