Attachment_G_-_AEL_Specifications_for_the_Department_of_State_TEMPEST_Products.docx

Specifications for the Department of State TEMPEST Products Approved Equipment List (AEL)

Summary

1. The Department of State (DoS or the Department), through requirements for testing, adjudication and acceptance, approves the addition of new information technology (IT), be it software, hardware, TEMPEST or Commercial off the Shelf (COTS). This document details to all parties the requirements and steps needed to approve new TEMPEST products. All TEMPEST IT products must be sponsored, either through a competitive process or by a DoS office direct sponsorship. The Department also employs this process for approval of TEMPEST IT equipment, for use in DoS facilities, by other government agencies.

Through the auspices of the Certified TEMPEST Technical Authority (CTTA), the Department requires a TEMPEST product manufacturer (TPM) be certified as a Certified TEMPEST Product Manufacturer by NSA and to comply with the production quality assurance program requirements provided herein on all associated products delivered to the Department. Through the auspices of the Information Technology Change Control Board (IT CCB), the Department requires that changes to the Department's global information technology (IT) environment, such as the introduction of new TEMPEST equipment, be approved by the IT CCB.

To initiate the approval process, a TPM certifies in writing that it is performing product assurance testing and agrees to a review of test records and data at CTTA discretion, in accordance with the guidelines provided later in this document.

For products being considered for DoS use, the TPM delivers a test plan and a test report to the CTTA. After the test plan and report are reviewed, the CTTA advises the TPM, the DoS sponsor, and the DoS laboratory whether the test plan and report are approved. If the CTTA disapproves the test plan or report, the CTTA notifies the TPM, the DoS sponsor and the DoS laboratory of the disapproval. If the CTTA approves the test plan and report, the DoS laboratory tests the initial product and sends a test report and memorandum to the CTTA recommending approval or disapproval as appropriate. If the DoS laboratory does not recommend approval, then the DoS laboratory notifies the CTTA, the sponsor, and the TPM of product failure. The sponsor, with DoS laboratory and CTTA concurrence, decides whether the product will enter a "cure" process for reconsideration. If the DoS laboratory recommends approval, and the CTTA concurs, the CTTA advises the DoS laboratory, DoS sponsor, and the TPM that the product passes testing. The sponsor then submits the product for approval to the IT CCB. The IT CCB intranet page is at http://enm.irm.state.gov/itccb_new/ITCCB_contact.htm. If the IT CCB subsequently approves the product, it will be added to the AEL for Department use.

For products being considered for other than DoS use, or for possible later DoS use, the TPM delivers a test plan and a test report to the sponsor. Sponsors are responsible for delivering test plans and reports to the CTTA. After the test plan and report are reviewed, the CTTA advises the TPM, the sponsor, and the DoS laboratory whether the test plan and report are approved. If the CTTA disapproves the test plan or report, the CTTA notifies the TPM, the DoS sponsor and the DoS laboratory of the disapproval. If the CTTA approves the test plan and report, the DoS laboratory tests the initial product and sends a test report and memorandum to the CTTA recommending approval or disapproval as appropriate. If the DoS laboratory does not recommend approval, then the DoS laboratory notifies the CTTA, the sponsor, and the TPM of product failure. The sponsor decides if the product is to enter a "cure" process for reconsideration. If the DoS laboratory recommends approval, and the CTTA concurs, the CTTA advises the DoS laboratory, DoS sponsor and the TPM that the product passes testing. The product will be added to the "other than DoS use" AEL list. If a product is later considered for DoS ClassNet use, the DoS sponsor submits the product for approval to the IT CCB. The IT CCB intranet page is at http://enm.irm.state.gov/itccb_new/ITCCB_contact.htm. If the IT CCB subsequently approves the product, it will be added to the AEL for Department use.

To verify that performance specifications are continually met, production lot sample testing is to be done on a random basis throughout the production of the product.

Applicable Documents

2. The Department recognizes NSTISSAM TEMPEST/l-92 as the current performance specification for TEMPEST countermeasures. The Department also recognizes NSA Specification 91-25 as the performance specification for identified RED signals beyond the scope of NSTISSAM TEMPEST/l-92. The Department further authorizes the selected reduction in testing from the requirements stated in NSTISSAM TEMPEST/l-92 for Level I, Level II, and Level III equipment as described in Reduced TEMPEST Requirements for Approved Equipment List Products (DOS RS 07-13). DOS RS 07-13 is a classified document and as such cannot be appended to this specification, but it is available from the CTTA to authorized personnel.

Equipment and System Descriptions

3. Processing equipment interconnected with metallic conductors must be tested as a complete system. A system is defined as the CPU (inclusive of but not limited to workstations, thin clients, laptops, etc.), monitor, keyboard, mouse and any other peripheral connected with non-fiber optic connections. Equipment having only fiber optic connections will be tested individually. For example, a laser printer connected to a PC via parallel cable or USB cable must be tested with the PC as a complete system. However, a laser printer connected to a PC via fiber optic cable will be tested independently. This applies but is not limited to printers, copiers, scanners, fax machines, network switches, network routers, servers, and hubs.

Process to Achieve AEL

4. To have a product included on the AEL or other government agency list for use in a DoS facility, the TPM must submit to the DoS CTTA or the other government agency sponsor the documentation identified in paragraph 6 of this specification. The TPM then provides (at no cost to the Department) a sample of the production unit for testing and inspection against the specified requirements, either directly to the DoS laboratory or through a sponsoring Government agency. Department testing of the production units will be non-destructive and the sample will be received from and then returned to the TPM or the sponsoring USG agency or office after testing is complete. If the product is being considered for DoS use, after CTTA approval, the product will be submitted by the sponsor to the IT CCB for approval before inclusion on the AEL. The sponsoring DoS or USG agency or office will notify the TPM of the IT CCB action and AEL inclusion.

Government Quality Assurance Testing

5. All TEMPEST production units purchased by the Department are to undergo DoS random sampling quality assurance testing for TEMPEST performance prior to deployment. The sampling rate is determined by the CTTA from a review of both vendor supplied test data and DoS test data. When a test failure is encountered, additional samples will be tested. Specific models will be deemed non-compliant if three production units of the same model fail testing. A report of failure will also be filed by the CTTA with the proper NSA office. The failed model must then go through the deficiency resolution requirements process in order to be reconsidered. This process requires that TPMs must agree to satisfactorily complete the Deficiency Resolution Requirements (paragraph 14), and to correct the deficiency in any purchased units. Once all units have been corrected, the Department will restore the product model to compliant status with a notification sent by the CTTA to the proper NSA office.

TPM Responsibilities

6. With a proper DD-254 in place, all TPMs must submit the following documentation to the CTTA (address to be included in DD-254 or RFQ) on electronic media (file names must include model number) and paper copy prior to any DoS testing. The CTTA is the final authority on determining if the proper documentation has been received.

A. A Certified TEMPEST Professional Level II (CTPII) signed copy of the TEMPEST test plan and report for the product that is in accordance with NSTISSAM TEMPEST/l-92 paragraph 6.8. This document will be classified.

B. An unclassified TEMPEST Critical Features List (CFL) for the product.

C. An unclassified product Critical Installation Guide for use by equipment installers at DoS field sites. This document should include instructions for peripheral cabling, if appropriate.

D. A statement on company letterhead from the manager authorized by the TPM, that the company will comply with all requirements identified in the Product Assurance Certification section.

E. A warranty to cover 4.5 years of service. If periodic or preventive maintenance is required to ensure compliance, TPM must provide details.

7. All TEMPEST products will display the model number on the top, front or another readily visible surface. Model numbers must end with the appropriate designation defined in DOS RS 07-13. Model numbers must not contain reference to the Department or any DoS program. Also, literature must not associate any product with the Department.

8. All TEMPEST product cabling, with the exception of the power cord, must comply with the marking convention identified in DOS RS 07-13.

9. All TEMPEST products that utilize an external power cord or power adapter with countermeasures technology incorporated, e.g., shielded cable, embedded power line filter, ferrite core, etc., MUST use a power cord or adaptor designed to prevent it from being easily replaced with an unapproved substitute. Such a design could include, but not necessarily be limited to, brackets that hold the cord in place or screw type connectors.

10. Product Assurance Certification. Prior to acceptance and inclusion of any product on the AEL, the TPM must submit the documentation identified in paragraph 6 of this specification.

A. Product Configuration Change Procedure. The TPM must ensure that no changes to materials or processes are made to the product that could degrade the performance integrity of the product. The CFL will constitute a basis upon which all engineering changes are measured to determine whether the changes could affect the performance integrity of the product. The engineers responsible for the performance design of the product must ensure that all engineering change orders (ECO) receive a proper performance assessment by a CTPII prior to implementation. A summary of all changes under consideration and the resulting impact on the RF performance of the product must be submitted from the CTPII to the DoS CTTA for review prior to DoS receipt of product containing the change.

B. TPM's Responsibilities for ECOs That Affect Critical Features. TPM responsibilities for those engineering changes that do affect a critical feature or could affect the RF performance integrity are as follows:

1) The design engineer or CTPII must determine that the engineering change has an effect or potential effect on the performance integrity of the product or affects a TEMPEST critical feature.

2) The TPM must submit to the DoS CTTA notification of the ECO along with the design engineer's and the CTPII's technical assessment and supporting documentation, (e.g., test plan and test report, as appropriate).

3) The ECO will contain, as a minimum, the approval signature of the design engineer and the TPM's CTPII.

4) The ECO must be marked as affecting a critical feature.

5) The critical features list will be updated to incorporate the design change.

C. TPM's Responsibilities for ECOs That Do Not Affect Critical Features. TPM responsibilities for those engineering changes that do not affect a critical feature and do not affect the RF performance integrity of the products areas follows:

1) The design engineer and CTPII will determine that the ECO has no effect or potential effect on the RF performance integrity of the product and does not affect a critical feature.

2) The ECO can be approved by the design engineer and CTPII.

3) All ECOs must be available to the Department for review during annual audits.

4) The configuration baseline list will be updated in accordance with Paragraph 6.B.

Department Auditing

11. Department Audits.

A. The Department may request an audit be conducted of a particular product at the TPM's facility. The audit is to be conducted at the discretion of the Department, to include the option of using another USG organization to perform the audit. This may be done to ensure that no unauthorized changes have been made to the manufacturing process or the product configuration that could affect the performance integrity, and to verify the continuing accuracy and completeness of the Process Assessment and the completeness of the technical drawings and lists. The Department will provide the TPM two weeks advance notice of each audit.

B. The Department may request an audit be conducted of the TPM's facility to review documentation, test data and records, ECOs, and quality assurance documentation related to any or all products delivered to the Department since the last audit. The audit is to be conducted at the discretion of the Department, to include the option of using another USG organization to perform the audit. This audit may also review documentation and production line processes of product that is being produced for delivery to the Department. The Department will negotiate with the TPM four weeks in advance for the date(s) of this audit.

TPM Production Testing and Inventory Reporting

12. TPM Production Tests. The TPM is required to perform Product Assurance TEMPEST testing on each production lot based on Quality Assurance sampling criteria given in Table 1 below. A production lot is defined as a maximum of one year or whenever a production line is subjected to process or personnel changes considered to be major by normal industry standards. Testing that is required for an ECO evaluation is not part of the sampling (i.e., an ECO cannot be approved by sample testing). This test data must be retained for the duration of the product's life cycle plus 5 years, and may be requested by Department representatives during audits. The intent of the sampling program is to ensure compliance and conformity across the production lot. Samples should be randomly selected and uniformly distributed over the production lot.

Table 1. TPM Production TEMPEST Testing Sampling Rate

* Fractional sampling size must be rounded up.

13. Annual Production and Inventory Report. To ensure Department product lists are current and as a condition of continued product inclusion on the active AEL, the TPM must submit to the Department, no later than 1 March of each year, an annual Production and Inventory Report which contains the following information for each product procured by the Department:

(1) Company name and location.

(2) Product model number.

(3) Number of units delivered to the Department in the calendar year (January through December) preceding date of the report.

(4) Whether or not the Product is still available for new or continued production.

(5) If the Product is no longer produced, note date of last production and serial number of last unit produced.

Deficiency Resolution

14. Deficiency Resolution Requirements. To maintain product inclusion on the AEL, TPMs are required to take corrective action to resolve confirmed product deficiencies. A confirmed design, material, or production lot deficiency exists when a product is found to perform below the requirements of this Specification and the cause is not unique to one unit of the product lot or clearly caused by incorrect handling, operation, installation or maintenance. The TPM must provide a detailed description of the failure, the cause of the failure, corrective action to fix the failure, and test data validating the fix. Subsequently, the TPM will provide written documentation on how it will ensure that the failure does not occur again on that product. For a product to remain on the AEL, the TPM must provide (at no cost to the Department, including shipping, testing, and other administrative costs), modification kits and/or services to correct deficiencies in all purchased units. In the event a TPM chooses not to or is unable to resolve confirmed deficiencies, the Department's CTTA may initiate removal of the TPM's product from the AEL along with an associated reduction in past performance metrics.