SOO Appendix A Requirements Traceability Matrix.xlsx
XLSX spreadsheet 127 KB Posted
- Solicitation number
- 75N97023R00006
About this file
This document is a Requirements Traceability Matrix for the Center for Information Technology Identity, Credential, Access Management Modernization Proof of Concepts project solicitation number 75N97023R00006 issued by the Department of Health and Human Services National Institutes of Health. The matrix compiles functional and technical requirements across four categories of General, Authentication, Directory, and SASE requirements for vendors to modernize the NIH's identity and access management platform. Vendors are to respond in the designated columns whether they meet each requirement with explanations. Requirements include supporting cloud-agnostic infrastructure, 99.99% system availability, FedRAMP authorization, NIST compliance, identity federation, multifactor authentication, Active Directory integration, zero trust network access, cloud access security, and endpoint security capabilities.
View the file
Other files
Show all 11
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Cover
| Center for Information Technology (CIT) Identity, Credential, Access Management (ICAM) Modernization - Proof of Concepts (POCs) - Appendix A | ||
| Requirements Traceability Matrix (RTM) | ||
| RFP: 75N97023R00006 | ||
| Version 1.0 |
The Center for Information Technology (CIT) has established the National Institutes of Health (NIH) Identity, Credential, and Access Management (ICAM) Modernization Project to increase the availability, functionality, and the cybersecurity resiliency of NIH resources. The objective of the Requirements Traceability Matrix (RTM) is to compile the full set of requirements necessary for a modernized ICAM platform, which have been gathered during requirements gathering sessions with various stakeholders across NIH Institutes and Centers (ICs). This document lists the functional and technical requirements for the solution(s)/vendor(s) that are ultimately selected. As a vendor being evaluated, please navigate through each of the four requirements tabs and respond Yes/No/Partial, with an explanation as to whether or not you provide each requirement, in the designated green "Vendor Responses" columns.
&"Arial,Bold"&G <Insert client logo>
&"Arial,Bold"&G <Insert client logo>
&"Arial,Bold"&G <Insert client logo>
&"Arial,Bold"&G <Insert client logo>
&"Arial,Bold"&G <Insert client logo>
&G
&8© 2010 Deloitte Development LLC. All Rights Reserved. &8&P of &N &8<Enter Project Name> &F
&8© 2010 Deloitte Development LLC. All Rights Reserved. &8&P of &N &8<Enter Project Name> &F
&8© 2010 Deloitte Development LLC. All Rights Reserved. &8&P of &N &8<Enter Project Name> &F
&8© 2010 Deloitte Development LLC. All Rights Reserved. &8&P of &N &8<Enter Project Name> &F
&8© 2010 Deloitte Development LLC. All Rights Reserved. &8&P of &N &8<Enter Project Name> &F
&8&P of &N &8Center for Information Technology (CIT) Identity, Credential, Access Management (ICAM) Modernization - Proof of Concept> &F
Requirements - GEN
| Requirements Traceability Matrix Appendix A - General Requirements | Vendor Responses | Internal Evaluation Team | |||||
| Requirement ID | Requirement Category | Requirement Description | Importance | Functionality | Vendor Response | Explanation | Feedback |
| Enter the unique ID number used to identify this requirement. | Indicate the specific category the requirement falls under (User Experience, Technical, Cloud/Infrastructure, Security, Operational, Compliance/Regulatory) | Provide a short, high-level description of the requirement. Note: all technical terms and acronyms are defined in the Glossary tab. | Indicate the requirement importance/priority: Mandatory, Preferred, Optional/Deferred | Indicate whether the requirement is functional or non-functional. | Respond Yes, No, or Partial based on whether or not you (the vendor) meet this requirement. | Include an explanation as to how you (the vendor) meet or do not meet this requirement. | For Evaluator Only: Provide any feedback or notes you have based on the vendor's response. |
| GEN-01 | Cloud/Infrastructure | Solution shall enable a cloud-agnostic infrastructure and integrate with existing or future cloud service providers (CSPs) (e.g., GCP, AWS, Azure, etc.) | Mandatory | Functional | |||
| GEN-02 | Operational | Solution shall provide real-time metrics on end-user sessions, user activity, and user transaction history | Mandatory | Non-Functional | |||
| GEN-03 | Operational | Solution shall provide reporting capability for metrics such as system and application health status and availability | Mandatory | Non-Functional | |||
| GEN-04 | Cloud/Infrastructure | Solution shall support on-premise, cloud-based, and hybrid systems and applications | Mandatory | Functional | |||
| GEN-05 | Compliance/Regulatory | Solution shall be FedRAMP (Federal Risk and Authorization Management Program) Authorized | Mandatory | Non-Functional | |||
| GEN-06 | Compliance/Regulatory | Solution shall adhere to NIST 800-53 Rev 5 standards and procedures | Mandatory | Non-Functional | |||
| GEN-07 | Compliance/Regulatory | Solution shall adhere to NIST 800-63 standards and procedures | Mandatory | Non-Functional | |||
| GEN-08 | Operational | Solution shall provide 99.99% system availability (4 nines) across all three capabilities | Mandatory | Functional | |||
| GEN-09 | Operational | Solution shall provide 99.999% system availability (5 nines) across all three capabilities | Preferred | Functional | |||
| GEN-10 | Cloud/Infrastructure | Solution shall minimize the impact to applications and services (hosted in an air-gap network) that must remain on-premise | Mandatory | Non-Functional | |||
| GEN-11 | Compliance/Regulatory | Solution shall adhere to standards and procedures outlined in the Executive Order 14028, Improving the Nation's Cybersecurity | Mandatory | Functional | |||
| GEN-12 | Compliance/Regulatory | Solution shall adhere to standards and procedures outlined in the OMB Memorandum M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles | Mandatory | Functional | |||
| GEN-13 | Technical-Integration | Solution shall integrate with applications and systems hosted by external third-party entities such as federal agencies | Preferred | Functional | |||
| GEN-14 | Operational | Solution shall support (at minimum) 40,000 internal NIH users and 2 million external federated users | Mandatory | Non-Functional | |||
| GEN-15 | Technical-Integration | Solution shall expand mobile device support beyond devices enrolled in MobileIron | Optional/Deferred | Functional | |||
| GEN-16 | Security | Solution shall centralize endpoint management for all devices including servers | Optional/Deferred | Functional | |||
| GEN-17 | Compliance/Regulatory | Solution shall adhere to standards and procedures outlined in the OMB Memorandum M-21-31, Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents | Mandatory | Functional | |||
| GEN-18 | Cloud/Infrastructure | Solution shall be compatible with operating systems (e.g. Windows, macOS, Linux) and mobile device operating systems (e.g. Android, IOS, etc.) | Mandatory | Functional | |||
| GEN-19 | Cloud/Infrastructure | Solution shall provide capability for internal and external users to securely authenticate to Cloud Service Providers (CSPs) for both console and programmatic access | Mandatory | Functional | |||
| GEN-20 | Cloud/Infrastructure | Solution shall provide NIH Cloud hosted applications end-to-end Identity management independent from NIH onPrem data center during events such as declared Disaster and non-disaster main campus outages | Mandatory | Functional | |||
| GEN-21 | Security | Solution shall collect only the minimum amount of personal information necessary to accomplish its intended purpose | Preferred | Functional | |||
| GEN-22 | Security | Solution shall have an automated capability in place for decommissioning of accounts in a secure manner | Mandatory | Functional | |||
| GEN-23 | Security | Solution shall have Threat Intelligence (TI) capabilities to collect, centralize, and aggregate security threat analysis and remediation based on the NIH Incident Response (IR) plan | Mandatory | Functional | |||
| GEN-24 | Security | Solution shall provide near real-time alert and notification capability for identified threats and critical vulnerabilities | Mandatory | Functional | |||
| GEN-25 | Compliance/Regulatory | Solution shall maintain compliance with Section 508 of the Rehabilitation Act on making technology accessible to everyone | Mandatory | Functional |
Requirements - AUT
| Requirements Traceability Matrix Appendix A - Authentication Requirements | Vendor Responses | Internal Evaluation Team | |||||||
| Requirement ID | Technical Field | Requirement Category | Requirement Description | Importance | Functionality | Vendor Response | Explanation | Feedback | |
| Enter the unique ID number used to identify this requirement. | Indicate the specific technical field the requirement falls under for each ICAM Service Category. | Indicate the specific category the requirement falls under (User Experience, Technical, Cloud/Infrastructure, Security, Operational, Compliance/Regulatory) | Provide a short, high-level description of the requirement. Note: all technical terms and acronyms are defined in the Glossary tab. | Indicate the requirement importance/priority: Mandatory, Preferred, Optional/Deferred | Indicate whether the requirement is functional or non-functional. | Respond Yes, No, or Partial based on whether or not you (the vendor) meet this requirement. | Include an explanation as to how you (the vendor) meet or do not meet this requirement. | For Evaluator Only: Provide any feedback or notes you have based on the vendor's response. | |
| AUT-TI-05 | CDM | Technical-Integration | Solution shall integrate with SIEM (Security Information and Event Management) tools, such as Splunk | Mandatory | Functional | ||||
| AUT-UX-04 | Certificate-based AuthN | User Experience | Solution shall be able to provide authentication for various IT assets (laptops, tablets, Workstation on Wheels [WOW], smartphones) and medical equipment (laboratory and electronic health devices, microscopes) | Mandatory | Functional | ||||
| AUT-TI-20 | Certificate-based AuthN | Technical-Integration | Solution shall support Application-to-Application authentication using PKI certificates | Mandatory | Functional | ||||
| AUT-TI-19 | Command-Line AuthN (RAS) | Technical-Integration | Solution shall support user-performed command-line authentication | Preferred | Functional | ||||
| AUT-TI-21 | Command-Line AuthN (RAS) | Technical-Integration | Solution shall restrict Application-to-Application authentication based on IP address criteria | Mandatory | Functional | ||||
| AUT-SEC-04 | Conditional Access | Security | Solution shall restrict access by IdP, IAL, AAL, and IAP | Mandatory | Functional | ||||
| AUT-TI-30 | Conditional Access | Technical-Integration | Solution shall integrate with social login IdP(s) for re-authentication | Mandatory | Functional | ||||
| AUT-TI-33 | Conditional Access | Technical-Integration | Solution shall support SEFT (Secure Email and File Transfer Service) to transfer sensitive files securely | Preferred | Functional | ||||
| AUT-TI-37 | Conditional Access | Technical-Integration | Solution shall support Azure AD conditional access signals to enforce security policies | Mandatory | Functional | ||||
| AUT-OP-13 | Conditional Access | Operational | Solution shall require separate access to production and non-production environments | Preferred | Functional | ||||
| AUT-TI-13 | Identity Federation | Technical-Integration | Solution shall integrate with identity providers (IdPs) including Login.gov, ID.me, InCommon, Google | Mandatory | Functional | ||||
| AUT-UX-02 | Identity Federation | User Experience | Solution shall offer authentication methods which minimize connectivity and bandwidth issues for international users | Preferred | Non-Functional | ||||
| AUT-UX-03 | Identity Federation | User Experience | Solution shall process user authentication requests in alignment with NIST-800-63 Identity Assurance Level (IAL) and Authenticator Assurance Level (AAL) guidelines | Preferred | Functional | ||||
| AUT-CR-01 | Identity Federation | Compliance/Regulatory | Solution shall post authentication consent policy by Identity Provider (IdP) | Mandatory | Functional | ||||
| AUT-OP-11 | Identity Federation | Operational | Solution shall support Multilateral Federation to facilitate collaboration across organizations around the world (e.g. for InCommon) | Mandatory | Functional | ||||
| AUT-OP-12 | Identity Federation | Operational | Solution shall support InCommon and the REFEDS (Research and Education FEDerations group) Assurance Framework to manage access control risks | Mandatory | Functional | ||||
| AUT-UX-01 | MFA | User Experience | Solution shall challenge the authenticated user to re-authenticate once the session times out | Mandatory | Functional | ||||
| AUT-TI-02 | MFA | Technical-Integration | Solution shall support secure Multifactor Authentication (MFA) for applications as well as users | Mandatory | Functional | ||||
| AUT-TI-28 | MFA | Technical-Integration | Solution shall be able to integrate with various authentication mechanisms/tools, including but not limited to the Microsoft Authenticator application | Mandatory | Functional | ||||
| AUT-TI-29 | MFA | Technical-Integration | Solution shall integrate MFA services with hardware and software RSA multi-factor tokens | Mandatory | Functional | ||||
| AUT-OP-06 | MFA | Operational | Solution shall provide Multi-Factor Authentication (MFA) using various methods like Push Notification, OTP (One-Time Password) and TOTP (Time-based One Time Password algorithm) | Mandatory | Functional | ||||
| AUT-OP-08 | MFA | Operational | Solution shall support Multifactor Authentication (MFA) that is resistant to common cybersecurity attacks (e.g. phishing, MFA fatigue) | Preferred | Functional | ||||
| AUT-TI-40 | MFA | Technical-Integration | Solution shall support FIDO2 as a MFA method for accessing workstations and servers | Mandatory | Functional | ||||
| AUT-TI-44 | MFA | Technical-Integration | Solution shall support Windows Hello for Business, allowing Azure Multifactor services to be used for logical access to workstations, servers, and web applications/services | Mandatory | Functional | ||||
| AUT-OP-04 | Monitoring | Operational | Solution shall provide a list of user access/privileges and recertify them on the cadence defined in NIST SP 800-53 Rev.4/5 | Preferred | Functional | ||||
| AUT-OP-05 | Monitoring | Operational | Solution shall provide APIs for returning component/feature status to report on the availability of each component (IDPs, Backends, RAS features) | Mandatory | Functional | ||||
| AUT-OP-09 | Monitoring | Operational | Solution shall include a feature for nearly immediate session disablement in case of an event compromising system integrity | Preferred | Functional | ||||
| AUT-SEC-06 | Monitoring | Security | Solution shall be capable of collecting device fingerprint data (e.g. geo-location, user IP address, browser data) | Preferred | Functional | ||||
| AUT-TI-06 | NIH Login | Technical-Integration | Solution shall provide identity-linking capability to link external user identities from multiple identity providers (IdPs) | Mandatory | Functional | ||||
| AUT-SEC-05 | NIH Login | Security | Solution shall provide reverse proxy capabilities to protect both on prem and cloud applications by providing proxy layer for authentication | Mandatory | Functional | ||||
| AUT-TI-31 | NIH Login | Technical-Integration | Solution shall support header-based authentication | Mandatory | Functional | ||||
| AUT-TI-34 | NIH Login | Technical-Integration | Solution shall link primary and secondary accounts for users needing access to multiple environments | Preferred | Functional | ||||
| AUT-TI-35 | NIH Login | Technical-Integration | Solution shall provide standardized approach for integration with legacy/homegrown applications | Mandatory | Functional | ||||
| AUT-TI-36 | NIH Login | Technical-Integration | Solution shall provide integration with API web services that supports Operational Technology (OT) systems (sensitive tenants such as Industrial Control System [ICS], Video Surveillance Systems hosted on Facilities network [FACNet]) | Mandatory | Functional | ||||
| AUT-UX-05 | NIH Login | User Experience | Solution shall provide the capability to create custom landing pages with IC-specific design and branding | Preferred | Non-Functional | ||||
| AUT-TI-38 | NIH Login | Technical-Integration | Solution shall support authentication chaining as a failover mechanism and support alternative authentication methods in case of primary authentication mechanism failure | Mandatory | Functional | ||||
| AUT-TI-41 | NIH Login | Technical-Integration | Solution shall provide cross-domain cookie support for service providers such as Grant Solutions | Mandatory | Functional | ||||
| AUT-TP-01 | OIDC/SAML | Technical-Protocols | Solution shall integrate with modern API patterns/protocols for integration with on-prem and cloud applications [e.g. Security Assertion Markup Language (SAML), Open Identity Connect (OIDC), WS federation (Web Services Federation), SOAP, REST, and HTTP] | Mandatory | Functional | ||||
| AUT-SEC-01 | OIDC/SAML | Security | Solution shall provide the ability to restrict OAuth Support Grant Types | Mandatory | Functional | ||||
| AUT-SEC-02 | OIDC/SAML | Security | Solution shall provide the ability to restrict OAuth Client Authentication methods | Mandatory | Functional | ||||
| AUT-TI-18 | OIDC/SAML | Technical-Integration | Solution shall offer PKI based solution for OAuth Client Auth | Preferred | Functional | ||||
| AUT-TI-22 | OIDC/SAML | Technical-Integration | Solution shall provide OIDC support for Single Page Applications | Mandatory | Functional | ||||
| AUT-TI-23 | OIDC/SAML | Technical-Integration | Solution shall provision account to directory, following SAML federation from given IdP | Mandatory | Functional | ||||
| AUT-TI-25 | OIDC/SAML | Technical-Integration | Solution shall modify outbound SAML to construct attributes (role, AD group name, app) as arguments to AWS for accessing AWS console and applications | Mandatory | Functional | ||||
| AUT-TI-42 | OIDC/SAML | Technical-Integration | Solution shall support dynamically constructed SAML/OIDC response attributes | Preferred | Functional | ||||
| AUT-TI-15 | Passwordless Authentication | Technical-Integration | Solution shall provide passwordless/WebAuthN MFA via biometrics and hardware authentication devices (e.g. YubiKey) | Preferred | Functional | ||||
| AUT-TI-24 | PIV | Technical-Integration | Solution shall provision account to directory, following PIV based login | Mandatory | Functional | ||||
| AUT-TI-26 | PIV | Technical-Integration | Solution shall support smart-card authentication (e.g. PIV, CAC) for all federal government agencies | Mandatory | Functional | ||||
| AUT-TI-32 | PIV | Technical-Integration | Solution shall support phishing-resistant authentication alternatives for logical access to workstations/servers if PIV cards and device-based certificates are not operational (e.g. expired certs, lost credentials) | Preferred | Functional | ||||
| AUT-TP-03 | PIV | Technical-Protocols | Solution shall provide authentication support for Derived PIV Credentials (DPCs) to authenticate users to NIH systems and applications | Mandatory | Functional | ||||
| AUT-TI-14 | Risk Based Evaluation | Technical-Integration | Solution shall leverage device trust and provide support for adaptive/risk-based authentication based on criteria such as geo-location, device, IP Address, and posture | Mandatory | Functional | ||||
| AUT-TI-03 | SaaS | Technical-Integration | Solution shall provide events-based authentication for users who do not have registered accounts with collaboration/productivity tools, such as Zoom, MS Teams, Skype, and Webex | Mandatory | Functional | ||||
| AUT-TI-04 | SaaS | Technical-Integration | Solution shall provide tenant-based authentication for users currently registered in collaboration/productivity tools | Mandatory | Functional | ||||
| AUT-TI-09 | SaaS | Technical-Integration | Solution shall integrate with Mobile Device Management (MDM) tools for authentication of devices (e.g. MobileIron, InTune) | Preferred | Functional | ||||
| AUT-TI-11 | SaaS | Technical-Integration | Solution shall provide capability for external users to authenticate to Microsoft Office 365 (M365) | Mandatory | Functional | ||||
| AUT-TI-12 | SaaS | Technical-Integration | Solution shall integrate with Microsoft Office 365 (M365) application suite for internal user authentication | Mandatory | Functional | ||||
| AUT-TI-16 | SaaS | Technical-Integration | Solution shall support custom integrations with SharePoint and SharePoint Online | Preferred | Functional | ||||
| AUT-TI-07 | Self-Service | Technical-Integration | Solution shall support self-service features to streamline application onboarding with the authentication provider and reduce time-to-delivery | Preferred | Functional | ||||
| AUT-OP-02 | Self-Service | Operational | Solution shall provide the ability to manage consents | Mandatory | Functional | ||||
| AUT-OP-03 | Self-Service | Operational | Solution shall provide OAuth Client Credential Renewal | Mandatory | Functional | ||||
| AUT-SEC-03 | Self-Service | Security | Solution shall provide the ability to view and revoke tokens issued to clients | Mandatory | Functional | ||||
| AUT-OP-07 | Self-Service | Operational | Solution shall provide delegated management of applications that enable application owners to configure their application-specific policies | Preferred | Functional | ||||
| AUT-OP-10 | Self-Service | Operational | Solution shall provide self-service capabilities for password reset issues | Mandatory | Functional | ||||
| AUT-TI-01 | SSO | Technical-Integration | Solution shall provide authentication for applications including High Performance Computing (HPC) apps that are hosted in hybrid IT environment (on-prem and cloud) | Preferred | Functional | ||||
| AUT-TP-02 | SSO | Technical-Protocols | Solution shall provide standards-based methods for network authentication such as Kerberos and RADIUS | Mandatory | Functional | ||||
| AUT-OP-01 | SSO | Operational | Solution shall offer an enterprise authentication dashboard which provides a list of available applications to single sign-on (SSO) | Optional/Deferred | Non-Functional | ||||
| AUT-TI-27 | SSO | Technical-Integration | Solution shall support Single Sign-On (SSO) and grant users access to all requested tools/services given an existing SSO session | Mandatory | Functional | ||||
| AUT-TI-39 | SSO | Technical-Integration | Solution shall integrate with ServiceNow (on-prem and cloud-based) and other IT Service Management (ITSM) tools | Mandatory | Functional | ||||
| AUT-TI-43 | SSO | Technical-Integration | Solution shall integrate with SPS (Secure Proxy Services) to validate SSO sessions | Preferred | Functional | ||||
| AUT-TI-17 | Step-Up Authentication | Technical-Integration | Solution shall support Step-Up Authentication by IdP, IAL, AAL, and IAP | Mandatory | Functional | ||||
| AUT-AP-01 | Anonymous/Pseudonymous/Personalized Access Anonymous Authentication | Technical-Integration | Solution shall comply with REFEDS Anonymous/Pseudonymous/Personalized Access Entity Category to support limited/no personalized user data. | ||||||
| The service provider shall offer service and personalization simply based on proof of successful authentication | Mandatory | Functional | |||||||
| AUT-AP-02 | Anonymous/Pseudonymous/Personalized Access Anonymous Authentication | Technical-Integration | Solution shall demonstrate that the attributes used for the entity category are not intended to provide authorization information | Mandatory | Functional |
Hide (DO NOT DEL)
| Authentication | Directory | SASE |
| PIV | LDAP | Zero Trust Network Access (ZTNA) |
| NIH Login | Federation Services | Software Defined Wide Area Network (SD-WAN) |
| SSO | Virtual Directory Services | Firewall as a Service (FWaaS) |
| Self-Service | Identity Repository | Secure Web Gateway (SWG) |
| Risk Based Evaluation | Credential Management | Micro Segmentation |
| WebAuth/FIDO2 | Replication and Synchronization | Endpoint Security |
| Passwordless Authentication | Entitlements Repository | Cloud Access Security Broker (CASB) |
| Step-Up Authentication | Dynamic Group Membership | Virtual Private Network (VPN) |
| Certificate-based AuthN | Active Directory (AD) | Trusted Internet Connections (TIC) |
| REST API | Azure Active Directory (AAD) | |
| OIDC/SAML | ||
| Conditional Access | ||
| Identity Federation | ||
| MFA | ||
| Command-Line AuthN (RAS) | ||
| SaaS | ||
| CDM | ||
| Monitoring | ||
| Anonymous/Pseudonymous/Personalized Access Anonymous Authentication |
Requirements - DIR
| Requirements Traceability Matrix Appendix A - Directory Requirements | Vendor Responses | Internal Evaluation Team | ||||||
| Requirement ID | Technical Field | Requirement Category | Requirement Description | Importance | Functionality | Vendor Response | Explanation | Feedback |
| Enter the unique ID number used to identify this requirement. | Indicate the specific technical field the requirement falls under for each ICAM Service Category. | Indicate the specific category the requirement falls under (User Experience, Technical, Cloud/Infrastructure, Security, Operational, Compliance/Regulatory) | Provide a short, high-level description of the requirement. Note: all technical terms and acronyms are defined in the Glossary tab. | Indicate the requirement importance/priority: Mandatory, Preferred, Optional/Deferred | Indicate whether the requirement is functional or non-functional. | Respond Yes, No, or Partial based on whether or not you (the vendor) meet this requirement. | Include an explanation as to how you (the vendor) meet or do not meet this requirement. | For Evaluator Only: Provide any feedback or notes you have based on the vendor's response. |
| DIR-TI-04 | Active Directory (AD) | Technical-Integration | Solution shall aggregate information from external/untrusted Active Directories (ADs) that are not in the AD Forest | Mandatory | Functional | |||
| DIR-OP-03 | Active Directory (AD) | Operational | Solution shall support ActiveRoles to manage objects in Active Directory | Mandatory | Functional | |||
| DIR-OP-04 | Active Directory (AD) | Operational | Solution shall provide direct access to active directory audit logs for application troubleshooting purposes | Preferred | Functional | |||
| DIR-TI-14 | Active Directory (AD) | Technical-Integration | Solution shall support data source integration with Active Directory | Mandatory | Functional | |||
| DIR-TI-30 | Active Directory (AD) | Technical-Integration | Solution shall provide capability to integrate Active Directory with VDS | Mandatory | Functional | |||
| DIR-TI-31 | Active Directory (AD) | Technical-Integration | Solution shall integrate with mobile device management to automate, secure, and administer devices using MobileIron | Mandatory | Functional | |||
| DIR-TI-32 | Active Directory (AD) | Technical-Integration | Solution shall integrate with Unified Endpoint Management (UEM) | Mandatory | Functional | |||
| DIR-OP-11 | Active Directory (AD) | Operational | Solution shall provide at minimum 100,000 security groups and group memberships in AD | Mandatory | Non-Functional | |||
| DIR-TI-45 | Active Directory (AD) | Technical-Integration | Solution shall integrate with NIH Enterprise support solutions [e.g. Security Orchestration, Automation, and Response (SOAR) data] for AD remediation and security response | Mandatory | Functional | |||
| DIR-TI-13 | Azure Active Directory (AAD) | Technical-Integration | Solution shall integrate with Azure Active Directory (AAD) | Mandatory | Functional | |||
| DIR-TI-33 | Azure Active Directory (AAD) | Technical-Integration | Solution shall integrate with device onboarding using Hybrid Azure AD | Mandatory | Functional | |||
| DIR-TI-34 | Azure Active Directory (AAD) | Technical-Integration | Solution shall integrate with Azure DevOps and the NIH Enterprise standard code repository | Mandatory | Functional | |||
| DIR-TI-35 | Azure Active Directory (AAD) | Technical-Integration | Solution shall be capable of supporting Azure AD Administrative Units | Preferred | Functional | |||
| DIR-TI-36 | Azure Active Directory (AAD) | Technical-Integration | Solution shall fully integrate with Azure Conditional Access and provide device, data, application, and network signals as appropriate | Mandatory | Functional | |||
| DIR-TI-37 | Azure Active Directory (AAD) | Technical-Integration | Solution shall support directory management tools for policy enforcement and delegation for Azure AD | Mandatory | Functional | |||
| DIR-SEC-08 | Azure Active Directory (AAD) | Security | Solution shall manage Azure AD Application and API governance | Mandatory | Functional | |||
| DIR-TI-38 | Azure Active Directory (AAD) | Technical-Integration | Solution shall support identity, authentication, and entitlement management for Adobe Cloud services | Mandatory | Functional | |||
| DIR-TI-40 | Azure Active Directory (AAD) | Technical-Integration | Solution shall provide capability to support Azure AD multi-tenant and multi-AD forest in support of secure AD migrations | Mandatory | Functional | |||
| DIR-TI-42 | Azure Active Directory (AAD) | Technical-Integration | Solution shall provide integration of Azure AD to other cloud service providers (such as AWS/GCP) for authentication and entitlement management services | Mandatory | Functional | |||
| DIR-TI-43 | Azure Active Directory (AAD) | Technical-Integration | Solution shall support integration with Azure Active Directory Domain Services (AADS) | Mandatory | Functional | |||
| DIR-OP-13 | Azure Active Directory (AAD) | Operational | Solution shall support Desired State Configurations [e.g. IaC (Infrastructure as Code) and CaC (Configuration as Code)] with centralized management and version switching | Preferred | Non-Functional | |||
| DIR-TI-44 | Azure Active Directory (AAD) | Technical-Integration | Solution shall support conditional access for service accounts in Azure AD | Mandatory | Functional | |||
| DIR-SEC-01 | Credential Management | Security | Solution should provide an admin view of identities and their roles/permissions/attributes to enable access reviews | Preferred | Functional | |||
| DIR-SEC-02 | Credential Management | Security | Solution shall support online identity proofing technology and storage of identity information | Preferred | Functional | |||
| DIR-TP-05 | Credential Management | Technical-Protocols | Solution shall support HSMs for critical/sensitive infrastructure key storage, such as Ncipher online HSMs and Azure key vault | Mandatory | Functional | |||
| DIR-OP-12 | Credential Management | Operational | Solution shall support identity proofing and external identity management for guest users accessing Microsoft cloud resources | Preferred | Functional | |||
| DIR-TI-41 | Credential Management | Technical-Integration | Solution shall integrate with InTune (MDM) solution and provide device signals to conditional access | Mandatory | Functional | |||
| DIR-CI-01 | Credential Management | Cloud/Infrastructure | Solution shall support Post-Quantum cryptography for DPKI key management | Mandatory | Functional | |||
| DIR-SEC-09 | Credential Management | Security | Solution shall provide temporary group membership feature for temporary security access to resources, including automatic removal of access | Preferred | Functional | |||
| DIR-OP-14 | Credential Management | Operational | Solution shall provide the ability to administer and manage NIH distribution lists | Mandatory | Functional | |||
| DIR-OP-15 | Credential Management | Operational | Solution shall provide the ability to delegate functions such as password and account changes to appropriate administrators (e.g., help desk) to offer capabilities like unlocking frozen accounts or assisting with password changes | Mandatory | Functional | |||
| DIR-TI-47 | Credential Management | Technical-Integration | Solution shall maintain integration capabilities with CyberArk | Mandatory | Functional | |||
| DIR-TI-02 | Federation Services | Technical-Integration | Solution shall allow automated linking of an identity to multiple personas from a single domain | Mandatory | Functional | |||
| DIR-TI-03 | Federation Services | Technical-Integration | Solution shall allow automated linking of an identity to multiple personas from multiple domains | Mandatory | Functional | |||
| DIR-SEC-06 | Federation Services | Security | Solution shall provide authentication capability to integrate Active Directory with ADFS (Idp) and create security token to access cloud applications like Office 365 | Mandatory | Functional | |||
| DIR-TI-27 | Federation Services | Technical-Integration | Solution shall provide on-prem user authentication to Azure AD via ADFS (AD Federation Services) as an IdP | Mandatory | Functional | |||
| DIR-TI-28 | Federation Services | Technical-Integration | Solution shall provide on-prem user authentication to Azure AD via ADFS as a service provider | Mandatory | Functional | |||
| DIR-TI-29 | Federation Services | Technical-Integration | Solution shall provide capability to replace ADFS services for on-prem and cloud applications | Mandatory | Functional | |||
| DIR-TP-01 | Identity Repository | Technical-Protocols | Solution shall provide New Technology LAN Manager (NTLM) V2 method for identity resolution of AD accounts | Mandatory | Non-Functional | |||
| DIR-TI-06 | Identity Repository | Technical-Integration | Solution shall support Identity Data Aggregation (Meta Directory) to consolidate disparate sources of identity data | Mandatory | Functional | |||
| DIR-TI-07 | Identity Repository | Technical-Integration | Solution shall support Identity Data Distribution to enable the querying of identity data for consumption | Mandatory | Functional | |||
| DIR-TI-08 | Identity Repository | Technical-Integration | Solution shall provide Application Program Interfaces (APIs) for components within the solution to communicate with each other and external applications | Mandatory | Functional | |||
| DIR-TI-09 | Identity Repository | Technical-Integration | Solution shall provide API-based access to identity and authorization information by approved third-party applications | Mandatory | Functional | |||
| DIR-OP-08 | Identity Repository | Operational | Solution shall support attribute indexing capabilities to optimize lookup operations to handle all queries | Mandatory | Functional | |||
| DIR-SEC-07 | Identity Repository | Security | Solution shall offer Hardware Security Modules (HSMs) in the cloud for DPKI where key storage is used | Mandatory | Functional | |||
| DIR-TP-06 | Identity Repository | Technical-Protocols | Solution shall support provisioning users directly in Azure | Mandatory | Functional | |||
| DIR-TP-02 | LDAP | Technical-Protocols | Solution shall be able to support LDAP authentication | Mandatory | Functional | |||
| DIR-TI-25 | LDAP | Technical-Integration | Solution shall store entities including user and digital certificates data in AD LDS (LDAP ALL) | Mandatory | Functional | |||
| DIR-OP-01 | Replication and Synchronization | Operational | Solution shall ensure that access management services are available through redundancy and failover | Mandatory | Functional | |||
| DIR-TI-10 | Replication and Synchronization | Technical-Integration | Solution shall enable the filtering and passable replication of the synchronized identity data | Mandatory | Functional | |||
| DIR-OP-06 | Replication and Synchronization | Operational | Solution shall create lower-level environments in active directory for test data specifically | Preferred | Functional | |||
| DIR-OP-09 | Replication and Synchronization | Operational | Solution shall support inter-cluster replication for High-Availability Directory Access Protocol (HDAP) | Mandatory | Functional | |||
| DIR-TI-24 | Replication and Synchronization | Technical-Integration | Solution shall synchronize Active Directory with Azure AD | Mandatory | Functional | |||
| DIR-TI-26 | Replication and Synchronization | Technical-Integration | Solution shall replicate AD LDS (LDAP ALL) records from Active Directory using multi-master replication process | Mandatory | Functional | |||
| DIR-TI-39 | Replication and Synchronization | Technical-Integration | Solution shall ensure multiple CSPs can utilize near real time directory synchronization | Mandatory | Functional | |||
| DIR-OP-02 | Virtual Directory Services | Operational | Solution shall have capability to refresh data automatically or by demand | Preferred | Functional | |||
| DIR-TI-01 | Virtual Directory Services | Technical-Integration | Solution shall provide meta-directory – Persistent Store for online synchronization/replication | Mandatory | Functional | |||
| DIR-SEC-03 | Virtual Directory Services | Security | Solution shall provide encryption and hashing mechanism for the data storage | Mandatory | Functional | |||
| DIR-TI-05 | Virtual Directory Services | Technical-Integration | Solution shall support aggregation of identity information from non-LDAP identity sources (e.g., Oracle Database, SQL server, REST, SOAP, and JDBC) | Mandatory | Functional | |||
| DIR-TI-11 | Virtual Directory Services | Technical-Integration | Solution shall integrate with non-LDAP sources such as databases and web services | Mandatory | Functional | |||
| DIR-TI-12 | Virtual Directory Services | Technical-Integration | Solution shall allow users to perform read, write, and modify operations in multiple authoritative sources | Preferred | Functional | |||
| DIR-OP-05 | Virtual Directory Services | Operational | Solution shall support logical groupings/nested groups | Mandatory | Functional | |||
| DIR-TI-15 | Virtual Directory Services | Technical-Integration | Solution shall have integration with data sources such as JDBC and SQL | Mandatory | Functional | |||
| DIR-TP-03 | Virtual Directory Services | Technical-Protocols | Solution shall publish attributes based upon business logic (attribute- based or/and group -based) | Mandatory | Functional | |||
| DIR-TI-16 | Virtual Directory Services | Technical-Integration | Solution shall have data source integration with Oracle Unified Directory (OUD) and LDAP | Mandatory | Functional | |||
| DIR-SEC-04 | Virtual Directory Services | Security | Solution shall support attribute-based access control (ABAC) authorization | Mandatory | Functional | |||
| DIR-TI-17 | Virtual Directory Services | Technical-Integration | Solution shall support integration with cloud service providers like AWS via service accounts (B2B) | Mandatory | Functional | |||
| DIR-TI-18 | Virtual Directory Services | Technical-Integration | Solution shall be able to process REST API Web service calls | Mandatory | Functional | |||
| DIR-TI-19 | Virtual Directory Services | Technical-Integration | Solution shall support account linking capabilities via the Globally Unique Identifier (GUID) attribute | Mandatory | Functional | |||
| DIR-CR-01 | Virtual Directory Services | Compliance/Regulatory | Solution shall support a flexible password policy, which is compliant with the baseline security and privacy requirements of the NIH InfoSec Handbook | Mandatory | Functional | |||
| DIR-OP-07 | Virtual Directory Services | Operational | Solution shall support persistent cache refresh mechanism to improve performance (handling at least 10 million records during query joins) | Mandatory | Functional | |||
| DIR-OP-10 | Virtual Directory Services | Operational | Solution shall manage all records (at least 10 million) without any performance degradation | Mandatory | Functional | |||
| DIR-TP-04 | Virtual Directory Services | Technical-Protocols | Solution shall provide an access control list (ACL) to restrict access for certain data sources | Mandatory | Functional | |||
| DIR-SEC-05 | Virtual Directory Services | Security | Solution shall support masking capabilities to hide/encrypt PII data | Mandatory | Functional | |||
| DIR-TI-20 | Virtual Directory Services | Technical-Integration | Solution shall be able to join (based on a common field) different types of data sources and publish the data in a single view | Mandatory | Functional | |||
| DIR-TI-21 | Virtual Directory Services | Technical-Integration | Solution shall have capability to store data locally within virtual directory servers instead of solely acting as a proxy for external data sources | Mandatory | Functional | |||
| DIR-TI-22 | Virtual Directory Services | Technical-Integration | Solution shall be able to create and compute new attributes based on the existing attributes and their values | Mandatory | Functional | |||
| DIR-TI-23 | Virtual Directory Services | Technical-Integration | Solution shall be able to configure/create a virtual attribute which can be available for the applications to write data into | Mandatory | Functional | |||
| DIR-TI-46 | Virtual Directory Services | Technical-Integration | Solution shall connect to multiple user directories and support multiple directory services | Preferred | Functional |
Requirements - SASE
| Requirements Traceability Matrix Appendix A - SASE Requirements | Vendor Responses | Internal Evaluation Team | |||||||
| Requirement ID | Technical Field | Requirement Category | Requirement Description | Importance | Functionality | Vendor Response | Explanation | Feedback | |
| Enter the unique ID number used to identify this requirement. | Indicate the specific technical field the requirement falls under for each ICAM Service Category. | Indicate the specific category the requirement falls under (User Experience, Technical, Cloud/Infrastructure, Security, Operational, Compliance/Regulatory) | Provide a short, high-level description of the requirement. Note: all technical terms and acronyms are defined in the Glossary tab. | Indicate the requirement importance/priority: Mandatory, Preferred, Optional/Deferred | Indicate whether the requirement is functional or non-functional. | Respond Yes, No, or Partial based on whether or not you (the vendor) meet this requirement. | Include an explanation as to how you (the vendor) meet or do not meet this requirement. | For Evaluator Only: Provide any feedback or notes you have based on the vendor's response. | |
| S-TI-02 | Cloud Access Security Broker (CASB) | Technical-Integration | Solution shall support access policies that are based on AD user objects/identities (GPO/Security groups) | Preferred | Functional | ||||
| S-CI-01 | Cloud Access Security Broker (CASB) | Cloud/Infrastructure | Solution shall provide application discovery of cloud-hosted applications | Mandatory | Functional | ||||
| S-OP-17 | Cloud Access Security Broker (CASB) | Operational | Solution shall provide SaaS performance monitoring and network analytics (Latency, Packet Loss, hop count) | Mandatory | Functional | ||||
| S-TI-09 | Cloud Access Security Broker (CASB) | Technical-Integration | Solution shall integrate with Microsoft Defender for Cloud Applications (MDCA) | Mandatory | Functional | ||||
| S-OP-22 | Cloud Access Security Broker (CASB) | Operational | Solution shall provide Data Loss Prevention (DLP) for all internet and private user traffic | Mandatory | Functional | ||||
| S-CR-19 | Compliance/Regulatory | Compliance/Regulatory | Solution shall be FIPS 140-3 compliant (or plan to be 140-3 compliant in the near future) | Mandatory | Functional | ||||
| S-UX-01 | Endpoint Security | User Experience | Solution shall provide performance optimization be able to identify Application, Network, Wi-Fi, and Endpoint impact on performance | Mandatory | Functional | ||||
| S-TI-07 | Endpoint Security | Technical-Integration | Solution shall integrate with Splunk (log management) to provide continuous monitoring, compliance, and policy enforcement | Mandatory | Functional | ||||
| S-OP-12 | Endpoint Security | Operational | Solution shall provide device management capability to track the device-type policy | Mandatory | Functional | ||||
| S-OP-13 | Endpoint Security | Operational | Solution shall capture end-to-end logging of every transaction transmitting through the NIH network | Mandatory | Functional | ||||
| S-UX-02 | Endpoint Security | User Experience | Solution shall provide intuitive administration user interface (UI) for metrics such as security operations (e.g. Fraud Detection, Botnet protection) | Mandatory | Functional | ||||
| S-OP-21 | Endpoint Security | Operational | Solution shall support pre-logon Machine Authentication leveraging the enterprise PKI for both Windows and MacOS | Mandatory | Functional | ||||
| S-CR-16 | Endpoint Security | Compliance/Regulatory | Solution shall provide continuous device posture compliance validation for all internet and private user traffic | Mandatory | Functional | ||||
| S-SEC-13 | Endpoint Security | Security | Solution shall provide device posture checking for domain membership, file, registry, process, and EDR (Endpoint Detection and Response) tools on a per-app connection request (not just limited to initial connection to access tool) | Mandatory | Functional | ||||
| S-SEC-01 | Firewall as a Service (FWaaS) | Security | Solution shall provide network (traditional) and application level firewalls | Mandatory | Functional | ||||
| S-TP-03 | Firewall as a Service (FWaaS) | Technical-Protocols | Solution shall provide L7 application and protocol-aware security inspection capabilities for all internet and private user traffic | Mandatory | Functional | ||||
| S-SEC-09 | Firewall as a Service (FWaaS) | Security | Solution shall provide an intrusion prevention system (IPS) for all internet and private user traffic | Mandatory | Functional | ||||
| S-SEC-14 | Firewall as a Service (FWaaS) | Security | Solution shall provide PEP capabilities and inspection in all directions for both Internet and Private Access | Mandatory | Functional | ||||
| S-OP-19 | Micro Segmentation | Operational | Solution shall provide visibility of network operations such as hop breakdown and drill down capability | Mandatory | Functional | ||||
| S-OP-06 | NGFW and Firewall-as-a-Service (FWaaS) | Operational | Solution shall operate with NIH co-managed firewalls that currently exist between ICs | Optional/Deferred | Functional | ||||
| S-OP-24 | Operational | Operational | Solution shall cache/store and keep all logs for 6 months without the loss of any logs | Mandatory | Functional | ||||
| S-OP-02 | Secure Web Gateway (SWG) | Operational | Solution shall monitor network traffic to detect potential threats such as phishing attacks and spyware | Mandatory | Non-Functional | ||||
| S-OP-03 | Secure Web Gateway (SWG) | Operational | Solution shall support web content filtering and SSL inspection | Mandatory | Functional | ||||
| S-OP-04 | Secure Web Gateway (SWG) | Operational | Solution shall provide Intrusion Prevention (IPS) capabilities | Mandatory | Functional | ||||
| S-OP-05 | Secure Web Gateway (SWG) | Operational | Solution shall provide malware/threat detection services | Mandatory | Functional | ||||
| S-CR-02 | Secure Web Gateway (SWG) | Compliance/Regulatory | Solution shall provide end-to-end traffic encryption between client and resource using encryption protocols in the Federal Information Processing Standard Publication 199, Standards for Security Categorization of Federal Information and Information Systems (FIPS 199) | Mandatory | Functional | ||||
| S-TI-06 | Secure Web Gateway (SWG) | Technical-Integration | Solution shall integrate with data loss prevention (DLP) tools for inline and out-of-band network traffic | Mandatory | Functional | ||||
| S-OP-11 | Secure Web Gateway (SWG) | Operational | Solution shall protect against Distributed Denial of Service (DDoS) attacks by monitoring various SASE service modules to detect and mitigate incidents such as anomalies and violations of Zero Trust policies | Mandatory | Functional | ||||
| S-OP-14 | Secure Web Gateway (SWG) | Operational | Solution shall enable advanced threat protection to detect and prevent malicious outbound traffic (e.g., illicit exfiltration and egress of traffic and data) | Preferred | Functional | ||||
| S-OP-15 | Secure Web Gateway (SWG) | Operational | Solution shall provide application discovery for the on-premises applications | Mandatory | Functional | ||||
| S-OP-16 | Secure Web Gateway (SWG) | Operational | Solution shall provide URL filtering and malicious content inspection capabilities to protect against unauthorized transfer of data | Mandatory | Functional | ||||
| S-TI-08 | Secure Web Gateway (SWG) | Technical-Integration | Solution shall integrate with Enterprise Data Loss Prevention (DLP) services to prevent NIH data disclosure | Mandatory | Functional | ||||
| S-OP-18 | Secure Web Gateway (SWG) | Operational | Solution shall provide contextually-aware policy enforcement based on telemetry data and zero trust security policies | Mandatory | Functional | ||||
| S-TI-11 | Secure Web Gateway (SWG) | Technical-Integration | Solution shall support Microsoft conditional access policies | Mandatory | Functional | ||||
| S-SEC-06 | Secure Web Gateway (SWG) | Security | Solution shall provide DNS category filtering and reputation filtering for all internet and private user traffic | Mandatory | Functional | ||||
| S-SEC-07 | Secure Web Gateway (SWG) | Security | Solution shall provide URL filtering for all internet and private user traffic | Mandatory | Functional | ||||
| S-SEC-08 | Secure Web Gateway (SWG) | Security | Solution shall provide Anti-Virus prevention for all internet and private user traffic | Mandatory | Functional | ||||
| S-SEC-10 | Secure Web Gateway (SWG) | Security | Solution shall provide anti-malware for all internet and private user traffic | Mandatory | Functional | ||||
| S-SEC-11 | Secure Web Gateway (SWG) | Security | Solution shall provide SSL break and inspect for encrypted internet and private application traffic up to TLS 1.3 | Mandatory | Functional | ||||
| S-SEC-12 | Secure Web Gateway (SWG) | Security | Solution shall provide file inspection, File type, and File control capabilities, including support for compressed/archive files in all directions for both Internet and Private access | Mandatory | Functional | ||||
| S-TI-01 | Software Defined Wide Area Network (SD-WAN) | Technical-Integration | Solution shall provide integration with Virtual Desktop Infrastructure (VDI) system such as Citrix | Mandatory | Functional | ||||
| S-TI-03 | Software Defined Wide Area Network (SD-WAN) | Technical-Integration | Solution shall provide VPN policy management and enforcement to ensure users only access necessary NIH resources | Preferred | Functional | ||||
| S-TI-04 | Software Defined Wide Area Network (SD-WAN) | Technical-Integration | Solution shall restrict VPN user groups based on IP subnets | Preferred | Functional | ||||
| S-OP-07 | Software Defined Wide Area Network (SD-WAN) | Operational | Solution shall provide inline monitoring by scanning uplink and downlink network traffic, as part of Zero Trust Telemetry required to define and enforce policies | Mandatory | Functional | ||||
| S-OP-08 | Software Defined Wide Area Network (SD-WAN) | Operational | Solution shall provide out-of-band (separate communication channel) monitoring by scanning uplink and downlink network traffic | Mandatory | Functional | ||||
| S-SEC-02 | Software Defined Wide Area Network (SD-WAN) | Security | Solution shall provide application discovery for all TCP/UDP traffic | Mandatory | Functional | ||||
| S-CR-06 | Software Defined Wide Area Network (SD-WAN) | Compliance/Regulatory | Solution must be capable of reporting performance metrics for critical NIH applications (~20) (e.g. metrics regarding network and server bandwidth to detect and prevent DDoS attacks, highest bandwidth utilization, user access list for applications) | Mandatory | Functional | ||||
| S-OP-23 | Software Defined Wide Area Network (SD-WAN) | Operational | Solution shall support bi-directionally initiated flows from both clients to server and server to client on all enterprise applications | Mandatory | Functional | ||||
| S-CR-17 | Software Defined Wide Area Network (SD-WAN) | Compliance/Regulatory | Solution shall provide an SLA for all service performance and availability across all internet and private application traffic | Mandatory | Functional | ||||
| S-CR-18 | Software Defined Wide Area Network (SD-WAN) | Compliance/Regulatory | Solution shall provide RFC compliance enforcement for protocol definitions | Mandatory | Functional | ||||
| S-CI-02 | Software Defined Wide Area Network (SD-WAN) | Cloud/Infrastructure | Solution should be 100% delivered from the cloud and not require any virtual or physical infrastructure deployment on the customer premises for the solution deployment or operation | Preferred | Functional | ||||
| S-TI-12 | Software Defined Wide Area Network (SD-WAN) | Technical-Integration | Solution should provide dedicated IP assignment and compute resources in the cloud | Mandatory | Functional | ||||
| S-CI-03 | Software Defined Wide Area Network (SD-WAN) | Cloud/Infrastructure | Solution shall support client multi-homing | Mandatory | Functional | ||||
| S-TI-13 | Software Defined Wide Area Network (SD-WAN) | Technical-Integration | Solution shall support access from local networks (e.g., home networks) to distributed points of presence/inspection points | Preferred | Functional | ||||
| S-CR-01 | Trusted Internet Connections (TIC) | Compliance/Regulatory | Solution shall align with the Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency's (CISA) Trusted Internet Connection (TIC) guidelines | Mandatory | Functional | ||||
| S-CR-04 | Trusted Internet Connections (TIC) | Compliance/Regulatory | Solution shall be capable of complying with HHS TIC 3.0 policy for all connections between an NIH system and untrusted networks to ensure secure and compliant network operations | Mandatory | Non-Functional | ||||
| S-CR-05 | Trusted Internet Connections (TIC) | Compliance/Regulatory | Solution shall provide Policy Enforcement Points (PEP) for the TIC untrusted zone connections | Mandatory | Non-Functional | ||||
| S-CR-07 | Trusted Internet Connections (TIC) | Compliance/Regulatory | Solution shall provide adaptive authentication based on the level of risk associated with the requested resource within the TIC | Mandatory | Functional |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .