DDEAMC RMF New System Questionnaire.pdf

*Equipment Category (Medical Device, Patform IT (PIT), Automation, General Service):

*Vendor:

*Requesting Service: *Model:

*Requestor: *Vendor Contact:

*Installation Location: (Dept, Bldg, Room):

*If server based, specify server name/type:

(virtual, hardware)

*Point of Contact: *Point of Contact Phone Number:

*Equipment Description (description of equipment function and systems it communicates with):

*Will IMD be responsible for configuration management,vulnerability management, and Security Technical Implementation Guide (STIG) compliance management for the hardware, firmware, or underlying system software: Yes No

If IMD is NOT responsible, please note the responsible department below:

DEPARTMENT OF THE ARMY

DWIGHT D. EISENHOWER ARMY MEDICAL CENTER (DDEAMC)

A&A RMF QUESTIONNAIRE

Software/Application Systems Information

What Operating System (OS) and version/Service Pack does the system utilize (Win 7 or 10, Win Svr 2008, 2012, or 2016)?

Does the system use a database application to operate? Yes No If yes, specify which database application and version:

Membership in the facility’s Windows Domain is:

Required Recommended Not Recommended N/A

Is a desktop web browser required to access the system/application? Yes No

If yes, specify which browsers and versions are supported:

If yes, does it require the use of https: and the Secure Socket Layer certificates – explain below:

If a browser is required, does it require a specific version of Java? Yes No If yes, specify the version:

Are there any software/hardware dependencies for operations? Yes No If yes, specify required dependencies:

If Windows based, can Configuration Management (CM) be used for for OS patches? Yes No

If no, specify how OS patching will be accomplished:

Can critical and routine OS and system security patches be applied as they become available without prior vendor approval? Yes No

If no, specify how approval notification to IMD will be accomplished:

Software or Application System Configuration

Can the device support the use of McAfee Anti-Virus (AV) software? Yes No If no, what AV packages and versions are supported and describe the mechanism to provide updates.

Can USB ports be disabled on the device without compromising operation? Yes No

Can auto run be disabled for portable media? Yes No Can host-based security components such as a firewall, host intrusion prevention system (HIPS), anti-malware software, and/or any other security suite software required to operate on EAMC LAN be installed without compromising operation?

Yes No

If “No” is the response to any of the above questions regarding updates and anti-virus software, please explain further for each item in the space below.

Is an administrator or power user account required to operate the device? Yes No

Can the device be made to require individual user authentication? Yes No Does the device support password aging and strong user password accounts? Yes No

Does the device support auto logoff or/and session lock? Yes No Does the system support the use of Active Directory for user authentication? Yes No

If yes, specify configuration requirements:

Does the system support the use of CAC/Smart Card only authentication? Yes No

Authentication and User Account

Specify which Electronic Protected Health Information (ePHI) data elements are stored on the device (first name, last name, SSN, DOB):

How many records with sensitive information can be stored on the device?

How long will they be retained on the device?

Is ePHI encrypted prior to transmission? Yes No If yes, what is the encryption mechanism(s)?

How is data transmitted to the storage repository (LAN, DVD, USB, etc.)?

Is ePHI stored only on a drive partition or a separate drive to assist with end-of-life media sanitization? Yes No

Will the medical device require data backups? Yes No If yes, specify how the system and data are backed up and what media is used:

Describe backup process: (data centers are lights out so this needs to be known up front)

Where will backups be stored and secured?

Does the device have the ability to assign unique ID numbers (accession numbers) instead of using patient identifying information?

Yes No

If yes, how is it generated?

Does the device utilize a laptop for system operation? Yes No If so, can the laptop be encrypted without impacting clinical functionality? Yes No

If yes, what encryption software can be used?

Data Handling

Provide a comprehensive list of all TCP and UDP ports that are required for operation:

Note: If more space is needed, please attach the comprehensive list of ports required for operation to this document. Attach a network diagram showing all communication requirements.

How many fixed/static IP addresses does the device require?

Is the device compatible with IP V6? Yes No Vendors’ products should be designed such that only ports required for the intended operation of the device are active. Are unused ports closed or disabled?

Yes No

Can this be accomplished without impacting system operation? Yes No Vendors’ products should be designed such that only services required for the intended operation of the device are active.

Are unused services (Telnet, IIS, FTP, etc.) disabled?

Yes No

Can this be accomplished without impacting system operation? Yes No Provide a comprehensive list of all services that are required for system operation:

Can the device be serviced remotely? Yes No Does the vendor have an existing Business to Business (B2B) VPN tunnel or individual user VPN account(s)? Yes No

What remote access software does the system utilize (Dameware, PC Anywhere, AD etc.)?

Does the device require connection to the Internet to operate? Yes No If yes, please justify and provide connection info (IP, port, protocol and traffic direction):

What are the LAN bandwidth requirements for full connectivity/performance?

What are the WAN bandwidth requirements for full connectivity/performance?

Networking

Does the device utilize wireless communication? Yes No

• If yes, what protocols are used?

Is the encryption module FIPS 140-2 certified. Provide certificate number if applicable:

Are any ePHI data elements transmitted via the wireless link? Yes No

• If yes, list each element (first name, last name, DOB, SSN).

Is this a new technology Yes No

Is software/application system compatible with Genesis and/or CHCS Yes No Has the software/application system been purchased? Yes No

Wireless

Software/Application System Acquisitions

If yes, identify how the purchased was performed (local/dept, DDEAMC, MEDCOM, DHA)

Prepared By:____________________ Company/Organization:_____________ Date:________

Is there an existing A&A package (current CON, ATO, etc) Yes No

Is the software/hardware Trusted Platform Manager (TPM) 2.0 certified Yes No

Directive 6550 - February 2015