Attachment_3_DX_Device_UEM_Requirements_Draft.pdf

U.S Census Bureau Draft

Attachment 3: D-X Functional Requirements for Devices and UEM September 15, 2026

D-X Functional Requirements for Devices & Unified Endpoint Management

Purpose This document defines the device‑agnostic functional requirements for devices and the Unified Endpoint Management (UEM) ecosystem supporting the 2028 Census Test and the 2030 Decennial Census under the D‑X delivery model. The requirements emphasize capabilities and mission outcomes rather than specific brands, operating systems, or vendors. Together, they outline the framework required to provision, manage, and sustain devices and connectivity at decennial scale.

FuncƟonal Requirements This section defines the functional scope for UEM, mobile and tablet devices, laptops, and integrated connectivity services, including cellular, WiFi, VPN, APN, and PKI/SCEP. Crosscutting compliance requirements to include, but not limited to FedRAMP, FISMA, Title 13, Zero Trust, Section 508/WCAG, Section 889, and SBOM are embedded throughout every phase of the UEM and device lifecycle to ensure confidentiality, integrity, availability, and accessibility of mission data and services.

Unified Endpoint Management (UEM) Requirements Req ID Functional Area Functional Description Priority UEM-PLT-01 Platform Security &

Authorization FedRAMP authorized UEM; NIST SP 800- 53; supports ATO milestones.

Mandatory

UEM-PLT-02 Platform Security & Authorization

Continuous monitoring, vulnerability management, incident detection & escalation.

Mandatory

UEM-PLT-03 Platform Security & Authorization

RBAC, MFA for admins, full exportable audit logs.

Mandatory

UEM-PLT-04 Platform Security & Authorization

FIPS‑validated encryption at rest/in transit; US‑only data hosting.

Mandatory

UEM-XPL-01 Cross‑Platform Support Manage all endpoint types/OEMs under one framework.

Mandatory

UEM-XPL-02 Cross‑Platform Support Uniform baselines/compliance across platforms; equivalent outcomes.

Mandatory

UEM-XPL-03 Cross‑Platform Support Manage approved peripherals or integrate with companion tools.

Desirable

UEM-ENR-01 Enrollment & Provisioning Zero/low‑touch enrollment at population scale; self‑configure on first use.

Mandatory

UEM-ENR-02 Enrollment & Provisioning Bulk provisioning workflows sustaining peak Census volumes.

Mandatory

UEM-ENR-03 Enrollment & Provisioning Multiple provisioning models with consistent quality during surges.

Mandatory

Req ID Functional Area Functional Description Priority UEM-ENR-04 Enrollment & Provisioning Rapid re‑provision/reassignment;

factory‑reset to compliant state.

Mandatory

UEM-POL-01 Policy & Configuration Enforce passcode/MFA, encryption, OS minimum; auto remediate/restrict;

freeze OS updates during data collection operations.

Mandatory

UEM-POL-02 Policy & Configuration Control hardware functions & app install; kiosk/single‑purpose mode.

Mandatory

UEM-POL-03 Policy & Configuration Managed profiles/containerization with selective enterprise wipe.

Mandatory

UEM-POL-04 Policy & Configuration Geography‑aware policy actions (geofencing).

Mandatory

UEM-POL-05 Policy & Configuration Staged policy/update deployment with scheduling & rollback.

Mandatory

UEM-POL-06 Policy & Configuration Policy sets by workforce role, group, or geography including enable/restrict device hotspot, connectivity and app access.

Mandatory

UEM-POL-07 Policy & Configuration Policy based web content filtering aligned with acceptable use policy

Mandatory

UEM-POL-08 Policy & Configuration Data loss prevention controls include restriction of copy/paste, screen capture, and data sharing.

Mandatory

UEM-POL-09 Policy & Configuration Full disablement of OS and app AI features

Mandatory

UEM-POL-10 Policy & Configuration Enforce enablement of location services and prevent user disablement.

Mandatory

UEM-SSR-01 End User Self Service Self-service credential reset and account unlock

Mandatory

UEM-SSR-02 End User Self Service Routine service request initiation via ITSM integration

Desirable

UEM-SSR-03 End User Self Service Activation guidance and enrollment status

Desirable

UEM-SSR-04 End User Self Service Self-service issue reporting, including mark device as lost.

Desirable

UEM-SSR-05 End User Self Service Self-service app catalog access for approved Census applications.

Desirable

UEM-SEC-01 Security Operations Integrity attestation; jailbreak/root detection; conditional access.

Mandatory

UEM-SEC-02 Security Operations Remote lock/full/selective wipe at individual mass scale with audit.

Mandatory

UEM-SEC-03 Security Operations Integrate identity/endpoint baselines;

zero trust; ICAM integration.

Mandatory

UEM-SEC-04 Security Operations Lost/stolen workflows: locate (authorized), lock, wipe, disposition.

Mandatory

UEM-APP-01 App & Content Management Deploy/update/config/remove apps;

per‑app VPN/ZTNA; app‑level protection.

UEM-APP-02 App & Content Management Application allow/deny lists; managed catalogs limited to census apps.

Mandatory

UEM-APP-03 App & Content Management Secure content/config delivery;

bandwidth‑aware for field devices.

Desirable

UEM-CEL-01 Connectivity & eSIM Cellular activation & eSIM profile management; carrier‑agnostic switching.

Mandatory

UEM-CEL-02 Connectivity & eSIM Deploy/manage Wi‑Fi, VPN, certificate (PKI/SCEP), and APN configurations.

Mandatory

UEM-CEL-03 Connectivity & eSIM Capture cellular usage & telemetry for optimization and performance.

Desirable

UEM-RPT-01 Reporting & Analytics Real‑time dashboards & reporting across inventory, compliance, progress, health.

Mandatory

UEM-RPT-02 Reporting & Analytics Telemetry feeds to D‑X Command Center for unified operational picture.

Mandatory

UEM-RPT-03 Reporting & Analytics Predictive analytics for demand planning, health, readiness.

Desirable

UEM-RPT-04 Reporting & Analytics Exportable, machine‑readable reporting via APIs & standard formats.

Mandatory

UEM-INT-01 Integration & Interoperability Secure APIs to integrate with Government ITSM; cross‑vendor escalation.

Mandatory

UEM-INT-02 Integration & Interoperability Integrate with asset management/CMDB & logistics; chain of custody reconciliation.

Mandatory

UEM-INT-03 Integration & Interoperability Interoperate in D‑X MSI multi‑vendor XaaS ecosystem.

Mandatory

UEM-INT-04 Integration & Interoperability Automate provisioning, updates, service workflows; policy‑bounded AI ok.

Desirable

UEM-SCL-01 Scale, Availability & Support Scale to hundreds‑of‑thousands endpoints; surge/de‑surge without degradation.

Mandatory

UEM-SCL-02 Scale, Availability & Support Meet availability/performance SLAs;

tracking/monitoring/escalation governance.

Mandatory

UEM-SCL-03 Scale, Availability & Support Tier‑3 engineering support is integrated with Government ITSM & MSI model.

Mandatory

UEM-LCM-01 Lifecycle & Decommissioning Un‑enroll; remote sanitization (NIST 800‑88) with auditable evidence.

Mandatory

UEM-LCM-02 Lifecycle & Decommissioning Retain/export lifecycle records; secure platform data disposition.

Mandatory

UEM-ACC-01 Accessibility Admin/end‑user interfaces conform to Section 508 accessibility.

Mobile & Tablet Requirements

MOB-FRM-01 Form Factor & Display

Handheld/tablet for one‑hand/on‑the‑move use.

Mandatory

MOB-FRM-02 Form Factor & Display

Sunlight & low‑light legibility for all‑day outdoor use.

Mandatory

MOB-FRM-03 Form Factor & Display

Usable in light rain/moisture; light gloves. Desirable

MOB-FRM-04 Form Factor & Display

Legible instrument/maps/lists without excessive scrolling.

Mandatory

MOB-CMP-01 Compute & Platform Run Census field app, mapping, training, security stack concurrently all day.

Mandatory

MOB-CMP-02 Compute & Platform Supported, enterprise‑manageable OS through 2030 operations.

Mandatory

MOB-CMP-03 Compute & Platform Encrypted local storage sized for extended offline operation.

Mandatory

MOB-LOC-01 Location & Sensors Multi‑constellation GNSS + assisted positioning;

structure‑level accuracy.

Mandatory

MOB-LOC-02 Location & Sensors Fused positioning in GNSS‑degraded environments.

Desirable

MOB-LOC-03 Location & Sensors Policy‑controlled location services; enforce during work; prohibit misuse.

Mandatory

MOB-CAM-01 Location & Sensors Authorized document/structure capture; able to fully disable by policy.

Desirable

MOB-CON-01 Connectivity LTE/5G + voice; eSIM/dual‑SIM; carrier‑agnostic activation inc. territories.

Mandatory

MOB-CON-02 Connectivity Current Wi‑Fi standards with enterprise authentication.

Mandatory

MOB-CON-03 Connectivity Bluetooth/short‑range for approved peripherals; policy control.

Desirable

MOB-CON-04 Connectivity Satellite messaging/data (native or companion) for remote operations.

Desirable

MOB-CON-05 Connectivity Store‑and‑forward offline; encrypted queue;

automatic sync.

Mandatory

MOB-CON-06 Connectivity Managed telephony; number masking/softphone.

Desirable

MOB-SEC-01 Security Hardware‑backed key storage & verified boot;

FIPS‑validated encryption.

Mandatory

MOB-SEC-02 Security AAL2 MFA for device/app; policy lockout & inactivity timeout.

Mandatory

MOB-SEC-03 Security Enterprise workspace separation; selective enterprise wipe.

Mandatory

MOB-SEC-04 Security Attestation & jailbreak/root detection;

automated policy responses.

Mandatory

MOB-SEC-05 Security Approved cryptography & zero trust patterns for data in transit.

Mandatory

MOB-SEC-06 Security Policy enable/disable radios, camera, mic, ports, apps; kiosk mode.

MOB-SEC-07 Security Geofencing actions when devices leave authorized areas/US territories.

Mandatory

MOB-MGT-01 Manageability Enroll at population scale; zero touch provisioning.

Mandatory

MOB-MGT-02 Manageability Remote lock/wipe/config & app deployment without physical access.

Mandatory

MOB-MGT-03 Manageability Asset/compliance/battery/connectivity/security telemetry reporting.

Mandatory

MOB-MGT-04 Manageability OTA OS/app updates; staged rollout, deferral windows & rollback.

Mandatory

MOB-MGT-05 Manageability Durable machine‑readable asset identifiers (barcode/RFID + serial) must also be visually readable, tamper‑resistant, and include a 12‑digit alphanumeric asset code.

Mandatory

MOB-PWR-01 Power & Durability Battery sustains 8+ hours of GNSS/cellular/screen‑on mixed use.

Mandatory

MOB-PWR-02 Power & Durability Rapid charging Desirable

MOB-DUR-01 Power & Durability Survive repeated drops; dust/water ingress protection (e.g., IP65).

Desirable

MOB-DUR-02 Power & Durability Operate across climates without shutdown or data loss.

Mandatory

MOB-ACC-01 Accessibility & Usability

Assistive technologies; Section 508/WCAG compliance.

Mandatory

MOB-ACC-02 Accessibility & Usability

Multilingual display & input; non‑Latin script rendering.

MOB-LCM-01 Lifecycle & Sustainability

Supportable at scale; rapid advance replacement/swap programs.

Mandatory

MOB-LCM-02 Lifecycle & Sustainability

Verifiable NIST 800‑88 sanitization with auditable certificates.

Mandatory

MOB-LCM-03 Lifecycle & Sustainability

Comply Section 889 source restrictions. Mandatory

MOB-LCM-04 Lifecycle & Sustainability

Support UEM‑managed anti‑theft/activation lock; allow authorized unlock at recovery/decommissioning to support sanitization and reuse.

Desirable

Laptop Requirements Req ID Functional Area Functional Description Priority LAP-CMP-01 Compute &

Performance Run control/case management/training/collaboration/productivity concurrently all shift.

Mandatory

LAP-CMP-02 Compute & Performance

Hardware virtualization/containerization (VDI, sandboxed workspace).

Desirable

LAP-CMP-03 Compute & Performance

Solid‑state local storage with headroom; secure caching for operations.

LAP-CMP-04 Compute &

Performance Supported, enterprise‑manageable OS through 2030 operations.

Mandatory

LAP-DSP-01 Display & Ergonomics

Display renders dashboards/maps/side‑by‑side apps without external monitor.

Mandatory

LAP-DSP-02 Display & Ergonomics

Support connection of ≥1 external display for office functions.

Mandatory

LAP-DSP-03 Display & Ergonomics

Integrated camera/microphone/speakers; privacy disable capability.

Mandatory

LAP-DSP-04 Display & Ergonomics

Weight/form factor supports routine transport by mobile workforce.

Desirable

LAP-SEC-01 Security Hardware root of trust (e.g., TPM 2.0) with measured/verified boot.

Mandatory

LAP-SEC-02 Security Full‑disk encryption (FIPS‑validated), enforceable by policy.

Mandatory

LAP-SEC-03 Security MFA including Assurance Level 2 (AAL2) MFA beyond Mandatory LAP-SEC-04 Security Biometric authentication (e.g. Facial Recognition or

Fingerprint) under enterprise policy control.

Desirable

LAP-SEC-05 Security Encryption for data in transit (VPN/TLS/ZTNA) to D‑X/government systems.

Mandatory

LAP-SEC-06 Security Manageable, integrity‑protected firmware; block unauthorized changes.

Mandatory

LAP-SEC-07 Security Policy control of ports, radios, cameras, microphones, removable media (DLP).

Mandatory

LAP-SEC-08 Security Physical lock slot; support privacy screen filters. Desirable LAP-SEC-08 Security Geofencing actions when devices leave authorized areas/US territories.

Mandatory

LAP-CON-01 Connectivity Current Wi‑Fi standards with WPA3‑Enterprise authentication.

Mandatory

LAP-CON-02 Connectivity Wired Ethernet (native or via managed adapter/dock). Mandatory LAP-CON-03 Connectivity Embedded or attachable LTE/5G connectivity;

carrier‑agnostic activation.

Desirable

LAP-CON-04 Connectivity Bluetooth/short‑range for approved peripherals;

security policy control.

Desirable

LAP-CON-05 Connectivity Degraded/disconnected mode; encrypted local work;

auto sync when online.

Mandatory

LAP-CON-05 Connectivity Minimum two USB ports, including at least two USB‑C, supporting simultaneous power, display, and peripheral connectivity natively or via managed dock/adapter.

Mandatory

LAP-MGT-01 Manageability Enroll in UEM platform; zero/low‑touch provisioning at census scale/pace.

Mandatory

LAP-MGT-02 Manageability Remote lock/wipe/selective wipe & configuration without physical access.

Mandatory

LAP-MGT-03 Manageability Asset/health/compliance/location (authorized)/security telemetry reporting.

Mandatory

LAP-MGT-04 Manageability Unattended, bandwidth‑aware OS/app updates; staged rollout & rollback.

Mandatory

LAP-MGT-05 Manageability Durable machine‑readable asset identifiers (barcode/RFID + serial) must also be visually readable, tamper‑resistant, and include a 12‑digit alphanumeric asset code.

LAP-PWR-01 Power & Environment

Battery supports a minimum of 8 hours of typical office productivity use on a single charge and supports rapid recharge.

Mandatory

LAP-PWR-02 Power & Environment

Standards‑based charging (e.g., USB‑C PD). Desirable

LAP-PWR-03 Power & Environment

Operate reliably across US temperature/humidity/altitude ranges.

Mandatory

LAP-DUR-01 Power & Environment

Withstand daily transport shocks/vibration/minor drops/spills; ruggedness preferred.

Desirable

LAP-ACC-01 Accessibility & Usability

Support assistive tech in end‑user/firmware UIs; Section

508/WCAG.

Mandatory

LAP-ACC-02 Accessibility & Usability

Multilingual display, input, and keyboard configurations. Mandatory

LAP-LCM-01 Lifecycle & Sustainability

Supportable through 2028 Census Test & 2030; rapid swap for failed units.

Mandatory

LAP-LCM-02 Lifecycle & Sustainability

Verifiable NIST 800‑88 media sanitization at decommissioning.

Mandatory

LAP-LCM-03 Lifecycle & Sustainability

Comply with Section 889 supply chain restrictions. Mandatory

LAP-LCM-04 Lifecycle & Sustainability

Environmental/energy registrations (EPEAT, ENERGY STAR); reuse/recycle.

Desirable