Amendment__1_questions.pdf

W81XWH-16-T-0078

Amendment #1

Retired keys: Supports 20 or more on-card retired private key management keys (aka Encryption keys) with their associated X509 certificates

• Question 1: Is having 20 on-card retired private key management keys a strong requirement? We are asking that because not too many cards on the market have such capacity, the number is usually between 8 and 16. Requiring 20 on-card retired private key management keys might increase the cost of the cards. For your information, certificates on the card usually expire every 3 years, that's when a key management key is created. Another situation is when a user loses his/her card. Having 20 slots means there is 60 years of key recovery. Even a specific user lose his/her card 10 times, that will still be 30 years of key recovery. We expect today's technology to be obsolete in no more than 10 years.

Answer:

Retired keys shall support 8 or more private key management keys, the solicitation has been revised to reflect this change.

On-card fingerprint verification: NIST MINEX II validated on-card fingerprint verification functionality available on a FIPS 140-2 validated PIV card. It should takes less than 100 milliseconds for a positive match.

• Question 2: Is this requirement a strong requirement and would you like to use On-card fingerprint verification for Logical Access? On-card fingerprint verification for Logical Access requires additional software that can increase the cost of the overall solution. Additionally only limited use case scenarios support this mode of authentication. For instance it is not possible to authenticate in a remote session using fingerprint as the fingerprint reader traffic is not supported by RDP. Additionally using this feature requires additional devices and software to capture the user fingerprint during the enrollment phase.

This is no longer a requirement and has been removed from the solicitation.

Common Access Card (CAC) implementation

• Question 3: We assume you are looking to deploy smart cards functionally similar to CAC.

Indeed CAC are really specific cards only produced by DMDC for the US Department Of Defense. A Common Access Card is issued by a government authority and has a legal value, a CAC is an government issued identity. Our understanding is that you would like to deploy smart card technically similar to CAC to protect your network but that are not necessarily real CAC that only a government authority can issue.

The Government requires a smart card system that is similar to DOD Common Access Card system, the solicitation has been revised to reflect this change.

The contractor shall install and configure all the acquired hardware or provide detailed installation and configuration guide. This hardware includes but is not limited to three high definition CAC printers with Reverse-Transfer Dual-Sided, General-purpose hardware security module server/device, Certificate authority (CA) server, SQL server, and the contract shall install and configure all the software components required for the deliverables

• Question 4: Can the CA be hosted outside of WRAIR environment (managed PKI)?

The CA will be internally manage by WRAIR OCONUS Labs, the solicitation has been revised to reflect this change.

Objective 2.11.3 Remote users shall be able to authenticate to the Virtual Private Network gateway using a Smart Card and PIN and securely gain access to the organization internal resources

• Question 5: Could you provide the model and version of the VPN Gateway as well of the type of VPN client used by the remote users: fat client, web based, IPSEC, SSL.

Cisco AnyConnect, SSL and IPSEC VPN

Objective 2.11.9 Employees shall be able to digitally encrypt emails, files and documents

• Question 6: The smart card and software provided store the encryption key and allow third party software to access the encryption keys to encrypt or decrypt data. However email, files and documents encryption requires a third party software. For instance Microsoft Outlook offers email encryption using a smart card. What third party products are you planning to use for files and documents encryption?

The third party software currently being use by these WRIAR OCONUS Labs are Microsoft Windows documents, Microsoft office suite 2010 files and email, Form flow files , Internet Explorer, Adobe acrobat files.

Deliverable 3.5.2 Design documentation Due: beginning of contract

• Question 7: What do you exactly mean by beginning of contract? Within a certain time after the contract award? The design of the solution usually requires a collaborative workshop with the customer to design a solution that best fit the customer. The first version of the design documentation usually comes within one month after the initial workshop and follow-up sessions.

The contract begins once it is awarded. The time line shall be determined at the kick off meeting.

Question 8: Is there some preferences in term of Certificate Authority? And do you have the CA already in place?

Answer:

We currently do not have internal or external CA authority. However, the contractor shall setup an internal CA at AFRIMS that will be manage by WRAIR OCONUS labs

Question 9: Are the signed/encrypted e-mail internal, or are you looking for e-mail that can be exchange outside of the organization?

Answer:

The sign and encrypted email designation will be internal

Question 10: Does the CA needs to be public (federal bridge)?

Answer:

The CA will be non-public

Question 11: Is there any identity vetting/Identity proofing requirements for this project?

Answer:

None required on the computing, except for network authorization and CA certificate revocation check

Question 12: Can you provide details on your wireless access points ? Which solution do you use and is it the same across the different sites?

Answer:

The Government is using Cisco wireless solution in all of the sites, may be different models.

Question 13:Can you provide some information in term of the PACS infrastructure at the different sites ?

Which technology is used for the PACS card today?

Answer:

This contract will be executed in isolation to our PACS system

Question 14: Will the hardware equipment be procured from the US or at each of the different locations?

The hardware will be procured in US and shipped to WRAIR.