Connections 2 Hosting Center - Procurement Integrity_v3.doc

Ensuring Procurement Integrity within the Connections II Hosting Center

Background

The Connections II Hosting Center (a system within the Network Services Program Hosting Center (NHC)) provides electronic access through a secure internet website to information that must be accessed as part of the Connections II solicitation. Figure 1 describes the flow between the Vendors, the system, and the evaluation team.

Figure 1. Accessing the Hosting Center through the Web. Offerors (purple) and government buyers (blue) need only a desktop computer to access a hosted site.

Certification and Accreditation The Connections II Hosting Center (HC) is enclosed in a secure environment and has been granted an Authority to Operate (ATO) by GSA at the FIPS 199 Moderate Level. The Current System Owner is Ed O’Hare (Assistant Commissioner for Integrated Technology Services). The Authority to Operate was granted in August, 2008 by the FAS Chief Information Officer of the time (Ed O’Hare).

Ensuring Protection of Vendor Data from other Vendors

Vendors access the Connections II HC through machine to machine VPNs over the internet, using Public Key Infrastructure (PKI) certificates. In addition, users must enter usernames and passwords to gain access to the system. Based on the IPSec key pair, the Connections II HC routes each Vendor’s connection to the correct web server/pricer/database. Figure 2 below provides details on how the proposal data flows between the virtual servers.

Figure 2. How the VPN array works. Each offeror is separated into its own fully encrypted and mutually authenticated VPN. Downloading and uploading are accomplished through the VPN and only the offeror associated with a VPN can review and run its reports.

Ensuring Vendor Data is Secured by Noblis Personnel

Noblis personnel acting as System administrators for the Connections II HC will have access to the data submitted by each of the Vendors. However, just like any other evaluator of the vendors’ proposals, the Noblis contractors must sign all related non-disclosure agreements and conflict of interest forms. Noblis personnel will also participate in the required security training associated with the Connections II acquisition.

Access to the Connections II HC facility is only allowed by badge reader access. Only individuals having the appropriate roles (assigned by the ISSO) will be allowed into the room.