FIPS 201 Evaluation Program - Laboratory Specification

Transcription

1 FIPS 201 Evaluation Program - Laboratory Specification Version May 17, 2006

2 Document History Status Version Date Comment Audience Draft /09/06 Document creation Limited Draft /09/06 Corrected formatting. Changed header title Limited Draft /10/06 Updated outline based on team review Limited Draft /22/06 Add content to section 1 6, 8, Appendix A.4, Appendix A.5. Added Appendix E. Limited Draft /22/06 Corrected format issue in sections and Limited Draft /01/06 Revisions per internal review Limited Draft /15/06 Revisions per internal review Limited Draft /22/06 Revisions per internal review Limited Draft /27/06 Revisions per internal review Limited Draft /05/06 Submitted to GSA for approval. GSA Draft /24/06 Revisions per GSA comments. Limited Draft /12/06 Submitted to GSA for approval. GSA Draft /17/06 Changes made per GSA comments. Limited Approved /17/06 Approved by GSA. Public ii

3 Table of Contents 1 Introduction Identification Background, Objectives and Scope Purpose Key Principles of Operation References Document Organization System Overview Laboratory Services and Functions Laboratory Environment and Operations Roles, Responsibilities and Qualifications Lab Director Qualifications and Training Requirements Relationship Manager Qualifications and Training Requirements Lab Team Lead Qualifications and Training Requirements Lab Engineer Qualifications and Training Requirements Applicant Qualifications and Training Requirements Approval Authority Qualifications and Training Requirements Lab Instantiation Staffing Facilities Management Laboratory Layout Lab Setup Inventory List Test Workstation # Test Workstation # Breakout Box Office Equipment and Services Office Furniture Asset Management Environmental Connectivity Escorting Visitors Laboratory Operations Rules of Behavior Scheduling Internal Meetings Evaluations Non-conformance Reviews...33 iii

4 5.3 Configuration Management Document Control Activities Start up Daily Tasks Weekly Tasks Monthly Tasks Approval Process Phase Descriptions Application Phase Evaluation Phase Evaluation Report Phase Notification Phase Non-Conformance Review Phase Minimum Security Requirements Personnel Security Physical and Environmental Protection Physical Access Emergency Power and Lighting Fire Protection Temperature and Humidity Control Water Damage Protection Contingency Planning Backups System Recovery Maintenance System and Information Integrity Media Protection Awareness and Training Identification and Authentication Access Control Audit and Accountability...66 Appendix A: Templates...67 A.1 Lab Services Agreement...68 A.2 Approval Letter...74 A.3 Non-conformance Letter...75 A.4 Application Acceptance Letter...76 A.5 Application Rejection Letter...77 A.6 Evaluation Completion Notice...78 A.7 Attestation Form...79 A.8 Evaluation Report...80 A.9 Evaluation Report Notice...82 A.10 Instruction Notice...83 A.11 Approval Request Letter...84 A.12 Approval Authorization Letter...85 A.13 Approval Request Denial Letter...86 iv

5 A.14 Non-conformance Authorization Notice...87 A.15 Review Form Rejection Letter...88 A.16 Review Decision Letter...89 Appendix B: Supplier Product Inventory List Template...90 Appendix C: Rules of Behavior...91 Appendix D: Sample Lab Layouts...94 Appendix D.1: Sample Small Lab Layout...94 Appendix D.2: Sample Medium Lab Layout...95 Appendix D.3: Sample Large Lab Layout...96 Appendix E: Glossary and Acronyms...97 Figures Figure 1 - Approval Process Phases Figure 2 - High-level Overall Process Flow Figure 3 - Application Phase Flow Diagram Figure 4 - Evaluation Phase Flow Diagram Figure 5 - Evaluation Report Phase Flow Diagram Figure 6 - Notification Phase Flow Diagram Figure 7 - Non-Conformance Review Phase Flow Diagram Tables Table 1 - Laboratory Services and Functions... 6 Table 2 - Laboratory Controls... 7 Table 3 Lab Staff Requirements Table 4 Lab Space Requirements Table 5 Workstation #1 Setup Inventory Table 6 Workstation #2 Setup Inventory Table 7 Breakout Box Setup Inventory Table 8 Office Equipment and Services Table 9 Office Furniture Table 10 - Status Codes Table 11 - Expected Durations of Key Steps Table 12 - Key Templates for Each Phase v

6 1 Introduction 1.1 Identification This Lab Specification (Lab Spec) document is a detailed description of the General Services Administration s (GSA) Evaluation Program (EP) Laboratory (Lab) operation to determine conformance of supplier products and services against the requirements of Federal Information Processing Standard (FIPS) 201 and its related publications. This document establishes details and guidelines regarding daily operations of the Lab and is complemented by the GSA EP Laboratory Concept of Operations, which provides a high-level overview of the approval process carried out by the Lab. 1.2 Background, Objectives and Scope On August 27, 2004, Homeland Security Presidential Directive-12 (HSPD-12) - "Policy for a Common Identification Standard for Federal Employees and Contractors was issued. HSPD-12 directed the promulgation of a new Federal standard for a secure and reliable form of identification issued by all Federal Agencies to their employees and contractors. In response to this directive, the National Institute of Standards and Technology (NIST) published FIPS 201 Personal Identity Verification (PIV) for Federal Employees and Contractors on February 25, The Office of Management and Budget (OMB) has designated GSA as the Executive Agent for government-wide acquisitions for the implementation of HSPD-12. OMB has directed Federal agencies to purchase only products and services that are conformant with the Federal policy, standards and numerous supporting technical specifications. Additionally, NIST has established the NIST Personal Identity Verification Program (NPIVP) to validate PIV components and sub-systems required by FIPS 201 that meet the NPIVP requirements. To ensure standard conformant products and services are available, NIST will issue test suites in Special Publication (SP) PIV Middleware and PIV Card Application Conformance Test Guidelines. At present, the NPIVP validation program includes FIPS 201 Interface Validation of PIV Card Applications and PIV Middleware for conformance to [SP ] - Interfaces for Personal Identity Verification. Additional NPIVP validation programs will be added as the PIV program evolves. The Lab ensures products and services are conformant with established FIPS 201 requirements. That is, if the Lab analysis or evaluation demonstrates that a supplier s product or service conforms to FIPS 201 specifications, as revised from time to time, then the name and version of the applicant s product or service will be added to an Approved FIPS 201 Products and Services List (Approved List). The Lab provides an environment, by means of an evaluation bed, whereby GSA collaborates with supplier representatives to validate product or service conformance with 1

7 FIPS 201 specifications, a prerequisite for availability to Agencies seeking to implement HSPD-12. Strict adherence to the Lab Spec will result in a consistent evaluation of products and services, and unbiased results. In addition, it will facilitate efficient, low risk capability to handle high volumes of approvals of conformant products and services. As such, the Lab Spec addresses overall Lab usability in context of meeting timeliness demands of Federal and supplier communities. 1.3 Purpose The purpose of this document is to provide sufficiently detailed guidance regarding Lab establishment and all facets of daily operation. This includes roles, responsibilities, facilities, security, processes, and procedures necessary to operate the Lab commensurate with the aforementioned scope and objectives. Because of its comprehensive detail, Lab Spec is a roadmap to achieve live operational capability. 1.4 Key Principles of Operation Certain key principles of Lab operation accompany the specific guidelines cited herein. These principles include: o Where process improvement and/or cost efficiencies are apparent, Lab management has the discretion to deviate from Lab Spec guidelines with approval from Program Manager prior to deviation. 1.5 References The following is a list of references used to develop this document. [HSPD-12] [FIPS 201] [SP ] HSPD 12, Policy for a Common Identification Standard for Federal Employees and Contractors, August 27, NIST FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors, NIST, March NIST Special Publication , Guide for Developing Security Plans for Federal Information Systems, Revision 1, February final.pdf [SP ] NIST Special Publication , Recommended Security Controls for Federal Information Systems, February

8 [SP ] [SP ] [SP ] [SP ] [NVLAP] [ConOps] [CM Plan] NIST Special Publication , Interfaces for Personal Identity Verification, NIST, April NIST Special Publication , Biometric Data Specification for Personal Identity Verification, NIST, February NIST Special Publication , Cryptographic Algorithms and Key Sizes for Personal Identity Verification, NIST, April NIST Special Publication , Guidelines for the Certification and Accreditation of PIV Card Issuing Organizations, NIST, July NIST Handbook 150, 2001 Edition, Procedures and General Requirements Handbook, July FIPS 201 Evaluation Program - Laboratory Concept of Operations, GSA,, February 13, 2006 FIPS 201 Evaluation Program - Configuration Management Plan [Approval Template] FIPS 201 Evaluation Program - Approval Procedures Template [Web Tool Manual] FIPS 201 Evaluation Program - Web-enabled Tool Laboratory User Guide 3

9 1.6 Document Organization The layout of the Lab Spec describes a support process and not a system. Nothing in this document is confidential or business proprietary. The remaining document describes the support process as follows: Section 1 provides document identification, background and scope, purpose, and document references; Section 2 provides a high level overview of the Lab; Section 3 details the roles, responsibilities, and qualifications for the staff and organizations involved in product and service evaluation; Section 4 details non-security Lab facility requirements, such as layout and environmental support (e.g., electrical power); Section 5 details Lab operations requirements such as approval mechanisms, scheduling, and activities (e.g., data backups) on a daily, weekly, and monthly basis; Section 6 details the process through which supplier products and services undergo as a prerequisite to placement on the Approved List for products and services, which indicates conformance with FIPS 201 requirements; Section 7 details all security relevant requirements for the Lab including management controls, operational controls and technical controls; Appendix A templates for various agreements, letters and notices used by the Lab, suppliers, and Approval Authority; Appendix B provides a Product Inventory List template; Appendix C lists the EP Lab rules of behaviour; Appendix D provides a sample Lab space layout per Lab size; and Appendix E defines key terms and lists acronyms used in the document. 4

10 2 System Overview The GSA Office of Government-wide Policy (OGP) authorizes the functioning of the Lab for evaluating products and services to be conformant to FIPS 201. The Lab includes a facility, testers, software, operating systems, networks, approval process, evaluation process, and test procedures. All of these, working within government policies, guidelines and procedures, form the basis of the Lab Spec. 2.1 Laboratory Services and Functions The core function of the Lab is to analyze and evaluate supplier products and services for conformance with FIPS 201 specifications. Based on Lab evaluation results, an authorized GSA official, the Program Manager (external to the Lab) makes the final determination as to whether the product or service should be approved, and added to the Approved List. Table 1 summarizes the various basic services and functions performed by the Lab. Services and Functions Application Processing Evaluation Preparation Evaluate Supplier Products & Services Evaluation Report Preparation Description Roles Involved Role Accountable for Completion Relationship Manager Relationship Manager Lab Engineer Applicant Review of supplier application and determination of acceptance. Initiate scheduling and evaluation preparation as appropriate upon acceptance. (See Section 1 for details) Prepare evaluation environment. Install and configure product or service. Speak with supplier before evaluation, if necessary, to resolve issues and questions, to optimize and expedite actual evaluation. (See Section 1 for details) Conduct consistent, accurate, formal evaluations of supplier products and services to verify conformance with applicable FIPS 201 specifications, following defined evaluation procedures and test suites to ensure consistency and neutrality. The lab evaluates products and services in accordance with the appropriate approval and/or test procedures. As deemed appropriate by the Lab, coordinate with supplier during evaluation to resolve question or obstacle encountered during the evaluation process. (See Section 1 for details) The Evaluation Report formally documents all evaluation and test results conducted in accordance with a specific category Approval Procedure document. (See Section 1 for details). Lab Engineer Lab Team Lead Applicant Lab Engineer Relationship Manager Applicant Lab Engineer Lab Team Lead Lab Director Lab Engineer Lab Engineer Lab Team Lead Relationship Management Facilitate and assist with the supplier application and deliverables process to ensure efficient, optimal task progression and evaluation correctness. Address questions from supplier and the Approval Authority. Address Nonconformance reviews, concerns and provide status information to supplier and the Approval Authority as requested. Relationship Manager Lab Engineers Lab Team Lead Lab Director Relationship Manager 5

11 Services and Functions Update Approved FIPS 201 Products & Services List Change Management Description Roles Involved Role Accountable for Completion Facilitate updates to the approved List, per Relationship Manager Relationship Manager Approval Authority approval. (See Section 1 for Approval Authority details) Ensuring disciplined, risk managed change to roles, responsibilities, processes, procedures, strategies as may be required from time to time. Collaborating with EP PMO and other stakeholders regarding change requests. [CM Plan] describes Lab change management in further detail. Lab Director Lab Team Lead Relationship Manager Lab Director Table 1 - Laboratory Services and Functions 2.2 Laboratory Environment and Operations To support the core function of the Lab and establishment of the Lab environment, appropriate operational processes and controls are required. Table 2 summarizes the various support activities: Support Activity Lab Facilities Lab Operations Evaluation Status Updating Information Source Description Non-security related aspects of the environment such as storage, power, HVAC, space layout, and LAN/WAN. (See Section 0 for details) Approval mechanisms employed by the Lab to approve products and services, as well as scheduling processes and other operational activities done on an ongoing basis (i.e., daily, weekly, monthly). (See Section 5 for details) Timely updating of evaluation status using the EP web-enabled tool (EP web tool), which serves as an informational source on the approval process, posting of approved products/services, online supplier application, and posting of approval product/service test procedures. (See Section 6 for details) Use of the EP website ( as an informational source regarding the approval process, posting of approved products/services, online supplier application, and posting of approval product/service test procedures. (See Section 6 for details) 6

12 Security Support Activity Description Various security controls (i.e., safeguards and countermeasures) in accordance with [SP ], which includes: Management Controls security controls that focus on the management of risk and the management of information systems Operational controls security controls for an information system that are primarily implemented by people, as opposed to systems; Technical controls security controls for an informational system that are primarily implemented and executed by an information system. This includes identification and authentication, access control, audit and accountability. (See Section 7 for details) Table 2 - Laboratory Controls 7

13 3 Roles, Responsibilities and Qualifications [ConOps] provides a conceptual overview of Lab roles and responsibilities, while this document provides the additional detail necessary to implement each Lab role and all its responsibilities. The additional detail provided herein includes: Frequency of task the specific trigger(s) that initiate the responsibility; Duration of task the amount of time expected for the responsibility to be completed. All durations are targets durations. Circumstances (e.g., response time by external parties such as the Applicant and the Approval Authority, peak periods where the number of applications submitted temporarily exceed. Lab resources) will likely impact durations, for better or for worse; Others needed internal and external participants needed for successful conclusion; Forms required the key forms, letters, and notices required to complete the responsibility; and Qualifications and training experience the essential education, training, and certification requirements to perform successfully all responsibilities cited for the position. 3.1 Lab Director The Lab Director is responsible for the overall operation of the Lab, which includes oversight of evaluation and quality assurance. The Lab Director responsibilities include: Setting the daily goals for the Lab the frequency of this task is daily. It must be completed at the beginning of each business day, or as quickly as possible as necessary during the day, so as not to impose a delay on any Lab activity. The duration of this task depends upon the nature of the issues of the day (e.g., complexity, priorities). However, sufficient decisions and clear, unambiguous direction must be given each day to ensure uninterrupted, ongoing operations of the Lab in accordance with project plans and commitments in effect at the time. To optimize daily goal setting, the Lab Director should consult with other Lab staff as appropriate, in particular, the Lab Team Leads and Relationship Managers. Towards this, Lab Director should have brief, daily meetings with Lab Team Leads and Relationship Managers to obtain general status and issues, and to communicate any changes to previous guidance. If circumstances allow, meetings can be held on a weekly basis. Project plans and other project and budget management mechanisms should be used where applicable to ensure optimal decision-making and efficient tracking. o No forms are relevant to this task. Ensuring all Lab operations adhere to the security and confidentiality requirements to protect all parties the frequency of this task is daily. The duration of this task is typically minutes, requiring brief visual inspection(s) or confirmation (verbal or written) from appropriate staff (e.g., Lab Team Leads, Relationship Managers). Other participants may include Lab Team Leads 8

14 (provide conformance reports), Relationship Managers, (provide conformance reports), and Lab Engineers (demonstrate processes being used are in conformance). The Lab Director should complete a formal audit every six (6) months to determine conformance in accordance with the established security and confidentiality requirements. The Lab Director should keep a log of all audits, inspections and verifications. o No forms are relevant to this task. Making efficient, effective use of the Lab s staff and other resources the frequency of this task is weekly. The duration of this task should be relatively short, one hour or less to assess needs and to make determinations. The Lab Director should consult with Lab Team Leads and Relationship Managers to optimize this task. Decision factors should include size of work queues, average time to complete Approval Procedures, and planned staff commitments. Staffing Plan adjustments should be made on a temporary basis as necessary, in accordance with previously drafted staffing and contingency plans. Project planning tools (e.g., MS Project) should be used to optimize planning and scheduling. o No forms are relevant to this task. Ensuring all evaluation activities are performed consistent with [ConOps] and Lab Spec the frequency of this task is daily. The duration of this task is typically minutes, requiring brief visual inspection(s) or confirmation (verbal or written) from appropriate staff (e.g., Lab Team Leads). Other participants may include Lab Team Leads (provide evaluation reports) and Lab Engineers (demonstrate processes being used are conformant). The Lab Director should consider a formal audit to determine conformance every six (6) months. The Lab Director should keep a log of all audits, inspections and verifications. The Lab Director should also archive all audit reports. o No forms are relevant to this task. Appointing roles and delegating responsibilities the frequency of this task is once at Lab opening, and then on an as needed basis. The initial duration may take days in order to sufficiently plan. Subsequent as needed instances should be very quick due to previous contingency planning. Consultation with others should be done if useful, but is not necessarily required to complete this task successfully. o No forms are relevant to this task. Briefing the EP PMO and Approval Authority on evaluation status the frequency of this task is weekly, or as requested intermittently. The duration of this task is variable (e.g., one minute response to an informal status update request, or a one hour status meeting), but should not be long in duration. Other participants may include Lab Team Leads to provide up-to-the-minute status updates. o No forms are relevant to this task. 9

15 Maintaining updates to the Lab policies and procedures the frequency of this task is monthly, or as needed. The duration of this task is approximately two-three weeks depending on the scope and extent of updates needed. To the extent possible and permitted by stakeholders, the Lab Director must seek to expedite the update process to maintain optimal Lab performance and capabilities. Other participants are needed to provide inputs and/or approvals, including Lab Managers (inputs), Lab Engineers (inputs), Relationships Managers (inputs), and the Approval Authority (inputs and approval). Updates must be processed in accordance with the approved [CM Plan]. The Lab Director facilitates meetings with the Approval Authority to discuss and the disposition of changes proposals. The Lab Director must request appropriate staff to publish revised documents to the GSA FIPS 201 EP web site (EP web site) site within one (1) business day of Approval Authority approval. The Lab Director must also instruct appropriate staff to publish revised documents to all Lab staff within one (1) business day of Approval Authority approval. Distribution of revised documents to staff must be accompanied with a memo highlighting the changes and instructing adherence. If necessary (e.g., significant changes to policies or procedures), the Lab Director must hold an all hands meeting with Lab staff to fully explain the changes and answer any questions. o No forms are relevant to this task. Authorizing submission of the Evaluation Report to the Approval Authority the frequency of this task is as requested by Lab Team Leads. The Lab Director must review the report for completeness and appropriateness of its conclusion, per supporting test results. If there are any problems or issues with the report, the Lab Director must notify the Lab Team Lead and provide sufficient comments and guidance. If necessary, the Lab Director should schedule a meeting with the Lab Team Lead (and possibly the Technical Evaluation Team) to discuss the matter. Execution should be as quickly as possible, but is dependent upon the scope and extent of the issues raised. If the report is satisfactory, the Lab Director must formally submit a full copy of the Evaluation Report to the designated Approval Authority contact via . The submission must include an Approval Request Letter signed by the Lab Director indicating the Lab s recommendation for approval. The signed Approval Request Letter must be added to the appropriate case file. The duration of this path is one (1) business day from receipt of the Evaluation Report. The Lab Director should encourage rapid Approval Authority response to maintain optimal Lab efficiency and rapid updates to the Approved List. o Forms used in this task include the Evaluation Report, and Approval Request Letter. Authorizing submission of the non-conformance letter to the Applicant the frequency of this task is as requested by Lab Team Leads. The Lab Director must review the report for completeness and appropriateness of its conclusion, per supporting test results. If there are any problems or issues with the report, the Lab Director must notify the Lab Team Lead and provide sufficient comments and guidance. If necessary, the Lab Director should schedule a meeting with the Lab 10

16 Team Lead (and possibly the Technical Evaluation Team) to discuss the matter. Execution should be as quickly as possible, but is dependent upon the scope and extent of the issues raised. If the report is satisfactory, the Lab Director must instruct the Applicant s Relationship Manager to inform the Applicant of evaluation non-conformance. The Lab Director does this by ing the Evaluation Report and a Non-conformance Authorization Notice to the Relationship Manager. The duration of this path is one (1) business day from receipt of the Evaluation Report. o Forms used in this task include the Evaluation Report, and Non-conformance Authorization Notice. Resolving Non-conformance review requests and/or disagreements submitted by suppliers the frequency of this task is as submitted by suppliers. On a daily basis or as circumstances allow, Lab Director uses the EP web tool to retrieve the next Non-conformance Review Form in the Non-conformance Review queue and takes ownership of it. The Lab Director reviews the Nonconformance Review Form. If there are any issues with the form or if the Lab Director determines the Non-Conformance Review fee has not been paid, the Lab Director sends the Applicant a Review Form Rejection Letter. Upon receiving a complete and paid submission, The Lab Director must add the Non-Conformance Review Form to the appropriate case file. The Lab Director then researches the facts leading to the non-conformance determination. This review includes thoroughly examining all documentation in the Applicant s case file and, if necessary, interviewing the Lab Team Lead and the Technical Evaluation Team. The Lab Director may also speak with the Approval Authority to obtain guidance or requirements clarification. The Lab Director then discusses the review with the Applicant. The Lab Director issues a formal Review Decision Letter to the Applicant, and adds the Letter to the Applicant s case file. If necessary per the decision, the Lab Director initiates follow up actions by sending the Lab Team Lead an Instruction Notice that defines actions items for the Lab in regards to the specified application. The duration of this task is fifteen (15) business days, but is dependent upon supplier availability and response times. o Forms used during this task include the Non-Conformance Review Form, Review Decision Letter, and Instruction Notice Qualifications and Training Requirements The following qualifications are applicable to the Lab Director position: Master s degree in Computer Science or similar; Broad experience with program management including budgeting, scheduling, resource allocation, organizational management, establishment of policies and procedures, internal auditing of conformance, relationship management, and strategic planning; Hands-on knowledge of and experience with project management methodology (e.g., PMI, CMM) and related tools (e.g., MS Project); Strong written and verbal communication skills; 11

17 PMI certification preferred; Thorough understanding of HSPD-12 objectives and FIPS 201 requirements; and Subject matter expertise in smart card and biometric technologies. Government Program Manager reserves the right to interview, select, and require replacement of said individual. 3.2 Relationship Manager For the evaluation of products and services, the Relationship Manager has the following responsibilities: Receiving, reviewing and approving the application package the frequency of this task is per application taken off the application queue. The Relationship Manager uses the EP web tool to retrieve the next application in the application queue and takes ownership of it. This task requires detailed review of all facets of the application for completeness and usefulness. Review includes the application itself, signing of the Lab Services Agreement, full payment of all applicable fees, proof that a submitted product is a commercial release, and presence of all necessary supporting materials. In addition, the Relationship Manager facilitates completion of a Product Inventory List to begin identification and tracking of assets to be proved by the Applicant (See Appendix B for a supplier asset inventory list template). If there are any issues with the application (e.g., incomplete, not understandable), the Relationship Manager must formally notify the Applicant via a formal Application Rejection Notice with specific citations, next steps, and where applicable, guidance on how best to correct. If the application is satisfactory, the Relationship Manager must the Applicant an Application Acceptance Notice. The duration of this task is ten (10) business days from taking the application off the application queue. Input from Lab Engineers may be required from time to time in order for the Relationship Manager to make a fully informed judgment. o Forms used during this task include the Application Form, Application Acceptance Notice and the Application Rejection Notice. Primary point of contact for Applicant interaction and evaluation the frequency of this task is as assigned by the Lab Director. The duration is for the full life cycle of each Applicant application/evaluation. Upon assignment to an Applicant, the Relationship Manager must notify the Applicant primary contact of such assignment and explain Relationship Manager services. o No forms are relevant to this task. Assisting Applicants with the application process the frequency of this task is as assigned by the Lab Director. Upon assignment to an Applicant and upon submission of an application, the Relationship Manager must proactively assist the Applicant with successful completion of the application. The Relationship Manager must have ongoing contact with the Applicant primary contact to effectively coordinate and facilitate the application process. The Relationship Manager must communicate to the Applicant early and often application and application process requirements and expectations (e.g., rapid response to 12

18 questions, in-person availability of Applicant staff to assist with installation and configuration). This ensures the Applicant immediately understands how to submit a successful (i.e., complete and accurate) application, and what specific items of evidence and other deliverables (e.g., installation and configuration guides) are required for the Technical Evaluation Team to conduct an efficient and effective evaluation. Telephone conference calls are sufficient, but in-person meetings should be scheduled if necessary. Where possible and practical, the Relationship Manager should review the application and supporting documents in advance of official submission, to provide feedback to the Applicant regarding completeness and usefulness. The duration of this task is primarily dependent upon the Applicant. However, the Relationship Manager should not spend an inordinate amount of time on this task, one (1) business day or less of assistance per application. If it is necessary to have the Applicant product or service on the Approved List as soon as possible, additional time may be acceptable. Input from Lab Engineers may be required from time to time in order for the Relationship Manager to assist fully the Applicant during the application submission step. o No forms are relevant to this task. Facilitating Applicant delivery of conformance evidence and deliverables necessary for evaluation (i.e. the Application package) the frequency of this task is as assigned by the Lab Director. Upon assignment to an Applicant and upon submission of an application, the Relationship Manager must proactively assist the Applicant with successful submission of conformance evidence and all supporting deliverables. The Relationship Manager must have ongoing contact with the Applicant primary contact to effectively coordinate and facilitate the coalescing of all needed evidence and deliverables. The Relationship Manager must notify the Applicant of all evidence and deliverable requirements and expectations. Telephone conference calls are sufficient, but in-person meetings should be scheduled if necessary. Where possible and practical, the Relationship Manager should review the evidence and supporting documents in advance of official submission, to provide feedback to the Applicant regarding completeness and usefulness. The duration of this task is primarily dependent upon the Applicant. However, the Relationship Manager should not spend an inordinate amount of time on this task, one (1) business day or less of assistance per application. If it is necessary to have the Applicant product or service on the Approved List as soon as possible, additional time may be acceptable. Input from Lab Engineers may be required from time to time in order for the Relationship Manager to assist fully the Applicant during the application submission step. o Forms used during this task include the Application Form. Responsible for updating the Applicant s evaluation status on the EP web tool The Relationship Manager must use the EP web tool to reflect the following statuses: Application Review In Progress, Application Accepted, and Non-conformant, and Approved. The status update must occur immediately upon the new state occurring (i.e., the Relationship Manager retrieves an application from the Application Queue, The Relationship Manager receives a Non-conformance Authorization Notice from the Lab Director, the 13

19 Relationship Manager receives an Approval Authorization Letter from the Approval Authority). The frequency of this task is as status changes per evaluation. The duration of this task is minimal, typically minutes per update. o No forms are relevant to this task. Briefing the Applicant on evaluation status of their product or service the frequency of this task is as needed or as requested. Typically, the duration of such a briefing is very short, perhaps minutes per briefing. A brief or a phone call is sufficient. However, a briefing pertaining to an evaluation nonconformance status is likely to take longer, and may require an in-person meeting. In this instance, the duration is more likely to be one to two (1-2) hours for a complete, thorough briefing as to what was non-conformant, why it was found non-conformant, and suggested corrective actions. o Forms possibly used in this task include the Evaluation Report, Approval Letter, and Non-conformance Letter. Transmitting the approval letter or the non-conformance letter to the Applicant the frequency of this task is as requested by the Lab Director (nonconformance) and the Approval Authority (approvals). The duration of this task is minimal, requiring one (1) hour or less to complete per request. The Lab Director s the Relationship Manager a Non-conformance Authorization Notice authorizing the sending of a Non-conformance Letter to the Applicant. The Approval Authority s the Relationship Manager an Approval Authorization Letter authorizing the sending of an approval letter to the Applicant. The Relationship Manager must the appropriate letter or notice to the Applicant within one (1) business day of receiving authorization. If there is any ambiguity or concern regarding the authorization, the Relationship Manager must contact the Lab Director or Approval Authority, as appropriate, to obtain clarification before sending anything to the Applicant. o Forms used during this task include the Evaluation Report, Approval Letter and Non-conformance Letter. Facilitating updates of the Approved List, per Approval Authority decisions the frequency of this task is per Approval Authorization Letter received from the Approval Authority. The duration of this task is minimal, requiring one (1) hour or less to complete per request. The Approval Authority s the Relationship Manager an official request to send the Applicant an Approval Letter. Upon receiving this formal request and sending the Approval Letter to the Applicant, the Relationship Manager updates the Approved List with the newly approved product or service. Updating of the Approved List must be completed within one (1) business day of receiving the Approval Authorization Letter. o No forms are relevant to this task Qualifications and Training Requirements The following qualifications are applicable to the Relationship Manager position: Bachelor s degree; 14

20 Broad experience with customer interaction and relations; Attention to detail; Efficient and timely handling of matters in accordance with documented procedures; Experience with web-based tools; Strong communication skills; Proactive; and Strong Familiarity with HSPD-12 objectives and FIPS 201 requirements. 3.3 Lab Team Lead A Lab Team Lead is responsible for the evaluation of products and service in one or more category(s). The Lab Team Lead has the following responsibilities: Prioritizing evaluation and other day-to-day Lab tasks the frequency of this task is daily. Upon receiving overall goals, priorities, and Lab operation instructions from the Lab Director, the Lab Team Lead must implement those instructions in a tangible way for each assigned evaluation. As necessary, the Lab Team Lead must contact the Lab Director if clarification is required or an exception is necessary. Such communication (request and response) must be via and archived for audit purposes. The duration of this task is ongoing, requiring constant assessment and adjustment as guidance from the Lab Director changes and as the daily workflow evolves. o No forms are relevant to this task. Assigning resources for evaluating products and services the frequency of this task is per evaluation. The duration of this task should be minimal, requiring no more than several hours. To the extent practical, Lab Team Leads must coordinate and plan assignment of resources (i.e., staff and assets) in advance, as appropriate for the current and reasonably expected requests in the evaluation queue. Such a meeting should be held daily, but can be held weekly if circumstances allow. With appropriate advance planning, resource assignment should be extremely quick (i.e., minutes) when needed, simply requiring final confirmation with colleagues that no factor has changed that could alter preplanned assignments. Lab Team Leads may need input from specific Lab Engineers to optimize advance planning (e.g., find out about vacation plans). o No forms are relevant to this task. Overseeing and facilitating successful conclusion of day-to-day tasks in accordance with project plans, budgets, and Lab objectives the frequency of this task is daily. The duration is ongoing, as this is a primary responsibility of the Lab Team Lead. Appropriate project management tools must be used to ensure up-to-date and correct information. As necessary, information input into these tools must be synchronized with Lab Director project management tools, to ensure current, accurate information. Team meetings (e.g., with Technical Evaluation Teams) must be used as necessary to obtain status and projections, and 15

21 to communicate expectations, constraints, and targets (e.g., budgeted hours per task, milestone dates). Daily meetings must be considered, but weekly or as necessary is acceptable. o Forms used during this task include the Evaluation Report. Determining the composition of the Technical Evaluation Team the frequency of this task is per evaluation taken off the queue. As circumstances allow, the Lab Team Lead uses the EP web tool to retrieve the next evaluation in the evaluation queue and takes ownership of it. Once scheduled, the Lab Team Lead must use the EP web tool to update the status to Evaluation Scheduled. The Lab Team Leads must assess Lab Engineer availability in conjunction with current and upcoming evaluations (per review of the evaluation queue and relevant project plans). In addition, the Lab Team Lead must determine the required skills and experience needed for the evaluation category. The Lab Team Lead then decides the optimal Technical Evaluation Team composition (i.e., which Lab Engineers and how many Lab Engineers) in context of the specific evaluation and overall evaluation planning. Upon determination, the Lab Team Lead s the selected Lab Engineers to inform them of the evaluation and its schedule. The Lab Team Lead must also update all relevant project plans and other project management tools to indicate the decisions and to preclude staff allocation conflicts. The duration of this task is one (1) business day. o No forms are relevant to this task. Communicating with the suppliers in the event issues arise during the evaluation of a product or service the frequency of this task is as requested by a Technical Evaluation Team. The Technical Evaluation Team will notify the Lab Team Lead via or in person. If necessary, the Lab Team Lead must meet with one or more Technical Evaluation Team members to ensure full understanding of the questions or issues raised. The Lab Team Lead then must contact the Applicant primary contact within one (1) business day of receiving the initial request. The Lab Team Lead must clearly communicate to the Applicant primary contact the questions and issues being raised, action items requested (e.g., providing what additional material, answering the questions, providing an onsight resource to assist), response expectations (e.g., scope and extent of the answer, qualified technical engineer), response timeframes, and consequences of failing to respond as requested. For audit purposes, the Lab Team Lead must follow-up the conversation by providing a written summary of all requests and points made during the conversation. An is sufficient for the written summary. A copy of the written summary must be placed in the appropriate case file. The Lab Team Lead must monitor the Applicant for a response within the expected period and contact (i.e., facilitate) the Applicant as necessary. During this period, the Lab Team Lead must determine when the evaluation should be terminated due to the Applicant s failure to respond, resulting in a Nonconformance Letter. o No forms are relevant to this task. 16

22 Assisting in reviewing and resolving non-conformance review requests and complaints submitted by suppliers, along with the Lab Director where appropriate the frequency of this task is as requested by the Lab Director. The duration of this task variable, as differing amounts of time and attention may be required for each submitted non-conformance review request form. However, the average duration should not exceed one (1) business day from receiving the request to investigate. The Lab Team Lead must research all available information (e.g., case file, personal archives) and speak to all relevant parties (e.g., Relationship Manager, Technical Evaluation Team) as necessary to provide the Lab Director with complete, accurate information, and if requested, a recommendation. Findings and recommendations must be documented and ed to the Lab Director. A copy of the findings and recommendation must be added to the appropriate case file. Upon receipt of an Instruction Notice from the Lab Director, the Lab Team Lead must quickly facilitate transition to the appropriate phase and step(s). In this case, the Lab Team Lead must update project schedules accordingly, resolving any resource or commitment conflicts. If there are conflicts that cannot be resolved, the Lab Team Lead must notify the Lab Director immediately to discuss and resolve. o Forms used during this task include the Non-Conformance Review Form and Instruction Notice. Providing evaluation reports to the Lab Director for final approval the frequency of this task is per evaluation. Upon completion of an evaluation, the Technical Evaluation Team sends the Lab Team Lead an indicating evaluation completion. At this point, the Lab Team Lead must use the EP web tool to update the status to "Evaluation Report In Progress and begin writing the official Evaluation Report. If clarification or additional information is needed, the Lab Test Lead must speak with the Technical Evaluation Team, either by or via an in-person meeting. The Lab Team Lead completes the Evaluation Report, and adds EP Confidential to each page. The Lab Team Lead must add the completed Evaluation Report to the appropriate case file. At this point, the Lab Team Lead must use the EP web tool to update the status to "Evaluation Report Complete. The Lab Team Lead must submit the completed Evaluation Report to the Lab Director via within five (5) business days of receiving Technical Evaluation Team findings. o Forms used during this task include the Evaluation Report Qualifications and Training Requirements The following qualifications are applicable to the Lab Team Lead position: Bachelor s degree in Computer Science or related (advanced degree preferred); Strong hands-on knowledge of and experience with project management methodology (e.g., PMI, CMM) and related tools (e.g., MS Project); Strong written and verbal communication skills; Experience writing test result reports; 17

23 Efficient and timely handling of matters in accordance with documented procedures; Experience with customer interaction and relations; Proactive; and Understanding of HSPD-12 objectives and FIPS 201 requirements. 3.4 Lab Engineer Lab Engineers execute the day-to-day tasks of the Lab. Lab Engineer responsibilities include: Managing internal network and systems the frequency of this task is daily for monitoring and minor fixes, and weekly or monthly for scheduled maintenance. Most of the work should be up front, when initially implementing and configuring the internal network and systems. This will likely takes days or weeks depending upon complexity and dependencies (e.g., equipment procurement, Internet provider response). Once operational, Lab Engineers must monitor the network and systems on a daily basis to ensure proper operations. Monitoring is brief (a few seconds or minutes) several times each day. Maintenance and upgrades to the network and systems must be done on a regularly scheduled basis (monthly, or if circumstances allow, quarterly) to ensure up to date licensing, functioning, and security. Scheduled maintenance must be coordinated with Lab activities and commitments so as not cause unnecessary disruption. Lab Engineers must publish their maintenance schedules to all Lab staff (particularly the Lab Team Leads). At least two (2) business days in advance of a scheduled maintenance, Lab Engineers must confirm with all Lab Team Leads that there is no conflict with currently scheduled Lab activities or commitments. When possible, scheduled maintenance must be done during non business hours. Unscheduled maintenance (e.g., unexpected failure, high priority security problem) requires immediate notification to all Lab staff, particularly all Lab Team Leads. Lab Engineers must proactively coordinate with all Lab Team Leads and Technical Evaluation Teams to determine next steps and revised schedules, if necessary. Lab Engineers must adhere to the [CM Plan] as appropriate for maintenance activities. o No forms are relevant to this task. Preparing the environment for evaluation - including establishing baselines for systems and the network environment the frequency of this task is per electronic test. If electronic testing is necessary, the one or more Lab Engineers assigned to the Technical Evaluation Team must establish the appropriate environment. This pertains to basic test environment infrastructure such as PCs needed and network configuration. Lab Engineers must use the relevant Test Procedures, as they provide general infrastructure and configuration guidelines. Establishing baselines must be done in accordance with the [CM Plan]. The duration of environment preparation must be within five (5) business days of the actual evaluation start date. o No forms are relevant to this task. 18