 |
| NATIONAL COMPUTER SECURITY CENTER NCSC TECHNICAL REPORT-004 Library No. S-241,359 A GUIDE TO PROCUREMENT OF LANGUAGE FOR RFP SPECIFICATIONS AND STATEMENTS OF WORK - AN AID TO PROCUREMENT INITIATORS INCLUDES COMPLEX, EVOLVING, MULTIPOLICY SYSTEMS July 1994 Approved for Public Release: Distribution Unlimited NCSC TECHNICAL REPORT-004 Library No. S-241,359 July 1994 FOREWORD This technical report is a strawman update to Volume 2 of 4 of the procurement
The business of computers, security, and acquisitions is complex and
dynamic. I invite National Computer Security Center 9800 Savage Road Fort George G. Meade, MD 20755-6000 ATTN: Standards, Criteria, and Guidelines Division Reviewed by:_______________________________________ GLENN GOMES Chief, INFOSEC Standards, Criteria & Guidelines Division Released by:_______________________________________ ROBERT J. SCALZI Chief, INFOSEC Systems Engineering Office ACKNOWLEDGMENTS This document has been produced under the guidance of MAJOR (USA) Melvin
L. De This STRAWMAN was delivered to the Government in March 1993, as Howard
TABLE OF CONTENTS FOREWORD ACKNOWLEDGEMENTS 1.0 GENERAL INFORMATION 1.1 INTRODUCTION 1.2 PURPOSE 1.2.1 Facilitating the Contracting Process 1.2.2 Facilitating Fairness in Competitive Acquisition 1.2.3 Minimizing Procurement Cost and Risk 1.2.4 Ensuring the Solicitation is Complete Before Issuance 1.3 SCOPE 1.4 BACKGROUND 1.5 COMPLEX SYSTEMS 2.0 PROCUREMENT PROCESS 3.0 REQUEST FOR PROPOSAL 3.1 SECTION C - DESCRIPTIONS/SPECIFICATIONS 3.2 SECTION C - STATEMENTS OF WORK 3.3 SECTION F - DELIVERIES AND PERFORMANCE 3.4 SECTION H - SPECIAL CONTRACT REQUIREMENTS 3.5 SECTION J - LIST OF DOCUMENTS, EXHIBITS, AND OTHER ATTACHMENTS 3.6 SECTION L - INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS 3.7 SECTION M - EVALUATION FACTORS FOR AWARD 4.0 OTHER CONSIDERATIONS 4.1 NONMANDATORY REQUIREMENTS AND OPTIONS 4.2 EVIDENCE AVAILABILITY 4.3 DOCUMENTATION COST 4.4 INTERPRETING THE TCSEC 5.0 STANDARD SOLICITATION LANGUAGE (The remainder of Chapter 5 is organized according to selected applicable
sections of the SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT C.1 SCOPE OF CONTRACT (AUTOMATED INFORMATION SYSTEM - EQUIPMENT, SOFTWARE AND MAINTENANCE) C.2 OPERATIONAL SECURITY SPECIFICATIONS C.3 TECHNICAL SPECIFICATIONS C.3.1 Discretionary Access Control Specifications C.3.2 Object Reuse Specifications C.3.3 Labels Specifications C.3.4 Label Integrity Specifications C.3.5 Exportation of Labeled Information Specifications C.3.6 Exportation to Multi Level Devices Specifications C.3.7 Exportation to Single Level Devices Specifications C.3.8 Labeling Human-readable Output Specifications C.3.9 Subject Sensitivity Labels Specifications C.3.10 Device Labels Specifications C.3.11 Mandatory Access Control Specifications C.3.12 Identification and Authentication Specifications C.3.13 Trusted Path Specifications C.3.14 Audit Specifications C.3.15 System Architecture Specifications C.3.16 System Integrity Specifications C.3.17 Covert Channel Specifications C.3.18 Trusted Facility Management Specifications C.3.19 Trusted Recovery Specifications C.4 STATEMENTS OF WORK C.4.1 Covert Channel Analysis Statement of Work C.4.2 Trusted Recovery Statement of Work C.4.3 Security Testing Statement of Work C.4.4 Design Specification and Verification Statement of Work C.4.5 Configuration Management Statement of Work C.4.6 Trusted Distribution Statement of Work C.4.7 Security Features User's Guide Statement of Work C.4.8 Trusted Facility Manual Statement of Work C.4.9 Test Documentation Statement of Work C.4.10 Design Documentation Statement of Work RFP SECTION F - DELIVERIES AND PERFORMANCE RFP SECTION J - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS RFP SECTION L - INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS RFP ATTACHMENT A - CONTRACT DATA REQUIREMENTS LIST (CDRL) FORM DD1423 RFP ATTACHMENT B - GLOSSARY RFP ATTACHMENT C - ACRONYMS RFP ATTACHMENT D - REFERENCES (This completes Chapter 5 and organization according to the RFP.) APPENDIX A BIBLIOGRAPHY LIST OF FIGURES Figure 2-1 Security Related Areas Figure 2-2 Procurement Initiator Guidance LIST OF TABLES Table 1-1 Procurement Guideline Series Table 3-1 RFP Organization Table F-1 Data Deliverables 1 GENERAL INFORMATION 1.1 INTRODUCTION The National Security Agency (NSA) wants to clarify the computer security
aspects of Table 1-1 Procurement Guideline Series An Introduction to Procurement Initiators on Computer Security Requirements, December 1992. Language for RFP Specifications and Statements of Work-An Aid to Procurement
Initiators, 30 Computer Security Contract Data Requirements List and Data Item Descriptions
Tutorial, 28 How to Evaluate a Bidder's Proposal Document-An Aid to Procurement Initiators
and DoD Directive 5200.28, "Security Requirements for Automated Information
Systems 1.2 PURPOSE The intended user of the document is the "procurement initiator,"
to include program The purpose of this document is to facilitate the contracting process,
to provide 1.2.1 FACILITATING THE CONTRACTING PROCESS This guideline provides Specification and Statement of Work (SOW) contract
language system will provide adequate security, while avoiding a costly solution.
This document DoD agencies should use this document whenever considering the acquisition
of trusted 1.2.2 FACILITATING FAIRNESS IN COMPETITIVE ACQUISITIONS This guideline promotes the use of EPL products while at the same time
satisfying a. Public Law 98-369 "Competition in Contracting Act of 1984" b. Title 41, United States Code, Section 418, "Advocates for Competition" c. Title 10, United States Code, Section 2318, "Advocates for Competition" d. DoD Instruction 5000.2, "Defense Acquisition Management Policy,"
February 23, e. DoD 5000. 2-M, "Defense Acquisition Management Documentation
and Reports," 1.2.3 MINIMIZING PROCUREMENT COST AND RISK Version 1 of this procurement guideline series is written solely to acquire
products on For solutions that use EPL products, not only have the specifications
of the evaluated For some well defined entity of a system to be regarded as secure in
the TCSEC sense A successful certification evaluation of an entity (which has not been
placed on the NSA The rationale for this approach is as follows: a. Although a Division/Class of the TCSEC is used as the basis for the
secure part of a b. The certification evaluation process addresses the needs of a single
implementation. It The Request for Proposal (RFP) can not dictate that an item come from
the EPL because 1.2.4 ENSURING THE SOLICITATION IS COMPLETE BEFORE ISSUANCE If we try to use existing TCSEC criteria as RFP requirements, it is found
that those 1.3 SCOPE This guideline does not revise the words in DoD 5200. 28-STD; it is a
reformatting and 1.4 BACKGROUND A Federal Government awareness of the lack of guidance in the security
arena led to the The TCSEC was published in 1983 and revised to become a DoD standard
in December The process for acquiring trusted systems is slightly different than
other acquisitions. The challenge for the procurement initiator is to specify the requirements
with sufficient 1.5 COMPLEX SYSTEMS The TCSEC and the TNI specify simple systems in the sense that they are
supported by a The general case of interfacing TCBs into a system, existing or not;
evaluated or not In the approach used here, the system is divided into unique pieces,
called domains of The goal is that each DOCP satisfies a Division/Class and that the system
be adequately In summary, use of this approach enjoys the following advantages: · It offers a solid, intuition supported approach for procurement administrators and DAAs. · It requires the statement of operational policy (e.g., DOCPs
and n-tuples) from the using · It enforces precise system covering boundary definition. · It allows, and in fact encourages, cost/risk tradeoffs and iteration
of operational policy · It can be applied to pre-regulatory (TCSEC, TNI and/or TDI)
systems where the interpre- · It does not preclude, and in fact supports use of the TNI and TDI. · It forces consideration of cascading risk, requires interface policy, requires global policy. · It accommodates/promotes use of EPL products since the basic
building block entity of · It addresses security interface requirements to be satisfied
if an EPL product component THIS PAGE INTENTIONALLY LEFT BLANK 2 PROCUREMENT PROCESS The procurement process is governed by policy. Here, three types of policy
are The procurement process begins with the determination of operational
requirements by Selection of these security specifications requires a clear understanding
of the system Figure 2-1 Security Related Areas The Designated Approving Authority (DAA) is responsible under Enclosure
4 of DoD Later in Chapter 5 of this document we will address specific protection
topics in the Figure 2-2 Procurement Initiator Guidance Working with acquisition personnel, the procurement initiators should
consult this 3 REQUEST FOR PROPOSAL The Request for Proposal (RFP) is the focus of this procurement guideline
series. A Table 3-1 RFP Organization Letter Section Title A B C D E F G H I J K L M Solicitation/Contract Form, Standard Form 33 Supplies or Services with Prices and Costs Descriptions/Specifications/Statements of Work Packaging and Marking Inspection and Acceptance Deliveries and Performance Contract Administration Data Special Contract Requirements Contract Clauses List of Documents, Exhibits and Other Attachments Representations, Certifications and Other Statements of Offerors or Quoters Instructions, Conditions, and Notices to Offerors Evaluation Factors for Award 3.1 SECTION C - DESCRIPTIONS/SPECIFICATIONS The first part of Section C describes the technical requirements to the
offeror, including 3.2 SECTION C - STATEMENTS OF WORK (SOW) The second part of Section C identifies the specific tasks the contractor
will perform 3.3 SECTION F - DELIVERIES AND PERFORMANCE This section covers delivery and installation requirements. Special delivery
3.4 SECTION H - SPECIAL CONTRACT REQUIREMENTS This section of the solicitation contains clauses that are specially
tailored for each 3.5 SECTION J - LIST OF DOCUMENTS, EXHIBITS, AND OTHER This section contains a list of documents, exhibits, attachments, and
other forms used to a. The Contract Data Requirements List (CDRL), referencing specific Data
Item Descrip- b. Even though it is presented separately, the glossary is an important
part of the Specifi- c. Acronyms used in the RFP must be defined in their first use and must
also be identi- d. References have been identified for incorporation into the RFP. Terms
are compatible 3.6 SECTION L - INSTRUCTIONS, CONDITIONS, AND NOTICES TO This section contains the instructions and conditions of the acquisition.
It informs 3.7 SECTION M - EVALUATION FACTORS FOR AWARD This presents to the bidder the basis of award and how proposals will
be evaluated. It THIS PAGE INTENTIONALLY LEFT BLANK 4 OTHER CONSIDERATIONS There are other important factors to consider before the RFP language is presented. 4.1 NONMANDATORY REQUIREMENTS AND OPTIONS An alternative for procurement initiators is to specify non-mandatory
requirements. Non-mandatory requirements and solutions can also be proposed by the
bidder if this is Options are requirements that may be proposed by the Government, but
ones that may 4.2 EVIDENCE AVAILABILITY Just because a vendor supplies NSA with evidence to support a product
evaluation, does 4.3 DOCUMENTATION COST The cost for operational security documentation (e.g. Security Feature
User's Guide and 4.4 INTERPRETING THE TCSEC The philosophy of this document is to present the words of the TCSEC
in a suitable form The features and assurances for a given TCSEC Division/Class are inseparable.
If The Trusted Computing Base (TCB) is the totality of protection mechanisms,
hardware, 5 STANDARD SOLICITATION LANGUAGE To assist the reader, the paragraph numbering that follows is as one
might expect to find Certain conventions are used in this chapter. The words in bold are either
words Paragraph designation is complicated and will be explained here. The
basis for (but not C.m.n.p.q C. Section C of the RFP m. Applicable DOCP number designator n. n=1 Scope of Contract, n = 2 Operational Specifications, n = 3 TCSEC Specifications, n = 4 TCSEC Statements of Work p. Number of topic taken from TCSEC q. Item of concern for procurement initiator In the Section C of this document, for use by the procurement initiator,
section m will be a. Scope of Contract (n=1), Operational Specification (n = 2), Text of
the Specification b. DOCP Interface Policy Interpretation - Interface policy of this DOCP
with respect to c. DOCP Global Policy Interpretation - Global policy imposed on this
and all other d. Trusted Network Interpretation - References to interpretations and
other applicable in- e. Trusted Database Management Interpretation - References to interpretations
and other f. Important References - These references should be included in the
RFP. They are gen- g. Procurement Considerations - Here, issues are discussed that have
arisen in previous In the section C being constructed by the procurement initiator, his/her
paragraphing a. Text of the Specification/Statement of Work b. Interpretation (Not to be considered as a requirement) c. References (Not to be considered as a requirement) The standard language and form for the trusted elements of a secure system,
along with SECTION C - DESCRIPTION/SPECIFICATION/WORK STATEMENT C.1 SCOPE OF CONTRACT (AUTOMATED INFORMATION SYSTEM - EQUIP- The Contractor shall furnish the equipment, software, documentation,
and other C.2 OPERATIONAL SECURITY SPECIFICATIONS a. Text of the Specification The bidder shall considered and/or recommend security support other than
The system shall be shown to be compatible with all operational security
requirements b. DOCP Interface Policy Interpretation (Note: First time readers should skip to section g below for a background
on what is Interface Policy - Policy established for control of data flow between
each pair of Operational requirements pertain, not only to portions of the system
being procured, but There shall be an explicit interface policy considered between each DOCP
and every c. DOCP Global Policy Interpretation Global Policy - System level requirements to be satisfied by each DOCP
(e.g., audit, Global considerations pertain to systems for which there can be or has
been no d. Trusted Network Interpretation The decision may be made to use the TNI as the basis for development
of one or more e. Trusted Database Management Interpretation The decision may be made to use the TDI as the basis for development
of one or more f. Important References "Use of the Trusted Computer System Evaluation Criteria (TCSEC)
for Complex, g. Operational Security Considerations Terms are introduced that must be understood to understand the DOCP concepts: Regulatory/Security Policy - Regulations, Directives, and Standards imposed
on the Operational Security Policy - Design and operational choices that satisfy
regulatory Domains of Constant Policy (DOCPs) - Unique pieces of the system, each
with a single Operational Security Parameter - Values and relations having a security
relationship · statement of operational positions and responsibilities of each associated with security, · statement concerning the intended frequency of mechanism integrity
checking during op- · minimum audit functionality to be supported at all times, plus
other increasing levels of · maximum number of users, · intended hours of operations, · hard copy output, · environment for Software Development. N-tuples - Operational security policy parameters associated with a DOCP
used to · minimum classification of data, · maximum classification of data, · minimum security clearance, · maximum security clearance, · categories (compartments/caveats), · build status (existing, EPL product, to be built), and · level of assurance achieved (e.g., EPL evaluation at some level,
certification evaluation Those n-tuple parameters considered to be derived are: · risk index, · · exposed risk index, · · mode, and · · division/class. Thus in this case n = 11, where 7 are basic and 4 derived. (1) Background For a simple system where development is only guided by the TCSEC, there
is a single When we are dealing with TDI, there are the same single set of operational
parameters (2) Domains of Constant Policy The approach is used when any or all of the following system characteristics
exist: a) Divide the complex system into pieces, addressing each piece, like simple
systems are Determine division/class using DoDD 5200.28, Enclosure 4. Using the DOCP's
Connected DOCPs are subject to cascading risk, requiring a search that
considers each Optimal operational policy is determined through requirement and design
iteration (3) Risk Assessment Exposed Risk Index - An adjusted risk index for a DOCP determined from
DoDD Contributed Risk - The summed amount of increase in exposed risk potentially
Solely Contributed Risk - The risk contributed by a DOCP which could
not have also A DOCP and its n-tuple are working entities in the sense that tradeoff
decisions A small part of the risk management process for simple systems is the
risk assessment Contributed risk is the summed amount of increase in exposed risk potentially
The exposed risk can be decreased by changing either the local operational
policies or (4) Protection Assessment With the operational policy (DOCPs and n-tuples), interface policy, and
global policy Besides protection mechanism assessment, there needs to be an assessment
of assurance. It is at this point a second iterative analysis should be undertaken
to take into account The results of this second iterative analysis may result in updates to
the operational C.3 TECHNICAL SPECIFICATIONS a. Text of the Specification Detailed technical specifications are found in this section. The glossary
and acronyms (For single policy systems, this section should be traversed once using
a single division/ b. DOCP Interface Policy Interpretation A DOCP has two interface responsibilities: 1) it must ensure that data
it sends continues The policy can be discretionary and/or mandatory and includes categories
Sending DOCPs must be assured that data is being released into a system
that can be Once data is in the possession of a receiving DOCP, it becomes the responsibility
of that A DOCP may not be affordably and certifiably able to support division/class
increases In a policy of mutual suspicion, a sending DOCP must establish interface
policy c. DOCP Global Policy Interpretation To be secure, either there shall be no sharing between DOCPs of discretionary
controlled Even if each TCB has its own data for identification and authentication,
the information Someone must be assigned the authority and assume the responsibility
of security Implications of failure of one of the component TCBs must be reviewed
from the TCBs following the subsetted TCB principles set forth by the TDI need
not be concerned d. Trusted Network Interpretation The specific Trusted Network Interpretations to topics of the Trusted
Computer System e. Trusted Database Management Interpretation The specific Trusted Database Management System Interpretations to topics
of the f. Important References "Use of the Trusted Computer System Evaluation Criteria (TCSEC)
for Complex, g. Technical Specifications Considerations (None) C.3.1 DISCRETIONARY ACCESS CONTROL SPECIFICATIONS a. Text of the Specification (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class C2, repeat TCSEC Section 2.2.1.1. For Class B1, repeat TCSEC Section 3.1.1.1. For Class B2, repeat TCSEC Section 3.2.1.1. For Class B3, repeat TCSEC Section 3.3.1.1. For Class A1, repeat TCSEC Section 4.1.1.1.) b. DOCP Interface Policy Interpretation The interface policy for discretionary access control depends greatly
on the specific c. DOCP Global Policy Interpretation The alternative to a complicated interface policy is to define a global
policy that can be d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class C2, TNI Section 2.2.1.1 applies. For Class B1, TNI Section 3.1.1.1 applies. For Class B2, TNI Section 3.2.1.1 applies. For Class B3, TNI Section 3.3.1.1 applies. For Class A1, TNI Section 4.1.1.1 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.1.1 and IR-2.1.1 applies. For Class C2, TDI Appendix A Section C2-1.1 applies. For Class B1, TDI Appendix A Section B1-1.1 applies. For Class B2, TDI Appendix A Section B2-1.1 applies. For Class B3, TDI Appendix A Section B3-1.1 applies. For Class A1, TDI Appendix A Section A1-1.1 applies.) f. Important References (Note: References are for information only and, unless specified elsewhere,
are not to be NCSC-TG-003, "A Guide to Understanding Discretionary Access Control
in Trusted g. Discretionary Access Control Procurement Considerations Unauthorized users include both those not authorized to use the system
and legitimate "Users" do not include "operators," "system
programmers," "Security Officers," and Deletion of subjects (e.g., users) and objects (e.g., data) is a potential
problem. The The ability to assign access permissions to an object by a user should
be controlled with The TCB should enforce need-to-know access restrictions placed on information
The design must consider that discretionary access control is usually
used for both user Discretionary access control will not stop Trojan horses. An attacker
can trick a more The Commercial-Off-The-Shelf (COTS) systems may vary with respect to
the granularity C.3.2 OBJECT REUSE SPECIFICATIONS a. Text of the Specification (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class C2, repeat TCSEC Section 2.2.1.2. For Class B1, repeat TCSEC Section 3.1.1.2. For Class B2, repeat TCSEC Section 3.2.1.2. For Class B3, repeat TCSEC Section 3.3.1.2. For Class A1, repeat TCSEC Section 4.1.1.2.) b. DOCP Interface Policy Interpretation Since, by definition, there is no part of the system which is not a part
of a DOCP, a c. DOCP Global Policy Interpretation (None) d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class C2, TNI Section 2.2.1.2 applies. For Class B1, TNI Section 3.1.1.2 applies. For Class B2, TNI Section 3.2.1.2 applies. For Class B3, TNI Section 3.3.1.2 applies. For Class A1, TNI Section 4.1.1.2 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.1.2 and IR-2.1.2 applies. For Class C2, TDI Appendix A Section C2-1.2 applies. For Class B1, TDI Appendix A Section B1-1.2 applies. For Class B2, TDI Appendix A Section B2-1.2 applies. For Class B3, TDI Appendix A Section B3-1.2 applies. For Class A1, TDI Appendix A Section A1-1.2 applies.) f. Important References (Note: References are for information only and, unless specified elsewhere,
are not to be NCSC-TG-025, "A Guide to Understanding Data Remanence in Automated
Information NCSC-TG-018, "A Guide to Understanding Object Reuse in Trusted Systems,"
July, g. Object Reuse Procurement Considerations The purpose of object reuse mechanisms is to prevent disclosure of sensitive
information Object reuse is a concern when an object is not fully allocated, that
is, the granularity is C.3.3 LABELS SPECIFICATIONS a. Text of the Specification (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class B1, repeat TCSEC Section 3.1.1.3. For Class B2, repeat TCSEC Section 3.2.1.3. For Class B3, repeat TCSEC Section 3.3.1.3. For Class A1, repeat TCSEC Section 4.1.1.3.) b. DOCP Interface Policy Interpretation The interface policy must be implemented so as to satisfy the labels
policy directly or by c. DOCP Global Policy Interpretation (None) d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class B1, TNI Section 3.1.1.3 applies. For Class B2, TNI Section 3.2.1.3 applies. For Class B3, TNI Section 3.3.1.3 applies. For Class A1, TNI Section 4.1.1.3 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.1.3 and IR-3 applies. For Class B1, TDI Appendix A Section B1-1.3 applies. For Class B2, TDI Appendix A Section B2-1.3 applies. For Class B3, TDI Appendix A Section B3-1.3 applies. For Class A1, TDI Appendix A Section A1-1.3 applies.) f. Important References (None) g. Labels Procurement Considerations The tranquility principle states that the security level of an object
cannot change while Labeling of data is not used solely to control classified information.
The mandatory A distinction must be made between objects that are explicitly labeled
and those that are Internal TCB variables that are not visible to untrusted subjects need
not be labeled, C.3.4 LABEL INTEGRITY SPECIFICATIONS a. Text of the Specification (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class B1, repeat TCSEC Section 3.1.1.3.1. For Class B2, repeat TCSEC Section 3.2.1.3.1. For Class B3, repeat TCSEC Section 3.3.1.3.1. For Class A1, repeat TCSEC Section 4.1.1.3.1.) b. DOCP Interface Policy Interpretation The integrity requirement applies to any interface information transmitted
to define c. DOCP Global Policy Interpretation Shared label interpretation between DOCPs must be identical through use
of identical d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class B1, TNI Section 3.1.1.3.1 applies. For Class B2, TNI Section 3.2.1.3.1 applies. For Class B3, TNI Section 3.3.1.3.1 applies. For Class A1, TNI Section 4.1.1.3.1 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.1.3 and IR-3 applies. For Class B1, TDI Appendix A Section B1-1.3.1 applies. For Class B2, TDI Appendix A Section B2-1.3.1 applies. For Class B3, TDI Appendix A Section B3-1.3.1 applies. For Class A1, TDI Appendix A Section A1-1.3.1 applies.) f. Important References (None) g. Label Integrity Procurement Considerations Care is needed when specifying the means of binding an object and its
label. A The form of internal sensitivity labels may differ from their external
(exported) form, but C.3.5 EXPORTATION OF LABELED INFORMATION SPECIFICATIONS a. Text of the Specification (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class B1, repeat TCSEC Section 3.1.1.3.2. For Class B2, repeat TCSEC Section 3.2.1.3.2. For Class B3, repeat TCSEC Section 3.3.1.3.2. For Class A1, repeat TCSEC Section 4.1.1.3.2.) b. DOCP Interface Policy Interpretation The exportation requirement should be satisfied as part of the interface
policy c. DOCP Global Policy Interpretation Labels and label interpretation between DOCPs shall be identical or transformed
to d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class B1, TNI Section 3.1.1.3.2 applies. For Class B2, TNI Section 3.2.1.3.2 applies. For Class B3, TNI Section 3.3.1.3.2 applies. For Class A1, TNI Section 4.1.1.3.2 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.1.3 and IR-3 applies. For Class B1, TDI Appendix A Section B1-1.3.2 applies. For Class B2, TDI Appendix A Section B2-1.3.2 applies. For Class B3, TDI Appendix A Section B3-1.3.2 applies. For Class A1, TDI Appendix A Section A1-1.3.2 applies.) f. Important References (None) g. Exportation of Labeled Information Procurement Considerations Changes in designation should be made by a properly authorized individual,
normally C.3.6 EXPORTATION TO MULTI LEVEL DEVICES SPECIFICATIONS a. Text of the Specification (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class B1, repeat TCSEC Section 3.1.1.3.2.1. For Class B2, repeat TCSEC Section 3.2.1.3.2.1. For Class B3, repeat TCSEC Section 3.3.1.3.2.1. For Class A1, repeat TCSEC Section 4.1.1.3.2.1.) b. DOCP Interface Policy Interpretation The interface policy shall support the multilevel exportation device
specification. A c. DOCP Global Policy Interpretation A global policy involving the unique assignment of devices to a single
DOCP at one time d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class B1, TNI Section 3.1.1.3.2.1 applies. For Class B2, TNI Section 3.2.1.3.2.1 applies. For Class B3, TNI Section 3.3.1.3.2.1 applies. For Class A1, TNI Section 4.1.1.3.2.1 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.1.3.2 and IR-3 applies. For Class B1, TDI Appendix A Section B1-1.3.2 applies. For Class B2, TDI Appendix A Section B2-1.3.2 applies. For Class B3, TDI Appendix A Section B3-1.3.2 applies. For Class A1, TDI Appendix A Section A1-1.3.2 applies.) f. Important References (None) g. Exportation to Multilevel Devices Procurement Considerations The sensitivity label of an object imported to a multilevel device must
be within the C.3.7 EXPORTATION TO SINGLE LEVEL DEVICES SPECIFICATIONS a. Text of the Specification (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class B1, repeat TCSEC Section 3.1.1.3.2.2. For Class B2, repeat TCSEC Section 3.2.1.3.2.2. For Class B3, repeat TCSEC Section 3.3.1.3.2.2. For Class A1, repeat TCSEC Section 4.1.1.3.2.2.) b. DOCP Interface Policy Interpretation The interface policy shall support the single-level exportation device
specification. A c. DOCP Global Policy Interpretation A global policy involving the unique assignment of devices to a single
DOCP at one time d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class B1, TNI Section 3.1.1.3.2.2 applies. For Class B2, TNI Section 3.2.1.3.2.2 applies. For Class B3, TNI Section 3.3.1.3.2.2 applies. For Class A1, TNI Section 4.1.1.3.2.2 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.1.3 and IR-3 applies. For Class B1, TDI Appendix A Section B1-1.3.2 applies. For Class B2, TDI Appendix A Section B2-1.3.2 applies. For Class B3, TDI Appendix A Section B3-1.3.2 applies. For Class A1, TDI Appendix A Section A1-1.3.2 applies.) f. Important References (None) g. Exportation to Single-level Devices Procurement Considerations Sometimes operational use of a single level device is actually to be
at one level for a C.3.8 LABELING HUMAN-READABLE OUTPUT SPECIFICATIONS a. Text of the Specification (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class B1, repeat TCSEC Section 3.1.1.3.2.3. For Class B2, repeat TCSEC Section 3.2.1.3.2.3. For Class B3, repeat TCSEC Section 3.3.1.3.2.3. For Class A1, repeat TCSEC Section 4.1.1.3.2.3.) b. DOCP Interface Policy Interpretation Where the data is formatted for a human readable output device, the human-readable
c. DOCP Global Policy Interpretation DOCPs receiving data in human-readable output form shall be expected
to be formatted d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class B1, TNI Section 3.1.1.3.2.3 applies. For Class B2, TNI Section 3.2.1.3.2.3 applies. For Class B3, TNI Section 3.3.1.3.2.3 applies. For Class A1, TNI Section 4.1.1.3.2.3 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.1.3 and IR-3 applies. For Class B1, TDI Appendix A Section B1-1.3.2.3 applies. For Class B2, TDI Appendix A Section B2-1.3.2.3 applies. For Class B3, TDI Appendix A Section B3-1.3.2.3 applies. For Class A1, TDI Appendix A Section A1-1.3.2.3 applies.) f. Important References (None) g. Labeling Human-Readable Output Procurement Considerations The System Administrator specifies the printed or displayed sensitivity
label that is to be C.3.9 SUBJECT SENSITIVITY LABELS SPECIFICATIONS a. Text of the Specification (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class B2, repeat TCSEC Section 3.2.1.3.3. For Class B3, repeat TCSEC Section 3.3.1.3.3. For Class A1, repeat TCSEC Section 4.1.1.3.3.) b. DOCP Interface Policy Interpretation The interface policy shall identify when one DOCP has the capability
for change in the c. DOCP Global Policy Interpretation At B2 and above, the TCSEC requires the following: The TCB shall immediately notify a terminal user of each change in the
security level For complex systems, the user interface could be to a DOCP that does
not support a d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class B2, TNI Section 3.2.1.3.3 applies. For Class B3, TNI Section 3.3.1.3.3 applies. For Class A1, TNI Section 4.1.1.3.3 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.1.3 and IR-3 applies. For Class B2, TDI Appendix A Section B2-1.3.3 applies. For Class B3, TDI Appendix A Section B3-1.3.3 applies. For Class A1, TDI Appendix A Section A1-1.3.3 applies.) f. Important References (None) g. Subject Sensitivity Labels Procurement Considerations (None) C.3.10 DEVICE LABELS SPECIFICATIONS a. Text of the Specification (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class B2, repeat TCSEC Section 3.2.1.3.4. For Class B3, repeat TCSEC Section 3.3.1.3.4. For Class A1, repeat TCSEC Section 4.1.1.3.4.) b. DOCP Interface Policy Interpretation There shall be labels associated with each physically connected DOCP
and a label c. DOCP Global Policy Interpretation Labels along with building and interpreting software shall be identical
between DOCPs d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class B2, TNI Section 3.2.1.3.4 applies. For Class B3, TNI Section 3.3.1.3.4 applies. For Class A1, TNI Section 4.1.1.3.4 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.1.3 and IR-3 applies. For Class B2, TDI Appendix A Section B2-1.3.4 applies. For Class B3, TDI Appendix A Section B3-1.3.4 applies. For Class A1, TDI Appendix A Section A1-1.3.4 applies.) f. Important References (None) g. Device Labels Procurement Considerations (None) C.3.11 MANDATORY ACCESS CONTROL SPECIFICATIONS a. Text of the Specification (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class B1, repeat TCSEC Section 3.1.1.4. For Class B2, repeat TCSEC Section 3.2.1.4. For Class B3, repeat TCSEC Section 3.3.1.4. For Class A1, repeat TCSEC Section 4.1.1.4. Also Section 9.0 of the TCSEC should be repeated in the specification
portion of the RFP b. DOCP Interface Policy Interpretation The interface policy shall be shown to uphold the mandatory policy of
each DOCP and, c. DOCP Global Policy Interpretation Mandatory policy shall support hierarchical classification according
to the rules d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class B2, TNI Section 3.2.1.4 applies. For Class B3, TNI Section 3.3.1.4 applies. For Class A1, TNI Section 4.1.1.4 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.1.4 and IR-2.1.4 applies. For Class B2, TDI Appendix A Section B2-1.4 applies. For Class B3, TDI Appendix A Section B3-1.4 applies. For Class A1, TDI Appendix A Section A1-1.4 applies.) f. Important References (None) g. Mandatory Access Control Procurement Considerations (None) C.3.12 IDENTIFICATION AND AUTHENTICATION SPECIFICATIONS a. Text of the Specification (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class C2, repeat TCSEC Section 2.2.2.1. For Class B1, repeat TCSEC Section 3.1.2.1. For Class B2, repeat TCSEC Section 3.2.2.1. For Class B3, repeat TCSEC Section 3.3.2.1. For Class A1, repeat TCSEC Section 4.1.2.1.) b. DOCP Interface Policy Interpretation Trusted paths shall be used at all division classes to provide TCBs to
relay authentication c. DOCP Global Policy Interpretation The identification and authentication requirements in the TCSEC address
the need to it is possible that only one of several DOCPs will provide identification
and d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class C2, TNI Section 2.2.2.1 applies. For Class B1, TNI Section 3.1.2.1 applies. For Class B2, TNI Section 3.2.2.1 applies. For Class B3, TNI Section 3.3.2.1 applies. For Class A1, TNI Section 4.1.2.1 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.2.1 and IR-2.2.1 applies. For Class C2, TDI Appendix A Section C2-2.1 applies. For Class B1, TDI Appendix A Section B1-2.1 applies. For Class B2, TDI Appendix A Section B2-2.1 applies. For Class B3, TDI Appendix A Section B3-2.1 applies. For Class A1, TDI Appendix A Section A1-2.1 applies.) f. Important References (Note: References are for information only and, unless specified elsewhere,
are not to be CSC-STD-002-85, "Department of Defense (DoD) Password Management
Guideline," NCSC-TG-017, "A Guide to Understanding Identification and Authentication
in Trusted g. Identification and Authentication Procurement Considerations (This subject is discussed in Volume 1 Chapter 3 of the Procurement Guideline Series.) Technology has provided techniques and products that vary greatly in
terms of reducing To be effective, authentication mechanisms must uniquely and unforgeably
identify an (B1 - A1) Authorizations include functional roles assigned to individuals.
Most roles can If passwords are to be used, an automatic password generator is strongly
recommended. Password aging is an important consideration that can be enforced administratively
or Smart cards and biometric approaches are effective, especially when they
augment a Whenever the subject is an operating computer program (i.e., a process),
that process C.3.13 TRUSTED PATH SPECIFICATIONS a. Text of the Specification (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class B2, repeat TCSEC Section 3.2.2.1.1. For Class B3, repeat TCSEC Section 3.3.2.1.1. For Class A1, repeat TCSEC Section 4.1.2.1.1.) b. DOCP Interface Policy Interpretation At B2, the only required uses of trusted path are login and authentication.
At B3 and c. DOCP Global Policy Interpretation The description of the limitation of trusted path to a single DOCP will
suffice for the d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class B2, TNI Section 3.2.2.1.1 applies. For Class B3, TNI Section 3.3.2.1.1 applies. For Class A1, TNI Section 4.1.2.1.1 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.2 and IR-2.2 applies. For Class B2, TDI Appendix A Section B2-2.1.1 applies. For Class B3, TDI Appendix A Section B3-2.1.1 applies. For Class A1, TDI Appendix A Section A1-2.1.1 applies.) f. Important References (None) g. Trusted Path Procurement Considerations It is important to note that the intent is to protect identification
and authentication data Technology is providing products that greatly reduce the possibility
of successful C.3.14 AUDIT SPECIFICATIONS a. Text of the Specification (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class C2, repeat TCSEC Section 2.2.2.2. For Class B1, repeat TCSEC Section 3.1.2.2. For Class B2, repeat TCSEC Section 3.2.2.2. For Class B3, repeat TCSEC Section 3.3.2.2. For Class A1, repeat TCSEC Section 4.1.2.2.) b. DOCP Interface Policy Interpretation The interface policy shall accommodate the passage of audit data over
a trusted path c. DOCP Global Policy Interpretation If each of several DOCPs meets the audit requirements locally, then there
is the issue of d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class C2, TNI Section 2.2.2.2 applies. For Class B1, TNI Section 3.1.2.2 applies. For Class B2, TNI Section 3.2.2.2 applies. For Class B3, TNI Section 3.3.2.2 applies. For Class A1, TNI Section 4.1.2.2 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.2.2 and IR-2.2.2 applies. For Class C2, TDI Appendix A Section C2-2.2 applies. For Class B1, TDI Appendix A Section B1-2.2 applies. For Class B2, TDI Appendix A Section B2-2.2 applies. For Class B3, TDI Appendix A Section B3-2.2 applies. For Class A1, TDI Appendix A Section A1-2.2 applies.) f. Important References (Note: References are for information only and, unless specified elsewhere,
are not to be NCSC-TG-001, "A Guide to Understanding Audit in Trusted Systems," June 1, 1988. g. Audit Procurement Considerations The option should exist that either some maximum of security related
activities be An audit control switch available to the System Administrator can allow
selection of A requirement exists that authorized personnel shall be able to read
all events recorded Switches and options must not violate the requirements and intent of the TCSEC. The audit information should be sufficient to reconstruct a complete
sequence of The capability should be provided to prevent System Administrator and
Security Officer Only the System Administrator or Security Officer should be able to select
what is to be (B3 - A1) The requirement to "monitor the occurrence or accumulation
of security intrusion detection. The DAA must determine what is reasonable in the
context of the (B3 - A1) "If the occurrence or accumulation of these security relevant
events continues, C.3.15 SYSTEM ARCHITECTURE SPECIFICATIONS a. Text of the Specification (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class C2, repeat TCSEC Section 2.2.3.1.1. For Class B1, repeat TCSEC Section 3.1.3.1.1. For Class B2, repeat TCSEC Section 3.2.3.1.1. For Class B3, repeat TCSEC Section 3.3.3.1.1. For Class A1, repeat TCSEC Section 4.1.3.1.1.) b. DOCP Interface Policy Interpretation (None) c. DOCP Global Policy Interpretation For many of the system architecture requirements, demonstrating that
a requirement is d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class C2, TNI Section 2.2.3.1.1 applies. For Class B1, TNI Section 3.1.3.1.1 applies. For Class B2, TNI Section 3.2.3.1.1 applies. For Class B3, TNI Section 3.3.3.1.1 applies. For Class A1, TNI Section 4.1.3.1.1 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.3.1 and IR-5 applies. For Class C2, TDI Appendix A Section C2-3.1.1 applies. For Class B1, TDI Appendix A Section B1-3.1.1 applies. For Class B2, TDI Appendix A Section B2-3.1.1 applies. For Class B3, TDI Appendix A Section B3-3.1.1 applies. For Class A1, TDI Appendix A Section A1-3.1.1 applies.) f. Important References (None) g. System Architecture Procurement Considerations "Domain" as used in the TCSEC refers to the set of objects
a subject has the ability to Protection granularity can be an issue. Finer granularity (e.g., a few
bytes) is ideal for An important consideration is sensitivity label mapping to protection
domain Asynchronous events are not predictable (e.g., arrival of a message,
the printer running C.3.16 SYSTEM INTEGRITY SPECIFICATIONS a. Text of the Specification (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class C2, repeat TCSEC Section 2.2.3.1.2. For Class B1, repeat TCSEC Section 3.1.3.1.2. For Class B2, repeat TCSEC Section 3.2.3.1.2. For Class B3, repeat TCSEC Section 3.3.3.1.2. For Class A1, repeat TCSEC Section 4.1.3.1.2.) b. DOCP Interface Policy Interpretation (None) c. DOCP Global Policy Interpretation (None) d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class C2, TNI Section 2.2.3.1.2 applies. For Class B1, TNI Section 3.1.3.1.2 applies. For Class B2, TNI Section 3.2.3.1.2 applies. For Class B3, TNI Section 3.3.3.1.2 applies. For Class A1, TNI Section 4.1.3.1.2 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.3.1 and IR-2.3.1.2 applies. For Class C2, TDI Appendix A Section C2-3.1.2 applies. For Class B1, TDI Appendix A Section B1-3.1.2 applies. For Class B2, TDI Appendix A Section B2-3.1.2 applies. For Class B3, TDI Appendix A Section B3-3.1.2 applies. For Class A1, TDI Appendix A Section A1-3.1.2 applies.) f. Important References (None) g. System Integrity Procurement Considerations System integrity requirements must be satisfied in the operational system,
not just C.3.17 COVERT CHANNEL SPECIFICATIONS a. Text of the Specification (For B2 through A1) Wherever possible, covert channels identified by
the covert channel b. DOCP Interface Policy Interpretation (None) c. DOCP Global Policy Interpretation (None) d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class B2, TNI Section 3.2.3.1.3 applies. For Class B3, TNI Section 3.3.3.1.3 applies. For Class A1, TNI Section 4.1.3.1.3 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.3.1 and IR-2.3.1.3 applies. For Class B2, TDI Appendix A Section B2-3.1.3 applies. For Class B3, TDI Appendix A Section B3-3.1.3 applies. For Class A1, TDI Appendix A Section A1-3.1.3 applies.) f. Important References (Note: References are for information only and, unless specified elsewhere,
are not to be For Class B2, TCSEC Section 3.2.3.1.3. For Class B3, TCSEC Section 3.3.3.1.3. For Class A1, TCSEC Section 4.1.3.1.3. TCSEC Section 8.0, A Guideline on Covert Channels. g. Covert Channel Considerations The TCSEC only requires the analysis of covert channels, trade-offs involved
in Covert Channel auditing and control mechanisms can vary widely from one
system to C.3.18 TRUSTED FACILITY MANAGEMENT SPECIFICATIONS a. Text of the Specification (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class B2, repeat TCSEC Section 3.2.3.1.4. For Class B3, repeat TCSEC Section 3.3.3.1.4. For Class A1, repeat TCSEC Section 4.1.3.1.4.) b. DOCP Interface Policy Interpretation (None) c. DOCP Global Policy Interpretation The ability to run a trusted system facility properly applies to the
combination of DOCP d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class B2, TNI Section 3.2.3.1.4 applies. For Class B3, TNI Section 3.3.3.1.4 applies. For Class A1, TNI Section 4.1.3.1.4 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.3.1 and IR-2.3.1.4 applies. For Class B2, TDI Appendix A Section B2-3.1.4 applies. For Class B3, TDI Appendix A Section B3-3.1.4 applies. For Class A1, TDI Appendix A Section A1-3.1.4 applies.) f. Important References (Note: References are for information only and, unless specified elsewhere,
are not to be NCSC-TG-015, "A Guide to Understanding Trusted Facility Management,"
October 18, g. Trusted Facility Management Considerations The TCSEC addresses System Administrator functions and operator functions
and The acquisition authority must carefully consider the division of functions
between the C.3.19 TRUSTED RECOVERY SPECIFICATIONS a. Text of the Specification (For B3 through A1) Based on the recommendations of a trusted recovery
analysis, b. DOCP Interface Policy Interpretation Interface policy shall accommodate and satisfy the required intercommunications
c. DOCP Global Policy Interpretation In the case of "an ADP system failure or other discontinuity,"
each DOCP in a B3 or d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class B3, TNI Section 3.3.3.1.5 applies. For Class A1, TNI Section 4.1.3.1.5 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.3.1 and IR-2.3.1.5 applies For Class B3, TDI Appendix A Section B3-3.1.5 applies. For Class A1, TDI Appendix A Section A1-3.1.5 applies.) f. Important References (Note: References are for information only and, unless specified elsewhere,
are not to be For Class B3, TCSEC Section 3.3.3.1.5. For Class A1, TCSEC Section 4.1.3.1.5. NCSC-TG-022, "A Guide to Understanding Trusted Recovery in Trusted
Systems," g. Trusted Recovery Considerations Satisfactory recovery can have significantly different meaning to different
applications Note that satisfaction of this requirement does not guarantee data recovery.
It keeps the THIS PAGE INTENTIONALLY LEFT BLANK C.4 STATEMENTS OF WORK Detailed Statements of Work can be found in this section. The glossary
and acronyms For each task, the requirements of the Statement of Work (SOW) describe
the work the (The appropriate information and considerations for determining Statements
of Work C.4.1 COVERT CHANNEL ANALYSIS STATEMENT OF WORK a. Text of the Statement of Work (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class B2, repeat TCSEC Section 3.2.3.1.3. For Class B3, repeat TCSEC Section 3.3.3.1.3. For Class A1, repeat TCSEC Section 4.1.3.1.3.) (For B2 through A1) The Contractor shall conduct an analysis of all auditable events that
may occur in the The Contractor shall conduct an analysis of identified covert channels
and bandwidths A report of the results of these analyses shall be provided in the form
of a Covert b. DOCP Interface Policy Interpretation (None) c. DOCP Global Policy Interpretation (None) d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class B2, TNI Section 3.2.3.1.3 applies. For Class B3, TNI Section 3.3.3.1.3 applies. For Class A1, TNI Section 4.1.3.1.3 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.3.1 and IR-2.3.1.3 applies. For Class B2, TDI Appendix A Section B2-3.1.3 applies. For Class B3, TDI Appendix A Section B3-3.1.3 applies. For Class A1, TDI Appendix A Section A1-3.1.3 applies.) f. Important References (Note: References are for information only and, unless specified elsewhere,
are not to be TCSEC Section 8.0 "A Guideline on Covert Channels." g. Covert Channel Analysis Considerations (None) C.4.2 TRUSTED RECOVERY STATEMENT OF WORK a. Text of the Statement of Work (For B3 through A1) The Contractor shall conduct an analysis of the computer system design
to determine Where procedures are recommended they should be thoroughly documented
in CDRL Where design is recommended it is delivered in the form of system design
in accordance b. DOCP Interface Policy Interpretation (None) c. DOCP Global Policy Interpretation In the case of "an ADP system failure or other discontinuity,"
each DOCP in a B3 or d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class B3, TNI Section 3.3.3.1.5 applies. For Class A1, TNI Section 4.1.3.1.5 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.3.1 and IR-2.3.1.5 applies. For Class B3, TDI Appendix A Section B3-3.1.5 applies. For Class A1, TDI Appendix A Section A1-3.1.5 applies.) f. Important References (Note: References are for information only and, unless specified elsewhere,
are not to be For Class B3, TCSEC Section 3.3.3.1.5. For Class A1, TCSEC Section 4.1.3.1.5. NCSC-TG-022, "A Guide to Understanding Trusted Recovery in Trusted
Systems," TCSEC Section 5.3.3, Assurance Control Objective, p. 63. g. Trusted Recovery Procurement Considerations (None) C.4.3 SECURITY TESTING STATEMENT OF WORK a. Text of the Statement of Work (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class C2, repeat TCSEC Section 2.2.3.2.1. and TCSEC Section 10.1. For Class B1, repeat TCSEC Section 3.1.3.2.1. and TCSEC Section 10.2. For Class B2, repeat TCSEC Section 3.2.3.2.1. and TCSEC Section 10.2. For Class B3, repeat TCSEC Section 3.3.3.2.1. and TCSEC Section 10.2. For Class A1, repeat TCSEC Section 4.1.3.2.1. and TCSEC Section 10.3.) The contractor shall deliver test results in the form of Test Reports
in accordance with b. DOCP Interface Policy Interpretation Security testing shall include testing against the individual DOCP interface
policies and c. DOCP Global Policy Interpretation This requirement applies as stated in the TCSEC to the entire TCB. If
a TCB consists of d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class C2, TNI Section 2.2.3.2.1 applies. For Class B1, TNI Section 3.1.3.2.1 applies. For Class B2, TNI Section 3.2.3.2.1 applies. For Class B3, TNI Section 3.3.3.2.1 applies. For Class A1, TNI Section 4.1.3.2.1 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.3.2 and IR-2.3.2.1 applies. For Class C2, TDI Appendix A Section C2-3.2.1 applies. For Class B1, TDI Appendix A Section B1-3.2.1 applies. For Class B2, TDI Appendix A Section B2-3.2.1 applies. For Class B3, TDI Appendix A Section B3-3.2.1 applies. For Class A1, TDI Appendix A Section A1-3.2.1 applies.) f. Important References (Note: References are for information only and, unless specified elsewhere,
are not to be NCSC-TG-002, "Trusted Product Evaluations: A Guide for Vendors," June 22, 1990. NCSC-TG-019, "Trusted Product Evaluation Questionnaire," May 2, 1992. NCSC-TG-028, "Assessing Controlled Access Protection," May 25, 1992. g. Security Testing Procurement Considerations Many of the statements in the security testing requirements are subject
to interpretation, C.4.4 DESIGN SPECIFICATION AND VERIFICATION STATEMENT a. Text of the Statement of Work (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class B1, repeat TCSEC Section 3.1.3.2.2. For Class B2, repeat TCSEC Section 3.2.3.2.2. For Class B3, repeat TCSEC Section 3.3.3.2.2. For Class A1, repeat TCSEC Section 4.1.3.2.2.) (For Class B1) Documentation developed under CDRL 004, Informal Security Policy Model,
and CDRL Initial delivery of CDRL 004, Informal Security Policy Model, and CDRL
008, Design (For Class B2) Documentation developed under CDRL 005, Formal Security Policy Model;
CDRL 006, Initial delivery of CDRL 005, Formal Security Policy Model; CDRL 006,
Descriptive Top (For Class B3) Documentation developed under CDRL 005, Formal Security Policy Model;
CDRL 006, Documentation resulting from this effort shall be provided in accordance
with CDRL Initial delivery of CDRL 005, Formal Security Policy Model; CDRL 006,
Descriptive Top (For Class A1) Documentation developed under CDRL 005, Formal Security Policy Model;
CDRL 006, Documentation resulting from this effort shall be provided in accordance
with CDRL Initial delivery of CDRL 005, Formal Security Policy Model; CDRL 006,
Descriptive Top b. DOCP Interface Policy Interpretation Design specification and verification requirements apply to interface
policy and the c. DOCP Global Policy Interpretation For many of the design specification and verification requirements, demonstrating
that a and the FTLS at A1 "be an accurate description of the TCB interface"
applies in a limited After complying security models are provided for the individual DOCPs,
a convincing After complying top-level specifications (DTLS at B3 and FTLS at A1)
are provided for d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class B1, TNI Section 3.1.3.2.2 applies. For Class B2, TNI Section 3.2.3.2.2 applies. For Class B3, TNI Section 3.3.3.2.2 applies. For Class A1, TNI Section 4.1.3.2.2 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.3.2 and IR-2.3.2.2 applies. For Class B1, TDI Appendix A Section B1-3.2.2 applies. For Class B2, TDI Appendix A Section B2-3.2.2 applies. For Class B3, TDI Appendix A Section B3-3.2.2 applies. For Class A1, TDI Appendix A Section A1-3.2.2 applies.) f. Important References (Note: References are for information only and, unless specified elsewhere,
are not to be NCSC-TG-014, "Guidelines for Formal Verification Systems," April 1, 1989. g. Design Specification and Verification Considerations If there is a multifaceted policy (e.g., both mandatory access control
and discretionary (B2 - A1) To broaden the audience, there is often an advantage to requiring
an informal C.4.5 CONFIGURATION MANAGEMENT STATEMENT OF WORK a. Text of the Statement of Work (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class B2, repeat TCSEC Section 3.2.3.2.3. For Class B3, repeat TCSEC Section 3.3.3.2.3. For Class A1, repeat TCSEC Section 4.1.3.2.3.) (B2 through A1) Prepare and deliver TCB Configuration Management Plan
in b. DOCP Interface Policy Interpretation (None) c. DOCP Global Policy Interpretation (None) d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class B2, TNI Section 3.2.3.2.3 applies. For Class B3, TNI Section 3.3.3.2.3 applies. For Class A1, TNI Section 4.1.3.2.3 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.3.2 and IR-2.3.2.3 applies. For Class B2, TDI Appendix A Section B2-3.2.3 applies. For Class B3, TDI Appendix A Section B3-3.2.3 applies. For Class A1, TDI Appendix A Section A1-3.2.3 applies.) f. Important References (Note: References are for information only and, unless specified elsewhere,
are not to be NCSC-TG-006, "A Guide to Understanding Configuration Management
in Trusted g. Configuration Management Considerations Master copies should be protected at the level of the operational data
for which it will be (B2 - A1) The maintenance of a consistent mapping between code and documentation
C.4.6 TRUSTED DISTRIBUTION STATEMENT OF WORK a. Text of the Statement of Work (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class A1, repeat TCSEC Section 4.1.3.2.4.) These procedures shall be delivered as a Section on Trusted Distribution
as a part of the b. DOCP Interface Policy Interpretation (None) c. DOCP Global Policy Interpretation (None) d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class A1, TNI Section 4.1.3.2.4 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.3.2 and IR-2.3.2.4 applies. For Class A1, TDI Appendix A Section A1-3.2.4 applies.) f. Important References (Note: References are for information only and, unless specified elsewhere,
are not to be NCSC-TG-008, "A Guide to Understanding Trusted Distribution in Trusted
Systems," g. Trusted Distribution Procurement Considerations (None) C.4.7 SECURITY FEATURES USER'S GUIDE STATEMENT OF WORK a. Text of the Statement of Work (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class C2, repeat TCSEC Section 2.2.4.1. For Class B1, repeat TCSEC Section 3.1.4.1. For Class B2, repeat TCSEC Section 3.2.4.1. For Class B3, repeat TCSEC Section 3.3.4.1. For Class A1, repeat TCSEC Section 4.1.4.1.) (C2 through A1) The Contractor shall produce and deliver the Security
Features User's b. DOCP Interface Policy Interpretation (None) c. DOCP Global Policy Interpretation (None) d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class C2, TNI Section 2.2.4.1 applies. For Class B1, TNI Section 3.1.4.1 applies. For Class B2, TNI Section 3.2.4.1 applies. For Class B3, TNI Section 3.3.4.1 applies. For Class A1, TNI Section 4.1.4.1 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.4.1 and IR-2.4.1 applies. For Class C2, TDI Appendix A Section C2-4.1 applies. For Class B1, TDI Appendix A Section B1-4.1 applies. For Class B2, TDI Appendix A Section B2-4.1 applies. For Class B3, TDI Appendix A Section B3-4.1 applies. For Class A1, TDI Appendix A Section A1-4.1 applies.) f. Important References (Note: References are for information only and, unless specified elsewhere,
are not to be NCSC-TG-026, "A Guide to Writing the Security Features User's Guide
for Trusted g. Security Features User's Guide Considerations The Contractor should conduct a security engineering analysis to determine
user C.4.8 TRUSTED FACILITY MANUAL STATEMENT OF WORK a. Text of the Statement of Work (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class C2, repeat TCSEC Section 2.2.4.2. For Class B1, repeat TCSEC Section 3.1.4.2. For Class B2, repeat TCSEC Section 3.2.4.2. For Class B3, repeat TCSEC Section 3.3.4.2. For Class A1, repeat TCSEC Section 4.1.4.2.) (C2 through A1) The Contractor shall deliver the Trusted Facility Manual
in accordance b. DOCP Interface Policy Interpretation (None) c. DOCP Global Policy Interpretation (None) d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class C2, TNI Section 2.2.4.2 applies. For Class B1, TNI Section 3.1.4.2 applies. For Class B2, TNI Section 3.2.4.2 applies. For Class B3, TNI Section 3.3.4.2 applies. For Class A1, TNI Section 4.1.4.2 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.4.2 and IR-2.4.2 applies. For Class C2, TDI Appendix A Section C2-4.2 applies. For Class B1, TDI Appendix A Section B1-4.2 applies. For Class B2, TDI Appendix A Section B2-4.2 applies. For Class B3, TDI Appendix A Section B3-4.2 applies. For Class A1, TDI Appendix A Section A1-4.2 applies.) f. Important References (Note: References are for information only and, unless specified elsewhere,
are not to be NCSC-TG-027, "Information System Security Officer Guideline," June 1991. g. Trusted Facility Manual Considerations The Contractor should conduct an analysis to identify the functions performed
by the running a secure facility and the specific interactions of the protection
features. The C.4.9 TEST DOCUMENTATION STATEMENT OF WORK a. Text of the Statement of Work (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class C2, repeat TCSEC Section 2.2.4.3. For Class B1, repeat TCSEC Section 3.1.4.3. For Class B2, repeat TCSEC Section 3.2.4.3. For Class B3, repeat TCSEC Section 3.3.4.3. For Class A1, repeat TCSEC Section 4.1.4.3.) (C2 through A1) The Contractor shall deliver the Security Test Plan in accordance with CDRL 012. The Contractor shall deliver the Test Procedure in accordance with CDRL 013. The Contractor shall deliver the Test Report in accordance with CDRL
014 using as input b. DOCP Interface Policy Interpretation Test Documentation shall include testing of interface requirements. c. DOCP Global Policy Interpretation Test Documentation shall include testing of global requirements. d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class C2, TNI Section 2.2.4.3 applies. For Class B1, TNI Section 3.1.4.3 applies. For Class B2, TNI Section 3.2.4.3 applies. For Class B3, TNI Section 3.3.4.3 applies. For Class A1, TNI Section 4.1.4.3 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.4.3 and IR-2.4.3 applies. For Class C2, TDI Appendix A Section C2-4.3 applies. For Class B1, TDI Appendix A Section B1-4.3 applies. For Class B2, TDI Appendix A Section B2-4.3 applies. For Class B3, TDI Appendix A Section B3-4.3 applies. For Class A1, TDI Appendix A Section A1-4.3 applies.) f. Important References (None) g. Security Testing Procurement Considerations The Contractor should analyze the sensitivity of information processed
on the delivered If an entity other than a contractor is to do the Security Testing, and
Test Report, this For B2 and above, penetration testing must consider the specific operational
C.4.10 DESIGN DOCUMENTATION STATEMENT OF WORK a. Text of the Statement of Work (Where the given Division/Class is applicable, the corresponding section
of the TCSEC For Class C2, repeat TCSEC Section 2.2.4.4. For Class B1, repeat TCSEC Section 3.1.4.4. For Class B2, repeat TCSEC Section 3.2.4.4. For Class B3, repeat TCSEC Section 3.3.4.4. For Class A1, repeat TCSEC Section 4.1.4.4.) (For Class C2) Documentation resulting from this effort shall be provided in accordance
with CDRL (For Class B1) Documentation resulting from this effort shall be provided in accordance
with CDRL Initial delivery of CDRL 004 and CDRL 008 is addressed under this task.
Subsequent Initial delivery of CDRL 008 is addressed under this task. Subsequent
deliveries shall be (For Class B2) Documentation resulting from this effort shall be provided in accordance
with CDRL Initial delivery of CDRL 005, CDRL 006, and CDRL 008 is addressed under
this task. (For Class B3) Documentation resulting from this effort shall be provided in accordance
with CDRL Initial delivery of CDRL 005, CDRL 006, and CDRL 008 is addressed under
this task. (For Class A1) Documentation resulting from this effort shall be provided in accordance
with CDRL Initial delivery of CDRL 005, CDRL 006, CDRL 007, and CDRL 008 is addressed
under b. DOCP Interface Policy Interpretation Design Documentation shall include design resulting from interface requirements. c. DOCP Global Policy Interpretation Design Documentation shall include design resulting from global requirements. d. Trusted Network Interpretation (Where the given Division/Class is applicable and the TNI is selected,
the For Class C2, TNI Section 2.2.4.4 applies. For Class B1, TNI Section 3.1.4.4 applies. For Class B2, TNI Section 3.2.4.4 applies. For Class B3, TNI Section 3.3.4.4 applies. For Class A1, TNI Section 4.1.4.4 applies.) e. Trusted Database Management Interpretation (Where the given Division/Class is applicable and the TDI is selected,
the corresponding For all classes, TDI Sections TC-5.2.4.4 and IR-2.4.4 applies. For Class C2, TDI Appendix A Section C2-4.4 applies. For Class B1, TDI Appendix A Section B1-4.4 applies. For Class B2, TDI Appendix A Section B2-4.4 applies. For Class B3, TDI Appendix A Section B3-4.4 applies. For Class A1, TDI Appendix A Section A1-4.4 applies.) f. Important References (Note: References are for information only and, unless specified elsewhere,
are not to be NCSC-TG-007, "A Guide to Understanding Design Documentation in Trusted
Systems," g. Design Documentation Procurement Considerations The Contractor should conduct an analysis of the sensitivity of information
to be The Contractor should analyze the TCB enforcement of the security policy
specified in THIS PAGE INTENTIONALLY LEFT BLANK RFP SECTION F - DELIVERIES AND PERFORMANCE Text of Section F (A1) Procedures generated under Trusted Distribution Statement of Work
shall be Data Deliverables: The following data deliverables in the form of Contract
Data CLASS CDRL* DOCUMENT SOWs C2-A1 CDRL 001 Security Feature User's Guide DI-MCCR-81349 C.4.7 C2-A1 CDRL 002 Trusted Facility Manual DI-TMSS-81352 C.4.2, C.4.8 C2-A1 CDRL 003 Philosophy of Protection DI-MISC-81348 C.4.10 B1 CDRL 004 Informal Security Policy Model DI-MISC-81341 C.4.4, C.4.10 B2-A1 CDRL 005 Formal Security Policy Model DI-MISC-81346 C.4.2, C.4.4, C.4.10 B2-A1 CDRL 006 Descriptive Top Level Specification DI-MISC-81342 C.4.2, C.4.4, C.4.10 A1 CDRL 007 Formal Top Level Specification DI-MISC-81347 C.4.4, C.4.10 C2-A1 CDRL 008 Design Specification DI-MCCR-81344 C.4.2, C.4.4, C.4.10 B3-A1 CDRL 009 Trusted Computing Base Verification Report DI-MISC-81350 C.4.4 B2-A1 CDRL 010 Covert Channel Analysis Report DI-MISC-81345 C.4.1 B2-A1 CDRL 011 Trusted Computing Base Configuration DI-CMAN-81343 C.4.5, C.4.6 C2-A1 CDRL 012 Security Test Plan DI-NDTI-81351 C.4.2, C.4.9 C2-A1 CDRL 013 Test Procedure DI-NDTI-80603 C.4.9 C2-A1 CDRL 014 Test/Inspection Reports DI-NDTI-80809A C.4.3, C.4.9 Table F-1 Data Deliverables (*) See note at top of next page. * These are sample CDRL's used to facilitate the presentations of this
guideline. Important References NCSC-TG-006, "A Guide to Understanding Configuration Management
in Trusted NCSC-TG-008, "A Guide to Understanding Trusted Distribution in Trusted
Systems," Section F Procurement Considerations Deliveries: The referenced document, NCSC-TG-008, discusses protective packaging,
couriers, Performance: Application specific performance requirements must be developed by the
procurement · Performance requirements must be satisfied under both typical and peak conditions. · Performance requirements should be such that both mission and
audit requirements can · The bidder shall identify the time to initialize, recover, and
shutdown the system in a se- The bidder shall identify the maximum, minimum and average time to perform
· The bidder shall identify the maximum, minimum, and average
time to create an audit · The bidder shall identify the amount of time required of a user
for security during a best · The bidder shall identify the maximum, average, and minimum
amount of time required · The bidder shall identify the maximum, average, and minimum
percentage overhead due THIS PAGE INTENTIONALLY LEFT BLANK RFP SECTION J - LIST OF DOCUMENTS, EXHIBITS AND OTHER AT- Text of Section J The following is a listing of all attachments to the contract: ATTACHMENT NO. TITLE A CONTRACT DATA REQUIREMENTS LIST B GLOSSARY C ACRONYMS D REFERENCES Important References (None) Section J Procurement Considerations RFP Sections A through K, when combined with the attachments referenced
above, THIS PAGE INTENTIONALLY LEFT BLANK RFP SECTION L - INSTRUCTIONS, CONDITIONS, AND NOTICES TO Text of Section L (These statements shall be included under GENERAL INSTRUCTIONS FOR THE
Offerors shall identify in the technical proposal the commercially available
products Offerors shall identify tests, analyses, and documents previously produced
for the TECHNICAL · The bidder shall precisely identify all security related hardware, firmware, and software. · The bidder shall present a description of the philosophy of
protection and an explanation · If the TCB is composed of distinct modules, the interfaces between
these modules shall · The bidder shall provide procedures for examining and maintaining audit files. · The bidder shall describe the test plan. · The bidder shall describe the approach to configuration management. · The bidder shall describe trusted initialization and shutdown. · The bidder shall describe the process of creating, maintaining,
and protecting from modi- · (B1-A1) The bidder shall describe the operator and system administrator
functions relat- · (B1-A1) The bidder shall state a security model either informally
or formally and pro- · (B1-A1) The bidder shall identify specific TCB protection mechanisms
with an explana- · (B2-A1) The bidder shall describe the approach to covert channel analysis. · (B2-A1) The bidder shall provide a descriptive top level specification. · (A1) A formal top level specification shall be provided. · (B3-A1) The bidder shall define system recovery procedures or
mechanisms with an ex- · (B3-A1) The bidder shall identify the functions performed by the System Administrator. · (A1) The bidder shall describe techniques to show that the Formal
Top Level Specifica- · The bidder shall show an understanding of the mission requirements
and reflect the secu- · The bidder shall show an understanding of the environment of
the system as stated in MANAGEMENT · Secure systems developed, tested, and placed into operational
usage have notoriously · The bidder shall summarize security experience applicable to
this project, major success- · The bidder shall explain the relationship between the senior
security specialist and the · The bidder shall identify key individuals on this project; summarize
their applicable edu- · The bidder shall identify who specifically is responsible for
any security modeling, secu- · The bidder shall show how the security organization operates
as a cohesive entity within · The bidder shall show how the management plan is organized such
that time and effort · The bidder shall show how potential problems are identified
early and how they are · The bidder shall show specific personnel continuity during the
critical stages of design, · The bidder shall identify who will be the primary interface during certification. · The schedule shall be easily and precisely associated with the
work plan with the deliv- · Items that are schedule critical to the project and items where
there is high schedule risk · The bidder shall identify from his/her experience where the
areas of greatest schedule · For the areas of high schedule risk, the bidder shall show how
he/she intends to identify COST · Commercial off-the-shelf items shall be broken down to the degree
that they will be de- · Costs of all items associated in any way with security and the
acquisition/development · The bidder shall identify from his/her experience where the
areas of greatest cost risk ex- · For the areas of high cost risk, the bidder shall show how he/she
intends to identify the GENERAL · A single work breakdown structure shall be used in all three
proposals, allowing a pre- · Trade-offs may be purely technical or they may be decided because
of cost, schedule or · The bidder shall identify what significant trade-offs are yet
to be made along with the Important References (None) Section L Procurement Considerations In procuring EPL products, a goal is to use as much of the existing documentation
and RFP ATTACHMENT A - CONTRACT DATA REQUIREMENTS LIST Contract Data Requirements List Discussion CDRL's will be provided for the following documents as part of Volume
3 of this · Security Feature User's Guide · Trusted Facility Manual · Philosophy of Protection Report · Informal Security Policy Model · Formal Security Policy Model · Descriptive Top Level Specification · Formal Top Level Specification · Design Specification · Trusted Computing Base Verification Report · Covert Channel Analysis Report · TCB Configuration Management Plan · Security Test Plan · Test Procedure · Test Reports THIS PAGE INTENTIONALLY LEFT BLANK RFP ATTACHMENT B - GLOSSARY Text of the Glossary (The Glossary Section of the TCSEC should be repeated here verbatim.) The ADP (automated data processing) system definition used in the TCSEC
should be Important References NCSC-TG-004, Glossary of Computer Security Terms, October 21,1988. Glossary Procurement Considerations Any conflicts between security terms and system terms must be found and
resolved. THIS PAGE INTENTIONALLY LEFT BLANK RFP ATTACHMENT C - ACRONYMS ADP Automated Data Processing AIS Automated Information System CDRL Contract Data Requirements List COTS Commercial-Off-The-Shelf DAA Designated Approving Authority DAC Discretionary Access Control DID Data Item Description DOCP Domain of Constant Policy DoD Department of Defense DTLS Descriptive Top-Level Specification ECP Engineering Change Proposal EPL Evaluated Products List FTLS Formal Top-Level Specification NCSC National Computer Security Center NIST National Institute of Standards and Technology NSA National Security Agency RFP Request for Proposal SOW Statement of Work TCB Trusted Computing Base TCSEC Trusted Computer System Evaluation Criteria THIS PAGE INTENTIONALLY LEFT BLANK RFP ATTACHMENT D - REFERENCES [1] DoD 5200.1-R, Information Security Program Regulation, August 1982,
June 1986, [2] DoD 5200.2-R, DoD Personnel Security Program, January 1987. [3] DoD Directive 5200.28, Security Requirements for Automated Information
Systems [4] DoD 5200.28-M, (Draft) "Automated Information System Security
Manual," April 29, [5] DoD 5200.28-STD, DoD Trusted System Evaluation Criteria, December 26, 1985. [6] CSC-STD-002-85, Department of Defense (DoD) Password Management Guideline,
[7] Johnson, H.L., "Use of the Trusted computer System Evaluation
Criteria (TCSEC) for [8] NCSC-TG-001, A Guide to Understanding Audit in Trusted Systems, June 1, 1988. [9] NCSC-TG-002, Version 2, Trusted Product Evaluation, A Guide for Vendors,
April 29, [10] NCSC-TG-003, A Guide to Understanding Discretionary Access Control
(DAC) in [11] NCSC-TG-004, Glossary of Computer Security Terms, October 21,1988. [12] NCSC-TG-005, Trusted Network Interpretation, July 31, 1987. [13] NCSC-TG-006, A Guide to Understanding Configuration Management in
Trusted Sys- [14] NCSC-TG-007, A Guide to Understanding Design Documentation in Trusted
Systems, [15] (A1 Only) NCSC-TG-008, A Guide to Understanding Trusted Distribution
in Trusted [16] NCSC-TG-010, Version 1, A Guide to Understanding Security Modeling
in Trusted Sys- [17] (A1 Only) NCSC-TG-014, Guidelines for Formal Verification Systems, April 1, 1989. [18] NCSC-TG-015, A Guide to Understanding Trusted Facility Management,
October 18, [19] NCSC-TG-016, Version 1, Guidelines for Writing Trusted Facility
Manuals, October, [20] NCSC-TG-017, A Guide to Understanding Identification and Authentication
in Trusted [21] NCSC-TG-018, A Guide to Understanding Object Reuse in Trusted Systems, July, 1992. [22] NCSC-TG-019, Trusted Product Evaluation Questionnaire, October 16, 1989. [23] NCSC-TG-021, Trusted Database Management System Interpretation of
the TCSEC, [24] NCSC-TG-022, A Guide to Understanding Trusted Recovery in Trusted
Systems, De- [25] NCSC-TG-024, Version 1, Volume 4/4, (Draft) "A Guide to Procurement
of Trusted [26] NCSC-TG-025, A Guide to Understanding Data Remanence in Automated
Information [27] NCSC-TG-026, A Guide to Writing the Security Features User's Guide
for Trusted Sys- [28] NCSC-TG-027, Information System Security Officer Guideline, June 1991. [29] NCSC-TG-028, Assessing Controlled Access Protection, May 25, 1992. [30] NCSC-TG-030, A Guide to Understanding Covert Channel Analysis of
Trusted Sys- A single complimentary copy of NSA guidelines (CSC-STD- and NCSC-TG-)
may be DoD documents and more than single copies of NSA guidelines may be obtained
from Important References None References Procurement Considerations DoD and NSA continue to publish guides and other supportive documents.
The initiator (This is the end of the standard RFP. The following Appendix pertains
only to this
This is the bibliography for this guideline and is not intended to be
part of the [1] AFSSM 5031, Complex System Guide, Air Force Special Security Instruction,
Air Force [2] A Guide to Standard Solicitation Documents for Federal Information
Processing Re- [3] "Competition in Contracting Act of 1984" (CICA). [4] CSC-STD-002-85, Department of Defense (DoD) Password Management Guideline,
[5] CSC-STD-003-85, Computer Security Requirements-Guidance for Applying
the Depart- [6] CSC-STD-004-85, Technical Rationale Behind CSC-STD-003-85: Computer
Security Re- [7] DoD Instruction 5000.2, Defense Acquisition Management Policy, February 23, 1991. [8] DoD 5000.2-M, Defense Acquisition Management Documentation and Reports,
Febru- [9] DoD 5010.12-L, Acquisition Management Systems and Data Requirements
Control List, [10] DoD 5200.1-R, Information Security Program Regulation, June 1986,
Change June 27, [11] DoD 5200.2-R, DoD Personnel Security Program, January 1987. [12] DoD Directive 5200.28, Security Requirements for Automated Information
Systems [13] DoD 5200.28-M, (Draft) "Automated Information System Security
Manual," April 29, [14] DoD 5200.28-STD, DoD Trusted Computer System Evaluation Criteria,
December 26, [15] DoD Directive 5215.1, Computer Security Evaluation Center, October 25, 1982. [16] DoD Directive 5220.22, Industrial Security Program, December 8, 1980. [17] DoD 5220.22-M, Industrial Security Manual for Safeguarding Classified
Information, [18] DoD 5220.22-R, Industrial Security Regulation, December, 1985. [19] Executive Order 12356, "National Security Information," April 6, 1982. [20] "Federal Acquisition Regulation" (FAR) Title 48, 1990
edition issued by General Servic- [21] Federal Information Resources Management Regulation (FIRMR), General
Services Ad- [22] FIPS PUB 31, Guidelines for ADP Physical Security and Risk Management,
U.S.Depart- [23] FIPS PUB 39, Glossary for Computer System Security, U.S. Department
of Commerce, [24] FIPS PUB 41, Computer Security Guidelines for Implementing the Privacy
Act of 1974, [25] FIPS PUB 48, Guidelines on Evaluation of Techniques for Automated
Personal Identifi- [26] FIPS PUB 65, Guideline for Automatic Data Processing Risk Analysis,
U.S. Department [27] FIPS PUB 73, Guidelines for Security of Computer Applications, U.S.
Department of [28] FIPS PUB 83, Guideline for User Authentication Techniques for Computer
Network Ac- [29] FIPS PUB 102, Guidelines for Computer Security Certification and
Accreditation, U.S. [30] FIPS PUB 112, Password Usage Standard, U.S. Department of Commerce,
National Bu- [31] Gasser, M., Building a Secure Computer System, Van Nostrand Reinhold, NY, 1988. [32] Information Systems Security Products and Services Catalogue, National
Security Agen- [33] Johnson, H.L., An Approach to Security Test, AFCEA 4th Annual Symposium
on C3I [34] Johnson, H.L., and J. D. Layne, Modeling Security Risk in Networks,
Proceedings 11th [35] Johnson, H.L., Use of the Trusted Computer System Evaluation Criteria
(TCSEC) for [36] MIL-HDBK-245B, Preparation of Statements of Work. [37] MIL-STD-481, Configuration Control, Engineering Changes, Deviations and Waivers. [38] MIL-STD-483A, Configuration Management Practices for Systems, Equipment,
Muni- [39] MIL-STD-490A, Specification Practices. [40] MIL-STD-499, Engineering Management. [41] MIL-STD-499B, System Engineering. [42] MIL-STD-1521A, Technical Review and Audits for Systems, Equipments
and Computer [43] NCSC-TG-001, A Guide to Understanding Audit in Trusted Systems, June 1, 1988. [44] NCSC-TG-002, Version 2, Trusted Product Evaluation, A Guide for
Vendors, April 29, [45] NCSC-TG-003, A Guide to Understanding Discretionary Access Control
(DAC) in Trust- [46] NCSC-TG-004, Glossary of Computer Security Terms, October 21, 1988. [47] NCSC-TG-005, Trusted Network Interpretation (TNI) of the Trusted
Computer System [48] NCSC-TG-006, A Guide to Understanding Configuration Management in
Trusted Sys- [49] NCSC-TG-007, A Guide to Understanding Design Documentation in Trusted
Systems, [50] NCSC-TG-008, A Guide to Understanding Trusted Distribution in Trusted
Systems, De- [51] NCSC-TG-009, Computer Security Subsystem Interpretation (CSSI) of
the Trusted Com- [52] NCSC-TG-010, Version 1, A Guide to Understanding Security Modeling
in Trusted Sys- [53] NCSC-TG-011, Trusted Network Interpretation Environments Guideline, 1 August,1990. [54] NCSC-TG-013, Rating Maintenance Phase, Program Document, June 23, 1989. [55] NCSC-TG-014, Guidelines for Formal Verification Systems, April 1, 1989. [56] NCSC-TG-015, A Guide to Understanding Trusted Facility Management,
October 18, [57] NCSC-TG-016, Version 1, Guidelines for Writing Trusted Facility
Manuals, October, [58] NCSC-TG-017, A Guide to Understanding Identification and Authentication
in Trusted [59] NCSC-TG-018, A Guide to Understanding Object Reuse in Trusted Systems, July, 1992. [60] NCSC-TG-019, Trusted Product Evaluation Questionnaire, October 16, 1989. [61] NCSC-TG-021, Trusted Database Management System Interpretation of
The Trusted [62] NCSC-TG-022, A Guide to Understanding Trusted Recovery in Trusted
Systems, Decem- [63] NCSC-TG-024, Version 1: · Volume 1/4, A Guide to Procurement of Trusted Systems: An Introduction
to Procure- · Volume 2/4, A Guide to Procurement of Trusted Systems: Language
for RFP Specifica- · Volume 3/4, "A Guide to Procurement of Trusted Systems:
Computer Security Contract · Volume 4/4, "A Guide to Procurement of Trusted Systems:
How to Evaluate a Bidder's [64] NCSC-TG-025, A Guide to Understanding Data Remanence in Information
Systems, [65] NCSC-TG-026, A Guide to Writing the Security Features User's Guide
for Trusted Sys- [66] NCSC-TG-027, Information System Security Officer Guideline, June 1991. [67] NCSC-TG-028, Assessing Controlled Access Protection, May 25, 1992. [68] OMB Circular Number A-130, Management of Federal Information Resources,
Appen- [69] Public Law 98-369, "Competition in Contracting Act of 1984." [70] Public Law 100-235, "Computer Security Act of 1987," January 8, 1988. [71] Standard Solicitation Document for Federal Information Processing
(FIP) Systems [72] Title 10, United States Code, Section 2318, "Advocates for Competition." [73] Title 41, United States Code, Section 418, "Advocates for Competition."  |