JCITS Requirements_2024 1021.pdf

Capability Overview:

Cyber Analytic Platform: Aggregate multiple data types from multiple sources to include but not limited to net flow, network vulnerability information, government contract award information, and Internet

Protocol registration information. The capability must be able to index data by type, enable users to input National Industrial Security Program (NISP) infrastructure information and retain and enrich that information. The capability must be able to allow users to input foreign network information and retain and enrich that information. The capability would enrich and correlate data in the different indexes. Users conduct searches within the data, and the data is presented in an intuitive interface.

Requirements:

Ingest multiple data types from multiple data streams.

• Current raw net flow ingests averages between 1.1– 4.5 Billion records / day

• Enriched net flow records average between 60 – 300 million / day

• Average 3.5 million domaine name system (DNS) / Protective Domain Name Service (PDNS) queries per day

• Net flow Ingests should occur no less than once per 24 hours

• Vulnerability information ingested no less than once per week

• Network enumeration information ingested no less than once per week

• Government contract award information ingested no less than once per week

The capability must be scalable to support 1,000 total users

The capability must be scalable to support 500 concurrent users

The capability must deliver 99.9% availability

User Interface: The capability should have an intuitive user interface (UI) that does not require knowledge in a specific programming language. The UI should enable visual depictions of all indexes and allow access to those indexes to users based on role. The UI should enable users to easily query the data.

Hierarchy and Role Based Security: Support the development and maintenance of role-based security / access control model. Support a role-based security approach that grants and restricts access to data and capabilities based upon user role (e.g., subject matter experts, Supervisors, Analysts, view-only).

Cloud Based / IL5: Capability should be cloud based, hosted and maintained by the vendor. A

Commercial-off-the-Shelf (COTS) or Government-off-the-Shelf (GOTS) capability is desired to reduce the overall cost. The capability should be cloud based to enable the processing and storage of large amounts of data without the dependance and cost of purchasing and maintaining hardware. Data ingestion should be scalable and flexible depending on mission requirements. The capability should have the ability to back-up enriched data in an alternate location for data security. The capability should be Impact

Level 5 certified in order to maintain Controlled Unclassified Information (CUI).

• Data availability – 6 months of data should be readily available to the users (Hot Storage) o Hot storage definition: Low latency: Hot storage is optimized for low-latency access, making it ideal for applications and data that require rapid response times.

o Scalability: Hot storage services often offer easy scalability to accommodate data growth or changing usage patterns.

o Data access speed: Hot storage is designed for frequent read and write operations, making it appropriate for data that requires rapid access.

• Warm storage - data ranging from 6-12 months can be stored in warm storage o Warm storage definition: Warm storage is data that is accessed less frequently. This could be data that is used for reporting or analytics. It doesn’t need to be accessed as quickly as hot data, so it can be stored on slightly slower, capacity-optimized storage.

• Cold storage – data older than 12 months should be stored in cold storage o Cold storage definition: Cold storage is data that is rarely accessed. This could be data that is archived for compliance reasons. It can be stored on even slower, “cheap and deep” storage.

Report Generation / Workflows: The capability should have a report generation capability inherent in the system. Report generation should be a system generated template with the ability for the user to edit the contents of the report. The capability should support workflows that assist in data analysis which enable accurate report generation.

Advanced Analytics: The capability should provide advanced analytic capabilities such as Machine

Learning and Artificial Intelligence algorithms. Advanced analytics should analyze data and provide a result based on a user defined need.

Collaborative Environment: Capability should enable collaboration through the ability to share workflows, data, projects, analysis, queries etc.

Request for Information (RFI) Management: Support RFI management including editing / updating RFI information, adding a tag, updating state (e.g., open, closed) or removing an RFI. Support responding to

RFI. Support editing / updating RFI response information, adding or updating tag (e.g., source information).

Auditing: Support the logging of events (e.g., accessing, creation, modification, or deletion) of records, artifacts and products. Support maintaining logged events in accordance with National Archives and

Records Administration (NARA)-approved schedules.

Administration: Support centralized administration capability, based on hierarchy and role-based security, to manage security, automation and workflows, and business rules.

Records Management: Provide automated records management capabilities, identifying the disposition date for designated products and information based on a Defense Counterintelligence Security Agency

(DCSA) and NARA records disposition schedule, and automatically notifying the appropriate data stewards when disposition dates are reached.

Platform as a Service - Implement a secured platform as a service system that is based in hardware, software or a combination of both that sends/receives data in multiple formats (JSON, XML, SQL, etc.)

to/from multiple sources (Industrial Security, Counterintelligence, Department of Defense (DoD), other government agencies, publically available information (PAI), etc.) with the intent to identify, assess, and deter foreign intelligence and cyber threats to government, trusted workforce, and cleared national industrial base.

Configurable Functionality –The system must have a configurable graphical user interface with supporting data elements customizable to specific mission areas needs as mission areas may have unique data input or output requirements. Common functionality examples include alert, triage, detailed analysis, and mitigation with new mission areas.

• The system must be capable of implementing and maintaining business rules in compliance with established and developing guidance (e.g., Intelligence Oversight).

• Solution must provide the ability to generate and display other non-standard reports based on data collected.

• The system must provide reliable access to admin and user needs. Scheduled maintenance shall not significantly impact availability and will be conducted during off peak hours. The system shall be capable of technology and software refresh.