AMLD4727-Vendor-Checklist.pdf

UNCLASSIFIED

Industrial Cybersecurity

Vendor Checklist

AMLD FORM 4727 (DEC 2021) UNCLASSIFIED Page 1 of 4

Provide this checklist to the perspective vendor when considering a new industrial purchase

POC Information This section is designed to establish who LEAD will reach out to when there are questions regarding the product from a cybersecurity perspective.

Primary POC

Name Email Phone

Vendor POC Name Email Phone

Product Info These are the specifics of the product that will potentially be purchased

Name of Product:

Technology “cut sheet” included with this package (Operating System, Connectivity Expectations, Additional Software, Security Features, minimum HW/SW requirements, etc.)

Safety This is top priority at LEAD and all safety considerations must be addressed

Identify any specific safety considerations when deploying, using, managing, upgrading this product (from a cybersecurity perspective)

Certification and Accreditation This is a formal validation that the product has undergone cybersecurity testing and the results of that testing.

Typically the two paths to choose from are Risk management Framework (RMF) (DOD path) and National Information Assurance Partnership (NIAP) (Commercial path)

RMF Compliant If answer is “Yes” for RMF provide the following (if capable):

I do not have the authority to obligate the government to pay for any item or service, or to authorize any deviation from any contractual obligation between a contractor and the government.

Describe how is this product typically used (attach additional sheet if needed) (i.e., what challenges does this product meet):

Product Hardware (HW) and Software (SW) lists included in this package

UNCLASSIFIED

AMLD FORM 4727 (DEC 2021) UNCLASSIFIED Page 2 of 4

Owner of Accreditation

System Categorization

Type or System Accreditation (choose one)

Registration in eMASS (provide DITPR Number)

NIAP Certified If the answer is “Yes” for NIAP Provide the following (if capable):

Protection Profile:

EAL Level:

C&A Testing in progress

If so what kind:

Test Report:

Usage/Capability This section outlines, at a high-level, what the product is designed to do and if it has basic cybersecurity capabilities integrated into it.

Product works with the Army Gold Master Image Army Gold Master Image (AGM): This image is leveraged to build most computer servers and workstations within the Army (mostly Windows based). It is a computer image that has gone through most of the STIG process and is deemed to be “hardened” at a basic level. DOIM can provide this image to vendors to ensure that the application or hardware needed for the request will operate in this computing environment.

Product has inherent cybersecurity capabilities (if “Yes” then list in notes section or separate sheet)

Interoperability/Net Analysis DOD has specific rules as to how data is protected in different environments. This section outlines some of those rules that could be “deal-breakers” or might bear a closer look.

Network capability required (If network capability is required, attach “high-level topology diagram” to checklist)

Product has Data-in-Transit Capabilities (If data generated for use with product traverses a network, how is it protected) (data-in-transit, this is normally accomplished via encryption) If network is not needed this is “N/A”

Product is FIPS 140-2 certified FIPS 140-2 certification: This is the Federal Information Processing Standard (FIPS) 140-2 the advanced encryption standard (AES). It is the encryption standard for the U.S. Government. If the product you are looking at transfers information in any way (i.e. Bluetooth, WiFi, etc.) it must use an approved cryptographic module. This is known as “protecting data-in-transit”. A list of approved modules can be found here:

https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search

Personally Identifiable Information (PII)/Collaboration/IA (Any “Yes” answers in this section will require documentation) PII: https://www.dhs.gov/privacy-training/what-personally-identifiable-information

PII is treated as sensitive information within DOD and is protected as such. If the product has the potential to process PII encryption will be needed.

Product has the potential to process PII?

Product has Data-at-rest capability (see section on FIPS 140-2 certification, based on information and environment these rules will apply for data-at-rest as well)

Web Capability/Remote Management In today's environment industrial products are increasingly dependent on “digital technology” to function. Along with this dependency networking, connection to the outside world, and remote management become key considerations to evaluate. DOD treats systems that have the capability to connect to the internet or some other network differently than Stand-alone systems.

Product has identified web capabilities (if “YES” list in notes section or in separate, attached sheet)

Product has remote management capability (If so how is it secured or can it be disabled?)

STIGs/Ports Security Technical Implementation Guides and Port security are some of the tools that DOD leverages to secure products of various kinds.

AMLD FORM 4727 (DEC 2021) UNCLASSIFIED Page 3 of 4 https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search https://www.dhs.gov/privacy-training/what-personally-identifiable-information

STIGS: https://public.cyber.mil/stigs/ PPSM: https://public.cyber.mil/connect/ppsm/

Have any STIGs been identified and applied to this product? (List here)

Ports, Protocols, Security Management (PPSM) worksheet included (if applicable) NOTE: This worksheet ensures that all ports and protocols that are used with the product are identified

Integration Support

Will vendor be available to support site surveys and integration efforts?

Life-cycle System Life-cycle is an important aspect of projecting level of effort for sustaining a product. Understanding what support comes with the product, what can be purchased as an upgrade, etc. assists in these projections.

What is the average life-cycle of this product?

What does support for this product include?

How are product updates handled?

Notes:

AMLD FORM 4727 (DEC 2021) UNCLASSIFIED Page 4 of 4 https://public.cyber.mil/stigs/ https://public.cyber.mil/connect/ppsm/

UNCLASSIFIED

Industrial Cybersecurity Vendor Checklist

AMLD FORM 4727 (DEC 2021) UNCLASSIFIED Page 1 of 4 Provide this checklist to the perspective vendor when considering a new industrial purchase

POC Information This section is designed to establish who LEAD will reach out to when there are questions regarding the product from a cybersecurity perspective.

Primary POC Name Email Phone Vendor POC Name Email Phone Product Info These are the specifics of the product that will potentially be purchased

Safety This is top priority at LEAD and all safety considerations must be addressed

Certification and Accreditation This is a formal validation that the product has undergone cybersecurity testing and the results of that testing. Typically the two paths to choose from are Risk management Framework (RMF) (DOD path) and National Information Assurance Partnership (NIAP) (Commercial path)

If answer is “Yes” for RMF provide the following (if capable):

I do not have the authority to obligate the government to pay for any item or service, or to authorize any deviation from any contractual obligation between a contractor and the government.

AMLD FORM 4727 (DEC 2021) UNCLASSIFIED Page 2 of 4 If the answer is “Yes” for NIAP Provide the following (if capable):

Usage/Capability This section outlines, at a high-level, what the product is designed to do and if it has basic cybersecurity capabilities integrated into it.

Interoperability/Net Analysis DOD has specific rules as to how data is protected in different environments. This section outlines some of those rules that could be “deal-breakers” or might bear a closer look.

UNCLASSIFIED

Personally Identifiable Information (PII)/Collaboration/IA (Any “Yes” answers in this section will require documentation) PII: https://www.dhs.gov/privacy-training/what-personally-identifiable-information

PII is treated as sensitive information within DOD and is protected as such. If the product has the potential to process PII encryption will be needed.

Web Capability/Remote Management In today's environment industrial products are increasingly dependent on “digital technology” to function. Along with this dependency networking, connection to the outside world, and remote management become key considerations to evaluate. DOD treats systems that have the capability to connect to the internet or some other network differently than Stand-alone systems.

STIGs/Ports Security Technical Implementation Guides and Port security are some of the tools that DOD leverages to secure products of various kinds.

AMLD FORM 4727 (DEC 2021) UNCLASSIFIED Page 3 of 4

UNCLASSIFIED

STIGS: https://public.cyber.mil/stigs/ PPSM: https://public.cyber.mil/connect/ppsm/

Integration Support

Life-cycle System Life-cycle is an important aspect of projecting level of effort for sustaining a product. Understanding what support comes with the product, what can be purchased as an upgrade, etc. assists in these projections.

AMLD FORM 4727 (DEC 2021) UNCLASSIFIED Page 4 of 4 9.0.0.2.20120627.2.874785