Attach 5 Sample SON 3 AUL ILS.docx

FA3002-10-R-0045

Attachment 5

AIR EDUCATION & TRAINING COMMAND (AETC)

PERFORMANCE WORK STATEMENT (PWS) ADDENDUM

FOR

AIR UNIVERSITY LIBRARY INTEGRATED LIBRARY SYSTEM (AUL ILS)

21 January 2010

1.0 DESCRIPTION OF TASK ORDER SERVICES:

1.1 Muir S Fairchild Research Information Center (formerly known as Air University Library ) requires contractor support to complete the certification and accreditation of the AETC AUL ILS under the Air Force implementation of DoD Information Assurance Certification and Accreditation Process (DIACAP), to include all requirements pertaining to the Security, Interoperability, Sustainability, Supportability, and Usability (SISSU) process to obtain Approvals to Operate (ATO) and Authorities to Connect (ATC). The contractor will require access to the Enterprise Information Technology Database Repository (EITDR) which requires a minimum of a national agency check (NAC).

2.0 GENERAL DESCRIPTION OF AETC ATOs AND ATCs.

2.1 The Air University Library Integrated Library System is registered in EITDR as AUL ILS. The system is in the Build and Test phase of the IT Lean process. Its current ATO/CTO was issued on 21 Mar 07. It is a MAC III and has a Public Confidentiality Level. The system resides in two locations on Maxwell AFB, AL. The application/data server is housed on the first floor (room 124, see diagram 2) of bldg 1405 of the Muir S. Fairchild Research Information Center. The DMZ web server is located on the data floor in bldg 941 of the 42d Communications Squadron. All software contained in the AUL ILS system is COTS. An integrated library system (ILS) software manages and provides access to the library's physical collection of books, documents, CDs/DVDs, etc. A digital asset management software manages and provides access to the library's digital resources which consist of locally digitized photos and publications. Library staff members use proprietary software clients installed on their .mil workstations as well as the web browser to connect to the application/data server in the same Maxwell enclave. The staff member’s workstations are not part of AUL ILS. The public access modules of both software on the web server in Maxwell DMZ allow library patrons all over the world to search the library's physical and digital collections.

2.2 AETC ATOs and ATCs consist of the following components:

2.2.1 Authority to Operate (ATO) for UNCLASSIFIED AUL ILS: Provide accreditation under DIACAP and SISSU sub-processes for the unclassified AUL ILS system owned by the Muir S. Fairchild Research Information Center located at Maxwell Air Force Base. Provide Approval to Operate according to Air Force Policy Directive 33-2, Information Assurance Program. This includes all documentation, coordination, and implementation required to operate on government networks. There are changes/upgrades planned to be submitted during this process. These include a new server, upgrades in software and OS versions. The C&A package will contain both current architecture and the planned upgrades since the existing equipment will be in place at the time of the ATO renewal and the planned changes will occur in the following months. While these changes are planned, the overall strategy and function of AUL ILS remains the same as originally approved in the initial ATO. For the purposes of this C&A effort, the AUL ILS termination point will be the point at which our servers connect to the base network (the literal demarcation point is the back of our servers). All base network settings and equipment connecting AUL ILS to the NIPRNet are maintained by the 42nd Communications Squadron.

2.2.2 Authority to Connect (ATC) for UNCLASSIFIED AUL ILS: Provide accreditation under DIACAP and SISSU sub-processes for unclassified AUL ILS system owned by the Muir S. Fairchild Research Information Center located at Maxwell Air Force Base. Provide Authority to Connect according to Air Force Policy Directive 33-2, Information Assurance Program. This includes all documentation, coordination, and implementation required to operate on government networks. The changes planned to be submitted during this process includes the approval of approximately 6 new port openings. The C&A package will contain both current architecture and the planned upgrades since the existing equipment will be in place at the time of the ATC renewal and the planned changes will occur in the follow months. These additional ports do not change the strategy of the AUL ILS system, they provide better support and access to library related data which has become available since the initial C&A. For the purposes of this C&A effort, the AUL ILS termination point will be the point at which our servers connect to the base network (the literal demarcation point is the back of our servers). All base network settings and equipment connecting AUL ILS to the NIPRNet are maintained by the 42nd Communications Squadron.

3.0 SCOPE/DELIVERABLES:

3.1 Contractor will complete the C&A of the unclassified AETC AUL ILS site to include all requirements pertaining to the SISSU process to obtain ATOs and ATCs as appropriate.

3.2 The contractor will develop and maintain documentation that meets or exceeds DoD Information Security requirements for system deliverables IAW DoDI 8510.01 DIACAP, AFI 33-202, Network and Computer Security Vol. 1, and Identity Management Vol. 6, and AF IT Lean Guidebook v5.07 (or later) including the first three phases (Define Need, Design, and Build and Test).

3.3 The contractor shall execute and update a Security Implementation Plan (SIP), conduct validation activities, and compile validation results in EITDR to retrieve a DIACAP scorecard. During the period of performance the contractor shall develop a Plan of Action and Milestones (POA&M) IAW DODI 8500.2.

3.4 The contractor shall provide an Information Support Plan (ISP) and related services. This shall include conducting initial certification tasks, periodic review of security configurations, and reviewing policy and procedure changes. The contractor shall complete the DIACAP Implementation Plan, answer all applicable IA controls, create and/or complete required security artifacts to include but not limited to the architectural framework views and upload into the EITDR system.

3.5 The contractor shall provide support required to achieve Federal Information System Management Act (FISMA) validation. FISMA support will be provided by the contractor to satisfy quarterly and annual reporting guidance requirements in accordance with the Air Force Chief Information Officer (CIO) 7 April 2007 memo and subsequent released guidance. FISMA requirements listed in this memorandum shall meet or exceed minimum standards as required by the program manager/system owner or the Quality Assurance Personnel (QAP). Cooperation between the contractor and the system owner shall ensure the appropriate FISMA questions in EITDR are answered and meet minimum solution requirements listed within the database. FISMA minimum requirements must be met or an appropriate Plan of Action and Milestones (POA&M) schedule shall be produced if it should fail.

3.6 The contractor shall work/coordinate with representatives from AETC and Air Force Network Integration Center (AFNIC) in obtaining information/documentation required for the completion of the C&A documentation required for receiving ATOs and ATCs from AFNIC and Air Force Network Operations (AFNetOPs).

3.7 The contractor shall support the AETC AUL ILS program manager in responding to any questions, attending meetings, and/or any other activities/tasks facilitating the development of the C&A documentation to include travel for testing and evaluation. Trip reports and/or meeting minutes detailing formal interactions will be required and supplied by the contractor, and included in a Monthly Status Report.

3.8 The contractor shall provide a schedule for completion of all tasks/activities required for receiving the ATO and ATC within five business days of contract. Due to the urgency in getting the DIACAP completed, the contractor is requested to base timelines on minimum time required to complete.

DIAGRAM 1

AUL ILS System Architecture with Data Flow

Internet

Port and IP specific access for vendor support of COTS software

Firewall DMZ web server (physically secured in a locked room) -Solaris OS -Apache HTTP -Voyager app -DigiTool app

App/database server (physically secured in a locked room) Solaris OS

-Apache HTTP -Apache Tomcat -Oracle databases -Voyager app -DigiTool app

Fairchild Research Info Center Staff -access only from .mil PCs which require CAC login. Screensaver locks users out after 15 minutes of inactivity -access to server through clients loaded onto .mil PCs with each user having a login/passwd Firewall Firewall

DIAGRAM 2

FLOOR DIAGRAM OF MUIR S. FAIRCHILD RESEARCH INFORMATION CENTER

image1.gif image2.emf