RFQ0016671_FBI_STACH_RFQ.pdf

U.S. Department of Justice Federal Bureau of Investigation (FBI) Director’s Office (DO) Office of Public Affairs (OPA)

FBI Education Center Scheduling, Tracking, Appointment & Calendar Hub (STACH)

Request for Quotation (RFQ)

RFQ0016671

January 4, 2016

FBI STACH PROCUREMENT SENSITIVE

1.0 GENERAL BACKGROUND

The Federal Bureau of Investigation (FBI) Director’s Office (DO) Officer of Public Affairs (OPA) Executive Staff and Education Center is responsible for providing the recently reinstituted J. Edgar Hoover Building tour. OPA is responsible for scheduling tours, accommodating reservation requests and facilitating the security checks of potential tour guests. Processes currently in place are not ideal for handling the current amount of requests nor the expected increase. This has prompted the government requirement to seek a scalable subscription-based cloud solution for the purpose of effectively scheduling tours, accommodating reservation requests, and facilitating security checks of potential tour guests.

For clarity, the following terms are defined below and will be used in the SOW.

Cross Domain Solution (CDS) – All components within the accreditation boundary of the Cross Domain Solution.

Cloud, Cloud Service Provider, or CSP – Refers to the cloud vendor capability.

Contractor – Refers to the integrator who will configure the cloud interface and develop and manage

STACH-VIC.

Distributed Application Virtual Environment (DAVE) – The FBI’s enterprise virtualized application hosting environment at the collateral secret level, on FBINET.

FBI Educational Center Scheduling, Tracking, Appointment, & Calendar Hub (STACH) – the name of the final project and final system name of the collective capability of both the Cloud and STACH-VIC, required by this SOW.

FBINET – The FBI’s enterprise collateral secret network, which can browse down to UNET via cross-domain services. May also be referred to as the FBI Secret Enclave, FBISE, or BUNET.

FBINET STACH Visitor Information Capability (STACH-VIC) – a content distribution capability to be built on FBINET and used to make visitor PII available on FBINET for security checks.

UNET – the FBI’s enterprise unclassified network, which has access to the Internet.

2.0 SCOPE

The Office of Public Affairs is seeking to acquire Customer Relationship Management (CRM) Software as a Service (SaaS) cloud services with a mobile application capability; and contractor integration services to configure and maintain the cloud environment subscribed to by the FBI, as well as develop and maintain a content distribution capability on FBINET. The cloud is needed to effectively schedule tours, accommodate reservation requests, and facilitate security checks of potential tour guests for the FBI Tour. The content distribution capability is needed to support the security checks, which currently occur using systems based on FBINET.

The goal is for the FBI to augment its ability to manage FBI visitor requests by subscribing to a commercially available CRM-based cloud Software as a Services (SaaS) with the ability to scale both up and down the level of services and performance required depending on demand and budget.

2.1 Competition

2.1 CONTRACT/CLIN STRUCTURE

This effort is a Small Business Set-Aside via GSA IT Schedule 70 Request for Quotation (RFQ) in accordance with and FAR 8.405.

This Contract shall contain five Contract Line Item Numbers (CLINS).

CLIN 0001 – Cloud SaaS Subscription - Customer Relationship Management - Firm Fixed Price (FFP) Annual cost for cloud service licenses based on an annually combined monthly cloud subscription rates.

CLIN 0002 – Cloud SaaS Subscription Support - Customer Relationship Management - Firm Fixed Price (FFP) Annual cost for cloud services support based on an annually combined monthly cloud subscription rates. Support provided by the Cloud Service Provider.

CLIN 0003 – Development – Firm Fixed Price (FFP) for services required to perform cloud SaaS configuration, customization, maintenance, and to develop STACH-VIC.

CLIN 0004 – Operations and Maintenance – Time and Materials (T&M) for services required to maintain STACH- VIC and Cloud interface.

CLIN 0005 – (Optional) Configure machine to machine communication between STACH-VIC and a FBI security check system on FBINET.

3.0 DESCRIPTION OF WORK

3.1 STACH Overview

The FBI’s intent is to subscribe to a FedRAMP Compliant1 Customer Relationship Management (CRM) Software as a Service (SaaS) cloud service, accessible through both a web browser and the cloud’s mobile application, and acquire integration services to configure and maintain the cloud environment subscribed to by the FBI. In addition, the FBI requires the development and maintenance of a content distribution capability on FBINET (STACH-VIC) to make the visitor PII available for security checks. The solution is needed to effectively schedule tours, accommodate reservation requests, and facilitate security checks of potential tour guests for the J. Edgar Hoover Building tour. The security check process involves resources only present on FBINET, hence the requirement for STACH-VIC. An analysis of alternatives demonstrated the SaaS approach represents the most cost effective and taxpayer-accountable approach when compared to developing an in-house or cloud hosted COTS or GOTS solution. Furthermore, leveraging an established cloud provider, whose core competency is CRM, minimizes the learning curve and time to production, further reducing costs.

STACH-VIC will be hosted on DAVE, the FBI’s enterprise virtualized application hosting environment on FBINET.

The OPA will and the Contractor shall work with the FBI’s Information and Technology Branch (ITB) to coordinate any ITB information technology services required to support the Contractor’s technical development effort, testing, and production.

For clarification, the following sections are divided into “Cloud” and “STACH-VIC” to indicate whether the action is taking place in the cloud solution or on the FBINET-based content distribution capability. The term “Cloud Service Provider,” “CSP,” or “Cloud” will be used to refer to the cloud SaaS vendor and “Contractor” will refer to the integrator vendor.

1 FedRAMP Compliant Systems. http://www.fedramp.gov/marketplace/compliant-systems/

The Contractor shall act as the integrator to provide cloud configuration and periodic changes (see Section 3.2).

The Contractor shall also develop and maintain an unclassified web application, STACH-VIC on FBINET (see Section 3.3).

3.2 Cloud

The Cloud, whose core business is providing customer relationship management cloud SaaS, shall be authorized by a Joint Authorization Board (JAB) or U.S. Federal Government Agency as FedRAMP Compliant2, authorized to operate at the “FedRAMP Moderate” level at the time of submitting to this proposal. The cloud vendor shall provide customer relationship management capabilities accessible both by an Internet browser and a cloud vendor developed and managed mobile application, as well as cloud vendor developed and managed data application programming interface (API) permitting machine to machine communication.

FBI personnel will manage J. Edgar Hoover Building tour schedules on the Cloud, requests for which will always originate from a Congressional office. Congressional staff shall be able to browse tour schedules and provide names and information3, including personally identifiable information (PII), of U.S. citizens interested in a tour.

Congressional staffers shall be able to log into the site to view the status of submitted visitor requests originating from their office.

The names and information collected on the Cloud website shall be transferred to STACH-VIC on FBINET, where it will be made available in several formats for internal consumption on FBINET by both authorized FBI personnel and computers.

Once the security check has been completed, authorized FBI personnel will log into the Cloud website and update the status of the visitor request to “Approved” or “Denied.” Congressional staffers shall be notified by an automated email originating from the Cloud when status updates and tour schedules are available.

Authorized FBI personnel shall be able to use their FBI-issued Smartphone to access the Cloud website or a Cloud mobile application to view the tour schedule for the day and the names of the visitors who were submitted for the tour. This list will include both those approved and denied access to help ensure the safety and security of the tour.

Authorized FBI personnel will review statistics on tour attendance based on non-attributable metadata in the Cloud, which will be used to enhance tour awareness to Congressional offices with the goal of increasing attendance.

3.2.1 Cloud Functions

The Cloud website shall provide CRM functions. The CRM functions and visible data fields shall be controllable using roll-based access controls. The CRM functions shall include tour scheduling/calendaring, data entry forms for visitor requests, the ability match visitors with scheduled tours, aggregate visitor data for security check processing, provide non-attributable data for tour attendance analysis, and provide CRM tools for informing congressional staffers.

The CRM shall permit authorized users requesting tours on behalf of visitors to have the ability to view scheduled tours, input visitor requests for specific tours, input visitor PII required for a security check, and view the status of the requests. PII entered shall be masked immediately upon completion of each field, and shall only be verifiable upon clicking on the field during the initial session. During subsequent sessions, any corrections to a visitor request, such as the need to correct an address or other information, shall require re-entry of the information in

2 FedRAMP Compliant Systems. http://www.fedramp.gov/marketplace/compliant-systems/ 3 See Section 3.12: Data Elements the relevant field. Each visitor entry shall have a drop down menu titled “Status,” which shall indicate one of five possible states of the security check: “Approved,” “Denied,” “In Process,” “Not Submitted,” or “Canceled.” The default status shall be set to “Not Submitted,” which shall automatically change to “Submitted” when the form is submitted. Select fields shall permit data validation as per Section 3.12. The Cloud shall provide authorized FBI users with the ability to update a visitor request for a tour with the status of their request (approved/denied), and automatically notify the Congressional staffer, as well as the potential visitor, via email. Once the visitor information is entered, the Congressional staffer will submit the data using a button or similar function which shall mark the visitor data as “Submitted.” Submitted data shall be provided to STACH-VIC when called for via an XML “read” request (detailed in Section 3.3). Congressional staffers shall have the ability to cancel a visitor request, which would either delete the visitor from the collection if accomplished before the read request, or mark the visitor as “Canceled” if the read request process has already taken place. Once the security check has been performed, authorized FBI users shall be able to access the Cloud website, find the visitor either using a list or by search, and change the status field to either “Approved” or “Denied,” unless the status field has been set to “Canceled,” in which case the FBI user will take no additional action. Authorized FBI OPA personnel shall be able to access the tour calendars on their FBI issued mobile devices, selecting the tour and listing the visitors scheduled for the tour. They shall also be able to indicate whether the visitor attended the tour or not.

The CRM shall permit authorized users to create, organize and assign tour dates, tour resources (tour guides, security staff) to tour events. Authorized FBI users shall have the ability to manage tour schedules, determine, manage, and indicate tour capacity, and view names of visitors and the tours to which they are matched. It shall also permit filtering by user selected categories and permit different views of the calendar, such as event lists, and views by month, week, and day to ensure pertinent information linked to the event will be readily visible.

The CRM shall have the ability to display scheduled tours in a calendar view, to include the ability to display tours by month, week, and day as well as in a list format. The week and day views should display tours in a visual format that conveys the duration and block of time, allowing for multiple tours to be scheduled and displayed side-by-side. The list view should include columns which display available slots, slots filled, waitlist, and notes.

The calendar shall permit authorized Congressional Staffers and authorized FBI users the ability to view scheduled visitors by tour date; however, Congressional staffers shall only be able to view visitors originating from their office. Cancellation of a tour date by an authorized user shall automatically generate emails from the Cloud to Congressional staff and the visitor(s), informing them of the cancellation and requesting potential visitors contact their Congressional staffer to reschedule, which should be accomplished on the site. There shall be a method of temporarily reserving a slot during the visitor data entry process to avoid contention among Congressional offices for available slots.

Authorized personnel should be able to see what visitors would be affected by a cancellation before such action is taken, and a list of visitors affected should the action be taken. The calendar function shall send a notification to Congressional staff and the visitor a week before the tour with a reminder and information on how to cancel if the visitor does not want to attend. The notification shall provide a link that would allow the Congressional staffer to cancel by clicking on the link. The scheduling function shall provide a link or means for Congressional staffers to assign waitlisted visitors to tour slots which become available. The Cloud shall provide mobile optimized access to permit authorized FBI users to view scheduled tours and both visitors approved and denied for specific tours. The mobile capability should be conducive to listing users for a particular tour and providing the capability to confirm attendance on the mobile device, which in turn would be captured by the Cloud. To support records management requirements, all email notifications generated by the Cloud shall also blind copy a UNET email address to be provided by the FBI.

The CRM shall provide on-line reporting capability/portal that shall allow authorized users to see the status of usage and costs updated on a daily basis. Metadata on visitor non-attributable data, such as number of visitors per tour, shall be viewable via reports accessible on the Cloud website. The CRM shall provide the ability to customize reports by selecting appropriate fields, metadata and reports such as, but not limited to, the number of attendees by geographical demographics, number of attendees for a given time period, number of tours based on type of tour, number of tours given by a specific tour guide, and number of requested tours from a specified congressional office. Reports shall show information for defined time periods such as number of tours booked, attendance rates and a breakdown of the types of tours that have occurred. Additional dashboard/reporting capability is preferred if available. Reports shall also detail tour data (such as number of requests or visitors) by Congressional office. It is preferred that the dashboard have the capability for users to customize reports and the dashboard view. The report data shall be downloadable in CSV or XLSX format.

The CRM shall provide authorized FBI users with the ability to use the information described in the previous section to generate emails to specific Congressional offices to increase tour awareness along with available tour dates.

The CRM shall have the capability of controlling access to data fields, records, attributes, and functionality through the use of user roles.

3.2.2 Understanding user roles for Cloud Licensing

The FBI OPA is the “owner” and “provider” of the FBI tour service, and represents the power user base for the Cloud capability. The Congressional staffers are acting on behalf of the FBI OPA as “resellers” of the FBI tours.

The visitors are the ultimate customers. Unlike a commercial sales tour organization, the customers will only be contacted via email to be notified of their approval or denial for a tour, tour reminders prior to a tour, and a link to a brief survey after the tour. The survey will be hosted on an alternate website and is outside the scope of this requirement. All tour requests shall originate from a Congressional office, and those offices will use their own means to initiate customer interest. The customers and their data shall not exist perpetually in the Cloud solution, but non-attributable data along with attributable data solely centered on which Congressional office the visitor originated, will be retained for forecasting tour demand and potential awareness campaigns directed toward the Congressional offices. The OPA will be the only consumer of the analytics. The potential awareness campaigns to the Congressional offices are optional, and should be priced as such unless included in the base license.

The other authorized FBI personnel with access to the Cloud are supporting OPA in an ancillary role; the security personnel will only be updating a single custom field within the Cloud to indicate whether the visitor (customer) is approved or denied for a tour. Neither the security personnel nor other FBI personnel will need access to any other capabilities in this cloud solution.

3.2.3 Cloud Orchestration

The process of collecting the data and administrative cleanup actions in the cloud shall be orchestrated from STACH-VIC on FBINET, using XML SOAP or REST, on a scheduled basis. Dependencies and constraints include the use of XML SOAP or REST encrypted at the transport layer using HTTPS to facilitate two-way data communication between the vendor cloud and STACH-VIC, the use of the FBI’s existing CDS for XML-based cross-domain communication and data transfer, and use of the FBI’s enterprise virtualized application hosting environment (DAVE) on FBINET, to host STACH-VIC. Neither the CSP nor the integrator will be involved in the security check process. The CDS process is detailed further in Section 3.5 and Attachment 1.

3.2.4 Cloud Data Storage, Recoverability, and Deletion

Visitor names, information, and PII shall be encrypted at rest and in motion. As a part of the normal routine, cloud data shall be marked for deletion immediately upon XML “DELETE” request originating from STACH-VIC (see Section 3.3). Users directly accessing the website should not have access to the data marked for deletion, and only the master account should have access to restore the data should the need arise. To minimize the amount of PII on the cloud at any given time, the FBI prefers any data marked for deletion also be permanently deleted (not recoverable) from production and the backup media immediately.

The Contractor shall describe the cloud deletion process and indicate if an immediate deletion is possible. Also, please describe the backup methodology (incremental, full back-ups, timelines, etc.), and if a snapshot-like process is utilized.

The vendor shall provide a Wide Area Network (WAN), with a minimum of two data center facilities at two different geographic locations with at least two Internet Exchange Point (IXP) for each price offering.

3.2.5 Cloud Data Ownership

All data in the cloud entered by users of the service is and shall remain the property of the FBI at all times, even if the contract is nullified or expires. The cloud provider shall guarantee that if the contract ends, the cloud provider shall provide the FBI access to migrate the data for 90 days and shall destroy FBI owned-data at no additional cost and in a manner verifiable by the FBI and compliant with FedRAMP and federal records management requirements. Metadata or metrics collected by the cloud provider may not be shared with third parties. This includes cookies set during browsing sessions, IP address ranges, domain names, or any other identifiable or non-attributable data. The said metadata may only be used solely by the cloud provider for improving its services.

3.2.6 Cloud Security

The Contractor shall describe for both the production and backup environments:

Detail how the Cloud ensures the integrity, confidentiality, and availability of the data to be accessed and stored both in motion and at rest.

Detail the technologies used, such as encryption at rest and data tagging, other logical controls, how physical access is controlled, how administrators are prevented from accessing the data, and who will have access to the encryption keys.

Detail the data destruction methods and what evidence the customers have that ensure the data is destroyed in a manner verifiable by the FBI and compliant with FedRAMP and federal records management requirements.

Detail the auditing performed at every level, using a model such as the Open Systems Interconnection (OSI) or another model which may help represent the discussion.

Detail what triggers are present and how quickly incidents are communicated to the customer in regards to perceived malicious threats.

Detail the update process and how quickly responses are made to install available security updates.

3.2.6.1 Cloud Security Requirements

The CSP shall adhere to the following security guidelines for all services and provide the FBI proof of compliance upon demand:

The CSP shall be authorized by a Joint Authorization Board (JAB) or U.S. Federal Government Agency as FedRAMP Compliant , authorized to operate at the “FedRAMP Moderate” level.

The CSP shall be compliant with all “Moderate” security controls detailed in NIST SP800-53r4

The CSP shall provide security mechanisms for handling data in motion in accordance with FIPS 140-2 Level 2, secured at 256bit using the Advanced Encryption Standard.

The CSP shall provide security mechanisms for handling data at rest in accordance with FIPS 140-2 Level 2, secured at 128bit, using the Advanced Encryption Standard.

The CSP shall provide a list of its personnel, identified by name and role, with system administration, monitoring, and/or security responsibilities that are to receive security alerts, advisories, and directives.

The FBI Enterprise Security Operations Center (ESOC) shall receive any and all alerts which would normally be shared with FedRAMP personnel as per NIST SP800-53r4 SI-5.

The CSP shall be compliant with Attachment 2 - FBI FedRAMP Cloud Contractual Requirements for Solicitation RFQ0016671B.

o The attachment represents the minimum baseline.

o Specific security requirements in this solicitation take precedence over the attachment.

The CSP shall identify all data centers that the data at rest or data backup will reside. All data centers shall reside within the contiguous United States.

The CSP shall guarantee all data in motion shall solely be transported within the contiguous United States.

The CSP shall encrypt XML data at the transport level (HTTPS) as opposed to the session level.

The CSP shall provide role-based access controls (RBAC) will be used to control access to functions, data, and attributes.

The CSP shall enforce website access through IP address range or individual addresses restrictions.

The CSP shall guarantee patching and upgrades in defense of real-time vulnerabilities within 24 hours or less and have no more than one non-compliant incident per fiscal year.

The CSP shall sustain operations with no more than three non-compliant FISMA findings per fiscal year.

The CSP shall provide a solution in which data calls (requests for information) do not exceed two incidents of non-compliance per fiscal year.

The CSP shall comply with directed mandates to protect and defend information systems from recurring security threats or in response to real-time vulnerabilities and have no more than one non-compliant incident per fiscal year.

The CSP shall at no time have access to customer (FBI) data, unless specifically authorized by the FBI.

3.2.6.2 Audit Records Retention

The CSP shall support a system in accordance with the requirement for Federal agencies to manage its electronic records and therefore must comply with statutory and FBI electronic recordkeeping requirements, thus:

The CSP shall ensure records functionality and integrity are maintained throughout the records’ full lifecycle, including the ability to adhere to the records schedule(s), The CSP shall maintain records metadata and the links between the records and their metadata, The CSP shall provide the ability to properly delete temporary records according to NARA approved retention schedules, including General Records Schedule guidance, The CSP shall ensure portability of records to different environments throughout the records lifecycle, including support of non-proprietary formats as needed (from one system to another and/or to NARA when needed), The CSP shall support and facilitate transition planning to address how continued preservation and access issues will be resolved in a contingency where the cloud service provider’s business operations materially change (e.g. bankruptcy) or cease altogether (contractor is changed).

The CSP shall make audit records available for 180 days on a rotating basis based on the creation of each record.

3.2.6.3 Multi-factor Authentication

The CSP shall support a secure, two-step method of authentication and authorization for Congressional staff members and FBI personnel, which shall allow said personnel the ability to perform duties on the CSP.

The CSP must provide proof it enforces a secure, multi-factor method of authentication and authorization for its CSP personnel to log into and conduct administrative tasks on its CSP resources.

3.2.6.4 Continuous Monitoring

The CSP shall provide a Continuous Monitoring Plan, which details how it is compliant with FedRAMP. The following shall be required by the FBI of the CSP as deliverables, to be delivered in a secure manner on a monthly basis:

1. Vulnerability Scanning: Operating System Scans – The CSP shall provide the FBI a summary of internal and external operating systems security scans including specific high and medium vulnerabilities. The scope of the scans include production infrastructure both internal and external as it relates to the boundary of the information system as defined in the System Security Plan as provided in the FedRAMP package.

2. Vulnerability Scanning: Web Applications Scans – The CSP shall provide the FBI with the results of web application security scans on a monthly basis.

3. Vulnerability Scanning: Database Scans – The CSP shall provide the FBI with the results of database security scans for a sample of the production databases on a monthly basis.

4. Plan of Actions and Milestone (POA&M) – The CSP shall provide the FBI with monthly updates on the POA&M including identifying any items which have been closed, actions which have been delayed, and identifying any new weaknesses identified since the last POA&M submission.

The following shall be required by the FBI of the CSP as deliverables, to be delivered in a secure manner on an annual basis:

1. Assessment of System Security Controls - The CSP shall provide the FBI with an independent third party audit report for a selection of FedRAMP moderate baseline controls.

2. System Security Plan (SSP) – The CSP shall provide the FBI with an updated SSP on at least an annual basis. The CSP shall review and update the plan annually to ensure the plan is current and accurately describes implemented system controls and reflects changes to the CSP information system and its operating environment.

3.2.6.5 Cloud Security Incident Handling/Incident Response and Reporting Timeframes In addition to the FedRAMP requirement, the CSP shall be required to report all computer security incidents to the FBI in accordance with US-CERT “Incident Categories and Reporting Timeframes” in Appendix J, Table J-1 of NIST SP 800-61 (as amended). Any incident that involves compromised Personally Identifiable Information (PII) must be reported to the FBI within 1 hour of detection regardless of the incident category reporting timeframe.

Notification outside of this window will be considered a breach of contract.

Please also describe how incidents involving the cloud are handled and responded to, detailing the lines of communication, reporting hierarchy, timelines, and mitigation actions.

3.2.6.6 Media Transport

The CSP shall document activities associated with the transport of FBI information stored on digital and non-digital media and employ cryptographic mechanisms to protect the confidentiality and integrity of this information during transport outside of controlled areas. The documentation shall be delivered prior to transport.

Digital media containing FBI information that is transported outside of controlled areas must be encrypted using FIPS 140-2 level 2 compliant 256bit AES. This includes, but is not limited to, DVDs, CD-ROMs, floppy disks, USB drives, or any other portable media.

3.2.6.7 CSP Personnel Screening

The FBI will accept reciprocity from other agencies that have implemented the CSP. The CSP shall furnish documentation upon demand, reflecting favorable adjudication of background investigations for all personnel supporting the system along with the documentation indicating the acceptance of this process by the sponsoring federal agency or agencies.

Applicants will not be reinvestigated if a prior favorable adjudication is on file with FPS or the reciprocating agency, there has been less than a one year break in service, and the position is identified at the same or lower risk level.

CSP personnel shall not have access to FBI facilities or information systems at any time. CSP personnel shall not have access to unencrypted FBI data at any time, unless pre-authorized in writing by an employee of the FBI Security Division.

3.2.7 Cloud Development and Testing Environment

The CSP shall provide a test and development environment, on the CSP’s cloud test environment, identical in functionality as the production environment.

3.2.8 Cloud Transition

The Cloud vendor shall ensure the FBI has access to export all data for 90 days via the XML API should the contract be nullified or expired. The Cloud vendor shall ensure the data is immediately destroyed upon the 90 day mark or earlier if instructed by the FBI, in both production and backup, at no additional cost and in a manner verifiable by the FBI and compliant with FedRAMP and federal records management requirements.

Describe how the solution will meet this requirement.

3.3 STACH-VIC (FBINET Content Distribution)

The data provided by Congressional staff members must be processed using resources resident on FBINET. The data shall be transferred in a secure, automated method, to limit access to the data and ensure it never resides on the FBI’s unclassified network (UNET). This method shall utilize XML SOAP or REST, leveraging the existing FBI CDS; see Figure 1. STACH-VIC shall be a web-based application capable of orchestrating the retrieval of data from the cloud provider via XML SOAP or REST calls through the FBI’s CDS. The STACH-VIC solution shall leverage virtualization to maximize existing FBINET hosting resources through reuse, and align with the FBI’s and Department of Justice’s (DOJ) long-term IT strategy, enterprise architecture, and data center consolidation initiative. STACH-VIC shall be required to accomplish the necessary XML SOAP or REST calls to the Cloud service for retrieving the visitor data, storing it, formatting it in user-configurable XML, comma separated values (CSV), and Microsoft Excel (XLSX) formats, and making it available via a web application for download as well as exposing the data as a service for XML-based machine to machine consumption.

Figure 1: Cloud/STACH-VIC XML Communication

3.3.1 STACH-VIC Web Application Functions

The contractor (integrator) shall develop and maintain a Microsoft-based .NET (C#) web application capable of making the necessary XML SOAP or REST calls and perform other routines. The web application shall be hosted on a Windows Server platform and use Windows Internet Information Services for hosting to ensure seamless integration with the FBINET domain directory services Microsoft Active Directory (A/D) for single sign-on and access controls. Access to the web application shall be controlled by domain-level A/D groups nested in local server groups. The domain-level groups will be created by the Information Technology Branch (ITB) and membership managed by the OPA.

The XML SOAP or REST calls to the cloud provider shall use the FBI’s GFE XML-enabled CDS (See Section 3.6) to pass calls to the Internet.

Application routines shall be developed to:

Make read requests to the internet-based Cloud service for retrieving the visitor data on a daily basis.

Make delete requests to the Cloud to mark select PII in the cloud for deletion, based on upon completion of a successful read request or the completion of a tour:

Immediately after a successful read request:

i. All PII data except for the name of the visitor, phone number, and email address.

Two weeks after a tour data has been completed:

i. Name of visitor, phone number and email address.

Store retrieved Cloud data on STACH-VIC in a relational database using Microsoft SQL.

Make the retrieved data available on a secure website webpage for download in user-configurable XML, comma separated values (CSV), and Microsoft Excel (XLSX) formats.

o The user-configurable fields in the XML, CSV, and XLSX files shall be column arrangements and date ranges.

Expose the XML data and XML schema for consumption for authorized machine to machine communication or a future enterprise service bus and publish the schema and instructions necessary to consume the data on a STACH-VIC web page.

Provide the ability to export in bulk of all or select data from STACH-VIC in support of FOIA or NARA requirements.

Delete all or select data on STACH-VIC on a scheduled basis to be determined and settable by the system owner; as per Section 3.3.2, the initial setting shall be 14 days after the scheduled tour. This timeline may be subject to change, and shall be configurable on the fly.

3.3.2 STACH-VIC Data Storage, Recoverability, and Deletion

Data retrieved shall be stored in a relational format using Microsoft SQL4 on a partition local to the virtual machine and secured with Microsoft Bitlocker. The disaster recovery solution shall be virtual machine backups only, as no Continuity of Operations (COOP) requiring a hot or cold backup server are anticipated. The data received by and stored on STACH-VIC shall be deleted 14 days after each completed tour, a setting which shall be configurable by the administrators group, via a secure web interface.

3.3.3 Code Ownership

The code to be used in STACH-VIC production shall become the property of the FBI, and be made available to the FBI on two identical CD-ROMs, using the Microsoft Visual Studio Solution format, to include the source code, solution, projects, compiled, assembly, and any other associated files normally included in a .NET solution.

3.3.4 STACH-VIC Security

STACH-VIC shall adhere to FBI security guidelines, including FBI requirements for Certification and Accreditation.

In addition, the following also apply:

PII on the server shall be encrypted at rest using Microsoft Bitlocker configured to use the FBINET domain certificate service and the standard domain policy for Bitlocker encryption.

All data in transit shall be encrypted using 256bit AES.

XML data shall be encrypted at the transport level (HTTPS) as opposed to the session level.

Two-factor authentication (TFA) shall be required for interactive server administrator access.

o TFA tokens will be provided as GFE.

Group based access controls (GBAC) will be used to control access to downloads, data, and interactive login.

3.3.5 Contractor access to the Visitor PII on STACH-VIC

The contractors shall only have access to the visitor PII upon approval from FBI personnel, and only for managing or troubleshooting cloud or STACH-VIC services. The contractors are forbidden from copying data or using said system for any purpose other than to maintain its capabilities. The contractors are forbidden to confirm, discuss or reveal any details of the data viewed with any party and will be required to sign a legally binding non-disclosure agreement.

3.3.6 Development Environment

The OPA will provide the necessary software and hardware for developing STACH-VIC. Two subscriptions for Microsoft Visual Studio Enterprise with MSDN will be delegated to the contractors for use. The MSDN subscription shall provide all Microsoft development software required and facilitate testing in the OTEF (see Section 3.3.7). Since the development environment will not be connected to production, group memberships and other network dependent configurations shall be designed to be locally configured groups to which global groups may be nested. No network configuration or server names should be hard coded. A configuration file easily modified is preferred for this functionality. The GFE hardware to support development will be either a Dell Precision or equivalent HP workstation.

3.3.7 Testing

The FBI will schedule testing of the application in the FBI’s Operational Test and Evaluation Facility (OTEF) before submission to the Distributed Application Virtual Environment (DAVE), the FBI production environment. The MSDN licenses may be used in the testing environment so long as the use is compliant with the Microsoft

4 Microsoft SQL 2014 Standard Edition, per core licensing model.

Product Use Rights (PUR). FBI will verify production licenses are acquired before submitting the application into production. The contractor shall be responsible for working with the OTEF team to configure the testing environment.

3.3.8 Production

The production application shall reside on FBINET, on the “DAVE” virtual server farm. The OPA will work with the ITB Customer Liaison Unit to have a virtual server and licenses provisioned based on the recommendation of the Contractor. Configurations include amount of memory, disk space, number of processors, number of licenses needed, etc. The FBI will be responsible for providing software licenses in the production environment.

3.3.8.1 Virtual Server Environment

The contractor shall configure and maintain the Windows operating environment and the applications necessary to facilitate the content storage and distribution. The contractor shall work with ITB to ensure application continuity after mandatory Windows security patches, updates, and version upgrades (i.e. Windows 2012 to 2016). The server operating system shall be the latest Microsoft Windows Standard Server baseline approved for use on FBINET, which is currently Windows Server 2012 R2 Standard Edition. The Microsoft SQL version and edition shall be either SQL 2012 or 2014, Standard Edition, using the core licensing model. The contractor shall ensure the virtual server design only employs the number of cores necessary to meet the processing needs to avoid unnecessary and costly SQL server licensing. The virtual server (operating systems and its applications) will require certification and accreditation by the Security Division before being allowed into production.

3.3.9 Software Licensing

Since the production server must adhere to the FBI server standard, in addition to Microsoft Windows and SQL, McAfee antivirus and other system monitoring and management licenses may be required. Those will be provided as GFE by the Government. OPA will be responsible for assuming the cost of any licenses and software maintenance costs for the Microsoft, McAfee, and any other required licenses. The Contractor may quote license costs for software other than those required as indicated above, however, the FBI reserves the right to provide any licenses as GFE. The OPA and Contractor shall work with the ITB IT Asset Management Unit (ITAMU) to ensure correct licensing guidelines are followed. The following software versions relevant to designing the solution are approved and in use at the FBI, available through GFE ELAs: Microsoft Windows Server Standard and Datacenter 2012 R2 and Microsoft SQL 2014 Standard and Enterprise.

3.3.10 Incident Handling/Incident Response

STACH-VIC, being an FBI-owned system, will be subject to FBI requirements for incident handling and response, evaluated separately as an FBI-owned system, and collectively with the Cloud as a complete system.

3.3.11 STACH-VIC Machine to Machine Communication with FBI Security System (Optional CLIN0005) With STACH-VIC already built and designed to expose the XML data, a webpage with the schema and directions already built, and the FBINET groups already built to control access to the exposed data, the Contractor shall perform any final configuration required on STACH-VIC to fully enable the exposure of the data to authorized systems and help perform any troubleshooting tasks to completion.

3.4 SSL Certificate Authority

The Cloud vendor shall provide, upon demand, a certificate verifiable by a third-party external certificate authority for secure cloud transport and website access using HTTPS. STACH-VIC shall use FBINET’s certificate service for secure STACH-VIC HTTPS website access.

3.5 Cross-Domain Service (CDS)

The FBI Security Division (SecD) will provide the cross-domain services. The FBI will provide the contractor with the appropriate information for server and Cloud configuration to leverage the CDS (See Attachment 1). The OPA will also provide the SecD with the XML SOAP or REST schema. The Security Division will require the XML schema to ensure the CDS can inspect all data. As stated in Section 3.2.5., XML data shall use transport rather than message encryption to facilitate data inspection. The CDS shall inspect all XML data in transit between Cloud and STACH-VIC. No PII or classified data shall be permitted to be passed back to the Cloud at any time. Please reference Attachment 1 for specific requirements for using the FBI GFE XDS.

3.6 Records Requirements

This section describes the requirements for records management, with 3.6.1 pertaining to the cloud, and 3.6.2 pertaining to STACH-VIC.

3.6.1 Cloud Records Requirements

In general, use of the Cloud may require management of Federal records. FedRAMP Compliance indicates the Cloud vendor is in compliance with NIST 800-53v4, AU-11: Audit Record Retention requirements, and shall be required to adhere to this requirement during the duration of the contract. The FedRAMP requirement is for the service provider to retain audit records on-line for at least ninety days and further preserves audit records off-line for a period that is in accordance with NARA requirements. NARA specifies the duration is to be set by the agency, and for this solicitation the requirement shall be a rotation of 180 days.

The Cloud vendor shall support a system in accordance with the requirement for Federal agencies to manage their electronic records in accordance with 36 CFR § 1236.20 & 1236.22 (ref. a), including but not limited to capabilities such as those identified in: NARA Bulletin 2008-05, July 31, 2008, Guidance concerning the use of e-mail archiving applications to store e-mail (ref. c), NARA Bulletin 2010-05 September 08, 2010, Guidance on Managing Records in Cloud Computing Environments (ref 8). 27.

These provide requirements for maintaining records to retain functionality and integrity throughout the records’ full lifecycle including: Maintenance of links between records and metadata, and Categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules.

To this end, the Cloud’s record management capability must also comply with statutory and Bureau electronic recordkeeping (ERK) requirements, including the proper creation, maintenance, use, and disposition of Bureau records as outlined in the FBI Electronic Recordkeeping Certification Policy Guide, dated August 14, 2015. At a minimum, the following issues must be addressed:

Maintaining records functionality and integrity throughout the records’ full lifecycle, including the ability to adhere to the records schedule(s), Maintaining records metadata and the links between the records and their metadata, Ability to properly delete temporary records according to NARA approved retention schedules, Portability to different environments throughout the records lifecycle including support of non-proprietary formats as needed (from one system to another and/or to NARA when needed), and Transition planning addressing how continued preservation and access issues will be resolved in a contingency where the cloud service provider’s business operations materially change (e.g. bankruptcy) or cease altogether (contractor is changed).

In the specific case of this solicitation, several mitigating factors are in play. The vast majority of visitor PII data itself has a very short lifetime as described on Page 11 in Section 3.3.1, and will be copied to STACH-VIC on a daily basis, with the remaining PII (including the visitor name), to be marked for deletion from the cloud two weeks after the tour date. The decisions for approving or denying a visitor access to the tour will be captured in a centralized email mailbox. Given these factors, the data in the cloud is considered transitory in nature, the cloud shall not be considered a recordkeeping system, and therefore the cloud capability as scoped in this document shall not require records management capabilities above and beyond what is specified in FedRAMP.

3.6.2 STACH-VIC Records Requirements

Given the scope of this system as outlined in this solicitation, the transitory nature of the data, and the capturing of attendance by other means, STACH-VIC shall not be considered a system of record.

3.7 Discovery Requirements

Describe what Cloud discovery capabilities are available, such as litigation hold and preservation, if any, and whether those are included or require additional costs. Discovery capabilities outside of what is required by FedRAMP shall not be required given the scope of this solicitation. Discovery capabilities for STACH-VIC shall not be required.

3.8 Configuration Management

The contractor shall follow established FBI configuration management policies regarding the configuration of the customer-controlled portion Cloud service and STACH-VIC. After the initial configuration and before the Cloud is permitted to be used in production, the contractor shall work with the FBI to demonstrate and permit FBI verification all requirements have been met. The contractor shall also document the “system” in its entirety, to include both the Cloud and STACH-VIC, which shall serve as the baseline for the production environment. If the FBI requires changes after the initial configuration, the contractor shall follow the FBI change management process and await approval before any changes are made. If and when the changes are approved, the contractor shall work with the FBI to demonstrate and permit FBI verification that all requirements have been met before the changes are approved for use in production. The contractor shall document any changes in the system documentation and shall maintain a change log. Both the documentation and the change log shall be considered deliverables. The FBI Technical Change Configuration Board (TCCB) is the governing body that will approve change requests before acceptance and implementation. The Security Division is the approving authority for all security requirements.

It shall be the responsibility of the contractor to notify the FBI of any changes to the cloud service outside of the customer-controlled interface, which will impact the functionality of the “system,” and propose any necessary changes to ensure continuity. This includes changes to both the desktop and mobile based Cloud solutions.

Policies regarding configuration management within the FBI will be provided as GFI upon award.

3.9 Anticipated Use Case

The following is a notional use case to assist readers with visualizing the requirement from the viewpoint of the business customer (OPA). It is not in any way intended to describe the technical requirements outlined in Section 3.0.

FBI OPA employees and Congressional staffers shall have access to an FBI-branded "J. Edgar Hoover Building Tour” Cloud-based website. FBI personnel will create tour dates and provide related information in fields attributed to the scheduled date. They may also provide summary information about tours which would display above the calendar. The tours will have a number of associated maximum slots which would be filled as they were reserved by potential visitors. Congressional staffers will view the calendar for potential time slots. They will either pick a time slot which then would present them with a form to fill out for a visitor request form, or conversely, fill out a visitor request form during which a time slot could be chosen from a drop down, radio button, or similar list type. Data attributes to be collected in the visitor form include, but are not limited to, the items listed in Table 1: Visitor Attributes. For a more detailed list, please reference Section 3.12.

First Name Place of Birth

Middle Name Social Security Number or Passport/Visa Number

Last Name Home Telephone Number

City Country of Citizenship

State

ZIP Code

Table 1: Visitor Attributes

On a daily basis, in an automated and time-randomized manner around a specific hour, the data shall be transferred to STACH-VIC where it would be retrieved by select authorized…