Complete Vendor Questions-Answers.xlsx
XLSX spreadsheet 83 KB Posted
- Solicitation number
- S120-00XX
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Vendor Questions (Sets 4-7).xlsx | XLSX spreadsheet | |
| EDWSanitizedTopology.pdf | ||
| Security Controls.pdf | ||
| Vendor Questions and responses (Sets 1 - 3).xlsx | XLSX spreadsheet | |
| EVV RFI Attachment 1.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Vendor # | Question # | Question | Reply |
| 1 | 1 | Please describe the USACE and/or other Information Repositories that are in-scope. i.e. backend data storage type (structured, unstructured) and technology (Oracle, MSSQL, noSQL, etc.) | USACE has many disparate data sources that includes and not limited to Oracle, Microsoft SQL servers, Sybase IQ, PostGres SQL and IBM Pure Data Netezza based data. |
| 1 | 2 | Please describe the unstructured data types, formats and use cases in scope. | USACE also retains requirements to process structured and unstructured data. |
| 1 | 3 | Please describe the geospatial data types and use cases in scope. | EVV should have the capability to accept and display point, line, polygon and raster GIS data types and consume ESRI Rest, Open Geospatial Consortium (OGC) and open source services. |
| 1 | 4 | Is the vendor to provide the analytics and reporting platforms? If not, please describe the analytics and reporting platforms that will be used. | Open to hear what what vendors have to offer. |
| 2 | 1 | USACE has previously said that the 30 day PoC would be paid for by the USACE CIO/G6 office. Can you share what the budget is for that work? | Not within the scope of this RFI |
| 2 | 2 | Are there any further requirements for the RFI response such as maximum length, required sections, formatting, etc. that we need to meet? | To this end, we would like to see capability statements of no more than 10 pages, including a summary of past work as it applies to the RFI, a 3-4 page executive summary or overview, a 1-2 page brief summary of staffing proposed for the project, and a 1-3 page ROM cost estimate, for a maximum page count of 25. |
| 2 | 3 | What Impact Level is the Corps interested in? | L4, L5 |
| 2 | 4 | USACE has previously stated that they do not want storage (like a data lake or data warehouse) as part of their solution. However, that requirement was not specifically listed in the RFI. Is no storage still a requirement? | Perfer no storage but open to options |
| 2 | 5 | Approximately how many identity objects will need to access the dashboard? | 10,000 Users currently access data warehouse |
| 2 | 6 | Is there a data classification and labeling strategy in place for the data sources? | Yes |
| 2 | 7 | Do you have a data governance program in place? If so can you share how you that program is deployed? | Yes. Deputy Commanding General, Senior Leaders, CIO, DCIO, Chief Data Officer, staff within OCIO (reference operating model attachment to RFI) |
2 8 Do you have any external sharing requirements for accessing data or resources? Yes to include external third party mission partners i.e., Army, Federal Procurement Data Systems. Future may include US State Department
| 2 | 9 | What are the baseline security controls and policies that are currently in place to secure your data? | AD access controls, encrypted data in motion, encrypted storage, STIGS, CAC enabled |
| 2 | 10 | Do you have a basic list of the output you want to be able to display from a C2 perspective? | Traditional back office info and field operations data. |
| 2 | 11 | Is there an architectural network diagram you can share to assess any ports or protocols that need to be addressed? | see EDW Sanitized Topology. Planned network co-location with cloud provider with 10 to 40g interfaces. |
2 12 What type of security analytics would you want to collect on activity of your data at rest, in use and in transit? (see Security Contols Sheet).
The EVV environment is intended to be an enterprise wide data viewer providing a VIEW (ONLY) of data we have all over the place. It is not intended to be a container of data. This changes the scoping of the questions a lot.
What type of security analytics would you want to collect on activity of your data at rest, in use and in transit? It is my understanding that "data" is not intended for transit, however the analytics to support Cyber active monitoring would include; network capacity usage (min, peak, sustain) over time, full path information, full syslog elements (requestor information (ipaddress, country code, userid), end to end encryption method used, Failed connection attempts, requested data type and size analysis.
If "they" need additional info, we can further expand it as needed.
| 2 | 13 | Will you have anyone accessing the EVV environment over a classified network or low latency connection we need to plan for? | None at this time. |
| 3 | 1 | Can a tentative timeframe be identified for the demo build occur? | 2nd Qtr FY21 (Jan - Mar 21) - Not part of RFI process |
| 3 | 2 | Will vendors be down-selected prior to the demo or will that be part of the down-select determination? | This is a Request For Information only. No Demo or down-select is included in this stage. |
| 3 | 3 | For the demo build, will vendors be given masked/scrambled data export or direct access to USACE Cloud environment and systems? | Out of scope of RFI. |
| 3 | 4 | For the cost requirement - is this an estimate for the cost of technology products and professional services for a fully deployed dev, test, production system or for a pilot system. Specific Requirement: proposed technical approach, gross estimation of the time required to implement concept, the type and magnitude of resources required to construct and operate the EVV as described or inclusive of the changes proposed by the vendor. the articulated | Whatever detail that can be provided would be appreciated to include cost and time. Please provide any underlying supporting assumptions. |
| 3 | 5 | Can you share a planned number of users? | 10000 |
| 3 | 6 | Are all users located in CONUS? Are they located at District and Division offices and the Headquarters? | CONUS and OCONUS and located both HQ/District/Division. Majority are CONUS based |
| 3 | 7 | Since this is intended to replicate the EDW, will USACE give more details on current EDW - size, # of views, # of total users, # of concurrent users, entity-relationship diagrams, various other diagrams? | USACE does not intend replicate the EDW. Vendors should acknowledge this is to be a cross-functional system with a large number of users. The current landscape of USACE is that we have approximately 30,000 employees distributed throughout the world. |
| 3 | 8 | Can the Corps give more details on size, # of tables, # of users, # of concurrent users, entity-relationship diagrams, various other diagrams needed of the 5 Strategic source systems (Financial Transaction Record (CEFMS), Program, Project and Services Management (P2), Construction Administration (RMS), Army Owned Land Management (REMIS, and DoD Use of Third Party Real Property (RFMIS))? Contract | This data is not readily available. |
Entity-relationship diagrams cannot be provided due to security protocol.
See EDW Topology for additional information.
| 3 | 9 | Can the Corps share the data volumes and how many years of history they desire to cover the 5 strategic source systems? | Data archiving and retention will be a responsibility of source systems. Perhaps some analytical reports will be the responsibility of the EVV |
| 3 | 10 | Does USACE want to use products currently owned by USACE for EVV or will they consider additional products? | No decision made at this time - open to options |
| 3 | 11 | Will the Corps establish a governance office that will establish parameters for EVV queries? | Yes under direction of Chief Data Officer (CDO) |
| 3 | 12 | Will users be allowed to process any query associated with the 5 strategic source systems? | No - data will be limited/constrainted based upon user authorization levels. |
| 3 | 13 | Will the Corps establish a repository for the contextual information or does the Corps want the objective EVV system to develop that for the users? | yes - USACE intends to use and maintain a data dictionary. |
| 3 | 14 | Since this is expected to access multiple clouds, does the Corps desire a cloud-based solution? | Absolutely yes. |
| 3 | 15 | Will the Corps establish a data repository for cloud systems as a way to minimize the data ingress and egress costs? | Recommendations solicted on this topic |
| 3 | 16 | Does the Corps want an estimate for BCAP related access fees for the various clouds since these are dependent upon the specific service agreement signed with the Corps? | Not required. |
| 3 | 17 | USACE Unstructured data formats are what file types (ppt, doc, xls, GIS related images, jpg, pdf)? This is not critical for the object store and catalog, but is important for reporting considerations. | USACE retains requirements to process structured and unstructured data. Formats include, but are not limited to all of those listed. |
| 3 | 18 | (Re: Objective 3.6) Are you looking transactional systems to consume data from EVV? Does this imply a data services layer as a component of EVV? | yes |
| 3 | 19 | (Re: Objective 3.8) Are you looking for EVV to replace EDW or are you referring to Analytics that currently runs against EDW would instead run through EVV? | Analytics that currently runs against EDW would instead run through EVV |
| 3 | 20 | (Re: Objective 3.11) Again, are we referring to analytics running against EVV rather than the EDW directly? | Yes. |
| 3 | 21 | (Re: Objective 3.13) Are you looking for a demo accompanied by a report, as a follow-up activity to the RFI response? | Only to demonstrate concepts |
| 3 | 22 | (Re: Page 1 of Word attachment) Are you looking for approaches to master / reference data management as part of the EVV RFI response? | Yes. |
| 4 | 1 | RFI, technical objective # 8 states: “Proves current EDW mission support can be quickly migrated at an acceptable cost within one year.“ What is the nature of the ”current EDW mission support“ being referenced? | Providing (# of reports) reports from data repositories to mission users. |
| 4 | 2 | RFI, technical objective #11 states: “Can be operated and scaled at a cost that is indicative of being superior to that of the current EDW approach and cost model”. What is the current EDW cost model? | At this time we are not looking for proposals but the elements of costs to support the EVV concept. And to better understand dimensions of costs which should be investigated in an RFP should one be released. |
| 4 | 3 | Is USACE looking for vendors responding to this RFI to address the modernization of the 5 “strategic systems” referenced in RFI main instructions, Background #2: CEFMS, P2, RMS, Army REMIS, and RFMIS? Or is that a separate programmatic effort? | It is a seperate programatic effort however, the EVV will be integrating with those initiatives. |
| 4 | 4 | RFI deliverables requires vendors to address the “Gross estimation of the time required to implement the articulated concept” and “the type and magnitude of resources required to construct and operate the EVV as described or inclusive of the changes proposed by the vendor.” Are these to be addressed in reference to the 30 day proof of concept, or the full displacement of EDW in FY21? | Both. USACE is looking for the vendors understanding on the timing feasability outlined in the RFI. |
| 4 | 5 | RFI Attachment 1: RFI Attachment 1 references ‘business case and budget development for FY21 budget submission’. Does the Government have a budget range in mind for FY21 budget submission? | Purpose of the RFI is to better understand the complexity and cost of implementing the EVV capability. Results of the RFI will be taken into consideration in the establishment of the budget. |
| 5 | 1 | Do EVV stakeholders have a preference for either existing tools migrations to cloud as opposed to using cloud native services? A quicker approach for “Lift and Shift” would migrate current on-premise BI, business dictionary, data catalog tools into the cloud, but this may not integrate well or quick enough with cloud EDW, and could carry over current technical debt into the cloud. Many cloud projects fail to deliver value due to such poorly planned migrations. On the other hand, a full migration using cloud native services for the capabilities mentioned above will have better integration with respect to the data pipeline, performance and security but at a higher migration costs for existing reports and data pipeline. USmax suggests the later approach of using cloud native services for longer term operational excellence, performance, reliability, security and cost optimization. Using a cloud native services approach, we would recommend a phased implementation to minimize disruptions, and that would keep both the existing EDW and cloud EDW running in parallel, utill full migration is achieved. Our question is intended to understand EVV stakeholder preference in this respect. | No decision at this time - all options will be considered. Such a decision will be based on proposed alternative tools. |
| 5 | 2 | What types of unstructured data need to be supported? Different types of data may need different cloud service to process them. For example, some unstructured data can be converted into semi-structured or fully structured data and can use technologies within EDW to process them. Some unstructured data will need Big Data cloud services beyond the EDW capability to be used in parallel with EDW. Our question is intended to better understand the scope and outcomes of unstructured data processing. | USACE is interested in all supported unstructured data types. Please provide information of what is believed to be possible and what would be recommended. |
| 6 | 1 | In reference to Vendor 2, Question 2: Please confirm the capability statement is in response to the original RFI’s list of objectives per the RFI’s Deliverables section, technical approach? | Yes. Responses should include any information that is relevant to the EVV concept. Please consider answering all of the 13 questions and provide any other information that is relevant so USACE can have a better understanding of vendor/industrythe capabilities in delivering the concept presented in the RFI |
| 6 | 2 | In reference to Vendor 2, Question 2: The original RFI includes a section on avoidance of non-personal services mentioning to refrain from discussing "skills levels and hours, salaries, cost and funding data”. Please confirm we should only provide a gross estimation of the time required to implement the articulated concept with magnitude of resources to construct and operate EVV per the RFI Deliverables section rather than a ROM Cost Estimate. | Yes -- just a gross order of magnitude estimation is requested. |
| 7 | 1 | How much data? How big is the data? (Production/Development/COOP) | ~50TB of data |
| 7 | 2 | So long as the software is still Oracle 12c, IBM Netezza, Business Objects, Apache Tomcat does it matter the platform? | All options will be considered. |
| 7 | 3 | What is the expected IOPS per system? (number of read and write operations per second) | No determination at this time -- open to vendor recommendations. |
| 7 | 4 | RPO (Recovery Point Objective) - How much data can you afford to lose during outages, testing and replication? | Our objective is none. |
| 7 | 5 | RTO (Recovery Time Objective) - How much time can you afford to lose during outages, testing and replication? | Request vendor recommendations on reasonable objective. |
| 7 | 6 | Number of transactions per environment? | Not prepared to answer at this time. |
| 7 | 7 | How often does the data change/update? | Objective of the EVV is near real-time updates. |
| 7 | 8 | As you stated the solution is expected to access multiple clouds, which cloud solutions must we connect to? | Minimum connectors required (Azure, Amazon (AWS), Oracle, Google) |
Security Contols
| Baseline | AC-2(1) | Automated System Account Management | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-2(2) | Removal Of Temporary / Emergency Accounts | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-2(3) | Disable Inactive Accounts | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-2(4) | Automated Audit Actions | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-2(5) | Inactivity Logout | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-2(7) | Role-based Schemes | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-2(10) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. If credentials are not terminated, users who are no longer part of the group, or more importantly shared root groups, will inappropriately retain rights and privileges. Access control is jeopardized, compounding over time. | Shared / Group Account Credential Termination | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-2(12) | Account Monitoring / Atypical Usage | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-3(4) | Discretionary Access Control | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-6(1) This control requires investigation because non-compliance has the potential to allow unauthorized individuals to modify security settings. | Authorize Access To Security Functions | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-6(5) This control requires investigation because non-compliance has the potential to allow unauthorized individuals to modify security settings. | Privileged Accounts | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-6(8) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. If not prevented from elevating privileges, authorized AND UNAUTHORIZED users can easily subvert protections and modify information or processes, potentially gaining even higher levels of access. This is a common method adversaries use to get root access once they gain normal user access. | Privilege Levels For Code Execution | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-7 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Unsuccessful Logon Attempts | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-10 | Concurrent Session Control | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-11(1) | Pattern-hiding Displays | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-12(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Without a distinct logout notification to the user, user sessions could be left hanging, and adversaries could hi-jack the session. | User-initiated Logouts / Message Displays | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-16(6) | Maintenance Of Attribute Association By Organization | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-17(3) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Managed Access Control Points | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-17(4) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Privileged Commands / Access | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-17(6) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Protection Of Information | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-17(9) | Disconnect / Disable Access | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-18 | Wireless Access | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-18(3) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Disable Wireless Networking | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-18(4) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Restrict Configurations By Users | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AC-20(2) | Portable Storage Devices | NIST SP 800-53 Revision 4 | Access Control |
| Baseline | AT-2(2) | Insider Threat | NIST SP 800-53 Revision 4 | Awareness and Training |
| Baseline | AT-3(2) | Physical Security Controls | NIST SP 800-53 Revision 4 | Awareness and Training |
| Baseline | AT-3(4) | Suspicious Communications And Anomalous System Behavior | NIST SP 800-53 Revision 4 | Awareness and Training |
| Baseline | AU-2(3) | Reviews And Updates | NIST SP 800-53 Revision 4 | Audit and Accountability |
| Baseline | AU-3(1) | Additional Audit Information | NIST SP 800-53 Revision 4 | Audit and Accountability |
| Baseline | AU-5 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Response To Audit Processing Failure | NIST SP 800-53 Revision 4 | Audit and Accountability |
| Baseline | AU-5(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Audit Storage Capacity | NIST SP 800-53 Revision 4 | Audit and Accountability |
| Baseline | AU-6(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Process Integration | NIST SP 800-53 Revision 4 | Audit and Accountability |
| Baseline | AU-6(4) | Central Review And Analysis | NIST SP 800-53 Revision 4 | Audit and Accountability |
| Baseline | AU-8 | Time Stamps | NIST SP 800-53 Revision 4 | Audit and Accountability |
| Baseline | AU-8(1) | Synchronization with Authoritative Time Source | NIST SP 800-53 Revision 4 | Audit and Accountability |
| Baseline | AU-11 | Audit Record Retention | NIST SP 800-53 Revision 4 | Audit and Accountability |
| Baseline | AU-12(1) | System-Wide / Time-Correlated Audit Trail | NIST SP 800-53 Revision 4 | Audit and Accountability |
| Baseline | AU-14(1) | System Start-Up | NIST SP 800-53 Revision 4 | Audit and Accountability |
| Baseline | CA-2(1) | Independent Assessors | NIST SP 800-53 Revision 4 | Security Assessment and Authorization |
| Baseline | CA-3(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Unclassified National Security System Connections | NIST SP 800-53 Revision 4 | Security Assessment and Authorization |
| Baseline | CA-5 | Plan Of Action And Milestones | NIST SP 800-53 Revision 4 | Security Assessment and Authorization |
| Baseline | CA-7(1) | Independent Assessment | NIST SP 800-53 Revision 4 | Security Assessment and Authorization |
| Baseline | CM-1 | Configuration Management Policy & Procedures | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-2 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Baseline Configuration | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-2(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Reviews And Updates | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-2(3) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Retention of Previous Configurations | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-2(7) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Given the enhancement is required for systems in high-risk environments, and given the systems are appropriately configured (i.e., locked down more than systems used in typical environments), the risk of sudden non-compliance is high, in that we would have unacceptable vulnerabilities exposed to advanced adversaries in those high-risk environments and/or we wouldn't clean up the system upon return to the typical user environment and potentially introduce malware to other systems in that environment. | Configure Systems, Components, or Devices for High-Risk Areas | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-3 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Configuration Change Control | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-3(2) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Test / Validate / Document Changes | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-3(4) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Security Representative | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-5 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Access Restrictions For Change | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-5(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. If access restrictions are not enforced, unauthorized users will have access to information or processes to which they have no need to/for and may be able to elevate privileges and gain a stronger foothold. | Automated Access Enforcement / Auditing | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-5(2) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Review System Changes | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-5(5) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Limit Production / Operational Privileges | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-5(6) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Limit Library Privileges | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-6 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Configuration Settings | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-6(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Automated Central Management / Application/Verification | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-7 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Least Functionality | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-7(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Periodic Review | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-7(2) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Prevent Program Execution | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-7(3) | Registration Compliance | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-7(5) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Failure of the deny-all, permit-by-exception function will (unbeknownst to system/security admin) allow users the ability to install unauthorized and potentially dangerous software, thereby introducing vulnerabilities that can be exploited to elevate privileges and/or gain access to the system or its components. | Authorized Software / Whitelisting | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-8 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Information System Component Inventory | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-8(2) | Automated Maintenance | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-8(3) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Automated Unauthorized Component Detection | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-8(5) | No Duplicate Accounting Of Components | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-9 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Configuration Management Plan | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-10 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Failure to track software licenses does not typically jeopardize the security posture of the system; it is mostly related to the legality of using software. However, failure of this control could result in criminal prosecution. | Software Usage Restrictions | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-10(1) | Open Source Software | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-11 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. While sudden non-compliance in the policy portion in paragraph "A" is not so alarming, sudden failure of the enforcement methods may allow users to install software at will, some of which may contain malware and allow unauthorized access to the system. | User-Installed Software | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CM-11(2) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. If the prohibition to privileged status suddenly fails, normal users can install software at will, some of which could contain malware. | Prohibit Installation without Privileged Status | NIST SP 800-53 Revision 4 | Configuration Management |
| Baseline | CP-3 | Contingency Training | NIST SP 800-53 Revision 4 | Contingency Planning |
| Baseline | CP-4 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Contingency Plan Testing | NIST SP 800-53 Revision 4 | Contingency Planning |
| Baseline | CP-9(1) | Testing For Reliability / Integrity | NIST SP 800-53 Revision 4 | Contingency Planning |
| Baseline | CP-10(2) | Transaction Recovery | NIST SP 800-53 Revision 4 | Contingency Planning |
| Baseline | IA-1 | Identification And Authentication Policy And Procedures | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-2(1) | Network Access to Privileged Accounts | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-2(2) | Network Access to Non-Privileged Accounts | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-2(3) | Local Access to Privileged Accounts | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-2(4) | Local Access to Non-Privileged Accounts | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-2(5) | Group Authentication | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-2(8) | Network Access to Privileged Accounts - Replay Resistant | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-2(9) | Network Access to Non-Privileged Accounts - Replay Resistant | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-2(12) | Acceptance of PIV Credentials | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-3 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Device Identification and Authentication | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-3(1) | Cryptographic Bidirectional Authentication | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-4(4) | Identify User Status | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-5(1) | Password-Based Authentication | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-5(2) | PKI-Based Authentication | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-5(3) | In-Person Or Trusted Third-Party Registration | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-5(4) | Automated Support for Password Strength Determination | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-5(7) | No Embedded Unencrypted Static Authenticators | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-5(8) | Multiple Information System Accounts | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-5(11) | Hardware Token-Based Authentication | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-5(13) | Expiration Of Cached Authenticators | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-5(14) | Managing Content of PKI Trust Stores | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-8(1) | Acceptance of PIV Credentials from Other Agencies | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-8(2) | Acceptance of Third-Party Credentials | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-8(3) | Use Of FICAM-Approved Products | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IA-8(4) | Use Of FICAM-Issued Profiles | NIST SP 800-53 Revision 4 | Identification and Authentication |
| Baseline | IR-3 | Incident Response Testing | NIST SP 800-53 Revision 4 | Incident Response |
| Baseline | IR-3(2) | Coordination With Related Plans | NIST SP 800-53 Revision 4 | Incident Response |
| Baseline | IR-4(1) | Automated Incident Handling Processes | NIST SP 800-53 Revision 4 | Incident Response |
| Baseline | IR-4(3) | Continuity Of Operations | NIST SP 800-53 Revision 4 | Incident Response |
| Baseline | IR-4(4) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Information Correlation | NIST SP 800-53 Revision 4 | Incident Response |
| Baseline | IR-4(6) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Due to the current exploitation of the insider threat concern, its necessary to have special procedures to identify, manage, thwart and prosecute the insider threat. | Insider Threats - Specific Capabilities | NIST SP 800-53 Revision 4 | Incident Response |
| Baseline | IR-4(7) | Insider Threats - Intra-organization Coordination | NIST SP 800-53 Revision 4 | Incident Response |
| Baseline | IR-4(8) | Correlation With External Organizations | NIST SP 800-53 Revision 4 | Incident Response |
| Baseline | IR-6(1) | Automated Reporting | NIST SP 800-53 Revision 4 | Incident Response |
| Baseline | IR-6(2) | Vulnerabilities Related To Incidents | NIST SP 800-53 Revision 4 | Incident Response |
| Baseline | IR-7 | Incident Response Assistance | NIST SP 800-53 Revision 4 | Incident Response |
| Baseline | IR-7(1) | Automation Support For Availability Of Information / Support | NIST SP 800-53 Revision 4 | Incident Response |
| Baseline | IR-7(2) | Coordination With External Providers | NIST SP 800-53 Revision 4 | Incident Response |
| Baseline | IR-9 Spillage implies the potential for loss of confidentiality for classified information. Failure to identify, alert, isolate, eradicate, etc. will undoubtedly lead to compromise of classified information. | Information Spillage Response | NIST SP 800-53 Revision 4 | Incident Response |
| Baseline | IR-9(1) | Responsible Personnel | NIST SP 800-53 Revision 4 | Incident Response |
| Baseline | IR-9(2) | Training | NIST SP 800-53 Revision 4 | Incident Response |
| Baseline | IR-9(4) | Exposure To Unauthorized Personnel | NIST SP 800-53 Revision 4 | Incident Response |
| Baseline | IR-10 | Integrated Information Security Analysis Team | NIST SP 800-53 Revision 4 | Incident Response |
| Baseline | MA-2 | Controlled Maintenance | NIST SP 800-53 Revision 4 | Maintenance |
| Baseline | MA-3 | Maintenance Tools | NIST SP 800-53 Revision 4 | Maintenance |
| Baseline | MA-3(1) | Inspect Tools | NIST SP 800-53 Revision 4 | Maintenance |
| Baseline | MA-3(2) | Inspect Media | NIST SP 800-53 Revision 4 | Maintenance |
| Baseline | MA-3(3) | Prevent Unauthorized Removal | NIST SP 800-53 Revision 4 | Maintenance |
| Baseline | MA-4 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Maintenance conducted through network must be secured with proper authentication occurring by maintenance persons. | Nonlocal Maintenance | NIST SP 800-53 Revision 4 | Maintenance |
| Baseline | MA-4(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Granted, this is an after the fact procedure, but it might identify suspicious activity of maintainers who may be more or less trusted with access to the system. This is especially concerning, because it is non-local maintenance. Failure to audit could fail to identify activities that could lead to unauthorized access to the system either during the maintenance session or later, because of some changes inappropriately made by the maintainer that can be used to bypass security mechanisms during a later exploit/attack. | Auditing And Review | NIST SP 800-53 Revision 4 | Maintenance |
| Baseline | MA-4(2) | Document Nonlocal Maintenance | NIST SP 800-53 Revision 4 | Maintenance |
| Baseline | MA-4(3) | Comparable Security / Sanitization | NIST SP 800-53 Revision 4 | Maintenance |
| Baseline | MA-4(7) | Remote Disconnect Verification | NIST SP 800-53 Revision 4 | Maintenance |
| Baseline | MP-7 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Failure to prevent the use of dangerous media types (e.g., thumb drives, personally owned mobile devices) on the system can easily lead to introduction of malware and compromise of the system. | Media Use | NIST SP 800-53 Revision 4 | Media Protection |
| Baseline | MP-7(1) | Prohibit Use Without Owner | NIST SP 800-53 Revision 4 | Media Protection |
| Baseline | PE-1 | Physical And Environmental Protection Policy And Procedures | NIST SP 800-53 Revision 4 | Physical and Environmental Security |
| Baseline | PE-3(1) | Information System Access | NIST SP 800-53 Revision 4 | Physical and Environmental Security |
| Baseline | PE-6 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. If it is not done or done correctly, how do we ensure unauthorized access is not occurring. | Monitoring Physical Access | NIST SP 800-53 Revision 4 | Physical and Environmental Security |
| Baseline | PE-6(1) | Intrusion Alarms / Surveillance Equipment | NIST SP 800-53 Revision 4 | Physical and Environmental Security |
| Baseline | PE-8 | Visitor Access Records | NIST SP 800-53 Revision 4 | Physical and Environmental Security |
| Baseline | PE-12 | Emergency Lighting | NIST SP 800-53 Revision 4 | Physical and Environmental Security |
| Baseline | PE-13 | Fire Protection | NIST SP 800-53 Revision 4 | Physical and Environmental Security |
| Baseline | PE-14 | Temperature And Humidity Controls | NIST SP 800-53 Revision 4 | Physical and Environmental Security |
| Baseline | PE-15 | Water Damage Protection | NIST SP 800-53 Revision 4 | Physical and Environmental Security |
| Baseline | PE-16 | Delivery And Removal | NIST SP 800-53 Revision 4 | Physical and Environmental Security |
| Baseline | PL-1 | Security Planning Policy And Procedures | NIST SP 800-53 Revision 4 | Planning |
| Baseline | PL-2(3) | Plan / Coordinate With Other Organizational Entities | NIST SP 800-53 Revision 4 | Planning |
| Baseline | PL-4(1) | Social Media and Networking Restrictions | NIST SP 800-53 Revision 4 | Planning |
| Baseline | PL-8(1) | Defense-In-Depth | NIST SP 800-53 Revision 4 | Planning |
| Baseline | PL-8(2) | Supplier Diversity | NIST SP 800-53 Revision 4 | Planning |
| Baseline | PM-4 | Plan Of Action And Milestones Process | NIST SP 800-53 Revision 4 | Program Management |
| Baseline | PM-5 | Information System Inventory | NIST SP 800-53 Revision 4 | Program Management |
| Baseline | PM-6 | Information Security Measures Of Performance | NIST SP 800-53 Revision 4 | Program Management |
| Baseline | PM-8 | Critical Infrastructure Plan | NIST SP 800-53 Revision 4 | Program Management |
| Baseline | PM-12 | Insider Threat Program | NIST SP 800-53 Revision 4 | Program Management |
| Baseline | PM-15 | Contacts With Security Groups And Associations | NIST SP 800-53 Revision 4 | Program Management |
| Baseline | PM-16 | Threat Awareness Program | NIST SP 800-53 Revision 4 | Program Management |
| Baseline | PS-4(1) | Post-employment Requirements | NIST SP 800-53 Revision 4 | Personnel Security |
| Baseline | PS-6(3) | Post-employment Requirements | NIST SP 800-53 Revision 4 | Personnel Security |
| Baseline | RA-5 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Would need to investigate to determine if the unremediated vulnerabilities change the risk level. | Vulnerability Scanning | NIST SP 800-53 Revision 4 | Risk Assessment |
| Baseline | RA-5(1) | Update Tool Capability | NIST SP 800-53 Revision 4 | Risk Assessment |
| Baseline | RA-5(2) | Update By Frequency / Prior To New Scan / When Identified | NIST SP 800-53 Revision 4 | Risk Assessment |
| Baseline | RA-5(4) | Discoverable Information | NIST SP 800-53 Revision 4 | Risk Assessment |
| Baseline | RA-5(5) | Privileged Access | NIST SP 800-53 Revision 4 | Risk Assessment |
| Baseline | SA-1 | System And Services Acquisition Policy And Procedures | NIST SP 800-53 Revision 4 | System and Services Acquisition |
| Baseline | SA-4(1) | Functional Properties Of Security Controls | NIST SP 800-53 Revision 4 | System and Services Acquisition |
| Baseline | SA-4(2) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Failure to comply with this control could lead to serious security concerns as critical system elements could go untested/ invalidated. | Design / Implementation Information For Security Controls | NIST SP 800-53 Revision 4 | System and Services Acquisition |
| Baseline | SA-4(7) | NIAP-approved Protection Profiles | NIST SP 800-53 Revision 4 | System and Services Acquisition |
| Baseline | SA-4(9) | Functions / Ports / Protocols / Services In Use | NIST SP 800-53 Revision 4 | System and Services Acquisition |
| Baseline | SA-4(10) | Use Of Approved PIV Products | NIST SP 800-53 Revision 4 | System and Services Acquisition |
| Baseline | SA-5 | Information System Documentation | NIST SP 800-53 Revision 4 | System and Services Acquisition |
| Baseline | SA-9 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Critical information is located on any of these external services sites and must be monitored. | External Information System Services | NIST SP 800-53 Revision 4 | System and Services Acquisition |
| Baseline | SA-9(1) | Risk Assessments / Organizational Approvals | NIST SP 800-53 Revision 4 | System and Services Acquisition |
| Baseline | SA-9(2) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. If this control fails, capabilities will be limited for the system or service and could result in a DoS to it with a direct mission impact. | Identification Of Functions / Ports / Protocols / Services | NIST SP 800-53 Revision 4 | System and Services Acquisition |
| Baseline | SA-10 | Developer Configuration Management | NIST SP 800-53 Revision 4 | System and Services Acquisition |
| Baseline | SA-10(1) | Software / Firmware Integrity Verification | NIST SP 800-53 Revision 4 | System and Services Acquisition |
| Baseline | SA-12 | Supply Chain Protection | NIST SP 800-53 Revision 4 | System and Services Acquisition |
| Baseline | SA-15 | Development Process, Standards, And Tools | NIST SP 800-53 Revision 4 | System and Services Acquisition |
| Baseline | SA-19 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. As identified in the counterfeit Cisco routers, failure to ID fake products/parts could have undesirable consequences in the loss or compromise of data. | Component Authenticity | NIST SP 800-53 Revision 4 | System and Services Acquisition |
| Baseline | SC-1 | System And Communications Protection Policy And Procedures | NIST SP 800-53 Revision 4 | System and Communications Protection |
| Baseline | SC-5 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | Denial Of Service Protection | NIST SP 800-53 Revision 4 | System and Communications Protection |
| Baseline | SC-5(1) | Restrict Internal Users | NIST SP 800-53 Revision 4 | System and Communications Protection |
| Baseline | SC-7 Ensures protection at the boundary. Publically accessible systems are provided protections by DMZ. | Boundary Protection | NIST SP 800-53 Revision 4 | System and Communications Protection |
| Baseline | SC-7(3) | Access Points | NIST SP 800-53 Revision 4 | System and Communications Protection |
| Baseline | SC-7(4) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Simply must tightly manage the firewalls to ensure they stay in compliance and do not open a window or door for our advanced adversaries. | External Telecommunications Services | NIST SP 800-53 Revision 4 | System and Communications Protection |
| Baseline | SC-7(5) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. The alternative is disastrous -that is allow all by default. Allowing all allows our advanced adversaries to get in, and then all bets are off-systems are quickly compromised. | Deny By Default / Allow By Exception | NIST SP 800-53 Revision 4 | System and Communications Protection |
| Baseline | SC-7(7) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. This is preventing split tunneling. A split tunnel in effect creates an external connection to the internal network resources, and that can be easily compromised. | Prevent Split Tunneling For Remote Devices | NIST SP 800-53 Revision 4 | System and Communications Protection |
| Baseline | SC-7(8) | Route Traffic To Authenticated Proxy Servers | NIST SP 800-53 Revision 4 | System and Communications Protection |
| Baseline | SC-7(9) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Failure of this control allows malicious "insiders" to initiate an attack against other DoD systems. Note that these "insiders" may actually be outsiders who have gained access to DoD systems and are using the system as a launching pad for other attacks or to increase their foothold and impact. | Restrict Threatening Outgoing Communications Traffic | NIST SP 800-53 Revision 4 | System and Communications Protection |
| Baseline | SC-7(10) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Failure of this control allows malicious "insiders" to exfiltrate terabytes of information. | Prevent Unauthorized Exfiltration | NIST SP 800-53 Revision 4 | System and Communications Protection |
| Baseline | SC-7(11) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Failure of this control means the firewall is not checking source/destination addresses, which is a low-tech means of thwarting attacks. More sophisticated means exist to get around this control when it is working correctly. | Restrict Incoming Communications Traffic | NIST SP 800-53 Revision 4 | System and Communications Protection |
| Baseline | SC-7(12) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Based on the importance of host-based protection across the DoD. | Host-based Protection | NIST SP 800-53 Revision 4 | System and Communications Protection |
| Baseline | SC-7(13) | Isolation Of Security Tools / Mechanisms / Support Components | NIST SP 800-53 Revision 4 | System and Communications Protection |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .