Attachment_2_of_52.212-1.xlsx
XLSX spreadsheet 52 KB Posted
- Solicitation number
- M67854-16-R-4001
- Issued by
-
United States Marine Corps
About this file
Attachment 2 to Instructions to Offerors
View the file
Other files
Show all 12
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
CERS DAR Reqs Eval Matrix
| Network Access Control, Compliance & Remediation (NACCR) Requirements Evaluation Matrix (REM) | |||||
| Unique ID | NIPR, SIPR or Both | Threshold | NACCR Spec | Bidder's Response | |
| (Please Select One) | Brief Description for Responses of Value 'A', 'M', or 'N' | ||||
| SYS001 | Both | T | The solution shall be certified and accredited through the MCEN Authorizing Official (AO). | ||
| SYS002 | Both | T | The solution shall be secured at the following cybersecurity levels under the Risk Management Framework (RMF) for DoD IT: |
Confidentiality: Moderate Integrity: Moderate Availability: Moderate Process PII: No Process Classified: Yes (Potential)
System Resides on: MCEN-N & MCEN-S
| SYS003 | MCEN-N | T | The system shall not interfere with NGEN’s ability to meet the sustainment (availability) KPP when the authorized end user device is compliant. |
| SYS004 | MCEN-S | T | The system shall not interfere with SONIC’s ability to meet the operational availability KPP when the authorized end user device is compliant. |
| General Requirements | |||
| SYS005 | Both | T | The solution shall include an appliance based product. |
| SYS006 | Both | T | The solution shall be license scalable to support an additional 50% of provided end point counts. |
| SYS007 | Both | T | The solution shall be license scalable to activate all specified functionality on the appliance without requiring additional hardware.. |
| SYS008 | Both | T | The appliance platforms used to deliver the solution shall hardware based. |
| SYS009 | Both | T | The appliance platforms shall include all of the computing resources needed to deliver the solution. |
| SYS010 | Both | T | The appliance platforms shall include all of the storage resources needed to deliver the solution. |
| SYS011 | Both | T | The appliance platforms shall include all of the software needed to deliver the solution. |
| SYS012 | Both | T | The appliances shall include all of the components required to interface with the current infrastructure in order to deliver the solution. |
| SYS013 | Both | T | The appliances used to deliver the solution may be physical appliances. |
| SYS014 | Both | T | The appliances used to deliver the solution may be virtual appliances. |
| SYS015 | Both | T | The appliances used to deliver the solution shall be configured in an active/passive configuration at the appliance level. |
| SYS016 | Both | T | The solution shall not introduce any new single point of failure into the environment. |
| SYS017 | Both | T | The appliances used to deliver the solution shall be configured with full redundancy at the component level. |
| SYS018 | Both | T | The solution shall include automatic failover to continue delivering the same capability after a single device fails. |
| SYS019 | Both | T | The solution shall include automatic failover to continue delivering the same capability after a single device component fails. |
| SYS020 | Both | T | The appliance shall be able to fully function to deliver solution capabilities independently without a management appliance if the management appliance fails. |
| SYS021 | Both | T | NAC management appliances shall retain solution device configuration for managed appliances. |
| SYS022 | Both | T | NAC management appliances shall automatically transfer a copy of managed appliance configurations to the designated remote site. |
| SYS023 | Both | T | Secondary NAC management appliances shall retain copies of managed appliance configurations from original site. |
| SYS024 | Both | T | The NAC management appliance shall automatically backup managed appliance configurations when a configuration change is made on the managed appliance. |
| SYS025 | Both | T | Managed appliance configurations shall be transferred to the designated remote site weekly. |
| SYS026 | Both | T | Remote site NAC management appliance shall be able to assume management for a failed NAC management appliance site in the event of a site loss manually by restoring the configuration from the failed site. |
| SYS027 | Both | T | All components shall be supported by the product vendor with an active warranty agreement to provide 8x5 (8 hours a days, five days a week) Next Business Day (NBD) advanced replacement upon return merchandise authorization (RMA) notification from the operator. |
| SYS028 | Both | T | The solution shall be able to recover from available backup files. |
| Management Requirements | |||
| SYS029 | Both | T | The solution shall include centralized management. |
| SYS030 | Both | O | The solution shall include global management. |
| SYS031 | Both | T | The solution shall include software distribution for NAC platform system software (hypervisor, firmware, etc.). |
| SYS032 | Both | T | The solution shall include software distribution for NAC appliance operating system / firmware. |
| SYS033 | Both | T | The solution shall include software distribution for NAC management appliance operating system / firmware. |
| SYS034 | Both | T | All active NAC policies shall be stored in an offline repository. |
| SYS035 | Both | T | The solution shall be able to recover from available backup files. |
| SYS036 | Both | T | The solution shall perform automated backups using only STIG compliant, DoD approved, and USMC accredited communication protocols. |
| SYS037 | Both | T | Global management for the NACCR solution shall be provided via web interface. |
| SYS038 | Both | T | Global management shall be provided via web interface. |
| SYS039 | Both | T | The web interface for NAC management shall support a minimum of 50 concurrent sessions. |
| SYS040 | Both | T | The web interface for NAC management shall support manual approval of end point access on the network. |
| SYS041 | Both | T | The NACCR solution administrative console shall be accessible through a web interface. |
| SYS042 | Both | T | The NACCR solution administrative console web interface shall be accessible from a standard MCEN client seat. The web interface shall not use plug ins or require nonstandard Microsoft Internet Explorer settings. |
| SYS043 | Both | T | The NACCR solution administrative console web interface shall be accessible from a standard MCEN Linux seat using the current approved Firefox browser. |
| SYS044 | Both | T | The NACCR solution administrative console shall not be a licensed product. |
| SYS045 | Both | T | The NACCR solution administrative console shall be accessible from any approved administrator seat. |
| Access Requirements | |||
| SYS046 | Both | T | NACCR solution administrative permissions shall leverage Role Based Access Control (RBAC). |
| SYS047 | Both | T | Enterprise level NACCR solution administration permissions shall be assigned globally. Enterprise administrators will have access to all systems globally. |
| SYS048 | Both | T | MITSC level NACCR solution administration permissions shall be assigned regionally. MITSC administrators will only have access within their assigned region. |
| SYS049 | MCEN-N | T | NACCR solution administrative access shall be authenticated via Common Access Card (CAC). |
| SYS050 | MCEN-S | T | NACCR solution administrative access shall be authenticated via USMC implementation of DoD PKI. |
| SYS051 | Both | T | NACCR solution administrative access shall be granted based on IP segment. |
| SYS052 | Both | T | NACCR solution administrative access shall be based on user ID. |
| SYS053 | Both | T | NACCR solution administrative access shall be granted based on valid USMC Active Directory certificate. |
| SYS054 | Both | T | NACCR solution administrative access shall be granted based on PKI authentication. |
| SYS055 | Both | T | NACCR solution administrative access shall be granted based on Active Directory group membership. |
| SYS056 | Both | T | NACCR solution administrative access shall be authenticated via RADIUS authentication |
| SYS057 | Both | T | NACCR solution administrative access shall require two-factor authentication. |
| SYS058 | Both | T | The solution shall use a minimum of 4096 bit Rivest, Shamir, and Adelman (RSA) Keys |
| SYS059 | Both | O | The solution shall use 8192 bit RSA Keys. |
| End-Point Discovery Requirements | |||
| SYS060 | Both | T | The solution shall discover network connected devices with 802.1x connection authentication protocol. |
| SYS061 | Both | T | The solution shall discover network connected devices without 802.1x connection authentication protocol. |
| SYS062 | Both | T | The solution shall discover network connected devices without using inline placement. |
| SYS063 | Both | T | The solution shall query switches using SNMP to discover connected endpoints. |
| SYS064 | Both | T | The solution shall query switches using SSH to discover connected endpoints. |
| SYS065 | Both | T | The solution shall query routers using SNMP to discover connected endpoints. |
| SYS066 | Both | T | The solution shall query routers using SSH to discover connected endpoints. |
| SYS067 | MCEN-N | T | The NAC appliance shall be capable of querying wireless controllers using SNMP to discover connected endpoints. |
| SYS068 | MCEN-N | T | The NAC appliance shall be capable of querying wireless controllers using SSH to discover connected endpoints. |
| SYS069 | Both | T | Where network infrastructure monitoring protocols (e.g. NetFlow, SPAN, etc.) are employed, the NACCR solution shall use those instances to discover connected endpoints. New deployments of the monitoring protocols (both new protocols and new instances of current protocols) shall be evaluated for impact prior to implementation. |
| SYS070 | Both | T | The SNMP version in the solution shall be limited to SNMPv3. |
| SYS071 | MCEN-N | T | The solution shall integrate with SSL-VPN solutions for endpoint discovery. |
| SYS072 | Both | T | The solution shall integrate with site-to-site VPN solutions for endpoint management. |
| SYS073 | Both | T | The solution shall integrate with network infrastructure regardless of vendor. |
| SYS074 | MCEN-N | T | The solution shall discover endpoints by monitoring DHCP traffic. |
| SYS075 | Both | T | The solution shall discover endpoints by monitoring SPAN traffic. |
| SYS076 | Both | T | The solution shall discover endpoints by monitoring NetFlow traffic. |
| SYS077 | Both | T | The NAC appliance shall be capable of discovering endpoints by monitoring IP flow traffic. |
| Traffic Monitoring Requirements | |||
| SYS078 | Both | T | The solution shall monitor network traffic without requiring inline placement |
| SYS079 | Both | T | The NAC appliance shall be configured with interfaces to physically connect at the distribution layer collocated with domain controllers. |
| SYS080 | Both | T | The NAC appliance shall be configured with sufficient quantity of interfaces to monitor all user VLAN routed interfaces at the distribution layer that are collocated (same Data Center) with the NAC appliance. If there are two distribution switches in the data center with user VLANs routed on each, the NAC appliance will require four interfaces (two to each distribution switch) to account for volume and redundancy. |
| SYS081 | Both | T | The NAC appliance shall be configured with interfaces sized to monitor an aggregate of all user VLAN routed interfaces at the distribution layer that are collocated (same Data Center) with the NAC appliance. If there are two distribution switches in the data center with multi 1Gbps interfaces to the access layer each, the NAC appliance will require four 10Gb interfaces (two to each distribution switch). If the aggregate bandwidth of connections to the access layer is <1Gb, then 1Gb interfaces may be sufficient. |
| SYS082 | Both | T | The NAC appliance shall be configured with the interface media needed to connect to the distribution layer through an available port on the distribution device. If the distribution device port is an SFP port, the solution will provide the SFP. If the port is a static fiber interface, the solution will account for that connection. If the port is a static copper interface, the solution will account for that connection. |
| SYS083 | Both | T | The NetFlow configurations in the solution shall use the current NetFlow versions deployed on the MCEN. |
| SYS084 | Both | T | The NAC appliance shall be capable of using the latest NetFlow versions. |
| SYS085 | Both | T | The NAC appliance shall be capable of deploying access control lists on user network default gateway interfaces. |
| Endpoint Classification Requirements | |||
| SYS086 | Both | T | The solution shall analyze collected data from network infrastructure monitors (e.g. NetFlow, SPAN, etc.). |
| SYS087 | Both | T | The solution shall classify end points based on analysis. |
| SYS088 | Both | T | The solution shall identify devices connected to the MCEN using discovery tools, e.g. active network mapper (NMAP). |
| SYS089 | Both | T | The solution shall identify devices by type. |
| SYS090 | Both | T | The solution shall identify devices by network activity. |
| SYS091 | Both | T | The solution shall identify devices connected to the MCEN using passive traffic monitoring. |
| SYS092 | Both | T | The solution shall identify devices by type. |
| SYS093 | Both | T | The solution shall identify devices by network activity. |
| SYS094 | MCEN-N | T | The solution shall identify device type by DHCP lease records. |
| SYS095 | Both | T | The NAC appliance shall be capable of collecting user authentication traffic. |
| SYS096 | Both | T | The NAC appliance shall be capable of identifying user authentication traffic. |
| Endpoint Management Requirements | |||
| SYS097 | Both | T | The NAC appliance shall be capable of using SMB to query Windows based endpoints. |
| SYS098 | Both | T | The NAC appliance shall be capable of using RPC to query Windows based endpoints. |
| SYS099 | Both | T | The NAC appliance shall be capable of using WMI to query Windows based endpoints. |
| SYS100 | Both | T | The NAC appliance shall be capable of using SSH to query Mac OSX based endpoints. |
| SYS101 | Both | T | The NAC appliance shall be capable of using SSH to query Linux based endpoints. |
| SYS102 | Both | T | The SSH version in the solution shall be limited to SSHv2. |
| SYS103 | Both | T | The NAC appliance shall be capable of permanently installing agents on endpoints. Permanently installation reinstalls an agent when manual deletion is attempted. |
| SYS104 | Both | T | The NAC agent shall be capable of monitoring events on the endpoint. |
| SYS105 | Both | T | The NAC appliance shall be capable of installing dissolvable agents on endpoints classified as temporary. Dissolvable agents are able to be removed. |
| SYS106 | Both | T | The NAC agent shall be capable of remediating vulnerabilities on the temporary endpoint. |
| SYS107 | Both | T | The solution shall use SNMP to query SNMP enabled devices. |
| Third-Party Integration Requirements | |||
| SYS108 | Both | T | The solution shall integrate with McAfee ePolicy Orchestrator (ePO) to query ePO on endpoint status. |
| SYS109 | Both | T | The NAC solution shall log detected endpoints that are not known by McAfee ePO. |
| SYS110 | Both | T | The NAC solution shall notify McAfee ePO of endpoints that are not know by McAfee ePO. |
| SYS111 | Both | T | The solution shall query ePO on endpoint agent status. |
| SYS112 | Both | T | The solution shall query ePO on DAT file (signature file for antivirus) date on the endpoint. |
| SYS113 | Both | T | The solution shall be able to receive events from the McAfee ePO solution. |
| SYS114 | Both | T | The solution shall take actions based on McAfee ePO received events. |
| SYS115 | Both | T | The solution shall integrate with BMC Remedy via Microsoft Orchestrator (SCORCH). |
| SYS116 | Both | T | The solution shall be able to query BMC Remedy for information on active BMC Remedy incident tickets. |
| SYS117 | Both | T | The solution shall be able to create BMC Remedy incident tickets. |
| SYS118 | Both | T | The solution shall assign BMC Remedy incident tickets to a queue. The routing may happen natively in Remedy or via SCORCH. |
| SYS119 | Both | T | The solution shall integrate with Microsoft System Center Configuration Manager (SCCM) to query SCCM on endpoint status |
| SYS120 | Both | T | The solution shall query SCCM on endpoint agent status. |
| SYS121 | Both | T | The solution shall query SCCM on mandatory packages (pending not scheduled or actively pushing) for the endpoint. |
| SYS122 | Both | T | The solution shall query SCCM on failed package pushes for the endpoint. |
| SYS123 | Both | T | The solution shall take action based on SCCM status. Actions requiring manual intervention by the SCCM administrator will be initiated by BMC Remedy incident ticket creation. |
| SYS124 | Both | T | The solution shall be capable of quarantining systems during remediation is a potential secondary action based on SCCM status. |
| SYS125 | Both | T | The solution shall integrate with Assured Compliance Assessment Solution (ACAS) to query ACAS on endpoint status by hostname. |
| SYS126 | Both | T | The solution shall query ACAS on last scan date for the endpoint. |
| SYS127 | Both | T | The solution shall take action based on ACAS scan status. Actions requiring manual intervention by the ACAS administrators will be initiated by BMC Remedy incident ticket creation. |
| SYS128 | Both | T | The solution shall be capable of quarantining systems during remediation is a potential secondary action based on ACAS status. |
| SYS129 | Both | T | The solution shall interface with McAfee Nitro SIEM for event logging. |
| SYS130 | Both | T | The NAC appliance shall transfer event logs on actions taken as part of the solution (e.g. quarantined user, ticket creation, disabled interface) to McAfee Nitro SIEM. |
| SYS131 | Both | T | The NAC management appliance shall transfer event logs on administrative actions taken to McAfee Nitro SIEM. |
| SYS132 | Both | T | The NAC management appliance shall transfer security event logs to McAfee Nitro SIEM. |
| Active Directory Integration | |||
| SYS133 | Both | T | The solution shall integrate with Active Directory to query AD on object attributes. |
| SYS134 | Both | T | The solution shall customize queries for information on Active Directory object attributes. |
| Open Integrations | |||
| SYS135 | Both | T | The NAC appliance shall be capable of open Web Post integrations to third party solutions |
| SYS136 | Both | T | The NAC appliance shall be capable of integrating with third party applications through APIs. |
| SYS137 | Both | T | The NAC appliance shall be capable of integrating with third party solutions through Web Services |
| SYS138 | Both | T | The NAC appliance shall be capable of integrating with third party solutions using a bi-directional SQL interface. |
| General | |||
| SYS139 | Both | T | The NAC appliance shall be capable of integrating with Infoblox appliances (MCEN DDI management) solution to query for IP address information. |
| SYS140 | Both | T | The NAC appliance shall be capable of integrating with Infoblox appliances (MCEN DDI management) solution to query for DNS attribute information. |
| SYS141 | Both | T | The solution shall take action based on configurable thresholds for integrated capabilities |
| SYS142 | Both | T | The NAC appliance shall be capable of integrating with third party solutions to query for presence of third party end point agents. |
| SYS143 | Both | T | The NAC appliance shall be capable of integrating with third party solutions to take action based on status of third party end point agents, |
| Endpoint Interrogation Requirements | |||
| SYS144 | Both | T | The solution shall detect unauthorized devices attempting to connect to the MCEN. |
| SYS145 | Both | T | The solution shall block unauthorized devices from connecting to the MCEN. |
| SYS146 | Both | T | The solution shall create a BMC Remedy incident ticket for investigating detected unauthorized devices. |
| SYS147 | Both | T | The NAC appliance shall be capable of detecting processes running on an endpoint. |
| SYS148 | Both | T | The NAC appliance shall be capable of detecting registry settings on an endpoint |
| SYS149 | Both | T | The NAC appliance shall be capable of executing custom scripts on the NAC solution. |
| Endpoint Remediation Requirements | |||
| Threat Protection Requirements | |||
| SYS150 | Both | T | Where network infrastructure monitoring protocols (e.g. NetFlow, SPAN, etc.) are employed, the NACCR solution shall use those instances to discover malicious events. |
| SYS151 | Both | T | The NACCR solution shall take action based on identification of malicious events by sending the information to McAfee Nitro SIEM for analyst action. |
| Network Response Requirements | |||
| SYS152 | Both | T | The NACCR solution shall assign VLANs to managed interfaces via SNMP set commands. |
| SYS153 | Both | T | The NACCR solution shall disable managed interfaces via SNMP set commands. |
| SYS154 | Both | T | The NAC appliance shall be capable of blocking unauthorized traffic with TCP reset commands. |
| SYS155 | Both | T | The NAC appliance shall be capable of applying a Port-based ACL. |
| SYS156 | Both | T | The NACCR solution shall notify user of quarantine status and access restrictions. This can occur using hypertext transfer protocol (HTTP) redirection or pop up alerts. |
| SYS157 | Both | T | The NAC appliance shall be capable of Domain Name System (DNS) Redirection |
| SYS158 | Both | T | The NAC appliance shall be able to enforce policy on assets regardless of connection medium. |
| Virtual Network Integrations | |||
| SYS159 | Both | T | The NAC appliance shall be able to integrate with VMware ESXi for ingesting endpoint information. |
| SYS160 | Both | T | The NAC appliance shall be able to set VLAN assignments on virtual switches in the same manner as physical switch VLAN assignments on access switch ports. |
| Guest Registration Requirements | |||
| SYS161 | Both | T | The NAC appliance shall be able to register guest devices via a network connection. |
| SYS162 | Both | T | The NAC appliance shall be able to authenticate users via Active Directory without requiring 802.1x or inline appliance placement for guest devices. |
| SYS163 | Both | T | The web interface for NAC management shall support manual approval of guest end point access on the network. |
| SYS164 | Both | T | The web interface for NAC management shall support manual approval of guest end point access on the network. |
| 802.1X Requirements | |||
| SYS165 | Both | T | The NAC appliance shall have the capability to serve as a proxy for MCEN RADIUS servers for 802.1x authentication. |
| SYS166 | Both | T | The NACCR solution shall include management needed to administer 802.1x for the enterprise. |
| SYS167 | Both | T | The NACCR solution shall cover all user enclaves on the MCEN-N and MCEN-S. |
| SYS168 | Both | T | The NACCR solution shall include MAC address locking on managed interfaces where 802.1x is not supported. |
| SYS169 | Both | T | 802.1x exceptions shall be documented in the NACCR solution design. |
| SYS170 | Both | T | The NACCR solution shall identify appropriate VLAN assignments for non-EUD authorized endpoints. |
| SYS171 | Both | T | The NACCR solution shall include non-EUD VLANs. |
| SYS172 | Both | T | The NACCR solution shall include network access controls for non-EUD VLANs. |
| SYS173 | Both | T | The NACCR solution shall assign non-EUD authorized endpoints to the appropriate VLAN. |
| Security Requirements | |||
| SYS174 | Both | T | The NAC appliance shall be on the National Information Assurance Partnership (NIAP) Product Compliant List (PCL) as certified for Protection Profile: Enterprise Security Management for the appropriate control. |
| SYS175 | Both | T | The NAC management appliance shall be on the National Information Assurance Partnership (NIAP) Product Compliant List (PCL) as certified for Protection Profile: Enterprise Security Management for the appropriate control. |
| SYS176 | Both | T | The NACCR solution shall comply with applicable STIGs, security configuration guides, and SRGs with any exceptions documented and approved by the AO. |
| SYS177 | Both | T | NACCR solution cryptographic modules shall be FIPS 140-2 validated. |
| SYS178 | Both | T | The NAC appliance DISA UC-APL. |
| SYS179 | Both | T | The NAC management appliance shall be on the DISA UC-APL. |
| SYS180 | Both | T | The NAC platform shall be on the DISA UC-APL. |
| SYS181 | Both | T | A previous version of the solution software is on the DISA UC-APL and the current version of that same product line is currently under evaluation for the DISA UC-APL. Software product lines that have never been on the DISA UC-APL do not meet this specification. |
| SYS182 | Both | O | The NACCR solution software shall be on the DISA UC-APL. |
| Onsite Support | |||
| SYS183 | Both | T | The vendor shall provide NAC product vendor professional services to serve as NACCR Subject Matter Expertise (SME). These are product vendor consultants, not third party integrators. |
| SYS184 | Both | T | The vendor shall provide dedicated onsite NACCR Subject Matter Expertise (SME) to perform technical oversight during deployment preparation of each instance. |
| SYS185 | Both | T | The vendor shall provide dedicated onsite NACCR Subject Matter Expertise (SME) to perform technical oversight during deployment of each instance. |
| SYS186 | Both | T | The vendor shall provide dedicated onsite NACCR Subject Matter Expertise (SME) to conduct technical activities as part of enterprise operations. |
| SYS187 | Both | T | The vendor shall provide dedicated onsite NACCR Subject Matter Expertise (SME) to perform engineering activities as part of program sustainment. |
| SYS188 | Both | T | Vendor NACCR SME shall be IASAE Level II certified |
| SYS189 | Both | T | Vendor NACCR SME shall be cleared IAW site requirements |
| Training | |||
| SYS190 | Both | T | The vendor shall provide onsite classroom training for administrators. |
| SYS191 | Both | T | The vendor shall provide onsite classroom training for users. |
| Installation | |||
| SYS192 | Both | T | All data center equipment shall include rails, brackets, and shelves to install devices into EIA-RS310D standard 19” width rackmount. |
| SYS193 | Both | T | Each device shall accept 110-220VAC power input. Solution equipment shall use 110V or 208V redundant conditioned power from the facility. |
| SYS194 | Both | T | The vendor shall provide environmental specifications for all equipment. |
| SYS195 | Both | T | The vendor shall provide metrics on network demand for each interfacing component. |
| SYS196 | Both | T | The vendor shall provide detailed product performance specifications for all equipment. This includes metrics for sizing, interfacing thresholds, processing and storage capacity, and how they relate to the managed network and interfacing systems. |
| SYS197 | Both | T | The vendor shall provide recommendations to optimize implementation based on industry best practices and lessons learned. |
| SYS198 | Both | T | The vendor shall provide system metrics to support implementation of required capabilities. |
| SYS199 | Both | T | The vendor shall provide interface requirements for integrated systems. For example, if an agent is needed on the EPO database server, the details on that agent, access, etc. shall be defined by the vendor. |
&"Calibri,Regular"&K000000United States Marine Corps &"Calibri,Regular"&K000000Page &P of &N &"Calibri,Regular"&K000000FOUO
File details come from the government source that posted it. Updated .