9 EPoS Attach 9 Cybersecurity Demonstration 20171201 CC.docx
DOCX document 28 KB Posted
- Solicitation number
- SP4703-17-R-CB01
- Issued by
-
Defense Logistics Agency Aviation
About this file
This document outlines requirements for a cybersecurity demonstration as part of a solicitation for an Electronic Point of Sale (EPoS) and supporting services contract. The solicitation seeks proposals for a turnkey hardware and software solution to capture fuel retail transactions at unattended military service stations, mobile ground fuel transactions, and aviation fuel transactions for mobile airfield operations. Offerors must execute two Security Technical Implementation Guides against their proposed solution and provide a written response summarizing compliance percentages for applicable controls. The cybersecurity demonstration will be evaluated based on the percentage of controls the solution complies with, with higher scores given to proposals demonstrating 81-100% compliance. The contract will have a five-year base period and ten one-year options, for a total of fifteen years.
9 EPoS Attach 9 Cybersecurity Demonstration 20171201 CC
View the file
Other files
Show all 42
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
ATTACHMENT 9
Solicitation SP4703-17-R-CB01 Electronic Point of Sale (EPoS) and Support Services Factor 3: Cybersecurity Demonstration
SECURITY TECHNICAL IMPLEMENTATION GUIDES
APPLICABLE TO BOTH FIXED FACILITY AND MOBILE DEVICES
The Government will not conduct cybersecurity demonstrations. The Offeror shall execute the two Security Technical Implementation Guides (STIGs) attached to the solicitation against the solution as appropriate.
STIG One: Application Security and Development Security Technical Implementation Guide, Version 4, Release 3, 28 April 2017
· The responder shall execute STIG One to show percentage of applicable control compliance.
· The responder shall provide to the Government the results of the demonstration containing cyber control compliance assessment results summarized by Control Correlation Identifier (CCI) family.
STIG Two: Windows 10 Security Technical Implementation Guide Version: 1, Release: 9, 28 Apr 2017.
NOTE: This STIG only applies to mobile devices. The Offeror shall identify and execute the STIG related to the applicable Government-approved operating system (OS) that the Offeror provides. The only stipulation is that the OS must be compatible with Windows Active Directory and must be supported by the manufacturer.
· The responder shall execute STIG Two to show percentage of applicable control compliance.
· The responder shall provide to the Government the results of the demonstration containing cyber control compliance assessment results summarized by Control Correlation Identifier (CCI) family.
The Offeror shall produce a written summation of the number of required control setting compliances as a percentage of the total number of applicable controls for the offered solution.
Explanation:
STIG One: There are 294 individual vulnerability checks in STIG One: the Application Security and Development. Not all of the 294 items will be applicable to the solution proposal. The responder shall identify the number of checks that apply to their specific solution proposal. This total number of applicable controls will represent the 100 percent baseline from which compliance percentages are derived.
STIG Two: This example is also applicable to STIG Two execution.
Response:
The Offeror shall create a response not to exceed seven pages on letterhead that identifies the results illustrating:
· Total number of applicable STIG controls.
· Applicable NIST SP 800-53r4 control families (As listed in Table 1 on Page 9 of Chapter 2 of the cited reference).
· NIST SP 800-54r4 Control Acronym and associated STIG CCI for each applicable control within each family.
· Total number of applicable CCI’s per control family
· Number of applicable CCI’s that are 100% compliant within the control family
· Number of applicable CCI’s that are less than 100% compliant within the control family
· For the less than 100% compliant applicable controls within the family, a summarized percentage provided that indicates how close the non-compliant controls are to being compliant.
· Example: X number of applicable CCI’s for the Access Control (AC) family that are not compliant are within Y% of total compliance.
Example Response/Report Format for STIG One
185* controls identified by responder as being applicable to the proposed solution Applicable control families, Controls, and CCI’s:
Access Control (AC) Summary:
Total Number of applicable controls: 15*
| Total Number of 100% compliant controls: 10* |
| Total Number of non-compliant controls: 5* |
| Non-compliance window: Controls are within 20%* of |
compliance
| Applicable/Selected Access Control (AC) Summary: | ||
| AC-2(9) Restrictions On Use Of Shared Groups/Accounts | ||
| AC-2(9).1 CCI: 002140: Compliant | ||
| AC-2(9).2 CCI: 00214: Non-compliant |
Responder will continue with additional entries for control families, Controls and CCI’s.
*Numbers used in the example are for illustration purposes only. The responder is expected to derive actual applicable numbers based on the proposal.
Rating:
The Government will evaluate the percentage compliance of the Offeror’s solution with each STIG as presented. The Cybersecurity Demonstration will be used to gauge Offeror’s solution compliance with applicable STIGs as delivered for the demonstration. The delta between the solution percentage and 100% requirement provides a measure of the risk incurred to bring the solution into 100% compliance.
This demonstration is for evaluation purposes and not to be construed as an acceptance modifier to the 100% cyber compliance requirement. Each Task Order Performance Work Statement describes in detail the cybersecurity compliance requirements for the program.
STIG ONE - Application Security and Development Security Technical Implementation Guide
| Demo Compliance Score |
| Outstanding |
| Good |
| Acceptable |
| Marginal |
| Unacceptable |
| 81 – 100% |
| 61 – 80% |
| 41 – 60% |
| 21 – 40% |
| 1 – 20% |
Overall percentage of compliant controls (Number of Demo Compliances divided by Total Number of Compliances)
| Unacceptable |
| Marginal |
| Acceptable |
| Good |
| Outstanding |
Overall percentage of non-compliant controls
STIG TWO - Windows 10 Security Technical Implementation Guide
| Demo Compliance Score |
| Outstanding |
| Good |
| Acceptable |
| Marginal |
| Unacceptable |
| 81 – 100% |
| 61 – 80% |
| 41 – 60% |
| 21 – 40% |
| 1 – 20% |
Overall percentage of compliant controls (Number of Demo Compliances divided by Total Number of Compliances)
| Unacceptable |
| Marginal |
| Acceptable |
| Good |
| Outstanding |
Overall percentage of non-compliant controls
Total Percentage Compliance for the Two STIGS
| Weighted STIG One Compliance Score |
| Weight |
| Score |
| (Number of Demo Compliances divided by Total Number of Compliances) * Weight |
| 40% |
| Weighted STIG Two Compliance Score |
| Weight |
| (Number of Demo Compliances divided by Total Number of Compliances) +Weight |
| 60% |
| Total Demo Score (Rating for STIG One + Rating for STIG Two) |
| 100% |
Rating based on Total Demo Score and table below
Totals will not be calculated for non-compliance.
Demonstration Ratings:
Color/Adjectival Rating
| Demo Compliance Score Range |
| Description |
Outstanding Blue
| 81 – 100% Compliance |
| Demonstration indicates an exceptional approach and understanding of the requirements and contains multiple strengths, and risk of unsuccessful performance is low. |
Good Purple
| 61 – 80% Compliance |
| Demonstration indicates a thorough approach and understanding of the requirements and contains at least one strength, and risk of unsuccessful performance is low to moderate. |
Acceptable Green
| 41 – 60% Compliance |
| Demonstration meets requirements and indicates an adequate approach and understanding of the requirements, and risk of unsuccessful performance is no worse than moderate. |
Marginal Yellow
| 21 – 40% Compliance |
| Demonstration has not demonstrated an adequate approach and understanding of the requirements, and/or risk of unsuccessful performance is high. |
Unacceptable Red
| 1 – 20% Compliance |
| Demonstration does not meet requirements of the solicitation, and thus, contains one or more deficiencies, and/or risk of unsuccessful performance is unacceptable. Demonstration is unacceptable. |
File details come from the government source that posted it. Updated .