2014112_NISS_SOO_FBO.pdf

STATEMENT OF OBJECTIVES

FOR

THE NATIONAL INDUSTRIAL SECURITY SYSTEM

(NISS)

November 12, 2014

Prepared by Defense Security Service

Introduction

As one of four Government Security Agencies (GSA) directed to implement the National Industrial Security Program (NISP) per Executive Order 12829, the Defense Security Service (DSS) provides Industrial Security Services and training to the Department of Defense (DoD) and twenty-seven other federal agencies.

Administering the NISP to cleared contractors eligible to receive, handle, and protect classified information for DoD and the 27 agencies makes DSS responsible for an industrial base that includes over 13,000 cleared facilities, 40,000 classified information systems, and over 10,000 industrial security professionals.

Purpose

There is an existing “gap” between DSS Agency capacity and national security requirements being predominantly driven by a summation of challenges found within three Agency operational activities:

1) Process Facility Clearances (FCL)

2) Conduct Proactive Monitoring

3) Manage Incident Response.

DSS currently conducts its critical missions without an integrated enterprise information technology architecture. The lack of an enterprise IT solution results in cumbersome, inefficient, and exceedingly manual processes that jeopardize the success of DSS missions.

Five primary factors that span across the three forenamed operational activities challenge DSS’s ability to effectively administer the NISP and account for Industry’s rapidly evolving security environment:

1. Limited ability to identify vulnerabilities and mitigate the expanding threat through consistent interaction and partnership with Industry, given resource constraints

2. Increasing reliance on proactive NISP stakeholder partnerships, which can be met with hesitation

3. Scaled directorates to meet growing mission sets, resulting in potential service delivery overlap

4. Required Department-level clarity on critical issues, such as cyber defense, fogging the Agency’s ability to determine mission effectiveness

5. Legacy technological infrastructure out-stripped by modern information security demands, and actually hampering the Agency’s ability to provide timely support to NISP stakeholders

The National Industrial Security System (NISS) is the working name for a new, automated business information capability that seeks to replace the legacy Industrial Security Facility Database (ISFD) and incorporate additional functionality. The NISS will be an integrated automated solution that will facilitate efficient execution of the Agency’s core mission. It will use available technology to drive smooth user workflow, enhance decision-making through stronger and timelier synthesis of information, and improve transparency pertaining to Industry’s National Industrial Security (NISP) participation.

NISS will allow users to sift through vast volumes of information and more easily form linkages about a facility and its Key Management Personnel (KMP), effectively closing Industry’s safeguarding gaps, while allowing DSS field personnel to proactively partner with Industry on-site through Security Vulnerability Assessments (SVAs). Presently critical resources are diverted from meaningful customer engagement and identification of high-risk threats to menial data entry without an effective NISS enterprise IT solution.

High Level Objectives for the NISS approach include the following:

a. Expedited performance against classified contracts

i. Streamlined facility clearance (FCL) processing

ii. Enhanced FOCI identification and mitigation

iii. Accelerated and improved C&A of Industry information systems

iv. Expedited production of quality information

b. Enhanced data linkages to provide full risk profile

i. Increased information sharing and transparency

ii. Automated prioritization of Industry engagement (FIL)

iii. Implemented enterprise risk analytics capability

c. Improved ability to make metrics-based decisions

i. Enhanced automated metrics capture and analysis

d. Improved vulnerability management from identification through mitigation

i. Improved vulnerability reporting through automation

ii. Streamlined vulnerability oversight

iii. Expedited vulnerability mitigation

e. Improved threat management from identification through mitigation

i. Improved threat reporting

ii. Expedited threat mitigation

f. Increased technology effectiveness and mobility

i. Create a mobile technology solution to meet mobile workforce needs

ii. Improve ability to utilize data from multiple sources, classifications, and types in a single location

iii. Improve analysis

iv. Improve discovery of unknown unknowns. Expedite data submission validation

NISS Required System Attributes

Attributes required for the NISS include the following features:

a. BPMN - The Defense Security Service (DSS) requires a product which enables the capturing of business operations through Business Process Modeling and Notation (BPMN) workflows with work prioritization.

b. Workflow Management – The contractor shall provide NISS users with the ability to manage workflow processes and ensures that out-of-the-box vender functional capabilities are available.

c. Facility Profile Creation – The contract shall provide an end product that will ensure that each facility has a profile within NISS that includes information such as the facility address, region, KMP list, corporate website, corporate legal structure, research data, facility actions, alerts, change conditions, workflow status, etc. The system shall visually display parent-child and related ownership hierarchies between facilities and companies.

d. Search/Content Management – The contractor shall provide a system that will enable site-wide searching for internal and external users on various information within the NISS. While search functionality provided as native capabilities will likely require further customization to meet Agency needs.

e. Reporting – The contractor shall provide a system that will calculate and display standard metrics related to all DSS processes conducted within the system. Additionally, the system should enable advanced ad-hoc reporting and analytics that can record and report historical transaction and usage data, and conduct real-time validation of the data. Reporting should facilitate the implementation of the risk management framework which includes identification of potential threats to detection of realized impacts, for the Industrial Security Supply Chain. The reporting should enable data-driven decision making to identify risks within the supply chain and enable executive level reporting for performance management.

f. Analytics – The contractor shall provide a system capable of transforming structured and unstructured data to help identify and develop meaningful and actionable information to inform business decisions and identify trends or risks. This analytic capability should allow for the easy interpretation of volumes of data, and provide historical, current and predictive views of internal (DSS) and external (Industry) operations. The system should acquire, process, and correlate data that is within the system, as well as within linked sources.

g. Integration and Interoperability – The contractor shall provide a system that will enable access to data from databases internal and external to DSS to complete internal processes and validate information included in this DSS system of record. The technical solution shall conform to DoD Guidelines and DSS infrastructure. The expectation is that the delivered product will have already incorporated external system integration activities prior to DSS Pre- Production staging.

h. Storage – The contractor shall provide a system that will allow users to upload and save documents as well as unstructured data.

i. Dashboard Portal/Single User Interface – The contractor shall provide a system that will present workflow data, notifications and messages, dependent upon roles and permission level assigned to each user. The graphical user interface (GUI) must be innovative in nature.

j. Auditing – The contractor shall provide a system with the capabilities to ensure that transactional logs of various actions are recorded and saved. This includes, but is not limited to, the overall system transactions and facility profile transactions.

k. Attribute Based Access Control (ABAC) – The contractor shall provide a system that establishes rules for users’ access, roles, and permissions within the NISS, in accordance with NIST SP 800-162.

l. Help – The contractor shall provide a system that provides access to job aides, FAQs, and other help-related documentation.

m. Mobile Capabilities – The contractor shall provide a system that converts core NISS capabilities into a mobile version for access over mobile devices.

n. Automated Notifications/Alerts/Messaging – The contractor shall provide a system that provides the ability for internal and external users to liberally manage notifications, alerts and messages.

o. Automated Cross Domain Solution (CDS) – The contractor shall provide a system that enables automated transfer of data between NIPR and SIPR without spillage. The developer must enable a bridge for NIPR information to be ingested up to SIPR, and primary unclassified NISS SIPR information to be available down to NIPR. A near real-time, bi-directional cross-domain data solution will be required to be in place at NISS initial deployment. The CDS will be included within and throughout the workflow processes.

p. NoSQL (Not Only SQL) data repository with modular systems integration to allow for multiple transactional systems to utilize, modify and validate data

q. Data Migration – The existing legacy application contains data which will continue to be used and must be migrated into the NISS.

The developer must prepare existing data so that it ports into the new system without losing functional meaning and with minimal disruption of service for daily operations. Data fields for the existing and receiving systems shall be formally documented mapping schemas for review and approved by stakeholders for accuracy.

r. GUI Interfaces – The Agency requires internal and external GUI interfaces. The interfaces should automate the exchange of Industrial Facility Clearance data, between DSS internal systems and extra- Agency systems. Timely exchange of this information will allow Agency representatives to execute proactive monitoring, risk response, and assessment responsibilities.

NISS Delivery Increments

Anticipated NISS Delivery increments include the following:

a. Incorporate ISFD and E-FCL into Core NISS Foundation Capabilities – The first increment will provide DSS with core ISFD and e-FCL capabilities and establishes the foundation for accessing facility data, site navigation, and fundamental application functionality within the NISS. The first increment will centralize all processes required for managing the facility security clearance process. The estimated duration for this increment is roughly 18 months since it will include all core capabilities listed as system attributes.

b. Security Vulnerability and Incident Response Management – The second increment will provide DSS stakeholders with essential tools and information required to manage security violations, assess vulnerabilities and respond to incident reports. This increment also builds upon the functionalities developed in Increment-I by enhancing existing system functionality. Processes include Security Vulnerability Assessment (SVA), Suspicious Contact Report (SCR), Security Violation (SV) processing, and Certification & Accreditation (C&A). The estimated duration for this increment is roughly 12 months.

c. Change Condition Monitoring – The third increment will enable DSS to efficiently and effectively perform change condition monitoring in light of all core facility data availability within the NISS. This increment allows for refinement of system functionality.

Processes include Key Management Personnel (KMP) Monitoring, NATO Control Point Inspections (CPI), Triage Outreach Program (TOP), NISP Facility Oversight, and Foreign Visit Requests (FVR).

d. Mobile Access Enablement – The fourth increment will provide stakeholders with the ability to access NISS functionality in a mobile environment, increasing productivity during facility site visits and security assessments. The estimated duration for this increment is roughly 12 months.

e. Facility System Inspections (CCRI) – The fifth increment will provide the ability to electronically manage the process of scheduling and conducting DISA mandated CCRI inspections. The estimated duration for this increment is roughly 9 months, including CI Mission Enablement work.

f. Counterintelligence (CI) Mission Enablement – The sixth increment shall enable the counterintelligence mission to identify insider threats and convey timely information. The scope of this increment will be determined at a later date. The estimated duration for this increment is roughly 9 months, including the Facility System Inspections work.

Reading Room Content

1) NISS Requirements Definition Document (RDD)

2) Capabilities Increment Mapping, HLOs slide deck

3) NISS Acquisition Friendly Business Case Exert

4) Hardware and Software Specifications

5) Work Breakdown Structure (WBS)

6) Reporting Requirements

7) 508 Compliance Documentation

8) DoD Risk Management Framework 8510.01

9) DIACAP IA Controls

10) Joint Information Environment (JIE) – DoD Interoperability Guidance

11) Open Systems Language

12) Software Assurance Guidance