Attachment C - Red Seguro Requirements.pdf

Solicitation 19GE5025Q0125 Call Center in Quito, Ecuador

RED SEGURO REQUIREMENTS

Red Seguro Requirement

Description

1. NSA CNSA 2.0 Cryptographic Standards

Adoption of CNSA 2.0-compliant algorithms such as AES- 256-GCM and quantum-resistant key exchanges.

2. FIPS 140-3 Validation All cryptographic modules must meet FIPS 140-3 certification. Vendor-supplied certificates required.

3. Defense-in-Depth Security Stack Includes dual ML3S switches, NGFW/IDS/IPS (Ingress & Egress), VPN concentrator, and OOBM router.

4. Zero Trust Architecture Enforces zero trust via continuous MFA, MACsec-256, micro-segmentation, and deny-by-default policy.

5. Secure Remote Maintenance SD-WAN and OOBM channels ensure encrypted, auditable admin sessions separated from user traffic.

6. Operational Resilience Active-active redundancy (Quito & Guayaquil) and DR site in Cuenca with 1-hour RTO, 6-hour RPO.

7. Scalability & Modularity Modular HCI (e.g., HPE SimpliVity), scalable core switching to expand user capacity and data flow.

To ensure full interoperability with Red Seguro—a secure, quantum-ready DoD communications infrastructure—the DoD Rewards Program (DoDRP) Call Center must adhere to the following advanced cybersecurity and operational standards:

1. Cybersecurity & Encryption Standards

• Systems must implement NSA CNSA 2.0 cryptographic algorithms, including AES-256- GCM and quantum-resistant key exchanges.

• All cryptographic modules must be FIPS 140-3 validated, with vendor certifications provided upon delivery.

2. Defense-in-Depth Architecture

• Dual Multi-Gigabit Layer 3 Switches (ML3S) for high-speed routing, VLAN segmentation, and redundancy.

• Dual NGFW/IDS/IPS firewalls for both Ingress and Egress to detect, block, and log threats.

• Out-of-Band Management (OOBM) Router to isolate network management traffic from production traffic.

• Layer 3 VPN Concentrator for centralized, encrypted remote user access.

• Dual Core Switches to interconnect all network segments with redundancy and high availability.

3. Zero Trust Architecture

• Continuous authentication with Multi-Factor Authentication (MFA) and MACsec-256 encryption.

• Role-based access control and micro-segmentation to enforce least-privilege policies.

• Default deny policies applied to all access points.

4. Secure Remote Maintenance

• Dedicated SD-WAN channel for vendor and administrative maintenance.

• All administrative access must be conducted via the OOBM router using encrypted, auditable sessions.

5. Operational Resilience & Continuity

• The system must support Active-Active replication between primary sites in Quito and Guayaquil, with <1-hour Recovery Time Objective (RTO).

• A separate Disaster Recovery site located in Cuenca must be capable of resuming operations within a 6-hour Recovery Point Objective (RPO).

6. Scalability & Modularity

• The architecture must support modular expansion to accommodate additional agents, increased data volume, and evolving security requirements.

• Preferred platforms include HPE SimpliVity or equivalent Hyper-Converged Infrastructure (HCI) and Aruba CX switches.

7. Compliance Assurance

• All vendor proposals must include documentation showing compliance with the above standards.

• Equipment or configurations that cannot meet Red Seguro requirements will be deemed non-compliant.