DRAFT SAM 2023 12 Ascend BPA Appendix XX Specifications and Standards.pdf

Appendix <<XX>>: Specifications and Standards

Table XX: Specifications and Standards

American National Standards Institute (ANSI)

XX American National Standards Institute https://www.ansi.org/

— Building Industry Consulting Service International (BICSI)

XX ANSI/BICSI 002-2019, Data Center Design and Implementation Best Practices https://www.bicsi.org/standards/avail able-standards-store/single-purchas e/ansi-bicsi-002-2019-data-center-d esign

XX ANSI/BICSI 009-2019, Data Center Operations and Maintenance Best Practices https://www.bicsi.org/standards/avail able-standards-store/single-purchas e/bicsi-009-2019-data-center-operat ions-and-maintenance

— Telecommunications Industry Association (TIA)

XX ANSI/TIA-942 Telecommunications Infrastructure Standard for Data Centers https://tiaonline.org/products-and-se rvices/tia942certification/ansi-tia-94 2-standard/ e-StewardsⓇ

XX Standard for Responsible Recycling and Reuse of Electronic Equipment© https://e-stewards.org/

International Organization for Standardization (ISO)

XX ISO 3166-1 Codes for the Representation of Names of Countries and Their Subdivisions - Part 1: County Code https://www.iso.org/iso-3166-country -codes.html

XX ISO 8601 Date and Time Format https://www.iso.org/iso-8601-date-a nd-time-format.html

XX ISO/IEC 5962:2021 Information technology - SPDX® Specification V2.2.1 https://www.iso.org/standard/81870.

html

XX ISO/IEC 19770-2:2015 Information Technology - IT Asset Management - Part 2: Software Identification Tag https://www.iso.org/standard/65666.

html

Internet Engineering Task Force (IETF)

Sam ple

Draf t https://www.ansi.org/ https://www.bicsi.org/standards/available-standards-store/single-purchase/ansi-bicsi-002-2019-data-center-design https://www.bicsi.org/standards/available-standards-store/single-purchase/ansi-bicsi-002-2019-data-center-design https://www.bicsi.org/standards/available-standards-store/single-purchase/ansi-bicsi-002-2019-data-center-design https://www.bicsi.org/standards/available-standards-store/single-purchase/ansi-bicsi-002-2019-data-center-design https://www.bicsi.org/standards/available-standards-store/single-purchase/bicsi-009-2019-data-center-operations-and-maintenance https://www.bicsi.org/standards/available-standards-store/single-purchase/bicsi-009-2019-data-center-operations-and-maintenance https://www.bicsi.org/standards/available-standards-store/single-purchase/bicsi-009-2019-data-center-operations-and-maintenance https://www.bicsi.org/standards/available-standards-store/single-purchase/bicsi-009-2019-data-center-operations-and-maintenance https://tiaonline.org/products-and-services/tia942certification/ansi-tia-942-standard/ https://tiaonline.org/products-and-services/tia942certification/ansi-tia-942-standard/ https://tiaonline.org/products-and-services/tia942certification/ansi-tia-942-standard/ https://e-stewards.org/ https://www.iso.org/iso-3166-country-codes.html https://www.iso.org/iso-3166-country-codes.html https://www.iso.org/iso-8601-date-and-time-format.html https://www.iso.org/iso-8601-date-and-time-format.html https://www.iso.org/standard/81870.html https://www.iso.org/standard/81870.html https://www.iso.org/standard/65666.html https://www.iso.org/standard/65666.html

XX RFC 791, Internet Protocol, Darpa Internet Program Protocol Specification https://datatracker.ietf.org/doc/html/r fc791

XX RFC 3339, Date and Time on the Internet: Timestamps https://datatracker.ietf.org/doc/html/r fc3339

XX RFC 3526, More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE) https://datatracker.ietf.org/doc/html/r fc3526

XX RFC 8200, Internet Protocol, Version 6 (IPv6) Specification https://datatracker.ietf.org/doc/html/r fc8200

XX RFC 8446, The Transport Layer Security (TLS) Protocol Version 1.3 https://datatracker.ietf.org/doc/html/r fc8446

Global Electronics Council (GEC)

XX EPEAT Ecolabel https://epeat.net/about-epeat

Greenhouse Gas (GHG) Protocol

XX A Corporate Accounting and Reporting Standard https://ghgprotocol.org/corporate-sta ndard

The Linux Foundation

— Software Package Data Exchange® (SPDX®)

XX The Software Package Data Exchange® (SPDX®) Specification Version 2.3 https://spdx.dev/specifications/

Open Worldwide Application Security Project® (OWASP)

— CycloneDX

XX CycloneDX Specification https://cyclonedx.org/specification/o verview/

SERI

XX Responsible Recycling Standards for Electronic Recyclers (R2) https://sustainableelectronics.org/we lcome-to-r2v3/document-library/

X12

XX EDI Standard Unit of Measure https://x12.org

United States Federal Government

— Internal Revenue Service (IRS) https://datatracker.ietf.org/doc/html/rfc791 https://datatracker.ietf.org/doc/html/rfc791 https://datatracker.ietf.org/doc/html/rfc3339 https://datatracker.ietf.org/doc/html/rfc3339 https://datatracker.ietf.org/doc/html/rfc3526 https://datatracker.ietf.org/doc/html/rfc3526 https://datatracker.ietf.org/doc/html/rfc8200 https://datatracker.ietf.org/doc/html/rfc8200 https://datatracker.ietf.org/doc/html/rfc8446 https://datatracker.ietf.org/doc/html/rfc8446 https://epeat.net/about-epeat https://ghgprotocol.org/corporate-standard https://ghgprotocol.org/corporate-standard https://spdx.dev/specifications/ https://cyclonedx.org/specification/overview/ https://cyclonedx.org/specification/overview/ https://sustainableelectronics.org/welcome-to-r2v3/document-library/ https://sustainableelectronics.org/welcome-to-r2v3/document-library/ https://x12.org/

XX Publication 1075, Tax Information Security Guidelines, For Federal, State, and Local Agencies, Safeguards for Protecting Federal Tax Returns and Return Information https://www.irs.gov/forms-instruction s-and-publications

— National Institute of Standards and Technology (NIST)

XX FIPS PUB 140-3: Security Requirements for Cryptographic Modules https://csrc.nist.gov/publications/det ail/fips/140/3/final

XX FIPS PUB 186-4: Digital Signature Standard (DSS) https://csrc.nist.gov/publications/det ail/fips/186/4/final

XX FIPS PUB 197: Advanced Encryption Standard (AES) https://csrc.nist.gov/publications/det ail/fips/197/final

XX FIPS PUB 199: Standards of Security Categorization of Federal Information and Information Systems https://csrc.nist.gov/publications/det ail/fips/199/final

XX FIPS 200: Minimum Security Requirements for Federal Information and Information Systems https://csrc.nist.gov/publications/det ail/fips/200/final

XX FIPS PUB 201-3: Personal Identity Verification (PIV) of Federal Employees and Contractors https://csrc.nist.gov/publications/det ail/fips/201/3/final

XX NIST, Software Supply Chain Security Guidance https://www.nist.gov/itl/executive-ord er-14028-improving-nations-cyberse curity/software-supply-chain-securit y-guidance

XX NIST, SP 500-267A Rev. 1: NIST IPv6 Profile https://www.nist.gov/publications/nis t-ipv6-profile

XX NIST, SP 500-267B Rev. 1: USGv6 Profile https://www.nist.gov/publications/us gv6-profile

XX NIST, SP 500-292: NIST Cloud Computing Reference Architecture https://www.nist.gov/publications/nis t-cloud-computing-reference-archite cture

XX NIST, SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy https://csrc.nist.gov/publications/det ail/sp/800-37/rev-2/final

XX NIST, SP 800-52 Rev. 2: Guidelines for https://csrc.nist.gov/publications/det https://www.irs.gov/forms-instructions-and-publications https://www.irs.gov/forms-instructions-and-publications https://csrc.nist.gov/publications/detail/fips/140/3/final https://csrc.nist.gov/publications/detail/fips/140/3/final https://csrc.nist.gov/publications/detail/fips/186/4/final https://csrc.nist.gov/publications/detail/fips/186/4/final https://csrc.nist.gov/publications/detail/fips/197/final https://csrc.nist.gov/publications/detail/fips/197/final https://csrc.nist.gov/publications/detail/fips/199/final https://csrc.nist.gov/publications/detail/fips/199/final https://csrc.nist.gov/publications/detail/fips/200/final https://csrc.nist.gov/publications/detail/fips/200/final https://csrc.nist.gov/publications/detail/fips/201/3/final https://csrc.nist.gov/publications/detail/fips/201/3/final https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/software-supply-chain-security-guidance https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/software-supply-chain-security-guidance https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/software-supply-chain-security-guidance https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/software-supply-chain-security-guidance https://www.nist.gov/publications/nist-ipv6-profile https://www.nist.gov/publications/nist-ipv6-profile https://www.nist.gov/publications/usgv6-profile https://www.nist.gov/publications/usgv6-profile https://www.nist.gov/publications/nist-cloud-computing-reference-architecture https://www.nist.gov/publications/nist-cloud-computing-reference-architecture https://www.nist.gov/publications/nist-cloud-computing-reference-architecture https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/final the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations ail/sp/800-52/rev-2/final

XX NIST, SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations https://csrc.nist.gov/publications/det ail/sp/800-53/rev-5/final

XX NIST, SP 800-56A Rev. 3:

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography https://csrc.nist.gov/publications/det ail/sp/800-56a/rev-3/final

XX NIST, SP 800-56B Rev. 2:

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography https://csrc.nist.gov/publications/det ail/sp/800-56b/rev-2/final

XX NIST, SP 800-56C Rev. 2:

Recommendation for Key-Derivation Methods in Key-Establishment Schemes https://csrc.nist.gov/publications/det ail/sp/800-56c/rev-2/final

XX NIST, SP 800-63-3: Digital Identity Guidelines https://csrc.nist.gov/publications/det ail/sp/800-63/3/final

XX NIST, SP 800-63A: Digital Identity Guidelines: Enrollment and Identity Proofing https://csrc.nist.gov/publications/det ail/sp/800-63a/final

XX NIST, SP 800-63B: Digital Identity Guidelines: Authentication and Lifecycle Management https://csrc.nist.gov/publications/det ail/sp/800-63b/final

XX NIST, SP 800-63C: Digital Identity Guidelines: Federation and Assertions https://csrc.nist.gov/publications/det ail/sp/800-63c/final

XX NIST SP 800-76: Biometric Specifications for Personal Identity Verification https://csrc.nist.gov/publications/det ail/sp/800-76/2/final

XX NIST, SP 800-88 Rev. 1: Guidelines for Media Sanitization https://csrc.nist.gov/publications/det ail/sp/800-88/rev-1/final

XX NIST, SP 800-218 Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities https://csrc.nist.gov/pubs/sp/800/21 8/final

XX NIST, SP 800-126 Rev. 3: The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.3 https://csrc.nist.gov/publications/det ail/sp/800-126/rev-3/final https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-56a/rev-3/final https://csrc.nist.gov/publications/detail/sp/800-56a/rev-3/final https://csrc.nist.gov/publications/detail/sp/800-56b/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-56b/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-56c/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-56c/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-63/3/final https://csrc.nist.gov/publications/detail/sp/800-63/3/final https://csrc.nist.gov/publications/detail/sp/800-63a/final https://csrc.nist.gov/publications/detail/sp/800-63a/final https://csrc.nist.gov/publications/detail/sp/800-63b/final https://csrc.nist.gov/publications/detail/sp/800-63b/final https://csrc.nist.gov/publications/detail/sp/800-63c/final https://csrc.nist.gov/publications/detail/sp/800-63c/final https://csrc.nist.gov/publications/detail/sp/800-76/2/final https://csrc.nist.gov/publications/detail/sp/800-76/2/final https://csrc.nist.gov/publications/detail/sp/800-88/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-88/rev-1/final https://csrc.nist.gov/pubs/sp/800/218/final https://csrc.nist.gov/pubs/sp/800/218/final https://csrc.nist.gov/publications/detail/sp/800-126/rev-3/final https://csrc.nist.gov/publications/detail/sp/800-126/rev-3/final

XX NIST, SP 800-126A: SCAP 1.3

Component Specification Version Updates: An Annex to NIST Special Publication 800-126 Revision 3 https://csrc.nist.gov/publications/det ail/sp/800-126a/final

XX NIST, SP 800-144: Guidelines on Security and Privacy in Public Cloud Computing https://csrc.nist.gov/publications/det ail/sp/800-144/final

XX NIST, SP 800-145: The NIST Definition of Cloud Computing https://csrc.nist.gov/publications/det ail/sp/800-145/final

XX NIST, SP 800-146: Cloud Computing Synopsis and Recommendations https://csrc.nist.gov/publications/det ail/sp/800-146/final

XX NIST, SP 800-157: Guidelines for Derived Personal Identity Verification (PIV) Credentials https://csrc.nist.gov/publications/det ail/sp/800-157/final

XX NIST, SP 800-162: Guide to Attribute Based Access Control (ABAC) Definition and Considerations https://csrc.nist.gov/pubs/sp/800/16 2/upd2/final

XX NIST, SP 800-171 Rev.2: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations https://csrc.nist.gov/publications/det ail/sp/800-171/rev-2/final

XX NIST, SP 800-171A: Assessing Security Requirements for Controlled Unclassified Information https://csrc.nist.gov/publications/det ail/sp/800-171a/final

XX NIST, SP 800-172: Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171 https://csrc.nist.gov/publications/det ail/sp/800-172/final

XX NIST, SP 800-175B Rev 1: Guideline for Using Cryptographic Standards in the Federal Government: Cryptographic Mechanisms https://csrc.nist.gov/publications/det ail/sp/800-175b/rev-1/final

XX NIST, SP 800-181 Rev. 1: Workforce Framework for Cybersecurity (NICE Framework) https://csrc.nist.gov/publications/det ail/sp/800-181/rev-1/final

XX NIST, SP 800-190: Application Container Security Guide https://csrc.nist.gov/publications/det ail/sp/800-190/final

XX NIST, SP 800-207: Zero Trust Architecture https://csrc.nist.gov/publications/det ail/sp/800-207/final

XX NIST, SP 800-210: General Access https://csrc.nist.gov/publications/det https://csrc.nist.gov/publications/detail/sp/800-126a/final https://csrc.nist.gov/publications/detail/sp/800-126a/final https://csrc.nist.gov/publications/detail/sp/800-144/final https://csrc.nist.gov/publications/detail/sp/800-144/final https://csrc.nist.gov/publications/detail/sp/800-145/final https://csrc.nist.gov/publications/detail/sp/800-145/final https://csrc.nist.gov/publications/detail/sp/800-146/final https://csrc.nist.gov/publications/detail/sp/800-146/final https://csrc.nist.gov/publications/detail/sp/800-157/final https://csrc.nist.gov/publications/detail/sp/800-157/final https://csrc.nist.gov/pubs/sp/800/162/upd2/final https://csrc.nist.gov/pubs/sp/800/162/upd2/final https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-171a/final https://csrc.nist.gov/publications/detail/sp/800-171a/final https://csrc.nist.gov/publications/detail/sp/800-172/final https://csrc.nist.gov/publications/detail/sp/800-172/final https://csrc.nist.gov/publications/detail/sp/800-175b/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-175b/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-181/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-181/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-190/final https://csrc.nist.gov/publications/detail/sp/800-190/final https://csrc.nist.gov/publications/detail/sp/800-207/final https://csrc.nist.gov/publications/detail/sp/800-207/final https://csrc.nist.gov/publications/detail/sp/800-210/final

Control Guidance for Cloud Systems ail/sp/800-210/final

XX NIST, SP 800-218: Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities https://csrc.nist.gov/publications/det ail/sp/800-218/final

XX NISTIR 8060: Guidelines for the Creation of Interoperable Software Identification (SWID) Tags https://csrc.nist.gov/publications/det ail/nistir/8060/final

— Small Business Administration (SBA)

XX US Small Business Administration Table of Small Business Size Standards Matched to North American Industry Classification System Codes https://www.sba.gov/document/supp ort-table-size-standards

— United States Bureau of Labor Statistics (BLS)

XX Occupational Employment and Wage Statistics, May 2022 Metropolitan and Nonmetropolitan Area Definitions https://www.bls.gov/oes/current/msa _def.htm

— United States Census Bureau

XX North American Industry Classification System https://www.census.gov/naics/

— United States Postal Service (USPS)

XX Publication 28 - Postal Addressing Standards, Appendix B Two-Letter State and Possession Abbreviations https://pe.usps.com/text/pub28/28ap b.htm

Uptime Institute

XX Tier Classification System https://uptimeinstitute.com/tiers

World Wide Web Consortium (W3C)

XX Web Authentication (WebAuthn) https://www.w3.org/TR/webauthn-2/ https://csrc.nist.gov/publications/detail/sp/800-210/final https://csrc.nist.gov/publications/detail/sp/800-218/final https://csrc.nist.gov/publications/detail/sp/800-218/final https://csrc.nist.gov/publications/detail/nistir/8060/final https://csrc.nist.gov/publications/detail/nistir/8060/final https://www.sba.gov/document/support-table-size-standards https://www.sba.gov/document/support-table-size-standards https://www.bls.gov/oes/current/msa_def.htm https://www.bls.gov/oes/current/msa_def.htm https://www.census.gov/naics/ https://pe.usps.com/text/pub28/28apb.htm https://pe.usps.com/text/pub28/28apb.htm https://uptimeinstitute.com/tiers https://www.w3.org/TR/webauthn-2/