ATTACHMENT 5 - LSSP Requirements OA.pdf

ATTACHMENT 5 - LSSP REQUIREMENTS

Item Category Requirement `In this context, User includes users internal and external to the vendor whereas Staff means only vendor personnel P1 Funding Build ability to Bill the user as per the Usage for Fee tracking.

P2 Funding Build functionality to calculate billing fees by direct inquirer combing billing usage with LSSP fees to Invoice the direct inquirer. This might be used to invoice the inquirer.

P3 Funding Maintain current and valid records of all amounts billed to Inquirers, the basis for such bills, amounts received from those Inquirers, and all expenses incurred in operating the LSSP.

P4 Funding Maintain current and valid billing and expense information.

P5 Funding Employ adequate billing and collection procedures.

P6 Funding Set a stable fee for each service provided.

P7 Funding In setting the fees, develop a fee structure that considers the size and classification of the various inquirers, reporting institutions, and other users and ensure that the fees do not discourage the use of the LSSP.

P8 Funding Fees shall be fair and reasonable, and fees shall be part of the contract.

P9 Funding Provide an analysis of the fees and the fee structure demonstrating that the fees and the fee structure do not discourage use of the LSSP and are fair and reasonable with regard to the various classifications and sizes of the inquiries, reporting institutions, and other users.

P10 Funding Provide cost and fee projections for each year of the contract, broken down by size classifications.

P11 Funding Calculate the fee projections based on the assumption of six million (6,000,000) total transactions by certificate for the base year with a projected decline of ten percent (10%) per year over the life of the contract. The ten percent (10%) decline figure is only an estimate and is being used in this context merely for evaluation purposes and should not be indicative of actual declining volume P12 Funding Billing function tabulates the invoice charges for participants of the Program

P13 Project Provide project plan to build, test, data transition, operational change over, SSP, security assessment, ATO, and release LSSP System P14 Project Provide COR with biweekly updates on LSSP builds P15 Project (Optional) Design and build capabilities that allow participants to securely interact with LSSP using web services P16 Project (Optional) Help users implement LSSP web service connections P17 Project Review LSSP documentation from the Incumbent Vendor, including the data from the database, data from the Participant file, data from the audit file, the X-17F-1A hard copy forms, registration hardcopy forms, all related microfiche records of the aforementioned data, and a description of the database records consisting of field names, lengths, and data types.

P18 Project Transfer the existing database from the Incumbent Vendor P19 Project Review, from the Incumbent Vendor, system documentation that adequately describe data types and structures, record formats, file designs, and database organization, including data (data from the database, Data from the Participant file, Data from the audit file), forms (X-17F-1A hard copy forms and registration hardcopy forms), records (all related microfiche records of the aforementioned data and a description of the database records consisting of field names, lengths, and data types), and documentation in order to facilitate transfer of the system P20 Project Provide project plan for data transfer, iterative testing, and operational change over from Incumbent Vendor P21 Project Provide the COR with biweekly updates during execution of data transfer, iterative testing, and operational change over from Incument Vendor P22 Project Finalize, working the the Incumbent and SEC, plans for technical and logistical issues involved in transitioning LSSP operation with disruption to partipants P23 Project Establish, working with the Incumbent and SEC, plans for an effective and efficient method for data transfer that enables the initial build of a test database and subsequently evolve it to, using an acceptable data transfer mode to move data from the Incumbent Vendor’s database, a database that can simulate active live processes P24 Project Build functionality to share, publicly information about the LSSP program, including a decription of the LSSP, the Rule, Form x-17f-1a, reporting, inquiring, and other useful information P25 Project Establish procedures for operating the LSSP consistent with the rules of the program and to ensure successful operation of program goals P26 Project Establish and submit to the SEC COR for approval a LSSP Quality Control Plan, including any future changes P27 Project Provide to the SEC COR an annual report within 30 days after the end of the contract year, addressing the Program's statistics P28 Project Provide monthly summary reports, within five business days of the end of the month, providing information on the number of certificates reported, the number of certificates inquired upon, and the number of hits.

P29 Project Train each employee assigned to work on LSSP on LSSP procedures and certify that each such employee has completed such training, including keeping a file of training completion, which is provided to the Commission upon request P30 Project Build and Operate the LSSP system with complete Disaster recovery support with built in redundancy to reduce the Downtime, and quick recovery time in case of system outage.

P31 Project Build and operate the system with ability to recover the system from a partial or complete failure , with no loss of data and keeping the Data Integrity intact at all times P32 Project Adequate facilities and personnel to operate the LSSP, including adequate physical security, cyber security, and personnel training.

P33 Project A detailed and summary annual report within 30 days of the end of each contract year P34 Project A monthly summary report within five business days of the end of each month P35 Project Change management policies are built around industry standard P36 Project Ensures 800-53 controls over information system P37 Project Reconcile reports received against existing information P38 Project Report feature to add lost, stolen, or permissive stops to the Program P39 Project Report gives staff view access to current or deleted certificates (recovered) P40 Project Provide the SEC and its designated staff with monthly usage, cost, and billing information, or more frequently upon request.

P41 Security Build functionality to encrypt Participant user passwords at rest P42 Security Create and share System Security Plan ("SSP") with COR and OIT Security P43 Security Support OIT Security inspection of process documents, policies, and scan results P44 Security Build functionality to encrypt Participant user passwords in-use (aka during authentication) P45 Security Build and operate the system with ability to provide a report of all access, actions and activities as and when requested with the details including the who, what, where and when P46 Security Provide reports to the SEC COR about the actions taken to keep the system secure as requested by the COR P47 Security Operate annd maintain the system access on an as needed basis keeping the system security to the maximum needed P48 Security Operate and Maintain the system with procedures in place to validate the policies and procedures of business continuity, disaster recovery and System security on a regular basis P49 Security Operate and Maintain the System with active ATO from SEC at all times. Usually ATO cycle is every 3 years for SEC at this time P50 Security Cooperate with the SEC Security Team in support of the risk analysis and Evaluation

P51 Staff Build functionality to update CUSIP numbers P52 Staff Build functionality to execute inquiry requests daily on inquiries with no matches for 30-days after the inquiry was created P53 Staff Build functionality to execute recovery search requests to recovery input fields with the database of reported securities P54 Staff Build functionality to store recovery action (ID, date, participant ID, origional report date) and Form x-17f-1a report fields P55 Staff Build functionality to search reported Form x-17f-1a submissions by FINS, CUSIP, and Certificate Number P56 Staff Build functionality to match data points to help inquirers and reporters P57 Staff (Optional) Build functionality to allow LSSP staff to support participants with secure web service submission confirmations, rejects, and errors P58 Staff (Optional) Build functionality to allow LSSP staff to support participants with secure file transfer upload confirmations, rejects, and errors P59 Staff Build functionality to allow LSSP staff (with notification from transfer agents) to update FINS numbers of reports P60 Staff Build functionality to allow LSSP staff to review participant registration information and manage compliance with LSSP Program Rules P61 Staff Build functionality to allow LSSP staff to add new participants P62 Staff Build functionality to allow LSSP staff change participant information (i.e., direct/indirect type, contact information, status, access codes, etc P63 Staff Build functionality for LSSP staff to support the administration of Participant users P64 Staff Build functionality for LSSP staff to support Participant user file transfers P65 Staff Build functionality for LSSP staff to support general Participant activities interacting with the LSSP P66 Staff Build functionality to generate a unique report ID for each report P67 Staff Ability to establish Participant as single entities for individual and entity accounts, or as group customers with defined group members (individuals and/or entities).

P68 Staff Ability to establish and track relationships between types of Inquirers P69 Staff Review and respond to phone, email, and web portal inquiries of the LSSP P70 Staff Monitoring program operations and collaborate with industry participants and the Commission to identify and implement program improvements P71 Staff Assist LSSP participants with inquire and report matches, including searches into older records P72 Staff Collect LSSP registration forms from participants P73 Staff Create and update LSSP registration information from LSSP registration forms P74 Staff Work with Transfer Agents to identify FINS updates to reports and update them P75 Staff Operate functionality that allows LSSP system admins to unlock and/or reactivate participant account P76 Staff Operate secure web portal that is open in parallel to the days and times that the active US stock exchanges and trade venues are open P77 Staff Build functionality to allow LSSP staff to update any missing information about securites, when provided later by reporting institutions P78 Staff Build functionality that allows for content to be deleted, but only after information has been provided by the same reporting instituion that submitted the initial information P79 Staff Build functionality that disallows information update on securities if two or more reporting agencies are reporting on the same security certificate

P80 User Build functionality for restricting searches and results based on Roles/Permissions (Differnet views for Direct Subscribers vs InInquirers) P81 User Build functionality to optimize database searching on CUSIP and certificate number P82 User Build functionality to store all inquiry transactions & metadata P83 User Build functionality to store all inquiry matches from daily re-inquiries P84 User Build functionality to store all reporting data submited by participants P85 User Build functionality to allow the submission of questions or comments via a web interface as well as share an LSSP phone number and email for questions and answers to frequently asked questions P86 User Build functionality to support LSSP participant registration P87 User (Optional) Build services to allow participants to download confirmation or rejection/error results from the system P88 User (Optional) Build functionality to allow participants to submit reports and/or inquiries via CSV upload to SFTP site P89 User Build functionality to allow inquirers to enter any number of parameters and run on a single query request P90 User Build functionality that prioritizes CUSIP and certificate number P91 User Build functionality that displays "no matches" when that is the case P92 User Build functionality that matches other parameters when CUSIP and certificate number match P93 User Build functionality that produces a unique identifier for each inquiry/report P94 User Build functionality for flags related to Direct Inquirer specifications P95 User Build functionality that allows Inquirers to download flag-related data P96 User Build functionality to allow Direct Inquirer users to view all historical inquiries P97 User Build function to display for Direct Inquirer users re-inquiry results, including display of contact information P98 User Build Functionality to allow Direct Inquirer Subsciber to search Structured content ( X17a-Form information) , Unscructured content( any attached documents/artifacts), And Key words ( If any) for the Reported Securities.

P99 User Build functionality that allows users to search for recovery P100 User Build functionality to display participant recovery search results P101 User Build functionality to allow participant interaction with recovery search results P102 User Build functionality to display search results by specific parameters P103 User Build functionality to display all process confirmations P104 User Build functionality to allow participant users to create & submit Form X-17f-1a fields (required) and comments (optional) on one, many, or a range of certificates in one requests P105 User Build functionality to display for participants reported Form x-17f-1a submissions, unique report IDs, and comments P106 User Build functionality that allows search with CUSIP and Certificate Number, related to Form x-17f-1a submissions P107 User Build functionality that displays searches related to Form x-17f-1a P108 User Build functionality that allows export of display results via PDF P109 User (Optional) Build functionality to allow inquirers to submit Inquiry GET requests (with inquiry field parameters) returned by inquiry result parameters (i.e., no-match, match results) P110 User (Optional) Build functionality to allow inquirers to submit Passback GET requests (with existing inquiry field parameters) returned by inquiry result parameters (i.e., new match results) P111 User (Optional) Build functionality to allow participant users to submit Recovery GET requests (with recovery field parameters) returned by recovery response parameters P112 User (Optional) Build functionality to allow participant users to submit Recovery PUT requests (with recovery field parameters) returned by recovery confirmation parameters P113 User (Optional) Build functionality to allow participant users to submit Report GET requests (with Form x-17f-1a fields and optional fields parameters) returned by report submission confirmation parameters P114 User Operate functionality that allows participant users to self-unlock their account by answering security questions from a preselected list P115 User (Optional) Provide the functionality to Bulk Load Multiple Lost/stolen/counterfiet/recovered securities in a secured automated fashion With proper data and user validation

PROGRAM REQUIREMENTS

Item Category Requirement S1 Admin Provide Administration and operational capabilities in a user friendly manner to support Program Participants S2 Admin Subscriber Maintenance function administers the participant registration status S3 Admin Support participants with all processes related to processing securities S4 Admin User Admin interface controls internal and external user access to the LSSP website S5 Admin User Admin interface controls the data feed flow between LSSP website and its participants.

S6 Audit Provide support to SEC information system audits S7 Audit Audit data has a minimum set of perimeters

S8 Data (Optional)Build services to automatically extract, process and load incoming data in approved file formats including support for manual batch upload of data S9 Data Ability for all participants to submit bulk inquiry or reporting files S10 Data Ability for the reporting institutions to view full certificate detail of reports or inquiries S11 Data Ability to change status at any time by submitting an updated registration form S12 Data Ability to handle data and File validations, Confirmation of data receival and error handling S13 Data Ability to update certificate records

S14 Data

Build tables to restore recovery Reporting Transaction data:

1. Recovery IF (unique identifier)

2. Recovery Date

3. Original Stop Submission Date

4. All X-17f-1a Fields (Fields defined in the sheet defined Form X17-F-1A fields)

5. Permissive Stop (Optional)

6. Permissive Stop Comment (Optional)

S15 Data Build tables to store direct inquirer usage for fee tracking. Current fee tracking rules are in Sheet named Fee Tracking.

S16 Data Build tables to store inquiry transaction data with an ability to match the enquirer and the direct enquirer information along with the results as to was there a match or not and type of match. Sample fields are in the Sheet Transaction Data.

S17 Data

Build tables to store Lost-Missing-Counterfeit reporting transaction data (i.e., Form x-17f-1a fields):

1. Report ID (unique identifer)

2. All X-17f-1a Fields (Fields defined in the sheet defined Form X17-F-1A fields)

3. Permissive Stop (Optional)

4. Permissive Stop Comment (Optional)

S18 Data Build tables to store Participant registration transaction data. Desription of the fields needed for registration is avaiable in Participant data Sheet S19 Data Data replication for workflows between primary and other sites, as defined in the associated disaster recovery plan S20 Data Data validation and masking for appropriated input fields that require specific format S21 Data Data validation, data submission, confirmation file generation, and file delivery.

S22 Data Electronic database must accommodate certain minimum information identified on Form X-17F-1A S23 Data File validation services inspect new files for formatting compliance S24 Data Flag a particular CUSIP number or a subset of a particular CUSIP number S25 Data Operational staff can view transaction activity for each record S26 Data Participant firms impacted by merger, acquisition, or closure are archived instead of deleted S27 Data Participants can elect to send reports and/or inquiries to data feeds S28 Data Shall provide the ability to submit Bulk data feed for Securities information securely S29 Data The application should provide ability for all users to submit the securities information on the website S30 Data Update database with Transger Agent information S31 Data Maintain current and valid records regarding each report, inquiry, confirmation, correction, and other information received.

S32 Data Maintain current and accurate records of all reporting institutions registered in LSSP.

S33 Data Accept reports of lost, stolen, or counterfeit securities on Form X-17F-1A and other securities permitted to be reported to the LSSP .

S34 Data Accept reports of recovery of securities originally reported as lost, missing or stolen.

S35 Data Record and maintain those reports.

S36 Data Confirm receipt of those reports.

S37 Data Accept and respond to inquiries about specific securities.

S38 Data Match inquiries against reports to determine if a given security has been reported as lost, stolen, or counterfeit.

S39 Data Report the results to the inquiring party.

S40 Data Process and accept access requests from reporting institutions.

S41 Data Ensure all records are current and accurate at all times.

Data Implement Records Management Requirements to comply with SEC Clause 6021.00 RECORDS MANAGEMENT REQUIREMENTS FOR CONTRACTORS (JANUARY 2022)

S42 Disaster Recovery Ability to recover from any site or application or components failure S43 Disaster Recovery Active content vs. archived content S44 Disaster Recovery Data integrity and recovery of lost data S45 Disaster Recovery Disaster recovery exercise reports must be provided upon request S46 Disaster Recovery Incremental Data is backed up and stored per established policy S47 Disaster Recovery Provides backup & disaster recovery S48 Disaster Recovery Recovery Time to Operation (24 hr) & Recovery

SYSTEM REQUIREMENTS

S49 Network Communication services to handle end-to-end file delivery S50 Network (Optional)Build Services to Transmit and Exchange data electronically with established modes of Communication channels S51 Network Administrative activities exist in a virtual private network, with multi-factor authentication and set session timeouts S52 Network All servers make internal connections with each other to support all workflows once securities data are ingested

S53 Optimization A scheduler handles the execution of workflows, and internal communication services, and end of day, start of day, and statistics gathering jobs S54 Optimization Ability to view Active and Archived Content on-line disk storage and allow for a planned rate of annual growth S55 Optimization Build Optimization so searches does not cause performance issues to the system and application responds with search results in a reasonable time frame.

S56 Optimization Database is optimized for quick responses for the queries S57 Optimization Established set of routines for end-of-day processing S58 Optimization Web page for jobs to be scheduled and run S59 Optimization Process all reports within the required time frames.

S60 Optimization Respond to inquiries resulting from reports entered into the system from FORM X-17F- 1A within the required time frames.

S61 Optimization Provide confirmation reports to reporting institutions.

S62 Security (Optional) Build functionality for compliance with FIPS 140-2 S63 Security (Optional) Build functionality to control access to user end points S64 Security (Optional) Monitor and maintain participant web service capabilities S65 Security (Optional) Operate multi-factor authentication for all users S66 Security A clear plan for User access control S67 Security Ability to provide a report of all access, actions and activities as and when requested with the details including the who, what, where and when S68 Security Allows for Securify of system + data S69 Security Build functionality that controls data inputs by users S70 Security Build functionality that limits user browser session to less than two S71 Security Build functionality that minimizes code insertions such as with SQL embedding S72 Security Build functionality to protect data from common types of cyber attacks S73 Security Build functionality to terminate user sessions automatically after "x" period, participant and LSSP support S74 Security Build functionality where browser session rides at least TLS 1.2 S75 Security Connect to web/sftp servers with SFTP and HTTP/S for data feed and website access, respectively S76 Security Data flows are protected with firewalls and TLS S77 Security Develop, implement, and report on plans to eliminate POA&MS S78 Security Encode data to prevent common cyber attacks S79 Security Encrypted at the host with AES-128 for data at rest and data in transit S80 Security Operate and Maintain the system to meet NIST Security Controls with data encryption to prevent site and data from external or internal hacks, attacks and data loss S81 Security Operate and Maintain the system with proactive Vulnerability scans and remediation of any vulnerabilities found within 45 days S82 Security Operate functioanlity that lock participant user accounts after extended period of activity S83 Security Operate functionality that displays to the user when creating their password the strength of the password they are creating S84 Security Operate functionality that moves a user to inactive after twice the aforementioned extended period S85 Security Operate functionality to log system access endpoints of participant users S86 Security Operate functionality to maintain confidentiality, integrity, and availability of information at-rest and in-transit S87 Security Operate functionality to perform continuous security threat monitoring S88 Security Operate functionality to provide unique identifiers to all LSSP Program Staff users S89 Security Operate functionality to provide unique identifiers to all participant users S90 Security Operate functionality to require strong passwords S91 Security Operate system logs that record successful and failed login attempts S92 Security Participants utilizing the data feed option must use only use secure file stransfer methods S93 Security Provides information and access to SEC for for site inspections to validate security posture S94 Security Review and execute procedures connected to continuous security threat monitoring S95 Security Review user accounts every six months S96 Security Sessions and connections upheld by HTTP, TLS 1.2 and FIPS 140-2 S97 Security Vulnerability scan reports must be provided upon request S98 Security Web/sftp servers connect to the database servers on a specific port through an internal network.

S99 Storage Ability to meet the projected data growth without any disruption of services S100 Storage Data centers use recognized industry standards S101 Storage Data must be either stored in a local data center or in the cloud

SYSTEM REQUIREMENTS CONTINUED