SCARS_RFP_Attachment_2_SRD_-_Amendment_1.pdf

SYSTEM REQUIREMENTS DOCUMENT

Simulator Common Architecture Requirements & Standards (SCARS)

12 January 2019

Prepared for:

USAF Simulators Program Office Wright-Patterson Air Force Base, OH

Prepared by:

AFLCMC/WNS

2300 D Street

WPAFB, OH 45431

RFP NO: FA8621-18-R-0002

Attachment 2

DISTRIBUTION STATEMENT A. Approved for public release. Distribution is unlimited.

http://dtic.mil/dtic/submit/distribution_limitations_and_statements.html#one i

THIS PAGE IS INTENTIONALLY BLANK

Simulator Common Architecture Requirements and Standards (SCARS) System Requirements Document ii

CHANGE HISTORY

Change Version Date Initial SRD 1.0 25 Oct 2018 RFP Update 1.1 12 Jan 2019

System Requirements Document iii

THIS PAGE IS INTENTIONALLY BLANK

Systems Requirements Document

1. Scope

This System Requirements Document (SRD) specifies the SCARS Simulator Common Architecture (SCA) including but not limited to Security Operations Center (SOC), Library, Network Operation Center (NOC), Wide Area Networking (WAN), On-Premise Equipment (OPEs), Software Baseline Recovery Units (SBRUs), Model Based Systems Engineering (MBSE) Tools and Artifacts, and Management Services software.

2. Applicable Documents

2.1. DoD Handbooks and Manuals and Directives

DoDD 8500.1 Cybersecurity DoDD 8500.2 Information Assurance (IA) Implementation DoD 5220.22-M National Industrial Security Program Operating Manual (NISPOM) Intelligence Community Directive (ICD) 503, IC Information Technology Systems Security Risk Management, Certification and Accreditation DoDM 5205.07 SAP Security Manual, Volume 1 (V1) General Procedures

2.2. Joint Guides

Joint SAP (Special Access Program) Implementation Guide (JSIG)

2.3. US Government Publications, Instructions, and Guides

NIST SP 800-53, Recommended Security Controls for Federal Information Systems and Organizations NIST SP 800-53A, Guide for Assessing the Security Controls in Federal Information Systems and Organizations, Building Effective Security Assessment Plans NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems CNSSI 1253, Security Categorization and Control Selection for National Security Systems

2.4. Other Government Documents and Publications

SCARS Objectives, dated 21 June 2018, AF/A3TI Performance Work Statement for the Simulator Common Architecture Requirements and Standards – SCARS, dated 12 January 2019, AFLCMC/WNS

2.5. Order of Precedence

In case of a conflict between this document and the references (except PWS), cited herein, this document shall take precedence. Nothing in this document supersedes applicable laws and regulations unless a specific exemption has been obtained.

3. System or Subsystem Requirements

3.1. Reference Architecture

3.1.1. SCARS shall be defined by a Reference Architecture. The Reference Architecture shall be modeled in Systems Modeling Language (SysML).

3.2. Simulator Common Architecture (SCA)

The SCA requirements are overarching system requirements that impact or are applicable to all SCARS sub-systems. The SCA shall not compromise training system availability and performance of the SCARS Affiliates or SCARS Partners.

The SCA shall contain the following HW/SW subsystems:

• MBSE Tools and Artifacts o System Model

• Security Operations Center (SOC) o Security Operations Center (SOC) Hardware and Software o Common Control Provider / Cyber Security Provider Hardware and Software o NOC / SCARS WAN Hardware and Software o SCARS Library Hardware and Software

• SCARS OPE (end node) o OPE Operation Mode Hardware and Software o OPE Development Mode Software

• Software Baseline Recovery Unit

• Management Service Software

• SCARS Standards Compliance Tools

3.2.1. The SCA equipment, software, networks and associated data shall be separated as required by classification level for levels up to Top Secret/SAP/SCI.

3.2.2. The SCA shall support all active end node’s security domains as determined by the

SCARS Affiliate classification IAW RMF, JSIG, ICD 503, and DoDM 5205.07 series documents.

3.2.3. The SCA software shalle use static code analysis identify and resolve source code security vulnerabilites.

3.2.4. The SCA equipment, software, and network shall have the capacity to scale to meet an increase in site activations at a rate of 60 sites per year across various security domains.

3.2.5. The SCA equipment, software, and network shall have the capacity scale to meet an increase in security domains at rate of 3 security domains per year.

3.2.6. The SCA equipment shall handle, transmit and protect classified/sensitive material/equipment IAW the National Industrial Security Program Operating Manual (NISPOM), DoDD 8500.1, DoDD 8500.2, DoD 5220.22-M, DoDM 5205.07 SAP Security Manual, Volume 1: General Procedures, ICD 503 and the DD Form 254.

3.2.7. The SCA equipment and software shall be designed to achieve and maintain the levels-of-concern IAW NIST SP 800-53 (RMF) / JSIG, ICD 503 and CNSSI 1253, Security Categorization and Control Selection for National Security Systems.

3.3. Security Operations Center (SOC)

3.3.1. The SOC shall include equipment and software necessary to support the SOC services, NOC, Library, Help Desk and SBRUs.

3.3.2. The SOC shall have equipment and software to centrally mange the configuration of the

OPE.

3.3.3. The SOC shall have equipment and software that aggregates enterprise security data to present an integrated picture of the training enterprise cybersecurity posture.

3.3.4. The SOC equipment and software shall scan SCARS affiliates using the Assured Compliance Assessment Solution (ACAS).

3.3.5. The SOC shall have equipment and software which support SCARS increments as a Common Control Provider (CCP) approach IAW NIST 800-37 and NIST 800-137.

3.3.6. The SOC shall include equipment and software to support the OPE Software Baseline Recovery Units.

3.3.7. The SOC equipment and software shall enable SCARS Help Desk services as defined in the PWS.

3.3.8. The SOC equipment and software shall enable SCARS Prime Management Services as defined in the PWS.

3.3.9. The SOC equipment and software shall have sufficient and scalable backup and redundancy to prevent data loss upon system failures and disasters.

3.3.10. The SOC shall provide baseline recovery to restore the SOC system configuration to its baseline.

3.4. SCARS Library

3.4.1. The SCARS Library shall include HW/SW necessary to support ACAS as a SCARS Library hosted application.

3.4.2. The SCARS Library HW/SW shall include equipment and software necessary to support the SCARS Library host applications, standards, and data.

3.4.3. The SCARS Library shall be scalable to meet an increase in hosted content as the number of SCARS artifacts (SCARS standards, applications, databases, models) increase over time

3.4.4. The SCARS Library shall host applications and data configuration baselines at lowest classification of the application and data.

3.4.5. SCARS Library application contents list shall be locally browsable on the OPE by SCARS Affiliates, Partners and Government without active network connection with the SCARS Library.

3.4.6. The SCARS Library shall scale to an increasing number of applications as the number of SCARS Baseline Applications increases by 1TB of disk storage per SCARS Baseline Application.

3.4.7. The SCARS Library shall host datasets, models and source code bases.

3.4.8. The SCARS Library equipment and software shall manage licenses digitally for the

SCA.

3.4.9. The SCARS Library equipment and software shall host and maintain an accessible

Evaluated Products List for simulator applications, datasets, models, and tools.

3.4.10. The SCARS Library equipment and software shall host and maintain releasability identification for products.

3.5. SCARS Network Operations Center (NOC)

3.5.1. The SCARS NOC HW/SW shall manage network connections between the SCARS Operation Center and OPE.

3.5.2. SCARS events shall be periodic (non-persistent) and not compromise training system availability and performance.

3.5.3. The SCARS NOC equipment and software shall only establish a OPE network conection during a SCARS event.

3.5.4. The SCARS NOC equipment and software shall terminate the OPE network conection after the SCARS event ends.

3.6. SCARS Wide Area Network (WAN)

3.6.1. The networking equipment and software shall route, filter, and transfer information.

3.6.2. A dedicated SCARS WAN shall be used to connect SCARS Affiliate Sites without

SCARS Partner WANs to the SOC.

3.6.3. The SCARS WAN shall route network traffic to and from SCARS Partners systems when an existing WAN connection exists to a SCARS Affiliate site (e.g.virtual circuit).

3.6.4. The SCARS WAN equipment and software shall support simultaneous SCARS events and library access instances numbering not less than 50% (rounded up) of the total number of active OPE end nodes.

3.6.5. The SCARS WAN shall supply scheduled network services for simultaneous SCARS events and Library access instances at different security classification levels.

3.6.6. The SCARS WAN shall scale to support up to 3 additional security domains per year for the life of the contract. For instance, in year 2, the network HW/SW shall support up to 6 security domains.

3.6.7. The SCARS WAN shall use National Security Agency (NSA)-approved type 1 cryptographic equipment, software, or processes to encrypt data.

3.7. SCARS On-Premise Equipment (OPE)

3.7.1. The SCARS OPE shall host software applications (Infrastructure as a Service) designed for training system capability and cybersecurity service applications that implement controls defined by the Risk Management Framework (RMF).

3.7.2. The OPE shall pull or receive software pushes for updates and patches from the SOC, without compromising training system availability and performance of the SCARS Affiliates or SCARS Partners.

3.7.3. The OPE shall provide HW/SW to support multi-factor authentication IAW USCYBERCOM TASKORD 15-0102 or DoD approved authentication alternatives.

3.7.4. The SCARS OPE shall have a Development Mode which enables SCARS Affiliates and Partners to test pending updates (developmental baseline) to the SCARS OPE operational baseline.

3.7.5. The SCARS OPE Development Mode shall allow for testing of SCARS Applications in development by the SCARS Affiliates and Partners.

3.7.6. The SCARS OPE shall swap from the OPE operational baseline to the OPE developmental baseline within 20 minutes of configuration change initiation.

3.7.7. The SCARS OPE shall be swap from the OPE developmental baseline to the OPE operational baseline within 20 minutes of configuration change initiation.

3.7.8. The OPE equipment and software shall execute simulator functions as they are adopted as SCARS Applications. Note: The OPE is intended to host simulator applications that do not require specialized hardware or Operating Systems (not applicable to real aircraft Line Replaceable Units (LRUs)).

3.7.9. The SCARS OPE shall support physical Graphics Processing Units (GPUs) for Virtual Machine (VM) processing.

3.7.10. The SCARS OPE shall support physical GPUs for Container processing.

3.7.11. The SCARS OPE shall configure SCARS Applications to use GPUs for processing when the SCARS Application supports GPU processing.

3.7.12. The SCARS OPE shall download and host SCARS applications from the SCARS

Library.

3.7.13. Vulnerability scanning components and credentials shall be available on the SCARS

OPE to enable SCARS Affiliates and Partners to conduct their own local scans.

3.7.14. The SCARS OPE vulnerability scanning components shall be modularly replacable.

3.7.15. The SCARS OPE shall conduct vulnerability scans initiated remotely by the SCARS

SOC.

3.7.16. The SCARS OPE shall implement common control that are inheritable by the SCARS

Affiliate training system.

3.7.17. The SCARS OPE shall be designed to support latency-sensitive applications that demand strict requirements for both response time of a transaction and the transactions response time variability.

3.7.18. The SCARS OPE shall access MBSE system models.

3.7.19. It is an objective for the SCARS OPE to implement Platform as a Service (PaaS) equipment and software to facilitate SCARS affiliate application development.

3.7.20. It is an Objective for the SCARS OPE to provide software to perform code analysis as defined by SA-11(1) in NIST.SP.800-53 to include use by SCARS Affiliates and Partners for application evaluation.

3.8. SCARS OPE Versions

3.8.1. The SCARS OPE versions shall scale in processing capacity, memory capacity and storage capacity by the introduction of 3 new SCARS baseline applications per version, where a SCARS baseline application requires 4 CPU cores operating at 2.8 GHz, 16 GB RAM, and 1 TB of Disk Space.

3.8.2. The SCARS OPE version 1 baseline shall have a threshold processing capacity, memory capacity and storage capacity that supports 12 CPU cores operating at 2.8 GHz, 48 GB RAM, and 3 TB of Disk Space.

3.8.3. The SCARS OPE version 2 baseline shall have a threshold processing capacity, memory capacity and storage capacity that supports 24 CPU cores operating at 2.8 GHz, 96 GB RAM, and 6 TB of Disk Space.

3.8.4. The SCARS OPE version 3 baseline shall shall have a threshold processing capacity, memory capacity and storage capacity that supports 36 CPU cores operating at 2.8 GHz, 144 GB RAM, and 9 TB of Disk Space.

3.9. SCARS Software Baseline Recovery Unit (SBRU)

3.9.1. The Software Baseline Recovery Unit (SBRU) shall serve as the authoritative configuration baseline for restoring the SCARS OPE.

3.9.2. The SOC shall restore SCARS OPE software remotely using the appropriate SBRU.

3.9.3. A SBRU application shall be hosted on each SCARS OPE restore the SCARS OPE operational baseline.

3.9.4. A SBRU application shall be hosted with each SCARS OPE restore SCARS developmental baseline.

3.10. SCARS Standards Compliance Tools (SCARS SCTs)

3.10.1. The SCARS Standards Compliance Tools shall test a SCARS Affiliate training system for SCARS compliance.

3.10.2. The SCARS SCTs shall test SCARS Applications for SCARS compliance.

3.10.3. The SCARS SCTs shall output a certification report detailing the compliance results after testing a SCARS Affiliate training system.

3.10.4. The SCARS SCTs shall output a certification report detailing the compliance results after testing a SCARS Application.

3.10.5. The SCARS SCTs shall output a certification report that adequately describes shortcomings of SCARS Affiliate training system or SCARS Application compliance with SCARS interfaces and standards.

3.10.6. The SCARS SCTs shall gather user feedback and reports regarding software faults (bugs) and feature requests for the tools.

3.11. SCARS Stakeholder Collaboration Website and Help Desk Web Tool

3.11.1. The SCARS Stakeholder Collaboration Website shall host an unclassified online Help Desk Web.

3.11.2. The Help Desk Web Tool shall schedule network connection (SCARS event) times between SCARS OPE and SCARS SOC.

3.11.3. The Help Desk Web Tool shall allow SCARS Affiliates to request network connection (SCARS event) times.

3.11.4. The Help Desk Web Tool shall allow the SCARS Prime to confirm or reject scheduled network connection (SCARS event) times requested by SCARS Affiliates.

3.11.5. The Help Desk Web Tool shall track network connections (SCARS events) outcomes including details describing the results of scheduled events.

3.11.6. The Help Desk Web Tool shall provide a ticket support system for requesting SCARS Help Desk support by SCARS Affiliates.

3.11.7. The SCARS Stakeholder Collaboration Website shall contain a listing of SCARS Applications available for download and hosting from the SCARS Library to SCARS

OPE.

3.11.8. The SCARS Stakeholder Collaboration Website shall track help desk metrics for view by the Government.

3.11.9. The SCARS Stakeholder Collaboration Website shall host a compliance tracking list that describes the compliance of each SCARS Affiliate training system with SCARS increments for view by the Government.

3.11.10. The SCARS Stakeholder Collaboration Website shall host unclassified SCARS Standards and Interface documents for view by all SCARS Stakeholders.

3.12. System Integration Requirements

3.12.1. External Interface

3.12.1.1. The SCARS NOC shall interface with SCARS Partner WANs including CAF DMO, MAF DMO, ARCNet, and future SCARS Partner WANs.

3.12.1.2. The SCARS WAN shall interface with SCARS Partner WANs.

3.12.1.3. The SCARS OPEs, shall interface with SCARS Partner WANs.

3.12.1.4. The SCARS OPE shall interface with SCARS Affiliate training systems.

3.12.1.5. The SCARS OPE shall interface with SCARS Affiliate Training System Sustainment

Center (TSSC) equipment.

3.12.1.6. The SCARS SCTs shall interface with SCARS Affiliate Training Systems.

3.12.1.7. The SCARS SCTs shall interface with SCARS Applications.

3.12.2. Internal Interface

3.12.2.1. The SOC shall interface with the SCARS NOC.

3.12.2.2. The SCARS NOC shall interface with the SCARS WAN.

3.12.2.3. The SOC shall interface with the SCARS Library.

3.12.2.4. The SOC shall interface with the SCARS OPE through the SCARS WAN.

3.12.2.5. The SOC shall interface with the centralized SBRUs.

3.12.2.6. The SCARS OPE shall interface with the SCARS WAN.

3.12.2.7. The SCARS OPE shall interface with the SCARS SBRUs over the SCARS WAN.

3.12.2.8. The SCARS OPE shall interface with the SCARS Library through the SCARS WAN

3.13. System Environment Requirements

3.13.1. Operational Environment

3.13.1.1. SCARS systems shall be designed for operation in a Ground, Benign environment as identified in MIL-HDBK 217F: non-mobile, temperature and humidity controlled environments readily accessible for maintenance.

3.13.1.2. SCARS systems shall survive temporary environmental issues such as power outages, power surges, and air conditioning and humidity control problems long enough to conduct graceful shutdown of all SCARS systems without data loss.

3.14. Computer Resource Requirements

3.14.1. SCARS Computer Operating Systems (OS) Requirements

3.14.1.1. SCARS Computer OS images shall comply with Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) to the greatest extent practicable without degrading AF training system performance for SCARS Affiliate and Partner training systems.

3.14.1.2. A SCARS Windows 10 Enterprise image shall be available as a part of the SCARS Library.

3.14.1.3. A SCARS Windows Server image shall be available as a part of the SCARS Library

3.14.1.4. A SCARS RedHat Linux image shall be available as a part of the SCARS Library

3.14.1.5. A SCARS RedHat Linux Server image shall be available as a part of the SCARS

Library.

3.14.1.6. Information Technology (IT) desktop and server computer systems shall host SCARS

Computer OS images.

3.14.1.7. The SCARS sytem shall support additional OS images as defined in a Government

Task Order.

3.14.2. SCARS Container and Virtual Machine (VM) Requirements

3.14.2.1. SCARS Computer OS images shall installed on Virtual Machines (VM).

3.14.2.2. SCARS Computer OS images shall be made available on SCARS OPE as VMs.

3.14.2.3. SCARS Computer OS images shall be made available on SCARS OPE Development Mode as VMs.

3.14.2.4. VMs shall be provided through the SCARS OPE

3.14.2.5. A Container virtualization shall be provided through the SCARS OPE

3.14.2.6. The SCARS Container virtualization shall host SCARS Applications developed by

SCARS Affiliates and Partners for the container virtualization implementation.

3.14.2.7. The SOC shall have a mechanism to centrally manage VMs available on SCARS OPE.

3.14.2.8. The SCARS OPE shall have a mechanism to manage VMs locally.

3.15. System Quality Factors

3.15.1. System Availability

3.15.1.1. All SCARS equipment shall be protected by an uninterruptable power source (UPS).

3.15.1.2. The SCARS SOC, NOC, WAN, Library, OPEs, and SBRUs, shall meet a 99% System

Availability threshold.

3.15.1.3. The SCARS SOC, NOC, WAN, Library, OPEs, and SBRUs shall meet a 97% Event

Availability threshold.

4. Verification Provisions

4.1. Verification Methods

Each SCARS requirement in SRD section 3 shall be verified using the Government approved RVTM verification methods.

4.1.1. Demonstration

4.1.1.1. Operation of the system, subsystem, or a part of the system that relies on observable functional operation not requiring use of instrumentation, special test equipment, or subsequent analysis.

4.1.2. Test

4.1.2.1. Operation of the system, subsystem, or a part of the system, using instrumentation or other special test equipment to collect data for later analysis.

4.1.2.2. Analysis

4.1.2.3. Processing of accumulated data obtained from other qualification methods.

4.1.2.4. Inspection

4.1.2.5. Visual examination of system components, documentation.

4.2. Special Verification Methods

4.2.1. MBSE System Model as a Verification Method

4.2.1.1. The use of the SCARS MBSE System Model is encouraged, where appropriate, to verify system requirements through conducting demonstrations, tests, analyses, and inspections on the System Model.

4.3. Requirements Traceability

4.3.1. Requirements in this SRD shall trace and maintain traceability to the MBSE system model.

4.3.2. Use of automated tools to document each requirement shall capture the SRD requirement’s text description and its corresponding identification number.

5. Increments

The contractor shall deliver additional SCA capability to meet SCARS increments as defined in a Government task order.

5. Increments