SB1341-16-RQ-0331_Attachment_1_Specifications-_Statement_of_Work_(Ref._16-02997)_revised_2016-05-12.pdf

Request for Quotation: SB1341‐16‐RQ‐0331 Attachment 1: Specifications/ Statement of Work (revised 2016‐05‐12)

Privileged Access Management Services for Non‐Windows Systems and Applications (PAMS) and Common Access Provisioning Services (CAPS)

Specifications/Statement of Requirements

A. Background

In September, 2008, The Office of Information Systems Management (OISM) purchased Centrify Direct Control Software licenses from Centrify, Inc. to integrate OISM’s non‐windows servers into the NIST Enterprise Active Directory (AD) Domain. Integration with the NIST Enterprise AD Domain allowed for automation of Account Provisioning and management and centralization of Authentication and Authorization for Privileged User Access as required by the Federal Information Security Management Act (FISMA). In 2011 and 2013, the Enterprise Services Division (ESD) purchased additional Centrify Suite Software licenses to continue the process of integrating some non‐Windows Servers (Linux and Unix Operating systems) with the NIST Enterprise AD Domain.

With the recent OMB mandate to define methods and process for managing privileged access on federal systems, ESD (now Infrastructure Services Division (ISD)), must implement a means to meet this mandate.

Centrify provides critical components to establishing centralized management of privileged accounts for non‐Windows systems and can include Windows systems to meet all the technical requirements for the integration of these systems with the NIST Enterprise AD Domain.

B. Purpose /Objectives The PAMS/CAPS initiative comprises two components to serve the requirements on privileged access management and system‐to‐system based integration on provisioning access control privileges. PAMS will provide an integrated set of services for ISD to manage privileged access controls for non‐Windows systems/applications by extending the current Identity & Access Management (IDAM’s) functionality.

CAPS will provide a system‐to‐system based access privilege provision interface and integrate with IDAM to provision changes to target infrastructural repositories utilizing the Centrify solution and leveraging centralization of the NIST Enterprise Active Directory. This will establish a common service framework to interact and leverage existing process in integrated systems to obtain approval on the access requests before provisioning them to target repositories through IDAM, and to provide feedback and audit services to the integrated systems upon privilege and account status changes.

C. Technical Requirements The government requires a privilege access management solution for non‐Windows and Windows‐ based systems. Technical requirements:

Mandatory Requirements for Active Directory Bridging and Identity Enforcement:

Active Directory "client" for UNIX, Linux and Mac; fully supports Kerberos and offers broad platform support

Completion of Federal Common Criteria Certification at EAL level 2 or higher

Federal Information Processing Standard: FIPS 140‐2 Validated

JITC‐Approved Smart Card Authentication for HSPD‐12 compliance

Works with existing Active Directory schema; i.e. does not require schema extensions

Supports RFC 2307 without need for additional proprietary schema extensions

Common identity policy management across Unix, Linux, and Windows

Stores identity policies inside Active Directory and does not require additional servers and infrastructure

Intelligent Domain Controller discovery and dynamic selection via Site awareness

Globally unique identity namespace established for new users and new systems, that is used across the environment unless overridden

Support for multiple UNIX identities tied to a single AD Account, i.e. does not force UID rationalization

Support for local caching of credentials (enables offline login)

Supports Mac & Linux smartcard login to Active Directory for SSO to Windows Integrated services and applications

WebApp Support: Supports AD‐ and ADFS‐based authentication for Java‐ and J2EE‐based applications running on both UNIX/Linux and Windows systems

Provides large number of AD‐based Group Policy objects for UNIX/Linux and Mac

Centralized license management; does not require reinstall or license key deployment on each system

Mandatory Requirements for Privileged Identity Management (PIM)

Common Privileged identity management across Unix, Linux, and Windows

Completion of Federal Common Criteria Certification at EAL level 2 or higher

Federal Information Processing Standard: FIPS 140‐2 Validated

JITC‐Approved Smart Card Authentication for HSPD‐12 compliance

Ability to grant temporary access rights based on user Role assignment to individual computers or groups of computers.

Stores PIM rights and roles inside Active Directory and does not require additional servers and infrastructure

Does not force delegation of PIM administrative privileges along OU boundaries

Grant users the rights to execute commands with elevated privileges to eliminate need for access to privileged accounts and passwords

Ability to assign users a "Restricted Environment" with access only to a specific "whitelist" of commands

Set time periods when a role can access a system

Does not force assignment of elevated Privileges along OU boundaries

Table 1. Required Items/Components

Line Item Model/Component # Description Quantity Unit

0001 CSSE‐ITSO‐SL Centrify Unix Licenses 425 EA

0002 CSSE‐ITSO‐W‐SL Centrify Windows Licenses 425 EA

0003 CSSE‐ITSO‐PM1Y Centrify Unix Licenses Maintenance 425 EA

0004 CSSE‐ITSO‐PM1Y Centrify Windows License Maintenance 425 EA

0005 CCS‐CSSE‐OSJS Centrify Jump Start Professional Services 4251 LO

Table 2 lists optional items/features for upgrade that may be acquired, either as part of the initial purchase or subsequently during the period of performance of this effort. The Government reserves the right to accept or decline all or a combination of the proposed optional item/features in addition to the required items (for example, the required items plus optional item 1 and 2; or only the required items and no optional items), as applicable.

The required items and selected combination will be determined at time of award, and shall be considered an upgrade to the required specifications and not an additional standalone order. It is acceptable for one or more of the optional items to be included by default in the required items offering, or for the contractor to decline to offer any of the optional items.

Table 2. Optional items for the Required System(s)

Line Item Model/Component # Description Quantity

CSEEU‐SLU

Centrify Suite Enterprise Edition ‐ Upgrade from Standard Edition ‐ Software License

0002 CSEEU‐SLU‐PM1Y

Centrify Suite Enterprise Edition ‐ Upgrade from Standard Edition ‐ Premium Maintenance

CSPEUSE‐SLU

Centrify Suite Platinum Edition ‐ Upgrade from Standard Edition ‐ Software License

0004 CSPEUSE‐SLU‐PM1Y

Centrify Suite Platinum Edition ‐ Upgrade from Standard Edition ‐ Premium Maintenance

Optional Upgrade Features: User Session Auditing

Unified integration of session auditing with identity, authorization and PIM policies

Single product architecture for auditing, authentication, authorization, group policy, PIM and app support

Detailed, non‐intrusive capture of user sessions on UNIX/Linux and Windows systems

Stores detailed user‐level audit data in a SQL database for ease of reporting and archiving

Comprehensive, easy‐to‐use search and query capabilities of user session activity

Role‐based access to query and replay user sessions, managed by AD groups

Session events are selectable, filterable and sortable for easy navigation

Export of user sessions to a text transcript or movie file for sharing or reuse

Optional Upgrade Features: Server Protection and Encryption

Supports DirectAccess, Active Directory and the native IPsec support in modern operating systems

Blocks "untrusted" systems from communicating with "trusted" systems

Enables optional end‐to‐end encryption of data in motion

Software and policy based solution; no hardware required

Requires no changes to network topology or applications

Automates provisioning of certificates on UNIX systems

D. Period of performance

12‐months from date of award.

E. Place of Performance

NIST Gaithersburg, MD