Attachment J.6 Cybersecurity Requirements.pdf

NOAA Class B

Attachment J.6

Cybersecurity Requirements

May 19, 2022

Solicitation No. 1305M222RNMAN00157

DISTRIBUTION STATEMENT A: Approved for public release; distribution is unlimited.

Table of Contents

1.0 1

2.0 1

3.0 IMPLEMENTATION GUIDELINES

3.1 11

3.2 2

3.3 2

3.4 22

3.5 3

3.6 3

3.7 33

3.8 Error! Bookmark not defined.

3.9 33

3.10 DEFAULT PASSWORDS AND ACCOUNTS 3

3.11 4

3.12 44

3.13 55

3.14 55

3.15 66

3.16 66

Cybersecurity Requirements Attachment J.6

1.0 GENERAL

The Contractor shall implement cybersecurity and cybersafety measures for all contractor responsible information technology and operational technology developed as part of this solicitation. For purposes of this contract, the following definitions are provided:

1. Information Technology (IT): Any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data and/or information.

2. Operational Technology (OT): Devices, sensors, software, and associated networking that monitor and control onboard systems.

3. Contractor Responsible IT/OT: All non-GFE systems, equipment, interconnections, software and associated networking.

Before delivery, the Contractor shall mitigate all identified and validated cybersecurity/cybersafety vulnerabilities in IT and OT systems. Ongoing identification of such vulnerabilities is a Contractor responsibility up to delivery, with the Government also exercising the option to conduct independent vulnerability analysis as required. In cases where mitigation of vulnerabilities is not possible, the Contractor will provide an explanation in writing and documentation so that any residual risk can be evaluated by the Government. The Government shall be the sole arbiter for identification and resolution acceptance of cybersecurity issues/vulnerabilities.

The Contractor shall identify and document any detrimental impacts to ship systems’ performance (e.g., timing, performance, availability, etc.) From cybersecurity/cybersafety controls that do not allow the product to conform to engineering requirements stated elsewhere in the specification/contract. The Government will adjudicate these concerns.

The Contractor shall recommend spare parts lists for IT and OT systems, as part of the Vendor-Recommended

Spares listing, to support the ability to maintain and repair the systems within 24 hours of a failure.

In selecting IT and OT devices other than those specified in J-1 and J-4, the contractor shall default to selection of National Information Assurance Partnership (NIAP) approved products (e.g. servers, operating systems, routers, firewalls). When NIAP products are available, but not selected, the Contractor shall provide its decision rationale to the Government prior to a purchase decision.

2.0 DOCUMENTATION

The Contractor shall ensure that all IT/OT systems are documented in accordance with DI-063-01 and DI-

063-02 requirements. A full inventory of all IT/OT equipment will be maintained during the projects (subject to inspection or request) and be made part of the baseline documentation provided to the Government at delivery.

The Contractor shall document mapping of control and communication systems in accordance with DI-063-02 requirements.

3.0 IMPLEMENTATION GUIDELINES

In addition to the requirements specifically called out, the Contractor should be aware that general cybersecurity and cybersecurity practices call for a comprehensive risk based approach that relies on adherence to the

NIST Risk Management Framework as defined by NIST’s Special Publications range and FIPS requirements.

Cybersecurity/cybersafety practices should be consistent with industry-standard best practices and not depend solely on the requirements identified herein.

3.1 REMOVAL OF UNNECESSARY SERVICES AND PROGRAMS

The Contractor shall install or enable, as applicable, only those applications, ports, protocols, services, and functions necessary for designed capabilities of a given IT/OT system or component. Systems shall use enforcement mechanisms (such as, application whitelisting or equivalent technology) to prevent unauthorized software from executing on the systems.

The Contractor shall provide a listing of services required for any computer system running applications or required to interface with the control or communication system applications in accordance with DI-063-03.

The Contractor shall provide appropriate software and service updates and/or workarounds to mitigate all vulnerabilities associated with the product and to maintain the established level of system security. These shall be documented in accordance with DI-063-06 and DI-063-08.

The Contractor shall remove and/or disable all software components that are not required for the operation and maintenance of IT/OT systems prior to Factory Acceptance Testing. The Contractor shall provide documentation on what is removed and/or disabled in accordance with DI-063-03.

3.2 HOST INTRUSION DETECTION SYSTEM

The Contractor shall provide and configure a Government approved host intrusion detection system (HIDS) for all interconnected systems and provide data in accordance with DI-063-04. In addition to the HIDS, the Contractor shall implement a one-way Data Diode architecture for all network connections within the system. Only the minimal traffic necessary for system operation shall be allowed. The Data Diode architectures and their application shall be documented in accordance with DI-063-09.

The Contractor shall configure the HIDS such that all system and user account connections are logged. This log shall be configured such that an alarm can be displayed to the operator if an abnormal situation occurs

3.3 INTRUSION PREVENTION SYSTEM (IPS)

The Contractor shall provide and configure a Government approved Intrusion Prevention System (IPS) for all interconnected systems and provide data in accordance with DI-063-11.The Contractor shall employ malicious code protection mechanisms at control system entry and exit points to detect and eradicate malicious code. Means shall be provided to update the malicious code protection mechanisms to identify the latest malicious code. The Contractor shall configure malicious code protection mechanisms to perform real-time scans of files from external sources at control system entry/exit points as the files are downloaded, opened, or executed; and prevent confirmed additions of executables/binaries from executing without interfering with real-time operation of the control systems. The malicious code protection mechanisms shall prevent the download and execution of Mobile Code from outside the systems boundary. Malicious code protection mechanisms shall be identified in accordance with DI-063- 11.

3.4 SYSTEM AND INFORMATION INTEGRITY

Systems shall monitor inbound and outbound communications traffic for unauthorized activities or conditions.

Monitoring shall be done at the entry/exit points and from network taps at selected intra-system locations. Systems shall employ integrity verification tools to detect unauthorized changes to the software, firmware, and run-time behavior. These systems shall provide alerts of potential and actual compromises that change the certified/qualified baseline configuration, to include software, hardware, firmware, and run-time behavior. When compromised or a potential compromise is detected, the system shall be configured to disable network access by the component and notify the responsible personnel.

For systems that interconnect the ship’s shipboard, scientific computer, and entertainment systems, the

Contractor shall implement a Host Based Security System (HBSS) as well as one-way Data Diodes, if compatible. Data

Diodes shall be identified in accordance with DI-063-09.

3.5 CHANGES TO FILE SYSTEM AND OPERATING SYSTEM PERMISSIONS

The Contractor shall configure hosts with “least privilege” file and account access and provide documentation of the configuration. The Contractor shall configure the necessary system services to execute at the lowest user privilege level possible for that service and provide documentation of the configuration in accordance with DI-063-05.

Systems shall enforce access restrictions and support auditing of the enforcement actions. These systems shall prevent the installation of unauthorized software using detection/enforcement mechanisms (for example, hash authentication or equivalent technology) and validate authorized software being installed on the system.

Systems shall provide alerts when the unauthorized installation of software is detected and shall prohibit user installation of software without explicit privileged status.

3.6 HARDWARE CONFIGURATION

The Contractor shall disable, through software or physical disconnection, all unneeded communication ports and removable media drives, or provide engineered barriers, and provide documentation of the results in accordance with DI-063-05. The Contractor shall password protect the BIOS from unauthorized changes

The Contractor shall configure the network devices to limit access to/from specific locations, where appropriate, and provide documentation of the configuration in accordance with DI-063-05.

The Contractor shall configure the systems to allow the Government the ability to re-enable devices, if the devices are disabled by software, and provide documentation of the configuration. If the devices are disabled by physical disconnection and can be re-enabled, the Contractor shall provide documentation of the configuration.

3.7 INSTALLING OPERATING SYSTEMS, APPLICATIONS, AND THIRD-PARTY SOFTWARE

UPDATES

The Contractor shall have a patch management and update process documented in accordance with DI-063-

06. The Contractor shall remove previous versions of software and firmware as part of the update process. The

Contractor shall provide notification of all known vulnerabilities affecting operating Systems, applications, and third-party software thirty (30) calendar days before Preliminary Acceptance.

3.8 REMOTE MAINTENANCE

For any hardware or software items that are required to be serviced or repaired remotely, the Contractor shall isolate the item prior to non-local maintenance and diagnostic services, and shall sanitize the item with regard to potentially malicious software before removal and after the service is performed before reconnecting the item to the ship systems. This requirement applies to subcontractors of the Contractor as well as any vendors providing equipment and/or services in support of this contract.

3.9 FIREWALLS/CONTROLLED INTERFACES

The Contractor shall use NIST Publication 800-41 recommendations for all firewalls and firewall rule sets between network zones. The Contractor shall provide firewall rule sets and/or other equivalent documentation in accordance with DI-063-07. The basis of the rule set shall be “deny all”, with exceptions explicitly identified by the

Contractor.

3.10 DEFAULT PASSWORDS AND ACCOUNTS

The Contractor shall change default passwords during implementation. Likewise, unnecessary default accounts shall be deleted or deactivated during implementation. No password shall be hardcoded into system files. The

Contractor and its subcontractors shall assist the Government in changing delivered passwords upon completion of the installation.

3.11 IDENTIFICATION AND AUTHENTICATION

Systems shall uniquely identify and authenticate users. Systems shall implement multifactor authentication for access to administrator accounts. Where possible and practical, authentication shall utilize PIV, CAC, and/or Token based access with username/password being the failsafe backup. Systems shall implement replay-resistant authentication mechanisms for network access to administrator accounts. If the system has role-based privileges, the system shall be configured with a minimum of a User role and an Administrator role. Security functions, such as account creation and configuring permissions, shall be limited to the Administrator role.

Systems shall implement replay-resistant authentication mechanisms for administrator accounts. These systems shall uniquely identify and authenticate all devices before establishing local and network connections. Systems shall authenticate any devices not a part of the configuration before establishing local or network connections using bidirectional authentication.

For password-based authentication, systems shall:

1. Enforce minimum password complexity of mixed case sensitivity, minimum 16 characters, mix of upper-case letters, lower-case letters, numbers, and special characters.

2. Enforce at least 8 changed characters when new passwords are created.

3. Store and transmit only cryptographically protected passwords.

4. Prohibit password reuse for 3 generations.

5. Require password reset every 60 days.

6. Allow the use of a temporary password for system logons with an immediate change to a permanent password.

User accounts shall be locked out after 3 failed logon attempts; locked-out accounts shall be disabled until they are reset by an administrator or until the lockout duration for the account has expired.

The contractor shall ensure that unencrypted static authenticators are not embedded in systems’ applications or access scripts or stored on function keys.

3.12 SYSTEMS AND COMMUNICATIONS PROTECTION

The Contractor shall separate user functionality, including user interface services, from management functionality by either physical or logical means. This can be achieved by using different computers, different central processing units, different instances of operating systems, different network addresses, virtualization techniques, or combinations of these or other methods, as appropriate.

These systems shall isolate security functions from non-security functions by controlling access to and protecting hardware, software, and firmware that perform those security functions.

These systems shall implement residual information protection by preventing object reuse between users of a shared resource.

These systems shall protect against or limit the effects of the following: denial of service attacks; consumption of scarce, limited, or non-renewable resources; destruction or alteration of configuration or configuration information;

physical destruction or alteration of network components. Compensating controls shall include ensuring a loss of communication results in the systems operating in a nominal or safe mode. The systems shall restrict the ability of individuals to launch denial of service attacks on other components or information systems outside the enclave boundary. Individuals shall not be able to connect and transmit arbitrary information on the transport medium. The systems shall be managed by establishing usage priorities, quotas, partitioning, and so forth, so that sufficient capacity is available to counter information flooding denial of service attacks. A tool shall be selected and employed to detect indicators of denial of service attacks against the systems and produce information that indicates if sufficient resources exist to prevent denial of service attacks.

Systems shall provide a display banner in accordance with Public Law 99-474 to users that the system is a

Department of Commerce (DOC) information system. As of the date of this document the current warning banner language from DOC follows. The Contractor is responsible for ensuring that warning banners are compliant with the

DOC standard in effect on the date of delivery:

***WARNING, WARNING, WARNING***

"You are accessing a U.S. Government information system, which includes: 1) this computer, 2) this computer network, 3) all Government-furnished computers connected to this network, and 4) all Government-furnished devices and storage media attached to this network or to a computer on this network. You understand and consent to the following: you may access this information system for authorized use only; unauthorized use of the system is prohibited and subject to criminal and civil penalties; you have no reasonable expectation of privacy regarding any communication or data transiting or stored on this information system at any time and/or any lawful Government purpose, the Government may monitor, intercept, audit, and search and seize any communication or data transiting or stored this information system; and any communications or data transiting or stored on this information system may be disclosed or used for any lawful Government purpose.

This information system may contain Controlled Unclassified Information (CUI) that is subject to safeguarding or dissemination controls in accordance with law, regulation, or Government-wide policy. Accessing and using this system indicates your understanding of this warning."

***WARNING, WARNING, WARNING***

3.13 CONFIGURATION MANAGEMENT

The Contractor shall perform configuration management during system, implementation, and operation. This process should document, manage, and control the integrity of changes; implement only approved changes to the system; document approved changes to the system and the potential security impact of such changes; and track security flaws and flaw resolution within the system.

The Contractor shall develop and document a baseline configuration at delivery of the systems to be maintained under configuration control in accordance with DI-063-05. The Contractor shall review and update the baseline configuration of the systems as a result of updates and patches. When patches are required, they shall be tested to determine the potential for, and acceptability of identified impacts generated by the patches prior to implementation.

The Contractor shall provide the baseline configuration to the Government to maintain an up-to-date, complete, accurate, and readily available baseline configuration of the systems to support rollback.

The Contractor shall test, validate, and document changes to the control and communication systems before implementing the changes on the operational system. The systems shall issue audible alerts and notifications if baseline configurations are changed in an unauthorized manner.

Changes to system hardware and software configurations shall be presented to the Government for approval as part of the configuration management process.

3.14 CONTINGENCY PLANNING

Systems shall contain automated back-up capability that does not cause the system to fail existing timing or performance requirements. System-level information (e.g. system state information, system data necessary to recover/restore system operation, and user data) shall be included in backups.

Whether for automated or manual back-up, the Contractor shall provide system restoration media and procedures to recover or completely rebuild disabled system components using only the material provided and routine backup data in accordance with DI-063-08.

Back-ups, other historical files, and network storage shall be protected by a NIAP approved Data-At-Rest solution.

3.15 TESTING

The Government will be conducting testing, evaluation, and assessment of Contractor compliance with DI-

063 and this document throughout the course of the contract and submitting feedback on corrections needed to ensure the Contractor is in compliance with contract requirements. The Contractor shall provide on-site attendance and support by knowledgeable/OEM certified subcontractor personnel for all supplied systems during this testing.

3.16 AUDIT AND ACCOUNTABILITY

The Contractor shall (in addition to the other audit requirements identified elsewhere) generate audit records in accordance with DI-063-10.

The auditing system shall provide an audit reduction and report generation capability that (1) supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents; and

(2) does not alter the original content or time ordering of audit records. Systems shall provide the capability to automatically process audit records for events of interest based upon selectable, event criteria.

The system shall use internal system clocks to generate time stamps for audit records that can be mapped to

Coordinated Universal Time. The audit records shall be logged in one second increments.

The audit system shall off-load audit records to an alternate system or media, which shall be capable of storing a minimum of 1 year of audit data.