QA as of 13 January 21.pdf

1. Are the machines to be black/white or color printing?

‐ Color and black and white capable

2. How many paper trays?

‐ 3 trays to accommodate 12'x17" paper

3. What are the network requirements?

‐ Provide devices capable of being configured to comply with the current Defense Information Systems

Agency (DISA) Security Technical Implementation Guide (latest version and release), developed by DISA for the DOD.

URL for zip files of this DISA documents found at: http://iase.disa.mil/stigs/index.html.

Note: DOD policy prohibits the publishing of network configuration information, and therefore DOD installations are not required to fill out pre‐installation site surveys. The required information will be provided at time of installation by the local IT support.

Contractor shall supply onsite support during installation. At time of installation, the end user IT department shall be present for collaboration.

‐Provide technical and system analysis support and appropriate digital cards/products to successfully connect devices to customer networks.

‐Provide, upon installation a minimum of, two (2) hours of technical and analyst support to the agency network administrator onsite for each digital/multifunctional unit installed. Support may be requested for the physical and software interface of the controller/device to the DLA Document Services’ customer’s network. Support shall be provided for network configurations based on agency hardware/software and initial Digital Site Survey provided prior to date of installation.

‐NETWORK SECURITY. For those devices that shall be connected to a local area network, the contractor shall:

‐‐‐ Warrant that the devices shall operate on and coexist on a network supporting any and all of the following:

☒ Internet Protocol Version 4 (IPv4), ☒ Internet Protocol Version 6 (IPv6), ☒ A hybrid of IPv4 and IPv6.

‐‐‐ Contractors shall monitor industry standard vulnerability sites (e.g. http://nvd.nist.gov/, https://www.uscert.gov/ncas/alerts, http://oval.mitre.org/ ) and take appropriate actions if their equipment is subject to a known vulnerability. In addition, the customer will notify the contractor via

409 CSB Theater Contracting Center as security vulnerabilities are identified concerning all equipment installed on the DOD Information Network (DODIN) When vulnerabilities are identified by either the contractor or the customer, the contractor shall provide remediation for distribution to all installed equipment in accordance with USCYBERCOM unless a different time period is directed by USCYBERCOM via 409 CSB Theater Contracting Center.

The TASKORD is For Official Use Only and is quoted below for reference:

• Assured Compliance Assessment Solution (ACAS) assigns severity scored of critical , high, medium and low to plug‐in findings.

• Critical findings reflect discovery of a common vulnerability and exposure (CVE) that poses significant risk to the confidentiality, integrity, and availability of DODIN Networks. Actions to mitigate or remediate critical vulnerabilities should be initiated upon discover with the goal of mitigation/remediation within 7 days.

• Findings with a severity score of high should be addressed in the same manner as vulnerabilities addressed via Information Assurance Vulnerability Alert (IAVA) directives and mitigated or remediated within 21 days of discovery.

• Findings with severity scores of medium and low should be addressed in accordance with local

Approving Official (AO), Information System Security Manager (ISSM), or Information System Security

Officer (ISSO) guidance until further notice.

• In all instances, DOD components should consider exposure to threat, mission impact, sensitivity of data, and current mitigating security controls when prioritizing implementation of fix actions. In the event remediation cannot be achieved within the mandated timeline, a Plan of Actions and Milestones will be approved by the Customer's Authorizing Official or designee for risk acceptance.

Additional Network Security Requirements. If the box is checked, the contractor shall provide devices that:

☒ NIAP: Are listed on either the NIAP CCEVS Product Compliant List

(https://www.niapccevs.org/Product/ ) or Common Criteria Portal Certified Products List

(http://www.commoncriteriaportal.org/products/)

‐‐‐ RMF: Are capable of obtaining accreditation through the Risk Management Framework (RMF) for

DoD Information Technology (IT). As part of this, the contractor agrees to provide all requested information and work in good faith with DLA Document Services so the 409 CSB Theater Contracting

Center customer(s) can expeditiously obtain RMF accreditation. The contractor further agrees that should the proposed device(s), not obtain RMF accreditation, after 6 months the contractor shall remove the device(s).

[Information regarding RMF is found in Risk Management Framework (RMF) for DoD Information

Technology (IT) Instruction 8510.1 dated 12 March 2014.

http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf]

‐‐‐ SMARTCARD: The contractor shall supply a SMARTCARD PKI Solution, which is compliant with DODI

8520.02/8520.03, CNSSP‐11 and NIST FIPS 201 (PIV) standards. The contractor shall provide card readers at time of installation that are capable of reading and processing all approved CAC and PIV cards.

4. What type of sorting functions are required?

Automatic Duplexing; Reversing Automatic Document Feeder with minimum 30 page document capacity.

5. Is CAC Enabled Scanning and / or CAC authentication a mandatory requirement?

‐Yes, is a CAC enabled requirement

6. What’s the maximum estimated number of pages usage per month?

‐5,000 copies for the month.

7. I know for SIPR devices, there is no need for FAX, but for NIPR usually, DLA requests fax. Can you please double‐check with the customer if he needs a fax on these devices?

‐Fax is required because we need the capability available. Usually most jobs are emailed but (rarely) sometimes fax is required.

8. Can you please check with the customer if he needs a stand (cabinet) and how many paper trays he would like?

Yes, we need a stand attached to the MFD with at least 3 paper drawer to accommodate up to 12"x18" sheet of paper.

9. Can you please check with the customer if he needs to print/scan 11 x 17 paper?

‐Yes, the requirement for a print/scan 11x17 exists.

10. Please check the machine speed that he would like. (25, 30 pages per minute or more) ‐30 pages per minute is our requirement.

12. Is a multi‐position staple finisher required on the machines?

‐Yes the requirement is there and should be part of the contract to resupply.