The file's text, extracted by GovTribe without its formatting.
Requirements Checklist
Security Compliance Posture Monitoring and Reporting (SCPMaR) Project
Date:
Instruction The Security Compliance Posture Monitoring and Reporting (SCPMaR) Requirements Checklist is a part of the Technical Volume.
The Offeror shall provide a brief system design document that explains the proposed system architecture: (Maximum of 50 pages)
· Contextually, the Offeror shall provide an indentured list of system functional components with a brief explanation of capabilities.
· Conceptually, the Offeror shall explain how the proposed solution’s capabilities will meet the Government-specified concept of operations.
· Logically, the Offeror shall explain what functional components of the proposed solution will meet the Government-specified system requirements.
· Physically, the Offeror shall explain how the functional components of the proposed solution are allocated to the physical components in order to meet the Government-specified system requirements.
The Offeror shall complete the following checklist using the three Government specified supportability definitions:
| LEVEL OF SUPPORT |
| Definition |
| Fully Supports (F) |
| Proposed solution fully supports the requirement. |
| Partially Supports (P) |
| Proposed solution partially supports the requirement. |
| Does Not Support (N) |
| Proposed solution does not support the requirement. |
Level of support indicated should apply to current capability.
For each Government specified system requirement, the Offeror shall provide detailed justification that briefly explains:
· How the proposed solution will meet the Government-specified requirement.
· What capability the proposed solution provides to meet the Government-specified requirement.
· Where the stated functional capabilities can be found in the provided system architecture.
The completed SCPMaR Requirements Checklist shall not exceed 50 pages.
Mandatory Requirements
| Req ID |
| Mandatory Requirement |
| Supports |
| Justification |
| MR-1 |
| The solution shall use NIST-defined Security Content Automation Protocol (SCAP) and agency-wide security configuration policies (e.g. IRS policies and NIST National Checklist Program) and provide Federal Desktop Core Configuration (FDCC) compliance reports using the NIST-defined SCAP-based reporting format. At a minimum, the solution must be SCAP validated as a FDCC Scanner, Authenticated Configuration Scanner, and Authenticated Vulnerability and Patch Scanner. |
| MR-2 |
| The solution shall use SCAP-based security configuration policy/benchmarks approved by IRS to assess compliance on the following computing platforms, including but not limited to: |
- Microsoft Windows 2000 Server
- Microsoft Windows Server 2003
- Microsoft Windows XP Professional Edition
- Microsoft Windows Vista Enterprise Edition
- Sun Solaris 10
- Sun Solaris 9
- Sun Solaris 8
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 4
- HP HP-UX 11
- IBM AIX 5.2
| MR-3 |
| The solution shall be compliant with FDCC and it shall perform security configuration compliance assessments in a manner that is compliant with FDCC requirements for Windows-based workstations and in accordance with IRS policy for Windows-based servers and UNIX-based servers. |
| MR-4 |
| For client console interfaces, the solution shall use Microsoft Active Directory Service for user authentication. |
| MR-5 |
| For web-based client interfaces, the solution shall integrate with CA SiteMinder for authentication. |
| MR-6 |
| The solution shall provide role-based access control (RBAC) with audit records for all system functionality. |
| MR-7 |
| The solution shall be able to import ISS Internet Scanner and Nessus data to enumerate identified vulnerabilities. Each identified vulnerability shall be associated with a specific computing asset. |
| MR-8 |
| The solution shall provide the ability to import a list of security patches specified by the IRS. |
| MR-9 |
| The solution shall be able to document and preserve records of approved risk based decisions (RBDs) and measure the level of security compliance against an approved baseline (i.e., security configuration benchmarks with approved RBDs) for a user-specified period of time, up to 3 years at minimum. |
| MR-10 |
| The solution shall be able to perform security configuration compliance assessments of IRS computing assets across multiple Microsoft Active Directory domains. |
| MR-11 |
| The solution shall provide both networked and non-networked assessment solutions. |
| MR-12 |
| The solution shall use NIST FIPS 140-2 validated cryptographic module. |
| MR-13 |
| The solution shall provide the capability to initiate the patching process for approved patch change requests through existing IRS patch tools: Altiris Patch Manager and Sun N1 Patch Manager. |
| MR-14 |
| The solution shall integrate with NetIQ Group Policy Administrator. |
| MR-15 |
| The solution shall provide the capability to support the FISMA reporting process mandated by OMB. |
| MR-16 |
| The solution shall provide the capability to generate metrics and provide status information for measuring the effectiveness of information security controls. (i.e., NIST SP 800-55 Rev.1, Performance Measurement Guide for Information Security, and Common Vulnerability Scoring System (CVSS).) |
| MR-17 |
| The solution shall provide metrics in the form of numbers and percentage that indicate the degree of compliance with the required security controls; and organized by flexible, expandable, and configurable grouping of assets. |
| MR-18 |
| The solution shall provide a set of user-defined, role-based, security compliance posture dashboards in accordance to the job functions defined in IRS policies. |
| MR-19 |
| The solution shall provide a set of status reports for tracking the effective period for approved RBDs and non-conformances. |
| MR-20 |
| The solution shall provide the capability to assess and report on the conformance to patch-levels established by the IRS for computing platforms. |
| MR-21 |
| The solution shall be scalable to support the IRS enterprise as described in Section 1.5, “Description of Operating Environment”. |
| MR-22 |
| The solution shall assess the degree of compliance to IRS-specified security configuration benchmarks (in SCAP format) and approved security configuration baselines for IRS UNIX-based computing assets. |
| MR-23 |
| The solution shall assess the degree of compliance to IRS-specified security configuration benchmarks (in SCAP format) and security configuration baselines for Windows-based assets. |
| MR-24 |
| The solution shall provide the capability to create user-defined (i.e. customized) automated security configuration checklists in SCAP format. |
| MR-25 |
| The solution shall enumerate identified vulnerabilities in CVE and correlate to a specific computing asset. |
| MR-26 |
| The solution shall provide functionality that allows for the acceptance of identified non-conformance or weakness, based on the existence of an approved waiver/ variance that acknowledges and accepts the risk, on a per asset or per asset group basis. |
| MR-27 |
| The solution shall be able to import or integrate data from other SCAP-enabled solutions. |
| MR-28 |
| The solution shall provide the ability to perform periodic and pre-scheduled automated security configuration assessments. |
| MR-29 |
| The solution shall provide the ability to perform on-demand security configuration assessments. |
| MR-30 |
| The solution shall provide the capability to support automation of IRS reporting processes for security compliance posture reporting. |
| MR-31 |
| The solution shall provide the capability to automate the IRS Security Configuration Risk Management process by recording RBDs as part of the security configuration baseline for a computing asset as described in the SCPMaR Concept of Operations. |
| MR-32 |
| The solution shall provide the capability to automate the IRS Security Configuration Baseline Management process as described in the SCPMaR Concept of Operations. |
| MR-33 |
| The solution shall provide the capability to automate the IRS Security Configuration Change Control process as described in the SCPMaR Concept of Operations. |
Functional Requirements
| Req ID |
| Functional Requirement |
| Support |
| Justification |
Functional Capability: The solution shall provide the ability to monitor and measure the effectiveness of IRM mandated security controls on computing systems, enterprise-wide, in a timely manner.
Requirements Category: Security posture reporting (SPR)
| F-SPR1.1 |
| The solution should report the number of compliant/ non-compliant information systems against security configuration baselines delineated by FIPS 199 security categories – High, Moderate, and Low. |
| F-SPR1.2 |
| The solution should report the number of compliant/ non-compliant information systems against security configuration baselines in accordance to the security controls specified in NIST SP 800-53 in accordance with FIPS 199 security categories – High, Moderate, and Low. |
| F-SPR1.3 |
| The solution should report number of compliant/ non-compliant information systems against security configuration baselines for Windows and UNIX operating system. |
| F-SPR1.4 |
| The solution should retain historical assessment data for a minimum of one year. (Assessments for each computing asset will be performed weekly.) |
| F-SPR2.1 |
| The solution should provide user-customizable reporting capability to generate metrics based on, but not limited to NIST SP 800-55 Rev.1, Performance Measurement Guide for Information Security. |
| F-SPR2.2 |
| The solution should provide the capability to report metrics and status information by criticality and severity of non-conformance. Risks should use the Common Vulnerability Scoring System (CVSS). |
| F-SPR3.1 |
| The solution should provide the number and percent of computing assets that are compliant with security configuration baselines by FIPS 199 security categories – High, Moderate, and Low; and delineated by Enterprise-wide, by UNIX-based computing assets, by Windows-based computing assets, by operating systems, by GSS, by AOR, and by other user-defined groups. |
| F-SPR3.2 |
| The solution should provide the number and percent of technical vulnerabilities enumerated by Enterprise-wide, by UNIX-based computing assets, by Windows-based computing assets, by operating systems, by GSS, by AOR, and by other user-defined groups. |
| F-SPR3.3 |
| The solution should provide the number and percent of computing platforms that have addressed the technical vulnerabilities identified by IRS/ US-CERT and delineated by Enterprise-wide, by UNIX-based computing assets, by Windows-based computing assets, by operating systems, by GSS, by AOR , and by other user-defined groups. |
| F-SPR4.1 |
| For security compliance posture dashboards , the solution should provide the number and percent of computing assets that are compliant with security configuration baselines by FIPS 199 security categories – High, Moderate, and Low; and delineated by Enterprise-wide, by UNIX-based computing assets, by Windows-based computing assets, by operating systems, by GSS, by AOR , and by other user-defined groups. |
| F-SPR4.2 |
| For security compliance posture dashboards, the solution should provide the number and percent of technical vulnerabilities enumerated by Enterprise-wide, by UNIX-based computing assets, by Windows-based computing assets, by operating systems, by GSS, by AOR , and by other user-defined groups. |
| F-SPR4.3 |
| For security compliance posture dashboards, the solution should provide the number and percent of computing assets that have addressed the technical vulnerabilities identified by IRS CSIRC and delineated by Enterprise-wide, by UNIX-based computing assets, by Windows-based computing assets, by operating systems, by GSS, by AOR , and by other user-defined groups. |
| F-SPR5 |
| The solution should provide a set of hardware/software asset discovery reports to include, but are not limited to IP address, machine name, operating system, and hardware platform. |
| F-SPR6.1 |
| The solution should provide role-based RBD status reports specific to the user's AOR. |
| F-SPR6.2 |
| The solution should provide the capability to alert and notify users on the status of RBDs within their AOR. |
| F-SPR7.1 |
| The solution should provide the capability to track number of patches that have been issued by the IRS delineated by computing platforms, by GSS, and by AOR. |
| F-SPR7.2 |
| The solution should provide the capability to assess the number and percent of patches that have been implemented. |
| F-SPR8 |
| The solution should provide the capability to export all user generated reports. |
| F-SPR8.1 |
| The solution should provide the capability to export all user generated reports in formats including but not limited to: xls, csv, html, xml, pdf. |
| F-SPR9 |
| The solution should be capable of supporting a minimum of 50 simultaneous users accessing detailed security posture reports. |
| F-SPR10 |
| The solution should be capable of supporting a minimum of 50 simultaneous users accessing aggregate level (GSS, AOR, etc…) security posture reports. |
Requirements Category: Security Configuration Assessment (SCA)
| F-SCA1.1 |
| The solution should track amount of time to implement the approved change for UNIX-based computing assets and by operating system. |
| F-SCA1.2 |
| The solution should track the number of UNIX-based computing assets and by operating system. |
| F-SCA1.3 |
| The solution should track number and percent computers that are compliant/ non-compliant with security configuration benchmarks and approved security configuration baselines for UNIX-based computing assets. |
| F-SCA2.1 |
| The solution should track amount of time to implement the approved change for Windows-based computing assets and by operating system. |
| F-SCA2.2 |
| The solution should track the number of Windows-based computing assets and by operating system. |
| F-SCA2.3 |
| The solution should assess the number and percent computers that are compliant/ non-compliant with security configuration benchmarks and approved security configuration baselines for Windows-based computing assets. |
| F-SCA3 |
| The solution should assess the degree of compliance to the IRS-specified security configuration benchmarks and approved security configuration baselines for Unisys systems using MCP operating system and z/OS systems using RACF. |
| F-SCA3.1 |
| The solution should track amount of time to implement the approved change for mainframe computing assets by operating system. |
| F-SCA3.2 |
| The solution should track the number of mainframe computing assets. |
| F-SCA3.3 |
| The solution should assess the number and percent of computers that are compliant/ non-compliant with security configuration benchmarks and approved security configuration baselines for mainframe computing assets. |
| F-SCA4.1 |
| The solution should provide the capability to create user defined security configuration benchmarks using SCAP. |
| F-SCA4.2 |
| The solution should provide the capability for user to create severity-level definitions for non-conformance. |
| F-SCA5 |
| The solution should be capable of completing security configuration assessments for 6000 server assets weekly. |
| F-SCA6 |
| The solution should be capable of completing security configuration assessments for 125,000 desktop and laptop assets monthly. |
| F-SCA7 |
| The solution should be capable of performing security configuration assessments for a single computing asset within 60 seconds. |
Requirements Category: Security Patch-Level Assessment (SPA)
| F-SPA1.1 |
| The solution should track the number of patches that have been issued by the IRS delineated by platform, by GSS, by AOR, and by other user-defined groups. |
| F-SPA1.2 |
| The solution should assess the number and percent of patches that have been implemented delineated by platform, by GSS, by AOR, and by other user-defined groups. |
| F-SPA2 |
| The solution should be capable of completing patch-level assessments for 6000 server assets weekly. |
| F-SPA3 |
| The solution should be capable of completing patch-level assessments for 125,000 desktop and laptop assets monthly. |
| F-SPA4 |
| The solution should be capable of performing patch-level assessments for a single computing asset within 60 seconds. |
Requirements Category: Security Vulnerability Identification & Enumeration (VIE)
| F-VIE1.1 |
| The solution should enumerate identified vulnerabilities in CVE or US-CERT Alert ID. |
| F-VIE1.2 |
| The solution should provide the number and percent of patches or fixes implemented to date; and the data should be compiled by Windows-based computing assets, UNIX-based computing assets, by operating systems, by GSS, by AOR, and by other user-defined groups. |
Functional Capability: The solution shall provide the ability to manage security configurations throughout the system life cycle by assessing the level of compliance with US Government and IRS specified technical controls.
Requirements Category: Access Control (AC)
| F-AC1 |
| The solution should provide controlled access (i.e., TCSEC C2 level) capability to implement user-defined need-to-know, least-privilege, and separation-of-duties, where: (To meet this requirement, the solution should meet all of the following sub-requirements) |
| F-AC1.1 |
| The solution should allow only authorized users access to add, modify, or delete security configuration benchmark and baseline information. |
| F-AC1.2 |
| The solution should allow only authorized users to initiate security configuration assessments, where authorization may be on a per asset or per asset group basis. |
| F-AC1.3 |
| The solution should allow only authorized users to add, modify, or remove RBDs, where authorization may be on a per asset or per asset group basis. |
| F-AC1.4 |
| The solution should allow only authorized users to add, modify, or remove attributes within security posture dashboards and reports, where authorization may be on a per asset or per asset group basis. |
| F-AC1.5 |
| The solution should allow only authorized users to add, modify, or remove hardware/software discovery reports, where authorization may be on a per asset or per asset group basis. |
| F-AC1.6 |
| The solution should allow only authorized users to add, modify, or delete user permissions. |
| F-AC2 |
| The solution should authenticate users using Microsoft Active Directory, but assign user access and privilege through the tool. |
| F-AC3 |
| The solution should automatically disable user access after 45 days of inactivity. |
| F-AC4 |
| The solution should enforce assigned authorizations for controlling access to the system in accordance with IRS policies (i.e., through the IRS’s Active Directory Service.) |
| F-AC5 |
| The solution should restrict access to privileged functions (deployed in hardware, software, and firmware) and security-relevant information to explicitly authorized personnel. |
| F-AC6 |
| The solution should enforce assigned authorizations for controlling the flow of information within the system and between interconnected systems in accordance with IRS policies. |
| F-AC7 |
| The solution should implement information flow control enforcement using protected processing domains (e.g., domain type enforcement) as a basis for flow control decisions. |
| F-AC8 |
| The solution should enforce separation of duties through assigned access authorizations. |
| F-AC9 |
| The solution should enforce the most restrictive set of rights/privileges or accesses needed by users (or processes acting on behalf of users) for the performance of specified tasks. |
| F-AC10 |
| The solution should limit the number of concurrent sessions to 1 for normal users. |
| F-AC11 |
| The solution should limit the number of concurrent sessions to 3 for system/security administrators. |
| F-AC12 |
| The solution should prevent further access to the system by initiating a session lock that remains in effect until the user reestablishes access using appropriate identification and authentication procedures. |
| F-AC13 |
| The solution should automatically terminate a session after 15 minutes of inactivity, except in the case of applications requiring continuous, real-time screen display, as exempted by IRS policies. |
| F-AC14 |
| Automatic session termination should apply to local and remote sessions. |
| F-AC15 |
| The solution should mark output using standard naming conventions to identify any special dissemination, handling, or distribution instructions. |
Requirements Category: Identification and Authentication (IA)
| F-IA1 |
| The solution should uniquely identify and authenticate users (or processes acting on behalf of users). The solution should integrate with IRS Directory Service (DS) (i.e., Microsoft Active Directory) for user authentication. For web-based user interface, the solution should integrate with SiteMinder for user authentication. |
| F-IA2 |
| The solution should identify and authenticate specific devices (i.e., SCPMaR System, subsystems, and components) before establishing a connection. |
| F-IA3 |
| The solution should obscure feedback of authentication information during authentication process to protect the information from possible exploitation/use by unauthorized individuals. |
| F-IA4 |
| The solution should employ authentication methods that meet the requirements of applicable laws, Executive Orders, directives, policies, regulation, standards, and guidance for authentication to a cryptographic module. |
Requirements Category: Audit and Accountability (AU)
| F-AU1 |
| The solution should generate audit records for specified events, in accordance with IRS policies. |
| F-AU2 |
| The solution should provide the capability to compile audit records from multiple components throughout the system into a single system wide (logical or physical), time-correlated audit trail. |
| F-AU3 |
| The solution should provide the capability to manage the selection of events to be audited by individual components of the system. |
| F-AU4 |
| The solution should produce audit records that capture sufficient information to establish what events occurred, the sources of the events, and the outcomes of the events, in accordance with IRS policies. |
| F-AU5 |
| The solution should provide the capability to include additional, more detailed information in the audit records for audit events identified by type, location, or subject. |
| F-AU6 |
| The solution should provide a warning when allocated audit record storage volume reaches a specified percentage of maximum audit record storage capacity. |
| F-AU7 |
| The solution should provide a real-time alert when an audit failure occurs, in accordance with IRS policies. |
| F-AU8 |
| The solution should provide an audit reduction and report generation capability. |
| F-AU9 |
| The solution should provide the capability to automatically process audit records for events of interest based upon selectable, event criteria. |
| F-AU10 |
| The solution should provide time stamps for each recorded event. |
| F-AU11 |
| The solution should integrate with the existing IRS time synchronization infrastructure in accordance with IRS policies. |
| F-AU12 |
| The solution should protect audit information and audit tools from unauthorized access, modification, and deletion. |
| F-AU13 |
| The solution should produce audit information on hardware-enforced, write-once media. |
| F-AU14 |
| The solution should provide the capability to determine whether a given individual took a particular action. |
Requirements Category: System and Communications (SC)
| F-SC1 |
| The solution should prevent unauthorized and unintended information transfer via shared system resources. |
| F-SC2 |
| The solution should protect the integrity of transmitted information. |
| F-SC3 |
| The solution should protect the confidentiality of transmitted information. |
| F-SC4 |
| The solution should terminate a network connection at the end of a session. |
| F-SC5 |
| The solution should terminate a network connection after 15 minutes of inactivity. |
| F-SC6 |
| The solution should establish a trusted communications path between the user (i.e., SCPMaR client) and the security functions of the system (i.e., SCPMaR server), in accordance with IRS policies. |
| F-SC7 |
| The solution should reliably associate security parameters with information exchanged between information systems. |
| F-SC8 |
| The solution should provide mechanisms to protect the authenticity of communications sessions. |
Requirements Category: HW/SW Inventory & Discovery (DIS)
| F-DIS1 |
| The solution should perform passive and active discovery of hardware and software (HW/SW) inventory installed on the IRS computing assets by authorized user. |
| F-DIS2 |
| The solution should provide manual entry capability to allow tracking of computing assets that are not on the IRS network. |
Requirements Category: Security Configuration Management (SCM)
| F-SCM2 |
| The solution should provide the ability to create, maintain, and report on user-defined custom fields for computing assets. |
| F-SCM3 |
| The solution should provide configuration management functionality that allows only authorized users to add, modify, and delete security configuration settings for security configuration benchmarks. |
| F-SCM4 |
| The solution should provide configuration management functionality that allows only authorized users to add, modify, and delete security configuration settings for security configuration baselines. |
| F-SCM5 |
| The solution should provide configuration management functionality that allows authorized users to add, modify, and delete security configuration settings for security configuration RBDs. |
| F-SCM6 |
| The solution should provide configuration management functionality that allows only authorized users to add, modify, and delete security configuration settings for security patch lists. |
Requirements Category: File Integrity (FI)
| F-FI1 |
| The solution should provide the ability to perform integrity checks for specified system configuration files (e.g., system registries (on Windows-based platforms), or system configuration files (on UNIX-based platforms)). |
Requirements Category: Remediation (REM)
| F-REM1 |
| The solution should provide the capability to remediate the mis-configuration of security configuration settings based on IRS approved security configuration baseline for IRS computing assets. (To meet this requirement, the solution should meet all of the following sub-requirements) |
| F-REM1.1 |
| The solution should provide the capability for authorized users to remediate mis-configurations after the change request has been validated and approved through the IRS change control process. |
| F-REM1.2 |
| The solution should provide the capability to automate the submission of change requests to apply missing patches. |
Functional Capability: The solution shall provide the ability to efficiently implement the solution by improving technology standardization across the IRS enterprise.
Requirements Category: Interoperability to Legacy Security Tools (IOL)
| F-IOL1 |
| The solution should be able to import or integrate data from existing IRS systems and tools, including but not limited to: (To meet this requirement, the solution should meet all of the following sub-requirements) |
| F-IOL1.1 |
| The solution should provide the ability to import a list of identified vulnerabilities generated from ISS Internet Scanner (Version 7.x or most current release) and Nessus (Version 3.x or most current release). |
| F-IOL1.2 |
| The solution should provide the ability to import a list of approved software specified by IRS. (e.g. Tivoli Configuration Manager.) |
| F-IOL1.3 |
| The solution should provide the ability to import a list of baseline IT hardware assets from IRS Information Technology Asset Management System (ITAMS) (i.e., HP Peregrine Asset Management), EOPS Master Server Database (MSDB) (i.e., Oracle RDBMS), and FISMA Inventory Database (i.e., Microsoft Access). |
| F-IOL1.4 |
| The solution should provide the ability to import and export Microsoft security policy templates. |
| F-IOL1.5 |
| The solution should provide the ability to import vulnerabilities enumerated by Application Security AppDetective and DB Protect. |
| F-IOL1.6 |
| The solution should provide the ability to import vulnerabilities enumerated by HP WebInspect. |
| F-IOL1.7 |
| The solution should provide the ability to export audit logs to ArcSight Logger. |
| F-IOL1.8 |
| The solution should be capable of integrating with Business Objects Enterprise reporting. |
| F-IOL3 |
| The solution should be able to operate and use SCAP-based security configuration policy/benchmarks approved by the IRS to assess compliance on the following computing platforms being planned for deployment. Solutions should have this capability by the end of 2009. |
· Windows 2008 Server (x-32, x-64)
· Windows Vista
· Mac OS X
Operational Requirements
| Req ID |
| Operational Requirement |
| Support |
| Justification |
Operational Capability: The solution shall provide the ability to automate the security assessment and reporting processes to reduce the level-of-effort in coordination and execution.
Requirements Category: Automated Assessment Process (OP-AAP)
| OP-AAP1.1 |
| The solution should permit only authorized users to schedule automated security assessment based on their security awareness needs and AOR. |
| OP-AAP1.2 |
| Each automated security configuration assessment performed by the solution should be based on IRS assigned security configuration baselines. |
| OP-AAP1.3 |
| The solution should store or archive automated assessment results to support the reporting and risk management processes for an agency-defined period of time. |
| OP-AAP1.4 |
| No automated security configuration assessment task should negatively affect IRS workstation timeout threshold. |
Requirements Category: On-demand Assessment Process (OP-OAP)
| OP-OAP1.1 |
| The solution should limit on-demand security configuration assessments on IRS computing assets to groups of authorized users. |
| OP-OAP1.2 |
| Each on-demand security configuration assessment should be based on IRS assigned security configuration baselines. |
| OP-OAP1.3 |
| The solution should store or archive on-demand assessment results to support the reporting and risk management processes for agency-defined periods of time. |
| OP-OAP1.4 |
| No on-demand security configuration assessment task should negatively affect IRS workstation timeout threshold. |
Requirements Category: Reporting Process (OP-RPP)
| OP-RPP1.1 |
| The solution should provide the capability to support the reporting sign-off process for security compliance posture reports. |
| OP-RPP1.2 |
| The solution provided reporting process automation should incorporate the use of IRS X.509 digital certificate. |
Operational Capability: The solution shall provide the ability to facilitate the risk management process by verifying that systems are operating within established security configuration and identify risk issues.
Requirements Category: Risk Management Process (OP-RMP)
| OP-RMP1 |
| The solution should provide the capability to automate the risk management process for security configuration benchmarks, baselines, and RBDs. (To meet this requirement, the solution should meet all of the following sub-requirements) |
| OP-RMP1.1 |
| The solution should capture and record all identified information security risks. |
| OP-RMP1.2 |
| The solution should record the approved RBD as part of the security configuration baseline for a computing asset. |
Operational Capability: The solution shall provide the ability to support the change control process by assisting the authorized organizations to define and maintain baseline security configurations with risk commensurate RBDs.
Requirements Category: Security Configuration Baseline Management Process (OP-BMP)
| OP-BMP1 |
| The solution should provide the capability to automate the IRS baseline management process for security configuration benchmarks, baselines, and RBDs as described in the Security Compliance Posture Monitoring and Reporting (SCPMaR) Concept of Operations. |
Requirements Category: Change Control Process (OP-CCP)
| OP-CCP1 |
| The solution should provide the capability to automate the IRS change control process for security configuration benchmarks, baselines, and RBDs. (To meet this requirement, the solution should meet all of the following sub-requirements) |
| OP-CCP1.1 |
| The solution should provide the capability to permit authorized users to initiate the change control process by submitting a change request to the CM organization. |
| OP-CCP1.2 |
| The solution should provide the capability to test and verify security configuration changes as a part of the change control process. |
| OP-CCP1.3 |
| The solution should provide the capability for multiple approval levels throughout the change control process. |
