FCSA RFP Sec J_sb.pdf

QTA-010-CTA-0010

SECTION J

List of Documents, Exhibits, and Other Attachments

J.1 LIST OF ATTACHMENTS

ATTACHMENT J-1 – Acronyms and Abbreviations

ATTACHMENT J-2 – FCSA Hosting Center Access Instructions

ATTACHMENT J-3 – FCSA Hosting Center Application

ATTACHMENT J-4 – Agreement to Restrict Access to Sensitive Government Information

ATTACHMENT J-5 – List of IP Addresses and Certificates

ATTACHMENT J-6 – List of Designated Vendor Users for FCSA Hosting Center

ATTACHMENT J-7 – Information Assurance Minimum Security Controls Checklist

ATTACHMENT J-8 – Security Controls for Information Systems

ATTACHMENT J-1

ACRONYMS AND ABBREVIATIONS

ASD/NII Assistant Secretary of Defense, Network &Information Integration CBA Cost Benefit Analysis CLIN Contract Line Item Number CO Contracting Officer CNSSP-12 Committee on National Security Systems Policy 12 COMSATCOM Commercial Satellite Communications DISA Defense Information Systems Agency DISN Defense Information Systems Network DoD Department of Defense DSTS-G DISN Satellite Transmission Services-Global EMI Electromagnetic Interference FAR Federal Acquisition Regulation FAS Federal Acquisition Service FedBizOps Federal Business Opportunities FCSA Future COMSATCOM Services Acquisition FIPS Federal Information Processing Standards FISMA Federal Information Security Management Act FOIA Freedom of Information Act GSA General Services Administration HNA Host Nation Agreements IAW In Accordance With ID/IQ Indefinite Delivery/Indefinite Quantity IGCE Independent Government Cost Estimates IT Information Technology NC FCB Net Centric Functional Capabilities Board NIST National Institute of Standards and Technology OCO Ordering Contracting Officer OPSEC Operations Security OSD Office of the Secretary of Defense PCO Procuring Contracting Officer PoP Period of Performance PM Program Manager PMO Program Management Office PWS Performance Work Statements RFI Radio Frequency Interference RFQ Request for Quote RFP Request for Proposal SAT Ops Satellite Operations SATCOM Satellite Communications SME Subject Matter Expert SIN Special Item Number SP Special Publication

SSA Source Selection Authority SSAC Source Selection Advisory Council SSD Source Selection Decision SSEB Source Selection Evaluation Board SSP Source Selection Plan STO Sample Task Order TT&C Telemetry, Tracking, and Commanding

(END OF ATTACHMENT J-1)

ATTACHMENT J-2

FCSA HOSTING CENTER ACCESS INSTRUCTIONS

FCSA Hosting Center

Access Instructions

February, 2010

Executive Summary

The FCSA Hosting Center provides electronic access through a secure internet website to information that must be accessed as part of the FCSA solicitation. The FCSA Hosting Center has been established as a secure environment for the electronic submission and storage of proposals and contract information. The FCSA vendor proposals will be submitted to the FCSA Hosting Center. This document provides instructions to the user in how to set up the IPSEC VPN connection and access the FCSA Hosting Center.

General Instructions

This instruction set is intended to aid the average computer user to configure an IPSEC VPN connection between his/her Microsoft Windows computer and the remote provider. It is recommended that the instructions be read in their entirety prior to beginning an implementation.

The process requires no specialized knowledge but is detailed and tedious, making mistakes quite possible so please read carefully. For ease of use, all certificate-related files should be stored in a common folder, C:\Certs.

Note: Users should create this folder (‘C:\Certs’) on their computer prior to starting the process of configuring the VPN connection.

The first section of this document provides instructions on purchasing a signed certificate from a trusted Certificate Authority. The second section provides instructions generating a private key and Certificate Signing Request (CSR). This CSR will be used in the third section to obtain a signed certificate from a trusted Certificate Authority. The private key is unique to the user and should be properly protected. An easy-to-use open source application can be used to generate these files (a link is provided), although the certutil.exe from Microsoft Corporation could also be used. The user should utilize whatever tool he is most comfortable with.

The third section requires the user to interact with an ACES Certificate Authority (CA), through the CA’s website. The user will submit the CSR to the CA and the CA will then return the signed certificate to the user. The signed certificate will allow the user to connect to the FCSA Hosting Center while ensuring the identity of the user. The issuance of a signed certificate is a process where trust is important, so the CA is charged with due diligence in verifying the users identity; it may take several days before the user receives the signed certificate.

Once the signed certificate is received, the user is instructed in section 4 on how to submit the application forms with this signed certificate to the General Services Administration (GSA). Next, the user receives a FCSA Hosting Center CD with the VPN Helper utility and other files and must follow the instructions in section 5 to setup the VPN. The document, “FCSA Hosting Center User Instructions.doc,” which contains detailed instructions for using the FCSA Hosting Center, will also be provided on this CD. Lastly, the user tests to ensure they have proper connectivity to the FCSA Hosting Center.

Once the IPSEC settings are in place the user can verify connectivity by connecting to the remote server via a web browser. This verifies the connection is working.

Prerequisites

The following instructions were developed on Windows XP Service Pack 3, although they should be applicable to most modern versions of Microsoft Windows including Windows XP

SP2.

Browser requirements:

Internet Explore 7.0 or Firefox 3.0 at a minimum

Step 1. Purchase a Signed Certificate from a Vendor.

The user must purchase a signed certificate from either Identrust or ORC. To purchase a VPN IPSEC certificate from Identrust, go to the following URL to start the process:

http://www.identrust.com/certificates/index.html

Click on the BUY button for the VPN IPSEC Client, and follow the Identrust instructions.

To purchase a certificate from ORC, go to the following URL to start the process:

http://aces.orc.com/busRepVPNOblig.html

In the case of buying a certificate from ORC, the CSR must be generated and included in the application process for ORC. In addition, the Hostname and IP Address of the machine establishing the VPN connection to the FCSA Hosting Center must be submitted. See your system administrator to obtain your hostname and IP Address. See Step 2 for generating a CSR.

Step 2. Creating a CSR and Private Key

Prior to requesting a signed certificate from a trusted Certificate Authority (CA) you will need to generate a private key and matching Certificate Signing Request (CSR). In order to do this, the user may use the open source application MyCert.

If MyCert is used to generate the CSR and Private Key, then the following steps must be followed:

1.Download the following 3 files and save them into the C:\Certs directory

a. www.nan.noblis.org/software/mycert.exe

b. www.nan.noblis.org/software/mycert.ini

c. www.nan.noblis.org/software/libeay32.zip http://aces.orc.com/busRepVPNOblig.html http://www.nan.noblis.org/software/mycert.exe http://www.nan.noblis.org/software/mycert.ini http://www.nan.noblis.org/software/libeay32.zip

2. Unzip or extract the file libeay32.dll from the zip file into the C:\Certs folder.

3. Double click on “mycert.exe”.

The following screen will appear:

Fill in the fields. Choose a pass phrase that you can remember, or else write it down in a safe place. Change the folder to C:\Certs, by clicking on the Change button. When all fields are completed, click the CREATE REQUEST button.

The application generates a private key for the users use (stored as a .key file in the C:\Certs folder) and the request (stored as a .req file in the C:\Certs folder). Additionally, the user must copy/paste the request information presented in the next dialog:

Save the text into a file called: certreq.txt in the C:\Certs directory.

Follow the chosen CA’s instructions for submitting the CSR, normally done via a web interface.

Step 3 provides the instructions for submitting the CSR. Use the certreq.txt file when submitting the CSR.

The user must have the private key available when they receive the signed certificate, as it is uniquely tied to the certificate they will receive. They must keep the private key secured to maintain the security of this mechanism. Do not transmit this key in an unsecured fashion (such as email or ftp). Additionally the user must have the pass phrase used to generate the key and request. Failure to retain these two items will make completion of this task impossible.

Step 3. Obtaining a Signed Certificate.

Identrust

Use a web browser to connect to the Identrust Certificate Authority website (https://secure.digsigtrust.com/tsapp/bus-start.jsp?AT=216&CT=530008) and follow a wizard-driven process to submit the users CSR. Once completed, it may take several days before the signed certificate is available to the user. In the meantime, the user will also need to download the CAs root certificate. This is normally available under the SUPPORT option of your CAs website, although some will also provide this as a portion of retrieving your signed certificate.

https://secure.digsigtrust.com/tsapp/bus-start.jsp?AT=216&CT=530008

Once the user has received their signed certificate they will have the components needed to authenticate to the IPSEC VPN.

Note the filename provided when the user saves the signed certificate (the example server.txt will be used in the following section). Please save all files (the signed certificate and all root CA certificates) to C:\Certs. Note, in Step 5, this file is called the Public Key.

ORC

For ORC please follow the detailed instructions on the following websites.

Instructions - http://aces.orc.com/instructions.html Aces IP Sec - http://aces.orc.com Help Desk - http://aces.orc.com/help.html

Step 4. Submitting Your Application Forms

There are 5 application forms indicated in the RFP that must be submitted to the GSA Procuring Contracting Officer.

1. Agreement to Restrict Access to certain FCSA Hosting Center Information

2. List of Designated Users

3. List of IP Addresses and Certificates

4. CD with copy of the certificate file(s) issued by ACES Certification Authority

5. Vendor Application

The CD containing the certificate file(s) must contain the certificate(s) obtained in Step 3, known as the Public Key.

The List of IP Addresses can be obtained as follows:

1) Obtain the Local IP Address of the machine that will be used to connect to the FCSA Hosting

Center.

a) Click the start button in the lower left corner of the screen.

b) Click “Run”.

c) Type “cmd” and then click “ok”.

d) When the new window opens up, type “ipconfig” at the command prompt.

e) Press enter.

f) The user will then see their Private IP Address. It will be different depending on the user’s location. Thus, this access can only be utilized by a single device at a single location. Use this IP Address when filling out the Private IP Address field on the form.

2) Obtain the Public Visible Static IP Address – should be obtainable from your IT department.

Note - This must be the “final” IP address sent by the server. Using the command : ping www.xxx.com does not give the correct IP.

http://aces.orc.com/instructions.html http://aces.orc.com/ http://aces.orc.com/help.html http://www.xxx.com/

Step 5. Using the VPN Helper Utility

Once the application forms have been received and accepted by the GSA Procuring Contracting Officer, a CD will be mailed to the user to complete the FCSA Hosting Center Access process.

The CD will contain the following files

1) Setup FCSA-VPN.bat (for running the VPN helper utility)

2) FCSA Hosting Center User Instructions.doc

3) psqlodbc.msi (an ODBC Driver)

4) readme.txt – which will contain

a) FCSA Hosting Center Help Desk Phone #

b) Vendor Number and PIN (to be used when calling the help desk)

c) Usernames and passwords based on the usernames supplied on the application form

d) IP address of the FCSA Hosting Center for web-browsing and ODBC access

When you receive the VPN Helper CD, insert the VPN Helper CD into the computer.

Double click on “Setup FCSA-VPN.bat”.

The 1st field titled “Public Key” should be pre-populated with the user’s public key.

On the second field titled “Private Key”, click on the box to the right and browse to the location (C:\Certs) where the key is stored.

Lastly, enter the user’s private key password. At this point the user clicks the box marked “Setup VPN”. The VPN Helper configures the computer and prompts the user to go to the FCSA Hosting Center.

Step 6. Completion and Testing

You will now have access to the FCSA Hosting Center website. You have successfully completed setting up your connection. For testing purposes, you can navigate to that IP address via a web browser. Enter the IP Address provided in the readme.txt file on the CD in your web-browser.

(END OF ATTACHMENT J-2)

ATTACHMENT J-3

FCSA HOSTING CENTER APPLICATION

t

Offeror Application

Contact Information for Prospective FCSA Prime Offeror

From:

Company Name (Prospective Prime Offeror)

Subject: Offeror Application for Access to the FCSA Hosting Center

To: GSA Procuring Contracting Officer

The prospective prime offeror submits its completed application package that consists of the following documents:

1. Agreement to Restrict Access to Sensi is ive Government Information

2. List of Designated Users

3. List of IP Addresses and Certificates

4. CD with copy of the certificate file(s) sued by ACES Certification Authority.

5. Offeror Application (this form)

The prospective prime offeror designates the following individual as its point of contact for all matters relating to offeror's application for access to the FCSA Hosting Center and requests the FCSA Hosting Center Access CD be delivered thereto:

Printed Name (Point of Contact) Title

Address Phone

Email Address

Si g nature Date

Attachment Offeror Application.pdf February, 2010

(END OF ATTACHMENT J-3)

ATTACHMENT J-4

Agreement to Restrict Access to Sensitive Government Information

Agreement between GSA and Prospective FCSA Prime Offerors

This Agreement is required to protect sensitive Government information that is provided to prospective FCSA offerors for proposal preparation purposes. Sensitive Government information may be accessed on the FCSA Hosting Center, downloaded, and distributed for use by the proposal team. This information must be protected in accordance with the below procedures.

In order to be granted access to the FCSA Hosting Center, this agreement must be signed by a company representative with authority to contractually obligate the company and delivered to the FCSA Contracting Officer.

By signature of the company officer/agent below, the prospective offeror agrees to the following conditions:

1. That sensitive Government information which can be downloaded from the hosting center shall be provided the same safeguards as the company's own proprietary data during proposal preparation and destroyed if not awarded a contract.

2. The prospective offeror will restrict access to members of the proposal team on a "need to know" basis.

Printed Name (Point of Contact) Title

Date

Company Name (Prospective Prime Offeror)

Signature

Attachment Agreement to Restrict Access.pdf February, 2010

(END OF ATTACHMENT J-4)

ATTACHMENT J-5

LIST OF IP ADDRESSES AND CERTIFICATES

From: __________________________________________________________________ (Prospective Prime Offeror)

Subject: Providing List of IP Addresses and Certificates

To: GSA Procuring Contracting Officer

List of IP Addresses and Certificates1:

Public Visible Static IP Address

Private IP Address2 File Name of Certificate3

Primary Backup 1 The Government requires that the Offeror provide the IP address for a Primary computer to access the FCSA Hosting Center. Designation of a backup computer is optional but recommended.

2 This is only if your company is performing Network Address Translation (NAT), and should be left blank if no Translation is being performed.

3 This should be the name of the file containing the Public Certificate and should either be a .CER or .CRT file extension.

Submitted by the undersigned on behalf of the prospective Prime Offeror.

Printed Name (Manager) Title

Signature Date

Offeror

(END OF ATTACHMENT J-5)

ATTACHMENT J-6

LIST OF DESIGNATED VENDOR USERS FOR FCSA HOSTING CENTER

From: __________________________________________________________________ Company Name (Prospective Prime Offeror)

Subject: Request Passwords to Access Networx Hosting Center

To: GSA Procuring Contracting Officer

Request that passwords be assigned to the following designated users1:

Name (Lname, Fname MI) Requested USER-ID2 1.

2.

3.

4 The Government requests that Offeror minimize the number of individuals designated for access to the FCSA Hosting Center. Further, the Government recommends that Offeror designate a single user to perform all FCSA Hosting Center user functions. However, the number of designated uses is at the discretion of the prospective Prime Offeror.

5 USER-IDs must contain a minimum of 8 alpha-numeric characters Submitted by the undersigned on behalf of the prospective Prime Offeror.

Printed Name (Manager) Title

Signature Date

Offeror

(END OF ATTACHMENT J-6)

ATTACHMENT J-7

INFORMATION ASSURANCE MINIMUM SECURITY CONTROLS CHECKLIST

IA Compliance Checklist.doc

(END OF ATTACHMENT J-7)

ATTACHMENT J-8

SECURITY CONTROLS FOR INFORMATION SYSTEMS

Security Controls for Information Systems.

(END OF ATTACHMENT J-8)

SECTION J