SOW.pdf

AOCAS Requirements Page 1

1. Introduction

1.1 Purpose: This document outlines the requirements for the Automated Onboarding and Account Creation System (AOCAS), designed to automate and streamline the onboarding process for personnel, including account creation, specifically addressing the challenges of USFJ's 2.0 TDY rotations and exercise participation.

1.2 Scope: This document covers the functional and non-functional requirements, system architecture, interfaces (detailed in Appendix B), and performance characteristics of the AOCAS. The system leverages SharePoint Online (SPO) and Power Apps for a cost-effective and scalable solution.

1.3 Target Audience: This document is intended for program managers, engineers, security personnel, and other stakeholders involved in the development, acquisition, and deployment of AOCAS within USFJ.

2. Operational Need and Intended Use

2.1 Mission Need: The AOCAS will automate the onboarding process, including account creation, reducing processing time to a consistent and predictable timeframe, minimizing errors, enhancing cybersecurity, and improving overall efficiency. This directly supports USFJ operational requirements by ensuring the rapid integration of personnel for both TDY rotations and exercises, contributing to USFJ Priority 4: Plan, Prepare, Practice for crisis and contingency operations, and potentially USFJ Priority 1: Advance US-JPN Alliance by demonstrating improved interoperability and responsiveness. Looking ahead, a future iteration of AOCAS could potentially leverage the centralized data management capabilities to automate the generation and maintenance of accurate and up-to-date recall rosters, directorate distribution lists, birthday lists, and other similar essential personnel information, further enhancing operational efficiency.

2.2 Operational Scenarios: The AOCAS will support:

o Standard Onboarding for Permanent Personnel o USFJ 2.0 TDY Rotations o Exercise Participation (varying durations)

AOCAS Requirements Page 2

3. System Requirements

3.1 Functional Requirements:

o 3.1.1. Automated Account Creation: Automated creation of user accounts across required USFJ systems based on predefined roles and access levels.

o 3.1.2. Self-Service Portal: A user-friendly portal for personnel to initiate the onboarding process, submit required information, and track their onboarding status.

o 3.1.3. Automated Workflow: Automated routing of onboarding requests for approvals and processing based on predefined rules within the USFJ structure.

o 3.1.4. Integration with Existing Systems: Seamless integration with existing USFJ HR, identity management, and security systems (e.g., Active Directory, CAC/PIV management).

o 3.1.5. Role-Based Access Control (RBAC): Enforcement of RBAC policies to ensure appropriate access privileges within the USFJ environment.

o 3.1.6. Automated Reporting: Generation of reports on onboarding status, processing times, and other key metrics specific to USFJ requirements.

o 3.1.7. Secure Data Storage: Secure storage and management of personnel data in compliance with USFJ and DoD regulations.

o 3.1.8. Notification System: Automated notifications to users and administrators regarding onboarding status updates.

3.2 Non-Functional Requirements:

o 3.2.1. Performance: Rapid processing of onboarding requests (target: <24 hours).

o 3.2.2. Security: Compliance with all relevant DoD and USFJ security regulations and standards. Implementation of multi-factor authentication.

o 3.2.3. Availability: High availability to ensure uninterrupted access to the system within the USFJ operational environment.

o 3.2.4. Usability: Intuitive user interface and minimal training required.

o 3.2.5. Scalability: Ability to handle fluctuating volumes of onboarding requests associated with USFJ rotations and exercises.

o 3.2.6. Interoperability: Seamless interoperability with existing USFJ and relevant mission partner systems.

AOCAS Requirements Page 3

5. System Architecture (High-Level)

AOCAS utilizes a simplified architecture leveraging SharePoint Online (SPO) and Power Apps. SPO serves as the central data repository for onboarding requests, workflows, and related information. Power Apps provides the user interface and facilitates workflow automation through Power Automate. See Appendix B for detailed interface specifications.

6. Testing and Evaluation

The AOCAS will undergo rigorous testing and evaluation to ensure it meets all functional and

Section 4 has been removed for clarity

AOCAS Requirements Page 4 non-functional requirements and adheres to USFJ and DoD security standards. The testing process will involve the following stages:

Unit Testing: Individual components and modules of the system will be tested to verify their functionality and performance.

Integration Testing: Integrated testing will ensure that the various components of AOCAS work together seamlessly and that data flows correctly between systems. This will include testing integrations with existing USFJ HR, identity management, and security systems.

User Acceptance Testing (UAT): Representative users from across USFJ, including personnel involved in TDY rotations and exercise participation, will participate in UAT to validate the system's usability and effectiveness in real-world scenarios. Feedback from UAT will be used to refine the system and ensure it meets user needs.

Security Testing: Dedicated security testing will be conducted to assess the system's vulnerability to cyber threats and ensure compliance with all relevant security regulations and standards. This will include penetration testing, vulnerability scanning, and other security assessments.

Performance Testing: Performance testing will evaluate the system's ability to handle the expected volume of onboarding requests and maintain acceptable performance levels under peak loads.

Acceptance Criteria:

The AOCAS will be considered acceptable for deployment within USFJ upon successful completion of all testing phases and meeting the following criteria:

Functional Requirements Met: All functional requirements outlined in Section 3.1 must be fully implemented and validated.

Non-Functional Requirements Met: All non-functional requirements outlined in Section 3.2 must be met, including performance, security, availability, usability, scalability, and interoperability targets.

User Acceptance: UAT participants must confirm that the system meets their needs and is easy to use.

Security Accreditation: The AOCAS must receive the necessary security accreditation from the appropriate authorities before deployment.

7. Security Considerations

Security is paramount in the design, development, and deployment of the AOCAS. The system will incorporate robust security measures to protect sensitive personnel data and maintain the integrity of USFJ systems. Key security considerations include:

AOCAS Requirements Page 5

Compliance with DoD and USFJ Security Policies: AOCAS will be designed and implemented in full compliance with all applicable DoD and USFJ security policies, regulations, and standards, including NIST SP 800-53, DISA STIGs, and other relevant guidance.

Role-Based Access Control (RBAC): Strict RBAC will be enforced to ensure that users only have access to the information and functionalities necessary for their roles.

This will prevent unauthorized access to sensitive data and minimize the potential for insider threats.

Multi-Factor Authentication (MFA): MFA will be implemented for all user accounts to enhance authentication security and protect against unauthorized access.

Data Encryption: All sensitive data stored within AOCAS will be encrypted both in transit and at rest using strong encryption algorithms.

Regular Security Audits and Assessments: Regular security audits and vulnerability assessments will be conducted to identify and mitigate potential security risks.

Penetration testing will be performed to simulate real-world attacks and identify vulnerabilities.

Security Incident Response Plan: A comprehensive security incident response plan will be developed and maintained to address any security incidents that may occur. This plan will outline procedures for incident detection, containment, eradication, recovery, and reporting.

Continuous Monitoring: AOCAS will be continuously monitored for suspicious activity and security breaches. Security logs will be collected and analyzed to identify potential threats.

8. Glossary of Terms and Acronyms

AOCAS: Automated Onboarding and Account Creation System

CAC/PIV: Common Access Card/Personal Identity Verification

DISA: Defense Information Systems Agency

DoD: Department of Defense

HR: Human Resources

MFA: Multi-Factor Authentication

NIST: National Institute of Standards and Technology

RBAC: Role-Based Access Control

STIG: Security Technical Implementation Guide

AOCAS Requirements Page 6

TDY: Temporary Duty

UAT: User Acceptance Testing

USFJ: United States Forces Japan

9. Appendix

Appendix B: Interface Specifications: Details the interfaces between AOCAS and the Global Force User Database (GFUD) and SharePoint Online (SPO). (See attached Appendix B document for full details.)

Appendix F: Cost-Benefit Analysis: Provides a cost-benefit analysis demonstrating the financial justification for investing in AOCAS. (See attached Appendix F document for full details.)

AOCAS Requirements Page 7

Appendix B: Interface Specifications

This appendix details the interfaces between the Automated Onboarding and Account Creation System (AOCAS), built using SharePoint Online and Power Apps, and other USFJ systems.

Specifically, this implementation will focus on interfacing with the Global Force User Database (GFUD) and utilizing SharePoint Online (SPO) as the central data repository.

1. AOCAS Architecture Overview

AOCAS leverages SharePoint Online (SPO) as the central data repository and Power Apps for the user interface and workflow automation. This architecture provides a secure, scalable, and cost-effective solution for automating the onboarding process. Below is a Notional Overview diagram depicting data flow and systems interfaces.

Appendix B Image 1. Notational OV-1

2. Interfaces

AOCAS will interface with the following USFJ systems:

AOCAS Requirements Page 8

Global Federated User Directory (GFUD): For user account creation, management, and validation.

SharePoint Online (SPO): Serves as the central data repository for onboarding requests, workflows, and related information. This replaces the need for direct interfaces with separate HR and CAC/PIV management systems in this implementation.

3. Interface Details

3.1 AOCAS - Global Federated User Directory (GFUD)) Interface:

o Purpose: Create user accounts in AOCAS based on data submitted through the GFUD, as well as validate user information and retrieve existing user data.

o Method: Power Automate flows will be used to connect to AOCAS via its API or other available integration methods.

o Data Exchange: The following data will be transferred between AOCAS and

GFUD:

Username

First Name

Last Name

Email Address

Organizational Unit (OU)

Security Groups (based on role)

Other relevant user attributes required by GFUD o Security: Communication between AOCAS and GFUD will be secured using secure API connections and robust authentication methods. Specific security protocols will adhere to USFJ and DoD standards.

3.2 AOCAS - SharePoint Online (SPO) Interface:

o Purpose: Store and manage onboarding requests, workflow status, supporting documentation, and other relevant information within SharePoint lists and libraries.

o Method: The Power App will directly interact with SharePoint lists and libraries using the SharePoint connector.

o Data Exchange: All data related to the onboarding process will be stored within SharePoint lists, including user information, request status, approvals, and associated documentation.

o Security: Access to SharePoint data will be controlled using SharePoint permissions, ensuring that only authorized personnel can access sensitive

AOCAS Requirements Page 9 information. This leverages SharePoint's built-in security features and complies with USFJ security policies.

4. Data Formats

Data exchange between AOCAS and GFUD will primarily utilize JSON or XML formats, depending on the specific API requirements of GFUD. Data within SharePoint will be stored in list item format.

5. Error Handling

Robust error handling mechanisms will be implemented within the Power Automate flows and Power App to manage potential issues during data exchange and ensure data integrity. Error logs will be maintained for troubleshooting and monitoring.

6. SharePoint Permissions and Security

Access to the SharePoint lists and libraries used by AOCAS will be strictly controlled using SharePoint permissions. Only authorized personnel will have access to sensitive data. This approach simplifies user and permission management by centralizing it within the SharePoint platform.