Livescan-SNF Connection Specification Update 004.pdf
PDF 86 KB Posted
- Attached to
- Livescan Machines
- Solicitation number
- 65DPS-S3437
- Issued by
- Douglas County, Nevada
About this file
This is a technical specification update document issued by the Nevada Department of Public Safety's Records, Communication and Compliance Division as part of the NCJIS Modernization Program. The document outlines updated interface specifications for Livescan-Store and Forward (SNF) connections, requiring all criminal and civil livescan machines across 25 Nevada locations to transition from basic authentication methods to modern, more secure authentication protocols. The project involves replacing existing livescan devices with new machines compatible with Windows 11 and Microsoft Exchange Online, which will be hosted on the Microsoft Azure Government Cloud. Livescan machines must implement either Microsoft Graph Outlook API or Open Authorization (OAuth) 2.0 for authentication to Exchange Online accounts provided by the State, and agencies may connect through either the SilverNet state network or the Internet. The procurement covers sheriff's offices, parole and probation offices, detention centers, and police departments across various Nevada counties. The formal bid solicitation has a proposal due date of September 15, 2025, with submissions required through the NevadaEPro online platform. The potential contract duration could extend up to two years with possibilities for annual extensions if determined to be in the state's best interest.
Vendors must comply with FBI Electronic Biometric Transmission Specification (EBTS) standards, maintain FBI certification, and adhere to stringent security policies regarding both device user authentication and server authentication. Mandatory vendor requirements include fingerprint-based background checks and CJIS training for personnel. The state's standard terms and conditions provide a 5% preference for Nevada-based businesses that certify a majority of goods are produced in Nevada. The current environment utilizes basic authentication over network circuit encryption, which is considered outdated and non-compliant with updated FBI CJISSECPOL policies; an interim solution allows continued use of legacy methods during a transition period, but all livescans must implement new specifications before the end of this transition. The document does not specify explicit budget amounts, set-aside designations for disadvantaged enterprises, or identify incumbent vendors. Evaluation criteria will likely emphasize lowest responsible bidder status, considering factors such as product specifications, total cost of ownership, conformity to requirements, and delivery dates.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Quote Instructions.pdf | ||
| NV Livescan Specifications - Criminal NCJIS Mod for Mod Vendors.xls | XLS spreadsheet | |
| 0000 Standard Terms and Conditions for Commodities.pdf | ||
| Questions-Answers.xlsx | XLSX spreadsheet | |
| Cost Schedule - updated.xlsx | XLSX spreadsheet | |
| NV Livescan Specifications-Civil NCJIS Mod.xls | XLS spreadsheet | |
| NVDPS Livescan Table Update Spec PRODUCTION 1.1.pdf | ||
| WIN-4.1.0-FBI-EBTS-Supplement.pdf | ||
| WIN-4.1.0-Reference-Guide.pdf | ||
| Scope of Work NVDPS Livescan_Final~1.docx | DOCX document | |
| EBTS v11.2_Final.pdf | ||
| WIN-4.0-Legacy-Reference-Guide.pdf | ||
| Cost Schedule~1.xlsx | XLSX spreadsheet |
Show all 13
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Livescan-Store and Forward (SNF) Connection Specification Update
Background Interface specifications for criminal and civil livescan connections to the Nevada State Store and Forward (SNF) are changing to improve security and comply with updated FBI CJISSECPOL policies for encryption and authentication.
As a part of the NCJIS Modernization Program, the SNF is moving to the Microsoft Azure Government Cloud. Microsoft Exchange Online is used to exchange fingerprint-related messages between livescans and the SNF. End-to-end encryption is used rather than relying on network circuit encryption and allowing unencrypted data in physically secure facilities. The current Basic Authentication method (using account name and password) is considered a weak form of authentication and is not supported by Exchange Online1.
Instead, a more secure authentication method is used, which Microsoft refers to as “Modern Authentication”.
Modern Authentication can be implemented in the livescan using one of the following:
• Microsoft Graph Outlook API, which is recommended for Windows development environments
• Open Authorization (OAuth) 2.0, which is recommended for non-Windows development environments, although it can also be used in Windows development environments
The new interface specifications allow livescans to continue to exchange messages with the SNF via Exchange Online over the SilverNet state network (including a VPN connection to Silvernet), but also permit livescans to connect securely to Exchange Online over the Internet.
Note that the authentication discussed in this document is solely about the authentication of livescans to the NCJIS Mod Exchange Online email server (for communicating with the SNF). It has nothing to do with a livescan user authenticating to the livescan device. The livescan vendor or agency is responsible for complying with FBICJISSECPOL and State security policies regarding livescan user authentication.
While an interim solution is being put into place that allows continue use of network circuit encryption and basic authentication during a transition period, all criminal and civil livescans will need to implement the new interface specifications before the end of the transition period.
1 https:/learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online https://urldefense.com/v3/__https:/learn.microsoft.com/en-us/Exchange/client-developer/exchange-web-services/office-365-rest-apis-for-mail-calendars-and-contacts__;!!JZxO7R1e!vK0dt8W2WBJHAHZ_VE1AFj8Up6UVcKcjd_7bBxXVOrQCWuDuf7t42TflKZU-BTI4ut8J3kOLF4iQNQe-w_3cSioL7L0$ https://urldefense.com/v3/__https:/learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth__;!!JZxO7R1e!vK0dt8W2WBJHAHZ_VE1AFj8Up6UVcKcjd_7bBxXVOrQCWuDuf7t42TflKZU-BTI4ut8J3kOLF4iQNQe-w_3cVWZGUT8$ https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online
Specification The new specifications are:
1. A Livescan shall exchange messages with the SNF using Microsoft Exchange Online accounts provided by the State.
2. A Livescan shall use either Microsoft Graph Outlook API or Open Authorization (OAuth) 2.0 to authenticate to its Exchange Online account.
a. Current information on Microsoft Graph Outlook API can be found at the following link:
https://learn.microsoft.com/en-us/Exchange/client-developer/exchange-web-services/office-365-rest-apis-for-mail-calendars-and-contacts
b. Current information on Open Authorization (OAuth) 2.0 can be found at the following link:
https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth
3. At the agency’s or organization's option, a Livescan may connect to Exchange Online over Silvernet (including a VPN connection to Silvernet) or the Internet.
V1.0 10/22/2024 https://learn.microsoft.com/en-us/Exchange/client-developer/exchange-web-services/office-365-rest-apis-for-mail-calendars-and-contacts https://learn.microsoft.com/en-us/Exchange/client-developer/exchange-web-services/office-365-rest-apis-for-mail-calendars-and-contacts https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth
| Livescan-Store and Forward (SNF) Connection Specification Update |
| Background |
| Specification |
File details come from the government source that posted it. Updated .