SAFE Technical Characteristics Attachment.docx

Technical Characteristics

· External Certification Authority (ECA): The Government requires the use of an approved ECA for the issuance of Secure Socket Layer (SSL) certificates. The use of ECA is critical for DoD SAFE to maintain secure and trusted communication. This ensures the platform's digital identity remains valid, enabling continued encrypted data exchange and preventing access disruptions.

· System Performance and Scalability

· Supports IPv4/IPv6 networking with a goal of IPv6-only, and will modernize architecture for autoscaling to improve scalability and resilience

· File Sharing Threshold: Supports file sharing with a 10GB threshold and an objective of 40 GB

· Interfaces with databases for data management, file storage for file sharing, and NetOps capabilities for provisioning, configuration, incident response, deployment, data collection, and visualization

· Traffic Volume Threshold: Supports total upload/download traffic with a threshold of 800 GB per hour and an objective of 1.5 TB per hour

· Availability: Maintains an availability threshold of 98.5% with an objective of 99.95%

· Mean Time to Repair (MTTR): Maintains a Mean Time to Repair (MTTR) threshold of 24 hours with an objective of 8 hours

· User Access and Identity Verification

· Secure access via CAC/PKI authentication, identity/access management controls, sender content revocation, availability on NIPR/commercial networks, and safeguarded admin management

· Displays transaction information, provides real-time updates, supports CAC authentication via E-ICAM IdP, tailors access by user type (DoD/guest), and offers a simple, intuitive interface for easy file transfers

· Maintenance mode allowing administrators to minimize disruption during updates, and the system offers different access levels and service offerings for authenticated and guest users

· DoD Network (DoDIN): Provides interface to the DoD Information Network (DoDIN) for authenticated DoD user access

· Public Internet: Enables access to non-DoD guest users via a commercial/public internet interface

· Data Security and Loss Prevention

· Enhanced security with file type filtering, restricted file handling (no nested compression), unique access for recipients, efficient batch uploads (25+ files), and a 7-day data retention policy for compliance

· Robust security features with proactive threat protection (CND "break and inspect"), multi-factor authentication (CAC, partner access), secure guest user management, Zero Trust DLP (CUI/PII/PHI handling), malware/content control, STIG/legal compliance (5-year retention), and secure admin access for incident response with Zero Trust architecture

· Comprehensive logging of all file transactions (uploads/downloads, malware detection, failures) including sender/recipient details, filenames, timestamps, and administrative actions at application and OS levels

· Maintains secure Authority to Operate (ATO) and uses trusted, government-approved SSL certificates for all public web interfaces

· System complies with National Archives and Records Administration (NARA) regulation 36 C.F.R. 1228.270

· Easy web-based access and file sharing (10GB+ uploads) with dedicated, secure infrastructure, monitored for performance, security, and auditing

· Email Notifications: Generates email notifications to inform recipients of sent files and senders of successful delivery

Responses may include information that addresses the following:

1. System Performance and Scalability

a. Describe your architecture's ability to maintain service performance and prevent degradation during sudden spikes in user activity and data throughput.

b. What is your system's demonstrated capability for handling large file transfers, specifically for individual files of 10GB or greater?

c. Detail your solution's integrated malware scanning capabilities for both uploaded and downloaded files.

2. User Access and Identity Verification

a. Explain the proposed mechanism for authenticated CAC-holding users to sponsor guest accounts for external collaborators.

b. How does your identity verification process for all users, including sponsored guests, align with Zero Trust principles?

3. Data Security and Loss Prevention

a. How would your solution implement Zero Trust-aligned Data Loss Prevention (DLP) to ensure a recipient’s authorization to access a file by verifying their clearance and need-to-know attributes before granting access?

4. External Partner Federation

a. Detail the architecture for providing tiered access and privileges to non-DoD governmental partners.

b. Explain how this access model could integrate with a pay-for-service agreement.