Attachment__13.xlsx

Milestone Criteria Government Implementation Milestones/Deliverables/Activities for

Phase Milestone ID Milestone Acronym Milestone Name Deliverables / Activities Due Date (Notional) Design Readiness Milestones DM1 PDR Preliminary Design Review • Architecture, DoDAF Artifacts/Diagrams (AV, OV, SV, StdV, CV) *

• Interfaces, Ports & Protocols Baseline **

• Service Support Functions and Integration Plan *

• D-DIL Architecture/ Integration Plan *

• Performance Monitoring Strategy *

• Data Loss Prevention Plan *

• Security Architecture Analysis

• Migration Strategy *

• Migration Schedule *

• Transition Strategy **

• Requirements Management Plan / Traceability Matrix**

• Licensing Structure *

• Cloud Service Administration Portal Plan **

• Single sign on with ADFS and Directory Synchronization Plan *

• Support model and Service Requests Plan **

• Service Management Plan *

• Change Management Documentation *

• Continuous Monitoring Test Plan *

• Incident Response Plan and Procedures *

• CPMP

• Service Desk Strategy *

* End User Fact Sheets/Manuals *

• System Administrator Configuration Guides for NIPR, SIPR, and D-DIL Environments*

• Training Requirements Definition *

• Training Material *

• Training Feedback Forms *

• Implementation Status Report *

• Implemented Controls *

• Security Assessment Report *

• Selected Security Control Assessment *

• Issue Resolution Report *

• Plan of Action & Milestones *

• Remediation Status Report *

• Residual Risk Statement *

• Risk Acceptance Recommendation *

• Risk Assessment **

• Security Assessment Report *

• Security Control Selection Documentation *

• Request and Obtain IP Addresses from the CSP (For CSP IPs) **

• Configure IP Addresses in CSP Routers **

• Configure IP Addresses in DISA Routers ***

• Configure Secure NAT ***

• Connectivity Test *

• Test SNAT Translation *

• Identify DNS Names and structure and notional record types

• Determine process to add URL *

• DNS Routing issues, sink holing, reverse proxy *

• Provide TTL and other parameters *

• Configure Domain in CSP Portal *

• Configure DNS Whitelist (Vendor's URLs) *

• Review external DNS records and SSL certificates

• Configure external/internal DNS; Ensure auto discover is working

• Configure DNS Failover

• Coordinate Technical Kick Off meeting with DISA SCA and CSP Representatives; include site visits if applicable **

• Validate deltas between CSP inherited controls and required inherited controls **

• Validate Implemented inheritable controls deltas **

• Approved SAR is submitted to AO office***

• Prepare POA&M addressing residual risk ***

• Submit eMASS Package ***

• Submit Provisional Authorization (PA) recommendation ***

• Conduct Site/ ST&E Visit if applicable **

• DSS SCA Assessor to develop security assessment repot (SAR) **

• DSS SCA Assessor reviews report with Vendor ISSM ***

• DSS SCA Assessor coordinate SAR with DSS SCA leadership for approval

• Vendor ISSM prepares POA&M addressing residual risk findings **

• Complete self-assessment and IA controls, System Implementation Plan (SIP), RMF Implementation Plan (DIP), RMF Scorecard, System POA&Ms ***

• Continuous monitoring strategy **

• System Security Plan (SSP), Service Operations Annex (SOX) ***

• Information System Contingency Plan (ISCP) ***

• CONOPS, Change Management Plan (CMP), IRP Updates ***

• ISSM and ISSO Appointment letters ***

• Produce Architecture Diagrams *

• Identify Enterprise Wide Lookup Mechanism (e.g. GAL) *

• Determine attributes to be replicated *

• Detail Replication Process *

• Create Documentation and Architecture Diagrams•

• Implement Provisioning Mechanism *

• Generate Server Side Certificates *

• Identify MILDEP POCs (Local Registration Authority) for CSR submission *

• Facilitate DoD PKI Certificate Generation/Signing *

• OCSP/CRL Integration *

• User Certificate Selection (e.g. PIV Certificates) *

• IP Transport *

• Produce Architecture Diagrams (e.g. Traffic Flows) *

• Assessment Report *

• Provisioning / Authentication Assessment Documentation *

• Impact Assessment *

• Privacy Impact Assessment *

• Privacy Threshold Analysis *

• Remediation Status Report *

• Residual Risk Statement *

• Security Assessment *

• Vulnerability Assessment *

• Access Management Support Plan

• Event Management Support Plan

• Incident Management Support Plan

• Request Fulfillment Support Plan

• Storefront Integration Plan

• Service Desk Support Plan

• Service Desk Integration Plan

• Problem Management Support Plan

• Customer Satisfaction Metric Collection Proposal

• GSD / Mission Partner Helpdesk Integration Plan

• Integrated / Non-Integrated Service Desk Plan

• NETOPS Plan

• Out of Band Integration

• Contingency Plan *

• Initial Risk Assessment Documentation *

• Security Assessment Plan *

• Security Control Selection Documentation *

• System Definition Document *

• System Security Plan *

• System Security Plan Analysis *

• Test Environment(s) Idenfiyed **

• Change Management Documentation (including Risk Analysis) **

• Continuous Monitoring Test Plan **

• Incident Response Plan and Procedures **

• I/AT for FRD Section 3 (System Wide Requirements) *

• I/AT for FRD Section 4 (DoDIN Protection) *

• I/AT for FRD Section 7 (Core Service Support Functions & Integration Points) *

• Cloud Infrastructure and Workload assessment report **

• Configuration Definition (i.e. – “As Built”) *

• Defect Tracking List *

• Updated System Baseline **

• Updated Configuration Baseline **

• Usage Reports (by feature capability) **

• Incident Reports **

• FISMA Reporting and Updates **