peace corps it security rfp security third party evaluation and testing

23
> \E[1 [J>>\;;6 Jmhlgcfb Zwcm{zgz-Zmigjgrnrgmc Em| R`g|b {n|rw Zwzrfhz Zfjv|grw Rfzrgcd ncb Funivnrgmc Zf|ugjfz Gcjivbfb tgr`gc n|f r`f emiimtgcd1 Zfjrgmc G1 Gczr|vjrgmcz rm Meef|m|z Zfjrgmc GG1 Funivnrgmc J|grf|gn Zfjrgmc GGG1 Jmcr|njr Rw{f Zfjrgmc GU1 [f|gmb me [f|em|hncjf Zfjrgmc U1 Zrnrfhfcr me Tm|o) Lnzgj Jmcr|njr Zfjrgmc UG1 Zrnrfhfcr me Tm|o) Eg|zr Rnzo M|bf| Zfjrgmc UGG1 Jmcr|njr Jinvzfz ZFJRGMC G ‚ GCZR\VJRGMCZ RM MEEF\M\Z ># R`gz gz n jmhlgcfb zwcm{zgz-zmigjgrnrgmc em| jmhhf|jgni grfhz {|f{n|fb gc njjm|bncjf tgr` r`f em|hnr gc Zvl{n|r ><#5) nz zv{{ifhfcrfb tgr` nbbgrgmcni gcem|hnrgmc gcjivbfb gc r`gz cmrgjf# R`gz nccmvcjfhfcr jmczrgrvrfz r`f mciw zmigjgrnrgmc? {|m{mzniz n|f lfgcd |f~vfzrfb ncb n t|grrfc zmigjgrnrgmc tgii cmr lf gzzvfb# R`f zmigjgrnrgmc cvhlf| gz [J>>\;;6 ncb gz gzzvfb nz n |f~vfzr em| {|m{mzni (\E['# R`gz gz n >;;& zhnii lvzgcfzz zfrnzgbf# Nii |fz{mczglif zmv|jfz hnw zvlhgr n {|m{mzni# <# R`f {|mugzgmcz ncb jinvzfz gcjm|{m|nrfb gcrm r`gz zmigjgrnrgmc bmjv hfcr n|f r`mzf gc feefjr nr r`f rghf me {vligjnrgmc# [|mugzgmcz ncb jinvzfz gcjm|{m|nrfb lw |fef|fcjf `nuf r`f znhf em|jf ncb feefjr nz ge r`fw tf|f dg ufc gc evii rfpr# R`f evii rfpr me r`f Efbf|ni Nj~vgzgrgmc \fdvinrgmc (EN\' jnc lf njjfzzfb mc r`f Gcrf|cfr nr `rr{1--ttt#nj~vgzgrgmcjfcr|ni#dmu # M|ni jmhhvcgjnrgmcz n|f cmr njjf{rnlif gc |fz{mczf rm r`gz cmrgjf# :# R`f Cm|r` Nhf|gjnc Gcbvzr|w Jinzzgegjnrgmc Zwzrfh (CNGJZ' jmbf gz 62>6>7 Mr`f| Jmh{vrf| ‚ \finrfb Zf|ugjfz # Meef|m|z hvzr lf |fdgzrf|fb gc r`f Jfcr|ni Jmcr|njrm| \fdgzr|nrgmc (JJ\' nr `rr{1--ttt#jj|#dmu) gc m|bf| rm lf jmczgbf|fb em| ntn|b# 2# R`f [fnjf Jm|{z |f~vg|fz n c gcem|hnrgmc nzzv|ncjf nzzfzzhfcr) zwzrfhz rfzrgcd ncb funivnrgmc rm gcjivbf jf|rgegjnrgmc ncb njj|fbgrnrgmc zv{{m|r zf|ugjfz em| nii [fnjf Jm|{z Zwzrfhz) N{{igjnrgmcz) Bnrnlnzfz) Gcrf|jmccfjrgmcz) ncb Cfrtm|o jmh{mcfcrz) hmbvifz# R`f zjm{f me r`gz rnzo gz rfzrgcd ncb funivnrgcd me nii r`f hnam| zwzrfh jmh{mcfcrz ncb lmvcbn|gfz nz gbfcrgegfb gc [fnjf Jm|{z Zwzrfhz

Upload: accessible-journal-media-peace-corps-documents

Post on 08-Apr-2018

220 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 1/23

>

\E[1 [J >> \ ;;6 Jmhlgcfb Zwcm{zgz-Zmigjgrnrgmc

Em|R`g|b {n|rw Zwzrfhz Zfjv|grw Rfzrgcd ncb Funivnrgmc Zf|ugjfz

Gcjivbfb tgr`gc n|f r`f emiimtgcd1

Zfjrgmc G1 Gczr|vjrgmcz rm Meef|m|zZfjrgmc GG1 Funivnrgmc J|grf|gnZfjrgmc GGG1 Jmcr|njr Rw{fZfjrgmc GU1 [f|gmb me [f|em|hncjfZfjrgmc U1 Zrnrfhfcr me Tm|o) Lnzgj Jmcr|njrZfjrgmc UG1 Zrnrfhfcr me Tm|o) Eg|zr Rnzo M|bf|Zfjrgmc UGG1 Jmcr|njr Jinvzfz

ZFJRGMC G ‚ GCZR\VJRGMCZ RM MEEF\M\Z

># R`gz gz n jmhlgcfb zwcm{zgz-zmigjgrnrgmc em| jmhhf|jgni grfhz {|f{n|fb gcnjjm|bncjf tgr` r`f em|hnr gc Zvl{n|r ><#5) nz zv{{ifhfcrfb tgr` nbbgrgmcnigcem|hnrgmc gcjivbfb gc r`gz cmrgjf# R`gz nccmvcjfhfcr jmczrgrvrfz r`f mciwzmigjgrnrgmc? {|m{mzniz n|f lfgcd |f~vfzrfb ncb n t|grrfc zmigjgrnrgmc tgii cmr lfgzzvfb# R`f zmigjgrnrgmc cvhlf| gz [J >> \ ;;6 ncb gz gzzvfb nz n |f~vfzr em|{|m{mzni (\E['# R`gz gz n >;;& zhnii lvzgcfzz zfr nzgbf# Nii |fz{mczglif zmv|jfzhnw zvlhgr n {|m{mzni#

<# R`f {|mugzgmcz ncb jinvzfz gcjm|{m|nrfb gcrm r`gz zmigjgrnrgmc bmjvhfcr n|f r`mzfgc feefjr nr r`f rghf me {vligjnrgmc# [|mugzgmcz ncb jinvzfz gcjm|{m|nrfb lw|fef|fcjf `nuf r`f znhf em|jf ncb feefjr nz ge r`fw tf|f dgufc gc evii rfpr# R`fevii rfpr me r`f Efbf|ni Nj~vgzgrgmc \fdvinrgmc (EN\' jnc lf njjfzzfb mc r`fGcrf|cfr nr `rr{1--ttt#nj~vgzgrgmcjfcr|ni#dmu # M|ni jmhhvcgjnrgmcz n|f cmrnjjf{rnlif gc |fz{mczf rm r`gz cmrgjf#

:# R`f Cm|r` Nhf|gjnc Gcbvzr|w Jinzzgegjnrgmc Zwzrfh (CNGJZ' jmbf gz 62>6>7Mr`f| Jmh{vrf| ‚ \finrfb Zf|ugjfz # Meef|m|z hvzr lf |fdgzrf|fb gc r`f Jfcr|niJmcr|njrm| \fdgzr|nrgmc (JJ\' nr `rr{1--ttt#jj|#dmu) gc m|bf| rm lf jmczgbf|fb

em| ntn|b#

2# R`f [fnjf Jm|{z |f~vg|fz nc gcem|hnrgmc nzzv|ncjf nzzfzzhfcr) zwzrfhz rfzrgcdncb funivnrgmc rm gcjivbf jf|rgegjnrgmc ncb njj|fbgrnrgmc zv{{m|r zf|ugjfz em| nii[fnjf Jm|{z Zwzrfhz) N{{igjnrgmcz) Bnrnlnzfz) Gcrf| jmccfjrgmcz) ncb Cfrtm|o jmh{mcfcrz) hmbvifz# R`f zjm{f me r`gz rnzo gz rfzrgcd ncb funivnrgcd me nii r`fhnam| zwzrfh jmh{mcfcrz ncb lmvcbn|gfz nz gbfcrgegfb gc [fnjf Jm|{z Zwzrfhz

Page 2: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 2/23

<

\E[1 [J >> \ ;;6 gcufcrm|w# R`f Jmcr|njrm| tgii jmcbvjr r`f rfzrgcd gc njjm|bncjf tgr` CGZR 0;;6:N jmcr|miz (rfj`cgjni) m{f|nrgmcni ncb hncndf|gni' em| n hmbf|nrf ifufi zwzrfh#

6# Nii jin|gegjnrgmc ~vfzrgmcz cffb rm lf zvlhgrrfb ugn fhngi lw >;1;;nh FZR)

R`v|zbnw) N{|gi <0) <;>> rm lln|cfrrK{fnjfjm|{z#dmu # Nii egcni ~vmrfz cffb rm lfzvlhgrrfb rm lln|cfrrK{fnjfjm|{z#dmu cm inrf| r`nc ><1;;{h FZR) Hmcbnw) Hnw>5) <;>>#

Inrf gz inrf# Cm ~vmrfz zvlhgrrfb nerf| r`f bfnbigcf tgii lf njjf{rfb#

ZFJRGMC GG ‚ FUNIVNRGMC J\GRF\GN

R`gz jmcr|njr tgii lf ntn|bfb nz n imtfzr {|gjf rfj`cgjniiw njjf{rnlif m|bf|# Ufcbm|zz`nii zvlhgr rtm {|m{mzniz em| r`gz jmcr|njr# R`fw n|f nz emiimtz1

># Rfj`cgjni [|m{mzni em| r`f Lnzgj Jmcr|njr1n# Gcjivbf [nzr [f|em|hncjfl# Gcjivbf Rfj`cgjni N{{|mnj`j# Gcjivbf ^vnigrw Nzzv|ncjf [inc

<# [|m{mzni em| r`f Eg|zr Rnzo M|bf|1n# Gcjivbf Rfj`cgjni N{{|mnj`l# Gcjivbf [|gjfj# Gcjivbf ^vnigrw Nzzv|ncjf [inc

ZFJRGMC GGG ‚ JMCR\NJR RW[F

R`f jmcr|njr tgii lf ntn|bfb nz nc gcbfegcgrf bfiguf|w-gcbfegcgrf ~vncrgrw jmcr|njr tgr`eg|h egpfb {|gjf zf|ugjf rnzo m|bf|z# R`f jmcr|njr tgii `nuf n lnzf wfn| tgr` 2 (emv|'m{rgmc wfn| {f|gmbz# R`f hnpghvh nccvni m|bf|gcd r`|fz`mib tgii cmr fpjffb"6;;);;;#;;) ncb r`f hnpghvh muf|nii m|bf|gcd r`|fz`mib tgii cmr fpjffb "<)6;;);;;#;;#

ZFJRGMC GU ‚ [F\GMB ME [F\EM\HNCJF

R`f {f|gmb me {f|em|hncjf tgii lf mcf Lnzf Wfn| {f|gmb) tgr` 2 (emv|' Mcf Wfn| M{rgmcznz emiimtz1

Lnzf Wfn| Mcf1 :> Hnw <;>> ‚ :; Hnw <;><

M{rgmc Wfn| Mcf1 :> Hnw <;>< ‚ :; Hnw <;>:

M{rgmc Wfn| Rtm1 :> Hnw <;>: ‚ :; Hnw <;>2

Page 3: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 3/23

:

\E[1 [J >> \ ;;6

M{rgmc Wfn| R`|ff1 :> Hnw <;>2 ‚ :; Hnw <;>6

M{rgmc Wfn| Emv|1 :> Hnw <;>6 ‚ :; Hnw <;>5

ZFJRGMC U ‚ LNZGJ ZRNRFHFCR ME TM\O

># GCR\MBVJRGMC1[fnjf Jm|{z gz nc gcbf{fcbfcr jgugignc fpfjvrguf ndfcjw me r`f Efbf|ni Dmuf|chfcrfzrnligz`fb gc >75> lw [|fzgbfcr Am`c E# Ofccfbw rm {|mhmrf tm|ib {fnjf ncb e|gfcbz`g{r`|mvd` r`f zf|ugjf me Nhf|gjnc umivcrff|z nl|mnb# [fnjf Jm|{z umivcrff|z fcigzr em| nrtm wfn| rf|h me zf|ugjf gc gcrf|fzrfb jmvcr|gfz gc cffb me r|ngcfb hnc{mtf|# R`fumivcrff|z‗ zf|ugjf eviegiiz r`f r`|ff {|ghn|w [fnjf Jm|{z dmniz fzrnligz`fb gc r`f

emvcbgcd ifdgzinrgmc1• Gh{|muf r`f igufz me {fm{if r`|mvd` d|nzz|mmrz nzzgzrncjf)• Emzrf| n lfrrf| vcbf|zrncbgcd me Nhf|gjncz mc r`f {n|r me r`f {fm{if zf|ufb) ncb• Emzrf| n lfrrf| vcbf|zrncbgcd me mr`f| {fm{if mc r`f {n|r me Nhf|gjncz#

R`f ndfcjw‗z dimlni GR gce|nzr|vjrv|f {|mugbfz zf|ugjfz rm n vzf| lnzf me cfn|iw 6);;; eviincb {n|r rghf {f|zmccfi bgzr|glvrfb r`|mvd`mvr r`f tm|ib# Bmhfzrgj GR ncbjmhhvcgjnrgmcz zf|ugjfz n|f {|mugbfb nr [fnjf Jm|{z @fnb~vn|rf|z) 7 \fdgmcni\fj|vgrgcd Meegjfz (\\Mz') nz tfii nz rm |fhmrf vzf|z ugn U[C# R`f \\Mz) FHN :#>ncb GN[ DZZ :#; {inrem|hz n|f imdgjniiw {n|r me r`f Bmhfzrgj Gce|nzr|vjrv|f t`gif r`fNe|gjn [mzrz‗ jv||fcriw m{f|nrf gcbf{fcbfcriw mc r`f Zgcdif Lvzgcfzz Zf|uf| (ZLZ'{inrem|h tgr` n {inccfb |fe|fz` rm imdgjniiw jmccfjr Ne|gjn rm @fnb~vn|rf|z zrn|rgcd gc r`f

zfjmcb ~vn|rf| me <;>> ncb fcbgcd gc eg|zr ~vn|rf| <;><#

<# LNJOD\MVCB1R`f J`gfe Gcem|hnrgmc Zfjv|grw Meegjf| (JGZM' gz |fz{mczglif em| gcem|hnrgmc nzzv|ncjfjmh{igncjf em| dimlni GR zfjv|grw) ncb |f{m|rz bg|fjriw rm r`f JGM# R`f JGZM {f|em|hzGR |gzo hncndfhfcr r`|mvd` r`f feefjrguf vzf me hncndfhfcr) m{f|nrgmcni) ncb rfj`cgjnijmcr|miz# R`fzf jmcr|miz rw{gjniiw gcjivbf {migjgfz) |f~vg|fhfcrz) {|mjfzzfz) nvbgrz) rfzrz)ncb r`f muf|zgd`r ncb hmcgrm|gcd me cfrtm|o zfjv|grw n{{igncjfz# R`f JGZM jmm|bgcnrfzr`fzf njrgugrgfz tgr`gc r`f Meegjf me r`f JGM) nz tfii nz tgr` mr`f| [fnjf Jm|{z lvzgcfzzvcgrz# R`f Meegjf me r`f JGM {|mugbfz fcrf|{|gzf tgbf ifnbf|z`g{ em| r`f dimlni bfiguf|wme gcem|hnrgmc ncb GR zf|ugjfz rm hffr r`f cffbz me r`f ndfcjw# R`f MJGM GR zf|ugjfz

{m|remigm n|f bfzgdcfb rm {|mugbf r`f ndfcjw jmh{frgrguf univf ncb hncndfhfcrmuf|zgd`r me gcem|hnrgmc ncb GR zf|ugjfz) gcjivbgcd1• Fcrf|{|gzf Lvzgcfzz Zf|ugjfz ncb N{{igjnrgmc Zwzrfhz Bfufim{hfcr• Jvzrmhf| Zv{{m|r Zf|ugjfz• GR M{f|nrgmcz ncb Gce|nzr|vjrv|f zv{{m|r• Nbhgcgzr|nrgmc % M{f|nrgmcz zv{{m|r• GR [inccgcd ncb Zr|nrfdw Zf|ugjfz (Fcrf|{|gzf N|j`grfjrv|f) Zrncbn|bz ncb

[|njrgjfz'

Page 4: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 4/23

2

\E[1 [J >> \ ;;6 • Gcem|hnrgmc Zfjv|grw Zf|ugjfz

:# ZJM[F ME TM\O1R`f J`gfe Gcem|hnrgmc Zfjv|grw Meegjf| (JGZM' `nz n cffb em| Gcem|hnrgmc nzzv|ncjf

Nzzfzzhfcr ncb Zwzrfhz Rfzrgcd ncb Funivnrgmc rm gcjivbf Jf|rgegjnrgmc ncbNjj|fbgrnrgmc zv{{m|r zf|ugjfz (J%N' em| nii [fnjf Jm|{z Zwzrfhz) N{{igjnrgmcz)Bnrnlnzfz) Gcrf| jmccfjrgmcz) ncb Cfrtm|o jmh{mcfcrz) hmbvifz# R`f zjm{f me r`gz rnzo gz rfzrgcd ncb funivnrgcd me nii r`f hnam| zwzrfh jmh{mcfcrz ncb lmvcbn|gfz nz gbfcrgegfbgc [fnjf Jm|{z Zwzrfhz gcufcrm|w# R`f Jmcr|njrm| tgii jmcbvjr r`f rfzrgcd gc njjm|bncjftgr` CGZR 0;; 6:N jmcr|miz (rfj`cgjni) m{f|nrgmcni ncb hncndf|gni' em| n hmbf|nrf ifufizwzrfh#

R`f [fnjf Jm|{z GR fcug|mchfcr vcbf| zjm{f em| rfzrgcd gz jmh{mzfb me hvirg{ifjmccfjrfb Zrncb Nimcf ncb Z`n|fb Zwzrfh jmh{mcfcrz) cfrtm|o jmh{mcfcrz) bnrnlnzfgczrncjfz vzgcd M|njif) Z^I ncb Njjfzz nz r`f bnrnlnzf n{{igjnrgmc) nj|mzz zfuf|ni

Hgj|mzmer Tgcbmtz lnzfb m{f|nrgcd zwzrfhz) VCGP ncb Igcvp lnzfb {inrem|hz r`nr `nzVzf| gcrf|enjfz ugn r`f gcrf|cfr) gcr|ncfr ncb bg|fjr cfrtm|o njjfzz r`|mvd`mvr r`f tm|ib#R`f zf|ugjfz vcbf| r`gz fcdndfhfcr z`nii lf nz emiimtz1

Jf|rgegjnrgmc ncb Njj|fbgrnrgmc \fugft Zv{{m|r• Zwzrfh Zfjv|grw [inc (ZZ['• \gzo Nzzfzzhfcr (\N'• Jmcrgcdfcjw [inc (J['• Zfjv|grw Nzzfzzhfcr Rfzr [inc (ZNR['• Fpgzrgcd [inc me Njrgmc ncb Hgifzrmcfz ([MN%H'

Uvicf|nlgigrw ncb Zfjv|grw Nzzfzzhfcrz• [`wzgjni ncb Gcem|hnrgmc Zfjv|grw Nzzfzzhfcrz• Zwzrfhz Rfzr nc funivnrgmc• Zmertn|f Uvicf|nlgigrw Rfzrgcd• [fcfr|nrgmc Rfzrgcd ‚ (Zwzrfhz) N{{igjnrgmcz) Bnrn ncb Umgjf Cfrtm|o '• Jf|rgegjnrgmc ncb Njj|fbgrnrgmc• Jmh{igncjf ncb Zfjv|grw Nvbgrz• Jvzrmh ncb-m| r`g|b {n|rw N{{igjnrgmc rfzrgcd) gcjivbgcd tfl lnzfb n{{igjnrgmcz

Fcrf|{|gzf Gcem|hnrgmc Nzzv|ncjf (GN' Zmivrgmcz ncb Zf|ugjfz• J|mzz Bmhngc Gcem|hnrgmc Z`n|gcd• [f|ghfrf| Bfefczf• [vligj Ofw Gce|nzr|vjrv|f ([OG'• Zfjv|grw N|j`grfjrv|ni Fcdgcff|gcd ncb Zwzrfhz Gcrfd|nrgmc• Gcem|hnrgmc Nzzv|ncjf R|ngcgcd

Hmcgrm|gcd ncb R|neegj Ncniwzgz• Zfjv|f Umgjf-Ugbfm-Bnrn Jmhhvcgjnrgmcz• Fcb{mgcr ncb Cfrtm|o Hmcgrm|gcd

Page 5: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 5/23

6

\E[1 [J >> \ ;;6 • Bnrn [|mrfjrgmc ncb Fcj|w{rgmc• \fni rghf Cfrtm|o R|neegj Gcrfiigdfcjf• zfjv|grw hmcgrm|gcd) GBZ ncb gcjgbfcr |fz{mczf {inccgcd zv{{m|r• Zfjv|grw hmcgrm|gcd nzzfzzhfcr) jmczmigbnrgmc ncb gh{ifhfcrnrgmc zv{{m|r• Gcr|vzgmc Bfrfjrgmc Zwzrfh (GBZ' n|j`grfjrv|f bfzgdc ncb gh{ifhfcrnrgmc

Gcem|hnrgmc Zf|ugjfz• J|w{rmd|n{`gj Zmivrgmcz• Uvicf|nlgigrw Fp{imgrnrgmc• Jmh{vrf| Cfrtm|o Bfefczf (JCB'-Jmh{vrf| Cfrtm|o M{f|nrgmcz (JCM'• M{fc Zmv|jf Fp{imgrnrgmc

Gcem|hnrgmc M{f|nrgmcz (GM'• Bwcnhgj Bfefczf• \fuf|zf Fcdgcff|gcd•

GM Rmmiz ncb Fp{imgrz• R|nbfj|ner

R`f [fnjf Jm|{z Jmcr|njrgcd Meegjf| Rfj`cgjni \f{|fzfcrnrguf (JMR\' m| bfzgdcnrfb|f{|fzfcrnrguf z`nii mlzf|uf nii rfzrgcd# R`f |fz{mczglgigrw me r`f JMR\ z`nii gcjivbf lvrcmr ighgrfb rm jmm|bgcnrgcd rfzrgcd) rfzrgcd zj`fbvifz) ncb |f{m|rgcd rm r`f MJGM r`f{|md|fzz me r`f rfzrgcd# R`f [fnjf Jm|{z tgii fczv|f r`nr r`f |vifz nd|ffb rm tgii niimt em|n hfncgcdevi rfzr# Jmcbgrgmcz em| {nzz tgii lf bfrf|hgcfb em| fnj` rfzrgcd fcdndfhfcr lwr`f JMR\ em| nii me r`f rfj`cgjni) hncndf|gni ncb m{f|nrgmcni jmcr|miz igzrfb gc r`f CGZR0;; 6: j|grf|gn em| n Hmbf|nrf ifufi zwzrfh#

:#n# \F^VG\FHFCRZ1 Bmjvhfcr \fugftR`f jmcr|njrm| z`nii |fugft nii Zwzrfhz) N{{igjnrgmcz) ncb Bnrnlnzfz) Cfrtm|o jmh{mcfcrz) gcrf| jmccfjrgmc ncb J%N {njondfz em| fnj` n{{igjnlif CGZR 0;; 6:jmcr|mi vcbf| fnj` fcdndfhfcr# R`f |fugft z`nii lf gc r`f em|h me n j`fjoigzr m|z{|fnbz`ffr#

Rfj`cgjni RfzrgcdHgcghvh fifhfcrz rm lf bg|fjriw rfzrfb n|f lvr cmr ighgrfb rm1

># \fzgzrncjf me r`f Hnam| n{{igjnrgmc) bnrnlnzf) cfrtm|o m| zwzrfh rm jmh{|mhgzflw {f|zmcz tgr`gc r`f cfrtm|o

<#

\fzgzrncjf me r`f Hnam| n{{igjnrgmc) bnrnlnzf) cfrtm|o m| zwzrfh rm jmh{|mhgzflw {f|zmcz mvrzgbf r`f cfrtm|o vzgcd tfl lnzfb njjfzz) zrncbn|b ncb cmczrncbn|b |fhmrf njjfzz rmmiz) zj|g{rz ncb U[C

:# Gh{ifhfcrnrgmc me jv||fcr {nrj`fz mc {inrem|hz ncb em| n{{igjnrgmc gz v{ rm bnrf2# Vcgem|h jmcegdv|nrgmc me zwzrfh n|j`grfjrv|f lnzfb mc jv||fcr J`ncdf

Hncndfhfcr {|md|nh ncb zfnr hncndfhfcr jmcr|njr6# Rfzr ncb Uvicf|nlgigrw Nzzfzzhfcr (UN' me r`f gce|nzr|vjrv|f n|j`grfjrv|f em| r`f

zv{{m|rgcd1

Page 6: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 6/23

5

\E[1 [J >> \ ;;6 m Zf|uf| ncb Cfrtm|o jmcegdv|nrgmcm Tm|ozrnrgmc jmcegdv|nrgmcm M{f|nrgcd zwzrfhz jmcegdv|nrgmcm M{f|nrgmcni ncb hncndf|gni lvzgcfzz [|mjfzzfz ncb jmcr|mizm Hn{ rn|dfr cfrtm|o rm gbfcrgew njrguf `mzrz#m [f|em|h nvrmhnrfb uvicf|nlgigrw zjnccgcd rn|dfrgcd njrguf `mzrz#m Hncvniiw bf jmceigjr enizf {mzgrgufz gbfcrgegfb lw r`f nvrmhnrfb

uvicf|nlgigrw zjnccgcd rmmiz#m [|gm|grgqf gbfcrgegfb uvicf|nlgigrgfz lw fnzf me fp{imgrnrgmc#m [|gm|grgqf |fhfbgnrgmc feem|rz lnzfb mc uvicf|nlgigrw zfuf|grw ncb gh{njr

5# Rfzr r`f zfjv|grw n|j`grfjrv|f em| r`f zv{{m|rgcd 1m \mvrf| Njjfzz Jmcr|mi Igzr (NJI'm [f|ghfrf| eg|ftnii jmcegdv|nrgmc ({m|rz) {|mrmjmiz ncb zf|ugjfz' ncb imdzm Gcr|vzgmc Bfrfjrgmcz Zwzrfhz (g#f# GBZ em| lmr` @mzr ncb Cfrtm|o' fufcr

imdz

4# Nlgigrw me r`f tfl lnzfb n{{igjnrgmc rm |fzgzr nrrnjoz e|mh1m Lveef| muf|eimtz)m Zr|vjrv|fb ^vf|w Incdvndf (Z^I' gcafjrgmcm J|mzz zgrf zj|g{rgcdm Jmmogf {mgzmcgcd

0# Jmcr|njrm| z`nii jmcbvjr gcrf|ugftz tgr` {f|zmccfi tgr` rfj`cgjni) evcjrgmc ncbm{f|nrgmcni |mifz#

m R`f m{f|nrgmcni gcjgbfcr `ncbigcd jn{nlgigrw r`nr gcjivbfz nbf~vnrf{|f{n|nrgmc) bfrfjrgmc) ncniwzgz) jmcrngchfcr) |fjmuf|w) ncb vzf|‗z|fz{mczf njrgugrgfz#

m R`f {|fzfcjf me Bmhfzrgj-FHN ncb Ne|gjn DZZ {inrem|hz# m{f|nrgmcni

zv{{m|r {|mjfbv|fz ncb {|mrmjmiz lmr` nr [mzr ncb @fnb~vn|rf|z#m R`f hngcrfcncjf me lnzfigcf jmcegdv|nrgmc ncb gcufcrm|w me m|dncgqnrgmcniGR |fzmv|jfz#

7# Ighgrfb jmbf |fugft z{fjgegj [fnjf Jm|{z bfufim{fb n{{igjnrgmcz

Jmcr|njrm| z`nii bgzjvzz {mzzglif enizf {mzgrgufz tgr` r`f [fnjf Jm|{z tgr`gc n {f|gmb me cm hm|f r`nc rfc (>;' lvzgcfzz bnwz# Jmcr|njrm| z`nii hnof n |fnzmcnlif feem|r rmfighgcnrf enizf {mzgrgufz# Mcjf enizf {mzgrgufz n|f fighgcnrfb) jmcr|njr z`nii {|mugbf1

• Nc fp{incnrgmc me egcbgcdz r`nr bfrngiz r`f hfr`mbmimdw vzfb gcrf|{|frnrgmc me r`f|nt bnrn ncb ncniwzgz me ncw r|fcbz) tfnocfzz) m| zwzrfhgj {|mlifhz#

• N |fjmhhfcbnrgmc em| gh{|mufhfcr me r`f hncndfhfcr m| m{f|nrgmc me r`f

zwzrfh rm fighgcnrf rfj`cgjni uvicf|nlgigrgfz#• N bfrngifb) {|gm|grgqfb) igzr m| rnlif me z{fjgegj uvicf|nlgigrgfz ncb

|fjmhhfcbnrgmcz em| fighgcnrgcd fnj` mcf#• N{{fcbgjfz m| nrrnj`hfcrz tgr` |nt bnrn m| mr`f| |fifuncr gcem|hnrgmc#

:#l# BFIGUF\NLIFZR`f jmcr|njrm| z`nii {|mugbf1

># \vifz me Fcdndfhfcr em| nii fcdndfhfcrz

Page 7: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 7/23

4

\E[1 [J >> \ ;;6 <# Zj`fbvif nc Fcr|w % Fpgr jmcef|fcjf tgr` JGZM ncb gcrf|cni Jvzrmhf|:# [|mugbf n bfrngifb {|mafjr {inc me fcdndfhfcr2# N b|ner |f{m|r (JB ncb `n|bjm{w' tgr`gc rfc (>;' lvzgcfzz bnwz nerf| rfzr# R`f

|f{m|r z`mvib gcjivbf nc fpfjvrguf zvhhn|w gc n {mtf| {mgcr {|fzfcrnrgmc em|hnr)

n bfrngifb rfzrgcd |f{m|r ncb n bfrngifb igzr me rfzr egcbgcdz tgr` |fjmhhfcbnrgmczrm hgrgdnrf m| |fzmiuf rm r`f Ndfcjw# [fnjf Jm|{z tgii |fugft r`f b|ner |f{m|rtgr`gc eguf (>;' lvzgcfzz bnwz# R`f [fnjf Jm|{z tgii jmcbvjr |fhfbgnrgmc ncb{|mugbf gc{vr rm |fzmiuf ncw egcbgcdz# Em| ncw vc|fzmiufb egcbgcdz) Jmcr|njrm|tgii bfufim{ n [MN%H em| fnj` egcbgcd gc r`f egcni |f{m|r#

6# Egcni |f{m|r ncb n [mtf| {mgcr Fpfjvrguf Zvhhn|w [|fzfcrnrgmc

:#j# [INJF ME [F\EM\HNCJFVcifzz mr`f|tgzf z{fjgegfb) jmcr|njrm| z`nii {f|em|h r`f rfzrgcd nr [fnjf Jm|{z`fnb~vn|rf|z) \fdgmcni |fj|vgrgcd meegjfz) [mzr ncb imjnrgmcz r`nr hnw lf bfrf|hgcfb nrr`f rghf me r`f fcdndfhfcr# Bmjvhfcr |fugft ncb t|grgcd z`nii lf bmcf nr jmcr|njrm|‗z

enjgigrw#

:#b# [F\GMB ME [F\EM\HNCJFR`f ncrgjg{nrfb {f|gmb me {f|em|hncjf em| r`gz fcdndfhfcr tgii lf n lnzf wfn| tgr` emv|m{rgmc wfn|z#

:#f# ZFJV\GRWR`f jmcr|njrm| gz |fz{mczglif em| r`f {|mrfjrgmc ncb jmcegbfcrgnigrw me nii [fnjf Jm|{zrfj`cgjni bnrn ncb egcbgcdz# R`f jmcr|njrm| z`nii fczv|f r`nr nii gcem|hnrgmc zwzrfhzvcbf| grz {v|ugft n|f {|mrfjrfb gc n hnccf| r`nr gz jmczgzrfcr tgr` ifufiz em| Zfczgrguf lvrvcjinzzgegfb gcem|hnrgmc nr nii rghfz# R`f jmcr|njrm| z`nii {|mrfjr r`f gcem|hnrgmc ncb

gcem|hnrgmc rfj`cmimdw |fzmv|jfz me r`f [fnjf Jm|{z nz {|m{|gfrn|w rm r`f [fnjf Jm|{z#Bnrn Zfjv|grw \f~vg|fhfcrz[fnjf Jm|{z gcem|hnrgmc zwzrfhz jmcrngc zfczgrguf gcem|hnrgmc) nz bfegcfb gc r`f Jwlf|Zfjv|grw Njr me >704 ([I >;; <:6') ncb jmcrngc {f|zmcni gcem|hnrgmc zvlafjr rm r`f[|gunjw Njr me >742 ([I 7: 647 ncb nhfcbhfcrz'# Gr tgii lf r`f Jmcr|njrm|$z|fz{mczglgigrw rm enhgign|gqf ncb l|gfe fh{imwffz ncb zvljmcr|njrm|z mc r`f {|mugzgmcz me r`f [|gunjw Njr# EN\ jinvzfz) 6<#<<2 >1 ,[|gunjw Njr Cmrgegjnrgmc, ncb 6<#<<2 <1,[|gunjw Njr,) n|f `f|flw gcjm|{m|nrfb lw |fef|fcjf#R`f jmcegbfcrgnigrw ncb bgzjimzv|f {|mugzgmcz me Rgrif UGG me r`f Jgugi \gd`rz Njr me >752ncb Rgrif G me r`f Nhf|gjnc tgr` Bgznlgigrgfz Njr {|m`glgr bgzjimzv|f me ncw j`n|df m|

j`n|df |finrfb gcem|hnrgmc# R`f jmcr|njrm| z`nii nd|ff r`nr zvj` gcem|hnrgmc tgii cmr lfbgzjimzfb ncb tgii mciw lf vzfb em| r`f {f|em|hncjf me r`fg| |fz{mczglgigrgfz vcbf| r`gzrnzo m|bf|#

[f|zmccfi Zfjv|grw \f~vg|fhfcrz Nii Jmcr|njrm| {f|zmccfi nzzgdcfb rm r`fzf rnzoz z`nii lf nlif rm |fnb) t|grf) z{fno) ncbvcbf|zrncb Fcdigz`#

• Nii Jmcr|njrm| {f|zmccfi njjfzzgcd r`f [fnjf Jm|{z @^ Bnrn Jfcrf|) t`f|f r`f

Page 8: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 8/23

0

\E[1 [J >> \ ;;6 hnam|grw me r`f INC-TNC f~vg{hfcr ncb cfrtm|o zf|uf| n|f `mvzfb) z`nii lfV#Z# jgrgqfcz#

• Nii Jmcr|njrm| {f|zmccfi t`m tgii lf tm|ogcd mczgrf ncb jf|rngc meezgrf {f|zmccfi)bfzgdcnrfb lw r`f JM) z`nii jmh{ifrf fgr`f| n Ighgrfb Lnjod|mvcb Gcufzrgdnrgmc

(ILG' m| Njjfzz Cnrgmcni Ndfcjw J`fjo tgr` Gc~vg|w (NCNJG'#• [fnjf Jm|{z |f{|fzfcrnrgufz z`nii `nuf r`f m{rgmc rm unigbnrf nii jifn|ncjf ifufiz

ncb nvr`m|grgfz#

R`f jmcr|njrm| z`nii {|f{n|f n \vifz me Fcdndfhfcr (\MF' bmjvhfcr r`nr gcjivbfz r`frw{fz me rfzrgcd) ighgrnrgmcz) nbb|fzz |ncdfz ({|mugbfb lw r`f [fnjf Jm|{z') ifdniignlgigrgfz) {mgcrz me jmcrnjr) ncb mr`f| gh{m|rncr nz{fjrz# R`f jmcr|njrm| z`nii jmh{ifrfr`f rfzrgcd tgr`gc r`f {f|em|hncjf {f|gmb bfrf|hgcfb lw r`f jmcr|njrgcd |f{|fzfcrnrguf><; lvzgcfzz bnwz zrn|rgcd Hnw > zr) <;>># R`f rfzr z`nii cmr zrn|r vcrgi r`f jmcr|njrm| `nzlffc dgufc nc nvr`m|gqnrgmc rm rfzr r`f zwzrfh r`|mvd` zgdcfb \vifz me Fcdndfhfcr# R`f\MF tgii lf |fugftfb lw [fnjf Jm|{z zrnee tgr`gc rtm (<' lvzgcfzz bnwz ncb rfzrgcd z`nii

cmr lfdgc vcrgi nr ifnzr <2 `mv|z nerf| r`f \MF `nuf lffc nd|ffb rm ncb zgdcfb lw r`f[fnjf Jm|{z#

R`f jmcr|njrm| z`nii {|mugbf `n|btn|f ncb zmertn|f cfjfzzn|w rm {f|em|h r`f rfzrgcd ncbjmh{ighfcrfb lw ncw [fnjf Jm|{z zmertn|f ncb @n|btn|f r`nr hnw lf |fjmhhfcbfb ncbzv{{igfb r`nr gz v{ rm bnrf ncb jmh{n|nlif rm r`f [fnjf Jm|{z zfjv|grw n|j`grfjrv|f(jv||fcr ncrg ug|vz zgdcnrv|fz) zmertn|f {nrj`fz) jmcegdv|nrgmc {n|nhfrf|z) frj#'# [|m{mzfbjmcr|njrm| f~vg{hfcr zvj` nz in{rm{z tgr` zmertn|f rmmiz zvj` nz Jfcrf| em| Gcrf|cfrZfjv|grw zj|g{rz) Cfzzvz) ncb N{{ Bfrfjrguf ncb ncw rmmiz rm lf vzfb z`nii lf ufrrfb lwr`f JGZM meegjfz {|gm| rm jmccfjrgmc rm r`f [fnjf Jm|{z cfrtm|o# [fnjf Jm|{z‗ in{rm{)njjmvcrz ncb jmccfjrgugrw tgii lf {|mugbfb nz cffbfb ncb tgr`gc r`f zjm{f me jv||fcr

zfjv|grw {migjw z{fjgegj rm [fnjf Jm|{z#

Rm |fbvjf gh{njr rm r`f ndfcjw‗z bngiw m{f|nrgmcz) zmhf rfzrgcd hnw cffb rm lfjmcbvjrfb tgr` |fhmrf njjfzz ugn U[C) nr tffofcbz ncb cgd`rz ge |f~vg|fb# [|gm| rm r`fzrn|r me r`gz {|mafjr) jmcr|njrm| zrnee hvzr {nzz n Zfjv|grw lnjod|mvcb j`fjo lfem|fzrn|rgcd tm|o mc zgrf# Jmcr|njrm| z`nii jmm|bgcnrf r`f [fnjf Jm|{z rm fczv|f jmh{ifrgmcme cfjfzzn|w zfjv|grw {n{f|tm|o em| grz {f|zmccfi#

ZFJRGMC UG ‚ EG\ZR RNZO M\BF\ ZRNRFHFCR ME TM\O># ZJM[F ME TM\O Bnrnlnzf Me Umivcrff| Fp{f|gfcjf DZZ J%N Zwzrfhz

Rfzr ncb Funivnrgmc Zf|ugjfz

R`f JGZM `nz n cffb em| Gce|nzr|vjrv|f Nzzfzzhfcr ncb Zwzrfhz Rfzr ncb Funivnrgmc em|Jf|rgegjnrgmc ncb Njj|fbgrnrgmc zf|ugjfz (J%N' em| Bnrnlnzf me Umivcrff| Fp{f|gfcjf(BMUF' DZZ [inrem|h rm gcjivbf r`f Umivcrff| Fifjr|mcgj @fnir` Zwzrfh (UF@Z'# R`fzjm{f me r`gz rnzo gz rfzrgcd ncb funivnrgcd me r`f hnam| zwzrfhz ncb jmh{mcfcrz jniifbr`f Bnrnlnzf me Umivcrff| Fp{f|gfcjf (BMUF' DZZ# R`gz tgii lf r`f eg|zr [`nzf me rfzrgcd lnzfb mc r`f gcgrgni n{{igjnrgmc ncb zwzrfhz bfiguf|w# R`f hngc jmh{mcfcrz rm lfrfzrfb ncb |fugftfb tgii gcjivbf nii zwzrfhz) n{{igjnrgmcz) bnrnlnzfz) cfrtm|o gcrf|enjfz)r|ncznjrgmcz ncb jmh{mcfcrz me r`f [fnjf Jm|{z Ofcfpn n{{igjnrgmc {inrem|h ncb r`f

Page 9: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 9/23

7

\E[1 [J >> \ ;;6 UF@Z Hfbgjni {inrem|h# R`f Jmcr|njrm| tgii jmcbvjr r`f rfzrgcd gc njjm|bncjf tgr`CGZR 0;; 6:N jmcr|miz (rfj`cgjni) m{f|nrgmcni ncb hncndf|gni' em| n hmbf|nrf ifufizwzrfh#

R`f Bnrnlnzf Me Umivcrff| Fp{f|gfcjf (BMUF' DZZ rm lf rfzrfb gz jmh{mzfb me hvirg{if jmccfjrfb Zrncb Nimcf ncb Z`n|fb Zwzrfh jmh{mcfcrz) cfrtm|o jmh{mcfcrz)bnrnlnzf gczrncjfz vzgcd hvirg{if bnrnlnzf n{{igjnrgmcz) nj|mzz zfuf|ni m{f|nrgcd zwzrfhz)r`nr `nz Vzf| gcrf|enjfz ugn r`f gcrf|cfr) gcr|ncfr ncb bg|fjr cfrtm|o njjfzz r`|mvd`mvr r`ftm|ib# Nii Jmh{mcfcrz ncb gcrf| jmccfjrgmcz me Bnrnlnzf me Umivcrff| Fp{f|gfcjf(BMUF' DZZ tgii gc zjm{f em| rfzrgcd#

Rfzrgcd tgii lf jmcbvjrfb nr [fnjf Jm|{z @fnb~vn|rf|z) [mzr imjnrgmcz ncb \fdgmcni\fj|vgrgcd Meegjfz# Rm |fbvjf gh{njr rm r`f ndfcjw‗z bngiw m{f|nrgmcz) zmhf rfzrgcd hnwcffb rm lf jmcbvjrfb tgr` |fhmrf njjfzz ugn U[C) nr tffofcbz ncb cgd`rz ge |f~vg|fb#[|gm| rm r`f zrn|r me r`gz {|mafjr) jmcr|njrm| zrnee hvzr {nzz n Zfjv|grw lnjod|mvcb j`fjo

lfem|f zrn|rgcd tm|o mc zgrf# Jmcr|njrm| z`nii jmm|bgcnrf r`f [fnjf Jm|{z rm fczv|fjmh{ifrgmc me cfjfzzn|w zfjv|grw {n{f|tm|o em| grz {f|zmccfi#

R`f jmcr|njrm| z`nii {|f{n|f n \vifz me Fcdndfhfcr (\MF' bmjvhfcr r`nr gcjivbfz r`frw{fz me rfzrgcd) ighgrnrgmcz) nbb|fzz |ncdfz ({|mugbfb lw r`f [fnjf Jm|{z') ifdniignlgigrgfz) {mgcrz me jmcrnjr) ncb mr`f| gh{m|rncr nz{fjrz# R`f rfzr z`nii cmr zrn|r vcrgi r`fjmcr|njrm| `nz lffc dgufc nc nvr`m|gqnrgmc rm rfzr r`f zwzrfh r`|mvd` zgdcfb \vifz me Fcdndfhfcr# R`f \MF tgii lf |fugftfb lw [fnjf Jm|{z zrnee tgr`gc rtm (<' lvzgcfzzbnwz ncb rfzrgcd z`nii cmr lfdgc vcrgi nr ifnzr <2 `mv|z nerf| r`f \MF `nuf lffc nd|ffb rmncb zgdcfb lw r`f [fnjf Jm|{z#

R`f jmcr|njrm| z`nii {|mugbf `n|btn|f ncb zmertn|f cfjfzzn|w rm {f|em|h r`f rfzrgcd ncbjmh{ighfcrfb lw ncw [fnjf Jm|{z zmertn|f ncb @n|btn|f r`nr hnw lf |fjmhhfcbfb ncbzv{{igfb r`nr gz v{ rm bnrf ncb jmh{n|nlif rm r`f [fnjf Jm|{z zfjv|grw n|j`grfjrv|f(jv||fcr ncrg ug|vz zgdcnrv|fz) zmertn|f {nrj`fz) jmcegdv|nrgmc {n|nhfrf|z) frj#'# [|m{mzfbjmcr|njrm| f~vg{hfcr zvj` nz in{rm{z tgr` zmertn|f rmmiz zvj` nz Jfcrf| em| Gcrf|cfrZfjv|grw zj|g{rz) Cfzzvz) ncb N{{ Bfrfjrguf ncb ncw rmmiz rm lf vzfb z`nii lf ufrrfb lwr`f JGZM meegjfz {|gm| rm jmccfjrgmc rm r`f [fnjf Jm|{z cfrtm|o# [fnjf Jm|{z‗ in{rm{)njjmvcrz ncb jmccfjrgugrw tgii lf {|mugbfb nz cffbfb ncb tgr`gc r`f zjm{f me jv||fcrzfjv|grw {migjw z{fjgegj rm [fnjf Jm|{z#

R`f [fnjf Jm|{z Jmcr|njrgcd Meegjf| Rfj`cgjni \f{|fzfcrnrguf (JMR\' m| bfzgdcnrfb

|f{|fzfcrnrguf z`nii mlzf|uf nii rfzrgcd# R`f |fz{mczglgigrw me r`f JMR\ z`nii gcjivbf lvrcmr ighgrfb rm jmm|bgcnrgcd rfzrgcd) rfzrgcd zj`fbvifz) ncb |f{m|rgcd rm r`f MJGM r`f{|md|fzz me r`f rfzrgcd# R`f [fnjf Jm|{z tgii fczv|f r`nr r`f |vifz nd|ffb rm tgii niimt em|n hfncgcdevi rfzr# Jmcbgrgmcz em| {nzz tgii lf 6; {f|jfcr {nzzgcd me rfj`cgjni) hncndf|gnincb m{f|nrgmcni jmcr|miz igzrfb gc r`f CGZR 0;; 6: j|grf|gn em| n Hmbf|nrf ifufi zwzrfh#Ncw ifzz gz n engiv|f ncb zvlafjr rm |f rfzr#

Page 10: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 10/23

>;

\E[1 [J >> \ ;;6 >#n# \F^VG\FHFCRZ

Bmjvhfcr \fugftR`f jmcr|njrm| z`nii |fugft n J%N {njondf gcjivbgcd1

># Zwzrfh Zfjv|grw [inc (ZZ['

<# \gzo Nzzfzzhfcr (\N':# Jmcrgcdfcjw [inc (J['2# Zfjv|grw Nzzfzzhfcr Rfzr [inc (ZNR['6# Fpgzrgcd [inc me Njrgmc ncb Hgifzrmcfz ([MN%H'

Em| fnj` n{{igjnlif CGZR 0;; 6: jmcr|mi) r`f jmcr|njrm| z`nii gbfcrgew t`fr`f| r`f|f~vg|fhfcr1

• @nz lffc eviiw hfr• @nz lffc {n|rgniiw hfr• @nz cmr lffc hfr• @nz cmr lffc hfr lvr gz {inccfb• Gz cmr n{{igjnlif lfjnvzf r`f |f~vg|fhfcr n{{igfz rm r`f DZZ• Gz cmr n{{igjnlif lfjnvzf r`f |f~vg|fhfcr n{{igfz rm mr`f| {n|rz me MJGM (f#d#)

JGZM'• Gz cmr n{{igjnlif lfjnvzf r`f |f~vg|fhfcr n{{igfz rm mr`f| m|dncgqnrgmcz (f#d#) @\)

Z%Z'

R`f |fugft z`nii lf gc r`f em|h me n j`fjoigzr m| z{|fnbz`ffr#

Rfj`cgjni RfzrgcdHgcghvh fifhfcrz rm lf bg|fjriw rfzrfb n|f lvr cmr ighgrfb rm1

5# \fzgzrncjf me r`f Hnam| n{{igjnrgmc m| zwzrfh rm jmh{|mhgzf lw {f|zmcz tgr`gcr`f cfrtm|o

4# \fzgzrncjf me r`f Hnam| n{{igjnrgmc m| zwzrfh rm jmh{|mhgzf lw {f|zmcz mvrzgbfr`f cfrtm|o vzgcd tfl lnzfb njjfzz) zrncbn|b ncb cmc zrncbn|b |fhmrf njjfzzrmmiz) zj|g{rz ncb U[C

0# Gh{ifhfcrnrgmc me jv||fcr {nrj`fz mc {inrem|hz ncb em| n{{igjnrgmc gz v{ rm bnrf7# Vcgem|h jmcegdv|nrgmc me zwzrfh n|j`grfjrv|f lnzfb mc jv||fcr J`ncdf

Hncndfhfcr {|md|nh ncb zfnr hncndfhfcr jmcr|njr>;# Rfzr ncb Uvicf|nlgigrw Nzzfzzhfcr (UN' me r`f gce|nzr|vjrv|f n|j`grfjrv|f em| r`f

zv{{m|rgcd1m Zf|uf| ncb Cfrtm|o jmcegdv|nrgmcm Tm|ozrnrgmc jmcegdv|nrgmcm M{f|nrgcd zwzrfhz jmcegdv|nrgmcm M{f|nrgmcni ncb hncndf|gni lvzgcfzz [|mjfzzfz ncb jmcr|mizm Hn{ rn|dfr cfrtm|o rm gbfcrgew njrguf `mzrz#m [f|em|h nvrmhnrfb uvicf|nlgigrw zjnccgcd rn|dfrgcd njrguf `mzrz#m Hncvniiw bf jmceigjr enizf {mzgrgufz gbfcrgegfb lw r`f nvrmhnrfb

uvicf|nlgigrw zjnccgcd rmmiz#m [|gm|grgqf gbfcrgegfb uvicf|nlgigrgfz lw fnzf me fp{imgrnrgmc#m [|gm|grgqf |fhfbgnrgmc feem|rz lnzfb mc uvicf|nlgigrw zfuf|grw ncb gh{njr

5# Rfzr r`f zfjv|grw n|j`grfjrv|f em| r`f zv{{m|rgcd 1

Page 11: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 11/23

>>

\E[1 [J >> \ ;;6 m \mvrf| Njjfzz Jmcr|mi Igzr (NJI'm [f|ghfrf| eg|ftnii jmcegdv|nrgmc ({m|rz) {|mrmjmiz ncb zf|ugjfz' ncb imdzm Gcr|vzgmc Bfrfjrgmcz Zwzrfhz (g#f# GBZ em| lmr` @mzr ncb Cfrtm|o' fufcr

imdz

4# Nlgigrw me r`f tfl lnzfb n{{igjnrgmc rm |fzgzr nrrnjoz e|mh1m Lveef| muf|eimtz)m Zr|vjrv|fb ^vf|w Incdvndf (Z^I' gcafjrgmcm J|mzz zgrf zj|g{rgcdm Jmmogf {mgzmcgcd

0# Jmcr|njrm| z`nii jmcbvjr gcrf|ugftz tgr` {f|zmccfi tgr` rfj`cgjni) evcjrgmc ncbm{f|nrgmcni |mifz#

m R`f m{f|nrgmcni gcjgbfcr `ncbigcd jn{nlgigrw r`nr gcjivbfz nbf~vnrf{|f{n|nrgmc) bfrfjrgmc) ncniwzgz) jmcrngchfcr) |fjmuf|w) ncb vzf|‗z|fz{mczf njrgugrgfz#

m R`f {|fzfcjf me Bmhfzrgj-FHN ncb Ne|gjn DZZ {inrem|hz# m{f|nrgmcni

zv{{m|r {|mjfbv|fz ncb {|mrmjmiz lmr` nr [mzr ncb @fnb~vn|rf|z#m R`f hngcrfcncjf me lnzfigcf jmcegdv|nrgmc ncb gcufcrm|w me m|dncgqnrgmcniGR |fzmv|jfz#

7# Ighgrfb jmbf |fugft z{fjgegj [fnjf Jm|{z bfufim{fb n{{igjnrgmcz

Jmcr|njrm| z`nii bgzjvzz {mzzglif enizf {mzgrgufz tgr` r`f [fnjf Jm|{z tgr`gc n {f|gmb me cm hm|f r`nc rfc (>;' lvzgcfzz bnwz# Jmcr|njrm| z`nii hnof n |fnzmcnlif feem|r rmfighgcnrf enizf {mzgrgufz# Mcjf enizf {mzgrgufz n|f fighgcnrfb) jmcr|njr z`nii {|mugbf1

• Nc fp{incnrgmc me egcbgcdz r`nr bfrngiz r`f hfr`mbmimdw vzfb gcrf|{|frnrgmc me r`f|nt bnrn ncb ncniwzgz me ncw r|fcbz) tfnocfzz) m| zwzrfhgj {|mlifhz#

• N |fjmhhfcbnrgmc em| gh{|mufhfcr me r`f hncndfhfcr m| m{f|nrgmc me r`f

zwzrfh rm fighgcnrf rfj`cgjni uvicf|nlgigrgfz#• N bfrngifb) {|gm|grgqfb) igzr m| rnlif me z{fjgegj uvicf|nlgigrgfz ncb

|fjmhhfcbnrgmcz em| fighgcnrgcd fnj` mcf#• N{{fcbgjfz m| nrrnj`hfcrz tgr` |nt bnrn m| mr`f| |fifuncr gcem|hnrgmc#

>#l# BFIGUF\NLIFZR`f jmcr|njrm| z`nii jmh{ifrf r`f rfzr ncb {|mugbf1

5# \vifz me Fcdndfhfcr4# Zj`fbvif nc Fcr|w % Fpgr jmcef|fcjf tgr` JGZM ncb gcrf|cni Jvzrmhf|0# [|mugbf n bfrngifb {|mafjr {inc me fcdndfhfcr7# N b|ner |f{m|r (JB ncb `n|bjm{w' tgr`gc rfc (>;' lvzgcfzz bnwz nerf| rfzr# R`f

|f{m|r z`mvib gcjivbf nc fpfjvrguf zvhhn|w gc n {mtf| {mgcr {|fzfcrnrgmc em|hnr)n bfrngifb rfzrgcd |f{m|r ncb n bfrngifb igzr me rfzr egcbgcdz tgr` |fjmhhfcbnrgmczrm hgrgdnrf m| |fzmiuf rm r`f Ndfcjw# [fnjf Jm|{z tgii |fugft r`f b|ner |f{m|rtgr`gc eguf (>;' lvzgcfzz bnwz# R`f [fnjf Jm|{z tgii jmcbvjr |fhfbgnrgmc ncb{|mugbf gc{vr rm |fzmiuf ncw egcbgcdz# Em| ncw vc|fzmiufb egcbgcdz) Jmcr|njrm|tgii bfufim{ n [MN%H em| fnj` egcbgcd gc r`f egcni |f{m|r#

>;# Egcni |f{m|r ncb n [mtf| {mgcr Fpfjvrguf Zvhhn|w [|fzfcrnrgmc

Page 12: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 12/23

><

\E[1 [J >> \ ;;6

>#j# [INJF ME [F\EM\HNCJFVcifzz mr`f|tgzf z{fjgegfb) jmcr|njrm| z`nii {f|em|h r`f rfzrgcd nr [fnjf Jm|{z`fnb~vn|rf|z ncb imjnrgmcz tgr`gc r̀ f zjm{f me r`gz ZMT# Bmjvhfcr |fugft ncb t|grgcd

z`nii lf bmcf nr jmcr|njrm|‗z enjgigrw#

>#b# [F\GMB ME [F\EM\HNCJFR`f ncrgjg{nrfb {f|gmb me {f|em|hncjf em| r`gz fcdndfhfcr tgii jmczgzr me n {f|gmb cmrfpjffbgcd rtfiuf (><' jnifcbn| hmcr` zrn|rgcd e|mh r`f bnrf bfrf|hgcfb lw [fnjf Jm|{z#

>#f# ZFJV\GRWR`f jmcr|njrm| gz |fz{mczglif em| r`f {|mrfjrgmc ncb jmcegbfcrgnigrw me nii [fnjf Jm|{zrfj`cgjni bnrn ncb egcbgcdz# R`f jmcr|njrm| z`nii fczv|f r`nr nii gcem|hnrgmc zwzrfhzvcbf| grz {v|ugft n|f {|mrfjrfb gc n hnccf| r`nr gz jmczgzrfcr tgr` ifufiz em| Zfczgrguf lvrvcjinzzgegfb gcem|hnrgmc nr nii rghfz# R`f jmcr|njrm| z`nii {|mrfjr r`f gcem|hnrgmc ncb

gcem|hnrgmc rfj`cmimdw |fzmv|jfz me r`f [fnjf Jm|{z nz {|m{|gfrn|w rm r`f [fnjf Jm|{z#

Bnrn Zfjv|grw \f~vg|fhfcrz[fnjf Jm|{z gcem|hnrgmc zwzrfhz jmcrngc zfczgrguf gcem|hnrgmc) nz bfegcfb gc r`f Jwlf|Zfjv|grw Njr me >704 ([I >;; <:6') ncb jmcrngc {f|zmcni gcem|hnrgmc zvlafjr rm r`f[|gunjw Njr me >742 ([I 7: 647 ncb nhfcbhfcrz'# Gr tgii lf r`f Jmcr|njrm|$z|fz{mczglgigrw rm enhgign|gqf ncb l|gfe fh{imwffz ncb zvljmcr|njrm|z mc r`f {|mugzgmcz me r`f [|gunjw Njr# EN\ jinvzfz) 6<#<<2 >1 ,[|gunjw Njr Cmrgegjnrgmc, ncb 6<#<<2 <1,[|gunjw Njr,) n|f `f|flw gcjm|{m|nrfb lw |fef|fcjf#R`f jmcegbfcrgnigrw ncb bgzjimzv|f {|mugzgmcz me Rgrif UGG me r`f Jgugi \gd`rz Njr me >752ncb Rgrif G me r`f Nhf|gjnc tgr` Bgznlgigrgfz Njr {|m`glgr bgzjimzv|f me ncw j`n|df m|

j`n|df |finrfb gcem|hnrgmc# R`f jmcr|njrm| z`nii nd|ff r`nr zvj` gcem|hnrgmc tgii cmr lfbgzjimzfb ncb tgii mciw lf vzfb em| r`f {f|em|hncjf me r`fg| |fz{mczglgigrgfz vcbf| r`gzrnzo m|bf|#

[f|zmccfi Zfjv|grw \f~vg|fhfcrz Nii Jmcr|njrm| {f|zmccfi nzzgdcfb rm r`fzf rnzoz z`nii lf nlif rm |fnb) t|grf) z{fno) ncbvcbf|zrncb Fcdigz`#

• Nii Jmcr|njrm| {f|zmccfi njjfzzgcd r`f [fnjf Jm|{z @^ Bnrn Jfcrf|) t`f|f r`fhnam|grw me r`f INC-TNC f~vg{hfcr ncb cfrtm|o zf|uf| n|f `mvzfb) z`nii lfV#Z# jgrgqfcz#

• Nii Jmcr|njrm| {f|zmccfi t`m tgii lf tm|ogcd mczgrf ncb jf|rngc meezgrf {f|zmccfi)

bfzgdcnrfb lw r`f JM) z`nii jmh{ifrf fgr`f| n Ighgrfb Lnjod|mvcb Gcufzrgdnrgmc(ILG' m| Njjfzz Cnrgmcni Ndfcjw J`fjo tgr` Gc~vg|w (NCNJG'#• [fnjf Jm|{z |f{|fzfcrnrgufz z`nii `nuf r`f m{rgmc rm unigbnrf nii jifn|ncjf ifufiz

ncb nvr`m|grgfz#

ZFJRGMC UGG ‚ JMCR\NJR JINVZFZ

Page 13: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 13/23

>:

\E[1 [J >> \ ;;6 ># > EN\ 6<#<6< < JINVZFZ GCJM\[M\#NRFB LW \FEF\FCJF(EFL\VN\W >770' # ‚ R`gz jmcr|njr gcjm|{m|nrfz mcf m| hm|f jinvzfz lw |fef|fcjf) tgr`r`f znhf em|jf ncb feefjr nz ge r`fw tf|f dgufc gc evii rfpr# V{mc |f~vfzr) r`f Jmcr|njrgcdMeegjf| tgii hnof r`fg| evii rfpr nunginlif# Nizm) r`f evii rfpr me n jinvzf hnw lf njjfzzfb

fifjr|mcgjniiw nr r`gz nbb|fzz1 `rr{z1--ttt#nj~vgzgrgmc#dmu-en|- 6< <;< > BFEGCGRGMCZ (Avi <;;2'6< <;: 6 JMUFCNCR NDNGCZR JMCRGDFCR EFFZ (N{| >702'6<#<;: 4 NCRG OGJOLNJO [\MJFBV\FZ (Avi >776'

6<#<;2 4 JFCR\NI JMCR\NJRM\ \FDGZR\NRGMC (N{| <;;0'

6<#<;7 < [\M@GLGRGMC MC JMCR\NJRGCD TGR@ GCUF\RFB BMHFZRGJJM\[M\NRGMCZ \F[\FZFCRNRGMC (Aviw <;;7'

6<#<>5 <2 IGHGRNRGMC ME DMUF\CHFCR IGNLGIGRW (N{| >702'6<#<>5 <6 JMCR\NJR BFEGCGRGQNRGMC (Mjr >774'6<#<:< > [NWHFCRZ (N{| >702'6<#<:: < ZF\UGJF ME [\MRFZR (Zf{ <;;5'6<#<22 5 ZVLJMCR\NJRZ EM\ JMHHF\JGNI GRFHZ (Avc <;>;'6<#<>< 2 JMCR\NJR RF\HZ NCB JMCBGRGMCZ JMHHF\JGNI GRFHZ (HN\<;;7'

># < 6<#<>< 6 Jmcr|njr Rf|hz ncb Jmcbgrgmcz \f~vg|fb rm Gh{ifhfcr Zrnrvrfz m|Fpfjvrguf M|bf|z‒Jmhhf|jgni Grfhz (AVI <;>;'

(n' R`f Jmcr|njrm| z`nii jmh{iw tgr` r`f emiimtgcd Efbf|ni Nj~vgzgrgmc \fdvinrgmc(EN\' jinvzfz) t`gj` n|f gcjm|{m|nrfb gc r`gz jmcr|njr lw |fef|fcjf) rm gh{ifhfcr{|mugzgmcz me int m| Fpfjvrguf m|bf|z n{{igjnlif rm nj~vgzgrgmcz me jmhhf|jgni grfhz1

(>' 6<#<<< 6;) Jmhlnrgcd R|neegjogcd gc [f|zmcz (Efl <;;7' ( << V#Z#J# 4>;2(d''#]]]Nirf|cnrf G (Nvd <;;4' me 6<#<<< 6;(<< V#Z#J# 4>;2(d''#

(<' 6<#<:: : ) [|mrfzr Nerf| Ntn|b (N VD >775' ( :> V#Z#J# :66: '#(:' 6<#<:: 2) N{{igjnlif Int em| L|fnj` me Jmcr|njr Jingh (M JR <;;2'

([vl# I# >;0 44) >;0 40'#(l' R`f Jmcr|njrm| z`nii jmh{iw tgr` r`f EN\ jinvzfz gc r`gz {n|nd|n{` (l' r`nr r`f

Jmcr|njrgcd Meegjf| `nz gcbgjnrfb nz lfgcd gcjm|{m|nrfb gc r`gz jmcr|njr lw |fef|fcjf rmgh{ifhfcr {|mugzgmcz me int m| Fpfjvrguf m|bf|z n{{igjnlif rm nj~vgzgrgmcz me jmhhf|jgni grfhz1

_Jmcr|njrgcd Meegjf| j`fjo nz n{{|m{|gnrf #X

]P] (>' 6<#<;: 5) \fzr|gjrgmcz mc Zvljmcr|njrm| Znifz rm r`f Dmuf|chfcr(Zf{r <;;5') tgr` Nirf|cnrf G (Mjr >776' ( 2> V#Z#J# <6:d ncb >; V#Z#J# <2;<'#

]] (<' 6<#<;: >: ) Jmcr|njrm| Jmbf me Lvzgcfzz Fr`gjz ncb Jmcbvjr (N{| <;>;' ([vl#I# >>; <6<) Rgrif UG) J`n{rf| > ( 2> V#Z#J# <6> cmrf''#

Page 14: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 14/23

>2

\E[1 [J >> \ ;;6 ]] (:' 6<#<;: >6) T`gzriflimtf| [|mrfjrgmcz vcbf| r`f Nhf|gjnc \fjmuf|w ncb

\fgcufzrhfcr Njr me <;;7 (Avcf <;>;' (Zfjrgmc >66: me [vl# I# >>> 6'# (N{{igfz rmjmcr|njrz evcbfb lw r`f Nhf|gjnc \fjmuf|w ncb \fgcufzrhfcr Njr me <;;7#'

]] (2' 6<#<;2 >;) \f{m|rgcd Fpfjvrguf Jmh{fcznrgmc ncb Eg|zr Rgf| Zvljmcr|njrNtn|bz (Avi <;>;' ([vl# I# >;7 <0<' ( :> V#Z#J# 5>;> cmrf'#

]] (6' 6<#<;2 >>) Nhf|gjnc \fjmuf|w ncb \fgcufzrhfcr Njr‒\f{m|rgcd\f~vg|fhfcrz (Avi <;>;' ([vl# I# >>> 6'#

]] (5' 6<#<>7 :) Cmrgjf me Rmrni @VLQmcf Zfr Nzgbf (Anc >777' (>6 V#Z#J# 564n'#]] (4' 6<#<>7 2) Cmrgjf me [|gjf Funivnrgmc [|fef|fcjf em| @VLQmcf Zhnii

Lvzgcfzz Jmcjf|cz (A VIW <;;6' (ge r`f meef|m| fifjrz rm tnguf r`f {|fef|fcjf) gr z`nii zmgcbgjnrf gc grz meef|' (>6 V#Z#J# 564n'#

]] (0' _\fzf|ufbX]P] (7'(g' 6<#<>7 5) Cmrgjf me Rmrni Zhnii Lvzgcfzz Zfr Nzgbf (Avcf <;;:'

(>6 V#Z#J# 522'#]] (gg' Nirf|cnrf G (Mjr >776' me 6<#<>7 5#]] (ggg' Nirf|cnrf GG (Hn| <;;2' me 6<#<>7 5#

]] (>;'(g' 6<#<>7 4) Cmrgjf me [n|rgni Zhnii Lvzgcfzz Zfr Nzgbf (Avcf <;;:'(>6 V#Z#J# 522'#

]] (gg' Nirf|cnrf G (Mjr >776' me 6<#<>7 4#]] (ggg' Nirf|cnrf GG (Hn| <;;2' me 6<#<>7 4#

] ] (>>' 6<#<>7 0) Vrgigqnrgmc me Zhnii Lvzgcfzz Jmcjf|cz (Hnw <;;2'

(>6 V#Z#J# 5:4(b'(<' ncb (:''# zmigjgrnrgmcz ncb jmcr|njrz t`fc r`f jmcr|njr nhmvcr gzfp{fjrfb rm fpjffb r`f zgh{igegfb nj~vgzgrgmc r`|fz`mib vcifzz‒(>' N {f|zmcnizf|ugjfz jmcr|njr gz jmcrfh{inrfb (zff :4#>;2 '? m| (<' R`f jmcr|njr) rmdfr`f| tgr` niime grz zvljmcr|njrz) tgii lf {f|em|hfb fcrg|fiw mvrzgbf me r`f Vcgrfb Zrnrfz ncb grzmvriwgcd n|fnz#

p]] (><'(g' 6<#<>7 7) Zhnii Lvzgcfzz Zvljmcr|njrgcd [inc (N{| <;;0'(>6 V#Z#J# 5:4(b'(2' '# zmigjgrnrgmcz ncb jmcr|njrz r`nr meef| zvljmcr|njrgcd{mzzglgigrgfz) n|f fp{fjrfb rm fpjffb "66;);;; (">);;;);;; em| jmczr|vjrgmc me ncw{vligj enjgigrw') ncb n|f |f~vg|fb rm gcjivbf r`f jinvzf nr 6<#<>7 0) Vrgigqnrgmc me

Zhnii Lvzgcfzz Jmcjf|cz) vcifzz r`f nj~vgzgrgmc gz zfr nzgbf m| gz rm lf njjmh{igz`fbvcbf| r`f 0(n' {|md|nh#

]] (gg' Nirf|cnrf G (Mjr <;;>' me 6<#<>7 7#]] (ggg' Nirf|cnrf GG (Mjr <;;>' me 6<#<>7 7#

]] (>:' 6<#<>7 >2) Ighgrnrgmcz mc Zvljmcr|njrgcd (Bfj >775'(>6 V#Z#J# 5:4(n'(>2' '#

Page 15: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 15/23

>6

\E[1 [J >> \ ;;6 ]] (>2' 6<#<>7 >5) Ig~vgbnrfb Bnhndfz‒Zvljmcr|njrgcd [inc (Anc >777'

(>6 V#Z#J# 5:4(b'(2'(E'(g' '#]] (>6'(g' 6<#<>7 <:) Cmrgjf me [|gjf Funivnrgmc Nbavzrhfcr em| Zhnii

Bgznbuncrndfb Lvzgcfzz Jmcjf|cz (M JR <;;0' ( >; V#Z#J# <:<: ' (ge r`f meef|m| fifjrz rmtnguf r`f nbavzrhfcr) gr z`nii zm gcbgjnrf gc grz meef|'#

]] (gg' Nirf|cnrf G (Avcf <;;:' me 6<#<>7 <:#]] (>5' 6<#<>7 <6) Zhnii Bgznbuncrndfb Lvzgcfzz [n|rgjg{nrgmc [|md|nh‒

Bgznbuncrndfb Zrnrvz ncb \f{m|rgcd (N{| <;;0' ([vl# I# >;: :66) zfjrgmc 4>;<) ncb>; V#Z#J# <:<: '#

]] (>4' 6<#<>7 <5) Zhnii Bgznbuncrndfb Lvzgcfzz [n|rgjg{nrgmc [|md|nh‒Gcjfcrguf Zvljmcr|njrgcd (Mjr <;;;' ([vl# I# >;: :66) zfjrgmc 4>;<) ncb>; V#Z#J# <:<: '# t`fc jmcr|njrgcd lw cfdmrgnrgmc) gczf|r gc zmigjgrnrgmcz ncbjmcr|njrz jmcrngcgcd r`f jinvzf nr 6<#<>7 <6) Zhnii Bgznbuncrndfb Lvzgcfzz[n|rgjg{nrgmc [|md|nh‒Bgznbuncrndfb Zrnrvz ncb \f{m|rgcd) n jinvzf zvlzrncrgniiwr`f znhf nz r`f jinvzf nr 6<#<>7 <5) Zhnii Bgznbuncrndfb Lvzgcfzz [n|rgjg{nrgmc[|md|nh‒Gcjfcrguf Zvljmcr|njrgcd) t`fc nvr`m|gqfb (zff >7#><;: '# R`fjmcr|njrgcd meegjf| hnw gcjivbf nc ntn|b eff {|mugzgmc gc igfv me r`f gcjfcrguf? gczvj` jnzfz) `mtfuf|) r`f jmcr|njrgcd meegjf| z`nii cmr vzf r`f jinvzf nr 6<#<>7 <5#

]] (>0' 6<#<>7 <4) Cmrgjf me Rmrni Zf|ugjf Bgznlifb Ufrf|nc Mtcfb ZhniiLvzgcfzz Zfr Nzgbf (Hnw <;;2' ( >6 V#Z#J# 564 e '# zmigjgrnrgmcz ncb jmcr|njrz em|nj~vgzgrgmcz vcbf| >7#>2;6 ncb >7#>2;5#

]] (>7' 6<#<>7 <0) [mzr Ntn|b Zhnii Lvzgcfzz [|md|nh \f{|fzfcrnrgmc (N{| <;;7'

(>6 V#Z#J# 5:<(n'(<' '#]] (<;' 6<#<<< :) Jmcugjr Inlm| (Avcf <;;:' (F#M# >>466'# zmigjgrnrgmcz ncb

jmcr|njrz nlmuf r`f hgj|m {v|j`nzf r`|fz`mib) t`fc r`f jmcr|njr tgii lf {f|em|hfbgc r`f Vcgrfb Zrnrfz) [vf|rm \gjm) r`f Cm|r`f|c Hn|gncn Gzincbz) Nhf|gjnc Znhmn)Dvnh) m| r`f V#Z# Ug|dgc Gzincbz? vcifzz‒

(n' R`f jmcr|njr tgii lf zvlafjr rm r`f Tniz` @fnifw [vligj Jmcr|njrz Njr (zffZvl{n|r <<#5 ') t`gj` jmcrngcz n zf{n|nrf {|m`glgrgmc ndngczr r`f fh{imwhfcr me jmcugjr inlm|?

(l' R`f zv{{igfz m| zf|ugjfz n|f rm lf {v|j`nzfb e|mh Efbf|ni [|gzmc Gcbvzr|gfz)

Gcj# (zff Zvl{n|r 0#5 '? m|(j' R`f nj~vgzgrgmc gcumiufz r`f {v|j`nzf) e|mh ncw Zrnrf {|gzmc) me egcgz`fb

zv{{igfz r`nr hnw lf zfjv|fb gc r`f m{fc hn|ofr m| e|mh fpgzrgcd zrmjoz) nzbgzrgcdvgz`fb e|mh zv{{igfz |f~vg|gcd z{fjgni enl|gjnrgmc#

]P] (<>' 6<#<<< >7) J`gib Inlm|‒Jmm{f|nrgmc tgr` Nvr`m|grgfz ncb \fhfbgfz(Avi <;>;' (F#M# >:><5'#

Page 16: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 16/23

>5

\E[1 [J >> \ ;;6 ]P] (<<' 6<#<<< <>) [|m`glgrgmc me Zfd|fdnrfb Enjgigrgfz (Efl >777'#]P] (<:' 6<#<<< <5) F~vni M{{m|rvcgrw (Hn| <;;4' (F#M# >><25'#]P] (<2' 6<#<<< :6) F~vni M{{m|rvcgrw em| Z{fjgni Bgznlifb Ufrf|ncz) Ufrf|ncz me

r`f Ugfrcnh F|n) ncb Mr`f| Figdglif Ufrf|ncz (Zf{r <;;5' ( :0 V#Z#J# 2<><'#]] (<6' 6<#<<< :5) Neeg|hnrguf Njrgmc em| Tm|of|z tgr` Bgznlgigrgfz (Avc >770'

(<7 V#Z#J# 47:'#]] (<5' 6<#<<< :4) Fh{imwhfcr \f{m|rz mc Z{fjgni Bgznlifb Ufrf|ncz) Ufrf|ncz me

r`f Ugfrcnh F|n) ncb Mr`f| Figdglif Ufrf|ncz (Zf{r <;;5' ( :0 V#Z#J# 2<><'#]] (<4' 6<#<<< 62) Fh{imwhfcr Figdglgigrw Uf|gegjnrgmc (ANC <;;7'# (Fpfjvrguf

M|bf| ><707'# (Cmr n{{igjnlif rm r`f nj~vgzgrgmc me jmhhf|jgniiw nunginlif mee r`f z`fie grfhz m| jf|rngc mr`f| rw{fz me jmhhf|jgni grfhz nz {|fzj|glfb gc <<#>0;: #'

]] (<0'(g' 6<#<<: 7) Fzrghnrf me [f|jfcrndf me \fjmuf|fb Hnrf|gni Jmcrfcr em|F[N‚Bfzgdcnrfb Grfhz (Hnw <;;0' ( 2< V#Z#J# 575<(j'(:'(N'(gg' '# (Cmr n{{igjnlif rm r`fnj~vgzgrgmc me jmhhf|jgniiw nunginlif mee r`f z`fie grfhz#'

]] (gg' Nirf|cnrf G (Hnw <;;0' me 6<#<<: 7(2< V#Z#J# 575<(g'(<'(J' '# (Cmrn{{igjnlif rm r`f nj~vgzgrgmc me jmhhf|jgniiw nunginlif mee r`f z`fie grfhz

]] (<7' 6<#<<: >6) Fcf|dw Feegjgfcjw gc Fcf|dw Jmczvhgcd [|mbvjrz (B FJ <;;4'(2< V#Z#J# 0<67l'#

]] (:;'(g' 6<#<<: >5) GFFF >50; Zrncbn|b em| r`f Fcug|mchfcrni Nzzfzzhfcr me [f|zmcni Jmh{vrf| [|mbvjrz (B FJ <;;4' (F#M# >:2<:'#

]] (gg' Nirf|cnrf G (B FJ <;;4' me 6<#<<: >5#]] (:>' 6<#<<6 >) Lvw Nhf|gjnc Njr‒Zv{{igfz (Efl <;;7' ( 2> V#Z#J# >;n >;b'#]] (:<'(g' 6<#<<6 :) Lvw Nhf|gjnc Njr‒E|ff R|nbf Nd|ffhfcrz‒Gz|nfig R|nbf Njr

(Avcf <;;7' ( 2> V#Z#J# >;n >;b) >7 V#Z#J# ::;> cmrf)>7 V#Z#J# <>><cmrf)>7 V#Z#J#:0;6 cmrf) [vl# I# >;0 44) >;0 40) >;0 <05) >;0 :;<) >;7 6:) >;7 >57) >;7 <0:) ncb>>; >:0'#

] (gg' Nirf|cnrf G (Anc <;;2' me 6<#<<6 :#]] (ggg' Nirf|cnrf GG (Anc <;;2' me 6<#<<6 :#

]P] (::' 6<#<<6 6) R|nbf Nd|ffhfcrz (N VD <;;7' ( >7 V#Z#J# <6;>) fr zf~ #)>7 V#Z#J# ::;> cmrf'#

]P] (:2' 6<#<<6 >:) \fzr|gjrgmcz mc Jf|rngc Em|fgdc [v|j`nzfz (Avcf <;;0' (F#M#‗z){|mjinhnrgmcz) ncb zrnrvrfz nbhgcgzrf|fb lw r`f Meegjf me Em|fgdc Nzzfrz Jmcr|mi me r`fBf{n|rhfcr me r`f R|fnzv|w'#

]] (:6' 6<#<<5 2) Cmrgjf me Bgznzrf| m| Fhf|dfcjw N|fn Zfr Nzgbf (Cmu <;;4'(2< V#Z#J# 6>6;'#

Page 17: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 17/23

>4

\E[1 [J >> \ ;;6

]] (:5' 6<#<<5 6) \fzr|gjrgmcz mc Zvljmcr|njrgcd Mvrzgbf Bgznzrf| m| Fhf|dfcjwN|fn (Cmu <;;4' ( 2< V#Z#J# 6>6;'#

]] (:4' 6<#<:< <7) Rf|hz em| Egcncjgcd me [v|j`nzfz me Jmhhf|jgni Grfhz(Efl <;;<' ( 2> V#Z#J# <66(e') >; V#Z#J# <:;4(e' '#

]] (:0' 6<#<:< :; ) Gczrniihfcr [nwhfcrz em| Jmhhf|jgni Grfhz (Mjr >776'(2> V#Z#J# <66(e') >; V#Z#J# <:;4(e' '#

]P] (:7' 6<#<:< :: ) [nwhfcr lw Fifjr|mcgj Evcbz R|nczef|‒Jfcr|ni Jmcr|njrm|\fdgzr|nrgmc (Mjr <;;:' ( :> V#Z#J# :::< '#

]] (2;' 6<#<:< :2) [nwhfcr lw Fifjr|mcgj Evcbz R|nczef|‒Mr`f| r`nc Jfcr|niJmcr|njrm| \fdgzr|nrgmc (Hnw >777' ( :> V#Z#J# :::< '#

]P] (2>' 6<#<:< :5) [nwhfcr lw R`g|b [n|rw (Efl <;>;' ( :> V#Z#J# :::< '#]] (2<' 6<#<:7 >) [|gunjw m| Zfjv|grw Znefdvn|bz (Nvd >775' ( 6 V#Z#J# 66<n'#]] (2:'(g' 6<#<24 52) [|fef|fcjf em| [|gunrfiw Mtcfb V#Z# Eind Jmhhf|jgni

Ufzzfiz (Efl <;;5' ( 25 V#Z#J# N{{p# ><2>(l' ncb >; V#Z#J# <5:>'#]] (gg' Nirf|cnrf G (N{| <;;:' me 6<#<24 52#(j' R`f Jmcr|njrm| z`nii jmh{iw tgr` r`f EN\ jinvzfz gc r`gz {n|nd|n{` (j')

n{{igjnlif rm jmhhf|jgni zf|ugjfz) r`nr r`f Jmcr|njrgcd Meegjf| `nz gcbgjnrfb nz lfgcdgcjm|{m|nrfb gc r`gz jmcr|njr lw |fef|fcjf rm gh{ifhfcr {|mugzgmcz me int m| Fpfjvrgufm|bf|z n{{igjnlif rm nj~vgzgrgmcz me jmhhf|jgni grfhz1

_Jmcr|njrgcd Meegjf| j`fjo nz n{{|m{|gnrf# X]] (>' 6<#<<< 2>) Zf|ugjf Jmcr|njr Njr me >756 (Cmu <;;4' ( 2> V#Z#J# :6>) fr zf~ #'#

]] (<' 6<#<<< 2<) Zrnrfhfcr me F~vgunifcr \nrfz em| Efbf|ni @g|fz (Hnw >707'(<7 V#Z#J# <;5ncb 2> V#Z#J# :6>) fr zf~

]] (:' 6<#<<< 2:) Eng| Inlm| Zrncbn|bz Njr ncb Zf|ugjf Jmcr|njr Njr‒[|gjfNbavzrhfcr (Hvirg{if Wfn| ncb M{rgmc Jmcr|njrz' (Zf{ <;;7' ( <7 V#Z#J# <;5ncb2> V#Z#J# :6>) fr zf~ #'#

]] (2' 6<#<<< 22) Eng| Inlm| Zrncbn|bz Njr ncb Zf|ugjf Jmcr|njr Njr‒[|gjfNbavzrhfcr (Zf{ <;;7' ( <7 V#Z#J# <;5ncb 2> V#Z#J# :6>) fr zf~

]] (6' 6<#<<< 6>) Fpfh{rgmc e|mh N{{igjnrgmc me r`f Zf|ugjf Jmcr|njr Njr rmJmcr|njrz em| Hngcrfcncjf) Jnigl|nrgmc) m| \f{ng| me Jf|rngc F~vg{hfcr‒\f~vg|fhfcrz

(Cmu <;;4' ( 2> :6> ) fr zf~# '#]] (5' 6<#<<< 6:) Fpfh{rgmc e|mh N{{igjnrgmc me r`f Zf|ugjf Jmcr|njr Njr rm

Jmcr|njrz em| Jf|rngc Zf|ugjfz‒\f~vg|fhfcrz (Efl <;;7' ( 2> V#Z#J# :6>) fr zf~# '#]] (4' 6<#<<5 5) [|mhmrgcd Fpjfzz Emmb Bmcnrgmc rm Cmc{|megr M|dncgqnrgmcz

(Hn| <;;7' ([vl# I# >>; <24'#]] (0' 6<#<:4 >>) Njjf{rgcd ncb Bgz{fczgcd me "> Jmgc (Zf{r <;;0' ( :> V#Z#J#

6>><({'(>' '#

Page 18: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 18/23

>0

\E[1 [J >> \ ;;6 (b' Jmh{r|miif| Dfcf|ni Fpnhgcnrgmc me \fjm|b # R`f Jmcr|njrm| z`nii jmh{iw tgr`

r`f {|mugzgmcz me r`gz {n|nd|n{` (b' ge r`gz jmcr|njr tnz ntn|bfb vzgcd mr`f| r`nc zfnifblgb) gz gc fpjfzz me r`f zgh{igegfb nj~vgzgrgmc r`|fz`mib) ncb bmfz cmr jmcrngc r`f jinvzf nr6<#<>6 <) Nvbgr ncb \fjm|bz‒Cfdmrgnrgmc#

(>' R`f Jmh{r|miif| Dfcf|ni me r`f Vcgrfb Zrnrfz) m| nc nvr`m|gqfb |f{|fzfcrnrguf me r`f Jmh{r|miif| Dfcf|ni) z`nii `nuf njjfzz rm ncb |gd`r rm fpnhgcf ncw me r`fJmcr|njrm|‗z bg|fjriw {f|rgcfcr |fjm|bz gcumiugcd r|ncznjrgmcz |finrfb rm r`gz jmcr|njr#

(<' R`f Jmcr|njrm| z`nii hnof nunginlif nr grz meegjfz nr nii |fnzmcnlif rghfz r`f|fjm|bz) hnrf|gniz) ncb mr`f| fugbfcjf em| fpnhgcnrgmc) nvbgr) m| |f{|mbvjrgmc) vcrgi: wfn|z nerf| egcni {nwhfcr vcbf| r`gz jmcr|njr m| em| ncw z`m|rf| {f|gmb z{fjgegfb gcEN\ Zvl{n|r 2#4 ) Jmcr|njrm| \fjm|bz \frfcrgmc) me r`f mr`f| jinvzfz me r`gz jmcr|njr# Ge r`gz jmcr|njr gz jmh{ifrfiw m| {n|rgniiw rf|hgcnrfb) r`f |fjm|bz |finrgcd rm r`f tm|o rf|hgcnrfb z`nii lf hnbf nunginlif em| : wfn|z nerf| ncw |fzvirgcd egcni rf|hgcnrgmczfrrifhfcr# \fjm|bz |finrgcd rm n{{fniz vcbf| r`f bgz{vrfz jinvzf m| rm igrgdnrgmc m| r`fzfrrifhfcr me jinghz n|gzgcd vcbf| m| |finrgcd rm r`gz jmcr|njr z`nii lf hnbf nunginlif vcrgizvj` n{{fniz) igrgdnrgmc) m| jinghz n|f egcniiw |fzmiufb#

(:' Nz vzfb gc r`gz jinvzf) |fjm|bz gcjivbf lmmoz) bmjvhfcrz) njjmvcrgcd {|mjfbv|fzncb {|njrgjfz) ncb mr`f| bnrn) |fdn|bifzz me rw{f ncb |fdn|bifzz me em|h# R`gz bmfz cmr|f~vg|f r`f Jmcr|njrm| rm j|fnrf m| hngcrngc ncw |fjm|b r`nr r`f Jmcr|njrm| bmfz cmrhngcrngc gc r`f m|bgcn|w jmv|zf me lvzgcfzz m| {v|zvncr rm n {|mugzgmc me int#

(f'(>' Cmrtgr`zrncbgcd r`f |f~vg|fhfcrz me r`f jinvzfz gc {n|nd|n{`z (n') (l') (j') ncb(b' me r`gz jinvzf) r`f Jmcr|njrm| gz cmr |f~vg|fb rm eimt bmtc ncw EN\ jinvzf) mr`f| r`nc

r`mzf gc r`gz {n|nd|n{` (f'(>' gc n zvljmcr|njr em| jmhhf|jgni grfhz# Vcifzz mr`f|tgzfgcbgjnrfb lfimt) r`f fprfcr me r`f eimt bmtc z`nii lf nz |f~vg|fb lw r`f jinvzf‒

(g' 6<#<;: >: ) Jmcr|njrm| Jmbf me Lvzgcfzz Fr`gjz ncb Jmcbvjr (N{| <;>;' ([vl#I# >>; <6<) Rgrif UG) J`n{rf| > ( 2> V#Z#J# <6> cmrf''#

(gg'6<#<>7 0) Vrgigqnrgmc me Zhnii Lvzgcfzz Jmcjf|cz (Hnw <;;2'(>6 V#Z#J# 5:4(b'(<' ncb (:'') gc nii zvljmcr|njrz r`nr meef| ev|r`f| zvljmcr|njrgcdm{{m|rvcgrgfz# Ge r`f zvljmcr|njr (fpjf{r zvljmcr|njrz rm zhnii lvzgcfzz jmcjf|cz' fpjffbz"66;);;; (">);;;);;; em| jmczr|vjrgmc me ncw {vligj enjgigrw') r`f zvljmcr|njrm| hvzrgcjivbf 6<#<>7 0gc imtf| rgf| zvljmcr|njrz r`nr meef| zvljmcr|njrgcd m{{m|rvcgrgfz#

(ggg' _\fzf|ufbX(gu' 6<#<<< <5) F~vni M{{m|rvcgrw (Hn| <;;4' (F#M# >><25'#(u' 6<#<<< :6) F~vni M{{m|rvcgrw em| Z{fjgni Bgznlifb Ufrf|ncz) Ufrf|ncz me r`f

Ugfrcnh F|n) ncb Mr`f| Figdglif Ufrf|ncz (Zf{r <;;5' ( :0 V#Z#J# 2<><'#(ug' 6<#<<< :5) Neeg|hnrguf Njrgmc em| Tm|of|z tgr` Bgznlgigrgfz (Avcf >770'

(<7 V#Z#J# 47:'#(ugg' _\fzf|ufbX

Page 19: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 19/23

>7

\E[1 [J >> \ ;;6 (uggg'6<#<<< 2>) Zf|ugjf Jmcr|njr Njr me >756 (Cmu <;;4' ( 2> V#Z#J# :6>)

fr zf~ #'#(gp' 6<#<<< 6;) Jmhlnrgcd R|neegjogcd gc [f|zmcz (Efl <;;7' ( << V#Z#J#

4>;2(d' '#]]]Nirf|cnrf G (Nvd <;;4' me 6<#<<< 6;(<< V#Z#J# 4>;2(d''#

(p' 6<#<<< 6>) Fpfh{rgmc e|mh N{{igjnrgmc me r`f Zf|ugjf Jmcr|njr Njr rmJmcr|njrz em| Hngcrfcncjf) Jnigl|nrgmc) m| \f{ng| me Jf|rngc F~vg{hfcr \f~vg|fhfcrz(Cmu <;;4' ( 2> V#Z#J# :6>) fr zf~# '#

(pg' 6<#<<< 6:) Fpfh{rgmc e|mh N{{igjnrgmc me r`f Zf|ugjf Jmcr|njr Njr rmJmcr|njrz em| Jf|rngc Zf|ugjfz \f~vg|fhfcrz (Efl <;;7' ( 2> V#Z#J# :6>) fr zf~# '#

(pgg'6<#<<< 62) Fh{imwhfcr Figdglgigrw Uf|gegjnrgmc (ANC <;;7'#(pggg'6<#<<5 5) [|mhmrgcd Fpjfzz Emmb Bmcnrgmc rm Cmc{|megr M|dncgqnrgmcz

(Hn| <;;7' ([vl# I# >>; <24'# Eimt bmtc |f~vg|fb gc njjm|bncjf tgr` {n|nd|n{` (f' me EN\ jinvzf 6<#<<5 5#

(pgu' 6<#<24 52) [|fef|fcjf em| [|gunrfiw Mtcfb V#Z# Eind Jmhhf|jgni Ufzzfiz(Efl <;;5' ( 25 V#Z#J# N{{p# ><2>(l' ncb >; V#Z#J# <5:>'# Eimt bmtc |f~vg|fb gcnjjm|bncjf tgr` {n|nd|n{` (b' me EN\ jinvzf 6<#<24 52#

(<' T`gif cmr |f~vg|fb) r`f jmcr|njrm| hnw gcjivbf gc grz zvljmcr|njrz em|jmhhf|jgni grfhz n hgcghni cvhlf| me nbbgrgmcni jinvzfz cfjfzzn|w rm znrgzew grzjmcr|njrvni mligdnrgmcz#

>#: M{rgmc rm Fprfcb Zf|ugjfz (6<#<>4 0' (Cmu >777'

R`f Dmuf|chfcr hnw |f~vg|f jmcrgcvfb {f|em|hncjf me ncw zf|ugjfz tgr`gc r`f ighgrzncb nr r`f |nrfz z{fjgegfb gc r`f jmcr|njr# R`fzf |nrfz hnw lf nbavzrfb mciw nz n |fzvir me |fugzgmcz rm {|fungigcd inlm| |nrfz {|mugbfb lw r`f Zfj|frn|w me Inlm|# R`f m{rgmc{|mugzgmc hnw lf fpf|jgzfb hm|f r`nc mcjf) lvr r`f rmrni fprfczgmc me {f|em|hncjf`f|fvcbf| z`nii cmr fpjffb 5 hmcr`z# R`f Jmcr|njrgcd Meegjf| hnw fpf|jgzf r`f m{rgmc lwt|grrfc cmrgjf rm r`f Jmcr|njrm| tgr`gc :; bnwz#

>#2 M[RGMC RM FPRFCB R@F RF\H ME R@F JMCR\NJR (6<#<>4 7' (HN\<;;;'(n' R`f Dmuf|chfcr hnw fprfcb r`f rf|h me r`gz jmcr|njr lw t|grrfc cmrgjf rm r`fJmcr|njrm| tgr`gc >; bnwz {|mugbfb r`nr r`f Dmuf|chfcr dgufz r`f Jmcr|njrm| n{|fighgcn|w t|grrfc cmrgjf me grz gcrfcr rm fprfcb nr ifnzr bnwz :; bnwz lfem|f r`f jmcr|njrfp{g|fz# R`f {|fighgcn|w cmrgjf bmfz cmr jmhhgr r`f Dmuf|chfcr rm nc fprfczgmc#(l' Ge r`f Dmuf|chfcr fpf|jgzfz r`gz m{rgmc) r`f fprfcbfb jmcr|njr z`nii lf jmczgbf|fb rmgcjivbf r`gz m{rgmc jinvzf#(j' R`f rmrni bv|nrgmc me r`gz jmcr|njr) gcjivbgcd r`f fpf|jgzf me ncw m{rgmcz vcbf| r`gzjinvzf) z`nii cmr fpjffb 6 wfn|z#

Page 20: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 20/23

<;

\E[1 [J >> \ ;;6 >#6 BNRN ZFJV\GRW \F^VG\FHFCRZ

[fnjf Jm|{z gcem|hnrgmc zwzrfhz jmcrngc zfczgrguf gcem|hnrgmc) nz bfegcfb gc r`fJmh{vrf| Zfjv|grw Njr me >704 ([I >;; <:6') ncb jmcrngc {f|zmcni gcem|hnrgmc zvlafjrrm r`f [|gunjw Njr me >742 ([I 7: 647 ncb nhfcbhfcrz'# Gr tgii lf r`f Jmcr|njrm|‗z|fz{mczglgigrw rm enhgign|gqf ncb l|gfe fh{imwffz ncb zvljmcr|njrm|z mc r`f {|mugzgmcz me r`f [|gunjw Njr# EN\ jinvzfz) 6<#<<2 >1 ’[|gunjw Njr Cmrgegjnrgmc‘) 6<#<<2 <1 ’[|gunjwNjr‘ ncb 6<#<:7 > ’[|gunjw m| Zfjv|grw Znefdvn|bz‘) n|f `f|flw gcjm|{m|nrfb lw|fef|fcjf#

R`f jmcegbfcrgnigrw ncb bgzjimzv|f {|mugzgmcz me Rgrif UGG me r`f Jgugi \gd`rz Njr me >752ncb Rgrif G me r`f Nhf|gjnc tgr` Bgznlgigrgfz Njr {|m`glgr bgzjimzv|f me ncw j`n|df m|j`n|df |finrfb gcem|hnrgmc# R`f Jmcr|njrm| z`nii nd|ff r`nr zvj` gcem|hnrgmc tgii cmr lfbgzjimzfb ncb tgii mciw lf vzfb em| r`f {f|em|hncjf me r`fg| |fz{mczglgigrgfz vcbf| r`gzjmcr|njr#

>#5 JMCEGBFCRGNIGRW-BGZZFHGCNRGMC ME GCEM\HNRGMC

R`f|f z`nii lf cm bgzzfhgcnrgmc m| {vligjnrgmc) fpjf{r tgr`gc ncb lfrtffc r`fJmcr|njrm| ncb ncw zvljmcr|njrm|z) me gcem|hnrgmc mlrngcfb m| bfufim{fb vcbf| r`gzjmcr|njr m| jmcrngcfb gc r`f |f{m|rz rm lf ev|cgz`fb {v|zvncr rm r`gz jmcr|njr) tgr`mvrr`f {|gm| t|grrfc n{{|muni me r`f Jmcr|njrz Meegjf| \f{|fzfcrnrguf (JM\' m| r`f JM#

>#4 Jinvzfz gcjm|{m|nrfb lw \fef|fcjf

6<#<6< < JINVZFZ GCJM\[M\NRFB LW \FEF\FCJF (EFL\VN\W >770'# ‚R`gz jmcr|njr gcjm|{m|nrfz mcf m| hm|f jinvzfz lw |fef|fcjf) tgr` r`f znhf em|jf ncbfeefjr nz ge r`fw tf|f dgufc gc evii rfpr# V{mc |f~vfzr) r`f Jmcr|njrgcd Meegjf| tgii hnofr`fg| evii rfpr nunginlif# Nizm) r`f evii rfpr me n jinvzf hnw lf njjfzzfb fifjr|mcgjniiw nrr`gz nbb|fzz1 `rr{1--en|zgrf#`gii#ne#hgi

n' 6<#<:< :: [NWHFCR LW FIFJR\MCGJ EVCBZ R\NCZEF\ ‚ JFCR\NIJMCR\NJRM\ \FDGZR\NRGMC (MJR <;;:'l' 6<#<26 > DMUF\CHFCR [\M[F\RW (AVCF <;;4'j' 6<#<:7 > [\GUNJW M\ ZFJV\GRW ZNEFDVN\BZ (NVD >775'

>#0 M\DNCGQNRGMCNI JMCEIGJR ME GCRF\FZR

>#0#> Dfcf|ni

>#0#>#> R`f rf|h ’m|dncgqnrgmcni jmceigjr me gcrf|fzr‘ hfncz r`nr r`f Jmcr|njrm| (t`gj`rf|h `f|fgcnerf| z`nii lf bffhfb rm gcjivbf grz j`gfe fpfjvrgufz) bg|fjrm|z) ncwjmczvirncrz) m| zvljmcr|njrm|z vrgigqfb vcbf| r`gz jmcr|njr mr`f| r`nc n ufcbm|zfiigcd gcjgbfcrni hnrf|gni' `nz gcrf|fzrz t`gj` (g' hnw bghgcgz` grz jn{njgrw rm dguf

Page 21: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 21/23

<>

\E[1 [J >> \ ;;6 gh{n|rgni) rfj`cgjniiw zmvcb) mlafjrguf nzzgzrncjf ncb nbugjf gc {f|em|hgcd r`gzjmcr|njr) (gg' hnw mr`f|tgzf |fzvir gc n lgnzfb tm|o {|mbvjr vcbf| r`gz jmcr|njr) m|(ggg' hnw |fzvir gc nc vceng| jmh{frgrguf nbuncrndf rm grzfie m| mr`f|z#

R`f Jmcr|njrm|‗z nrrfcrgmc gz bg|fjrfb rm EN\ Zvl{n|r 7#6) M|dncgqnrgmcni Jmceigjrz me Gcrf|fzr# Gc r`f fpfjvrgmc me jf|rngc jmcr|njr rnzoz) gr gz ncrgjg{nrfb r`nr nzzgdcfbJmcr|njrm| {f|zmccfi tgii |f~vg|f njjfzz rm jmcegbfcrgni m| {|m{|gfrn|w lvzgcfzz) rfj`cgjnincb egcncjgni gcem|hnrgmc lfimcdgcd rm r`f Dmuf|chfcr m| mr`f| jmh{ncgfz# R`fgcem|hnrgmc hnw gcjivbf lvr gz cmr ighgrfb rm {|f bfjgzgmcni lvbdfr ncb nj~vgzgrgmczfczgrguf gcem|hnrgmc) {|f{n|nrgmc me z{fjgegjnrgmcz m| tm|o zrnrfhfcrz) ncb funivnrgmczf|ugjfz# Nerf| |fjfg{r r`f|fme) r`f Jmcr|njrm| ncb neefjrfb gcbgugbvniz z`nii r|fnr zvj`gcem|hnrgmc nz jmcegbfcrgni ncb nd|ff cmr rm n{{|m{|gnrf zvj` gcem|hnrgmc rm grz mtc vzfm| rm bgzjimzf zvj` gcem|hnrgmc rm r`g|b {n|rgfz vcifzz z{fjgegjniiw nvr`m|gqfb lw r`fjmcr|njrgcd meegjf| gc t|grgcd# R`f em|fdmgcd mligdnrgmcz) `mtfuf|) z`nii cmr n{{iw rm1Gcem|hnrgmc t`gj`) nr r`f rghf me |fjfg{r lw r`f Jmcr|njrm|) gz gc r`f {vligj bmhngc?

Gcem|hnrgmc t`gj` gz {vligz`fb nerf| |fjfg{r r`f|fme lw r`f Jmcr|njrm| m| mr`f|tgzflfjmhfz {n|r me r`f {vligj bmhngc r`|mvd` cm envir me r`f Jmcr|njrm|?

Gcem|hnrgmc t`gj` r`f Jmcr|njrm| jnc bfhmczr|nrf tnz gc `gz {mzzfzzgmc nr r`f rghf me |fjfg{r r`f|fme ncb tnz cmr nj~vg|fb bg|fjriw m| gcbg|fjriw e|mh r`f Dmuf|chfcr m| mr`f|jmh{ncgfz?

Gcem|hnrgmc) t`gj` r`f Jmcr|njrm| jnc bfhmczr|nrf) tnz |fjfgufb lw gr e|mh n r`g|b {n|rwr`nr bgb cmr |f~vg|f r`f Jmcr|njrm| rm `mib gr gc jmcegbfcjf#R`f Jmcr|njrm| z`nii mlrngc r`f t|grrfc nd|ffhfcr) gc n em|h znrgzenjrm|w rm r`fjmcr|njrgcd meegjf|) me fnj` fh{imwff {f|hgrrfb njjfzz) t`f|flw r`f fh{imwff nd|ffz r`nr

`f tgii cmr bgzjvzz) bguvidf m| bgzjimzf ncw zvj` gcem|hnrgmc m| bnrn rm ncw {f|zmc m|fcrgrw fpjf{r r`mzf {f|zmcz tgr`gc r`f Jmcr|njrm|‗z m|dncgqnrgmc bg|fjriw jmcjf|cfb tgr`r`f {f|em|hncjf me r`f jmcr|njr#

R`f Jmcr|njrm| nd|ffz) ge |f~vfzrfb lw r`f Dmuf|chfcr) rm zgdc nc nd|ffhfcr gbfcrgjni) gcnii hnrf|gni |fz{fjrz) rm r`f {|mugzgmcz me r`gz jinvzf) tgr` fnj` jmh{ncw zv{{iwgcdgcem|hnrgmc rm r`f Jmcr|njrm| vcbf| r`gz jmcr|njr) ncb rm zv{{iw n jm{w me zvj` nd|ffhfcrrm r`f jmcr|njrgcd meegjf|# E|mh rghf rm rghf v{mc |f~vfzr me r`f jmcr|njrgcd meegjf|) r`fJmcr|njrm| z`nii zv{{iw r`f Dmuf|chfcr tgr` |f{m|rz grfhgqgcd gcem|hnrgmc |fjfgufb nzjmcegbfcrgni) {|m{|gfrn|w) {|f bfjgzgmcni lvbdfr gcem|hnrgmc) m| nj~vgzgrgmc zfczgrgufgcem|hnrgmc) ncb zfrrgcd em|r` r`f jmh{ncw m| jmh{ncgfz e|mh t`gj` r`f Jmcr|njrm|

|fjfgufb zvj` gcem|hnrgmc#R`f Jmcr|njrm| nd|ffz r`nr v{mc |f~vfzr lw r`f Jmcr|njrgcd Meegjf| gr tgii fpfjvrf njmcr|njrgcd meegjf| n{{|mufb nd|ffhfcr tgr` ncw {n|rw t`mzf enjgigrgfz m| {|m{|gfrn|wbnrn gr gz dgufc njjfzz rm m| gz ev|cgz`fb) |fzr|gjrgcd vzf ncb bgzjimzv|f me r`f bnrn m| r`fgcem|hnrgmc mlrngcfb e|mh r`f enjgigrgfz# V{mc |f~vfzr lw r`f jmcr|njrgcd meegjf|)Jmcr|njrm| {f|zmccfi z`nii nizm zgdc zvj` nc nd|ffhfcr#

Page 22: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 22/23

<<

\E[1 [J >> \ ;;6 >#0#>#< Ge nerf| ntn|b) r`f Jmcr|njrm| bgzjmuf|z nc m|dncgqnrgmcni jmceigjr me gcrf|fzr)

tgr` |fz{fjr rm r`gz jmcr|njr) gr z`nii hnof nc ghhfbgnrf ncb evii bgzjimzv|f gct|grgcd rm r`f Jmcr|njrgcd Meegjf|# R`f bgzjimzv|f z`nii gcjivbf gbfcrgegjnrgmc me r`f jmceigjr) r`f hnccf| gc t`gj` gr n|mzf) ncb n bfzj|g{rgmc me r`f njrgmc r`f

Jmcr|njrm| `nz rnofc m| {|m{mzfz rm rnof rm numgb) fighgcnrf m| cfvr|nigqf r`fjmceigjr# R`f Dmuf|chfcr hnw) `mtfuf|) rf|hgcnrf r`f jmcr|njr#

>#0#>#: Gc r`f fufcr r`nr r`f Jmcr|njrm| tnz ntn|f me nc m|dncgqnrgmcni jmceigjr me gcrf|fzr {|gm| rm ntn|b me r`gz jmcr|njr ncb bgb cmr bgzjimzf r`f jmceigjr rm r`fJmcr|njrgcd Meegjf| m| lfjmhfz ntn|f me nc m|dncgqnrgmcni jmceigjr me gcrf|fzrnerf| ntn|b me r`gz jmcr|njr ncb bmfz cmr bgzjimzf r`f jmceigjr me gcrf|fzr tgr`gcrfc (>;' tm|ogcd bnwz me lfjmhgcd ntn|f me zvj` jmceigjr) r`f Dmuf|chfcr hnwrf|hgcnrf r`f jmcr|njr ncb r`f Jmcr|njrm| z`nii cmr lf fcrgrifb rm |fghlv|zfhfcrme ncw jmzr gcjv||fb gc {f|em|hgcd r`gz jmcr|njr m| {nwhfcr me ncw eff r`f|fvcbf|# Ev|r`f|) zvj` jmzrz z`nii cmr lf niimjnlif m| j`n|dfnlif) bg|fjriw m|

gcbg|fjriw) rm ncw mr`f| jmcr|njr tgr` r`f Dmuf|chfcr#

>#0#>#2 R`f |gd`rz ncb |fhfbgfz me r`f Dmuf|chfcr {|mugbfb gc r`gz jinvzf z`nii cmr lffpjivzguf ncb n|f gc nbbgrgmc rm ncw mr`f| |gd`rz ncb |fhfbgfz me r`fDmuf|chfcr {|mugbfb lw int m| vcbf| r`gz jmcr|njr#

>#0#>#6 R`f Jmcr|njrm| nd|ffz r̀ nr bv|gcd {f|em|hncjf me r`f jmcr|njr ncb em| n {f|gmbme r`|ff (:' wfn|z nerf| r`f jmh{ifrgmc me {f|em|hncjf me r`gz jmcr|njr) r`fJmcr|njrm|) gcjivbgcd nii bgugzgmcz r`f|fme) ncb ncw neegignrf me r`f Jmcr|njrm|)ncw amgcr ufcrv|f gcumiugcd r`f Jmcr|njrm|) ncw fcrgrw gcrm m| tgr` t`gj` gr hnwzvlzf~vfcriw hf|df m| neegignrf) m| ncw mr`f| zvjjfzzm| m| nzzgdc me r`f

Jmcr|njrm|) z`nii cmr1(n' Zv{{iw gcem|hnrgmc m| hnrf|gni |fjfgufb e|mh r`gz jmcr|njr) rm ncw eg|h{n|rgjg{nrgcd gc m| `nugcd n ocmtc {|mz{fjrguf gcrf|fzr gc r`f zvlafjrhnrrf| n|fnz em| t`gj` r`f zfczgrguf gcem|hnrgmc bfzj|glfb gc {n|nd|n{` (g'nlmuf tnz gcgrgniiw zvlhgrrfb) cm| fcrf| gcrm ncw jmcr|njrvni |finrgmcz`g{t`gj` tmvib neefjr m| n{{fn| rm neefjr r`f f~vgrw ncb gcrfd|grw me grz|fjmhhfcbnrgmcz#

(l' Ev|cgz` rm r`f Vcgrfb Zrnrfz Dmuf|chfcr) fgr̀ f| nz n {|ghf Jmcr|njrm| m|nz n zvljmcr|njrm|) ncw jmh{mcfcr me ncw zwzrfh em| t`gj` r`f zfczgrgufgcem|hnrgmc bfzj|glfb gc {n|nd|n{` (>' nlmuf tnz gcgrgniiw zvlhgrrfb) r`nrgr gz cmr jv||fcriw mligdnrfb rm bfiguf| em| bfefczf {v|{mzfz#

R`gz {|mugzgmc z`nii eimt bmtc rm nii zvljmcr|njrz ncb rfnhgcd nd|ffhfcrz#

Cm bnrn {|mugbfb rm r`f Jmcr|njrm| m| jmiifjrfb lw r`f Jmcr|njrm| em| r`f {v|{mzf me tm|o {f|em|hncjf z`nii lf vzfb mvrzgbf me r`f jmcr|njr# Nr r`f fcb me r`f jmcr|njr rf|h) r`fJmcr|njrm| ncb nii zvljmcr|njrm|z z`nii |frv|c zngb bnrn ncb bfzr|mw nbbgrgmcni jm{gfz me zngb bnrn egifz) frj#

Page 23: Peace Corps IT Security RFP Security Third Party Evaluation and Testing

8/7/2019 Peace Corps IT Security RFP Security Third Party Evaluation and Testing

http://slidepdf.com/reader/full/peace-corps-it-security-rfp-security-third-party-evaluation-and-testing 23/23

<:

\E[1 [J >> \ ;;6 >#7# 6<#<:4 : Jmcrgcvgrw me Zf|ugjfz#

J MCRGCVGRW MEZF\UGJFZ (ANC >77>'

(n' R`f Jmcr|njrm| |fjmdcgqfz r`nr r`f zf|ugjfz vcbf| r`gz jmcr|njr n|f ugrni rm r`fDmuf|chfcr ncb hvzr lf jmcrgcvfb tgr`mvr gcrf||v{rgmc ncb r`nr) v{mc jmcr|njrfp{g|nrgmc) n zvjjfzzm|) fgr`f| r`f Dmuf|chfcr m| ncmr`f| jmcr|njrm|) hnw jmcrgcvf r`fh#R`f Jmcr|njrm| nd|ffz rm‒

(>' Ev|cgz` {`nzf gc r|ngcgcd? ncb(<' Fpf|jgzf grz lfzr feem|rz ncb jmm{f|nrgmc rm feefjr nc m|bf|iw ncb feegjgfcr

r|nczgrgmc rm n zvjjfzzm|#(l' R`f Jmcr|njrm| z`nii) v{mc r`f Jmcr|njrgcd Meegjf|‗z t|grrfc cmrgjf) (>' ev|cgz`

{`nzf gc) {`nzf mvr zf|ugjfz em| v{ rm 7; bnwz nerf| r`gz jmcr|njr fp{g|fz ncb (<' cfdmrgnrfgc dmmb engr` n {inc tgr` n zvjjfzzm| rm bfrf|hgcf r`f cnrv|f ncb fprfcr me {`nzf gc){`nzf mvr zf|ugjfz |f~vg|fb# R`f {inc z`nii z{fjgew n r|ngcgcd {|md|nh ncb n bnrf em|r|nczef||gcd |fz{mczglgigrgfz em| fnj` bgugzgmc me tm|o bfzj|glfb gc r`f {inc) ncb z`nii lfzvlafjr rm r`f Jmcr|njrgcd Meegjf|‗z n{{|muni# R`f Jmcr|njrm| z`nii {|mugbf zveegjgfcrfp{f|gfcjfb {f|zmccfi bv|gcd r`f {`nzf gc) {`nzf mvr {f|gmb rm fczv|f r`nr r`f zf|ugjfzjniifb em| lw r`gz jmcr|njr n|f hngcrngcfb nr r`f |f~vg|fb ifufi me {|megjgfcjw#

(j' R`f Jmcr|njrm| z`nii niimt nz hncw {f|zmccfi nz {|njrgjnlif rm |fhngc mc r`f aml rm`fi{ r`f zvjjfzzm| hngcrngc r`f jmcrgcvgrw ncb jmczgzrfcjw me r`f zf|ugjfz |f~vg|fb lw r`gzjmcr|njr# R`f Jmcr|njrm| nizm z`nii bgzjimzf cfjfzzn|w {f|zmccfi |fjm|bz ncb niimt r`fzvjjfzzm| rm jmcbvjr mc zgrf gcrf|ugftz tgr` r`fzf fh{imwffz# Ge zfifjrfb fh{imwffz n|fnd|ffnlif rm r`f j`ncdf) r`f Jmcr|njrm| z`nii |fifnzf r`fh nr n hvrvniiw nd|ffnlif bnrfncb cfdmrgnrf r|nczef| me r`fg| fn|cfb e|gcdf lfcfegrz rm r`f zvjjfzzm|#

(b' R`f Jmcr|njrm| z`nii lf |fghlv|zfb em| nii |fnzmcnlif {`nzf gc) {`nzf mvr jmzrz(g#f#)jmzrz gcjv||fb tgr`gc r`f nd|ffb {f|gmb nerf| jmcr|njr fp{g|nrgmc r`nr |fzvir e|mh{`nzf gc) {`nzf mvr m{f|nrgmcz' ncb n eff ({|megr' cmr rm fpjffb n {|m |nrn {m|rgmc me r`feff ({|megr' vcbf| r`gz jmcr|njr#

>#>; Zrnrf ncb Imjni Rnpfz (6<#<<7 >' (N{| >702'

Cmrtgr`zrncbgcd r`f rf|hz me r`f Efbf|ni) Zrnrf) ncb Imjni Rnpfz jinvzf) r`f jmcr|njr{|gjf fpjivbfz nii Zrnrf ncb imjni rnpfz ifugfb mc m| hfnzv|fb lw r`f jmcr|njr m| znifz{|gjf me r`f zf|ugjfz m| jmh{ifrfb zv{{igfz ev|cgz`fb vcbf| r`gz jmcr|njr# R`f Jmcr|njrm|z`nii zrnrf zf{n|nrfiw mc grz gcumgjfz rnpfz fpjivbfb e|mh r`f jmcr|njr {|gjf) ncb r`fDmuf|chfcr nd|ffz fgr`f| rm {nw r`f nhmvcr me r`f rnpfz rm r`f Jmcr|njrm| m| {|mugbffugbfcjf cfjfzzn|w rm zvzrngc nc fpfh{rgmc#