Disclaimer The following presentation is an abbreviated description

Disclaimer The following presentation is an abbreviated description of 60 FF-1, 60 FF-2 and 60 FF-3, Florida Administrative Code. The presentation is meant to convey the general intent of the rules and the means by which the Department of Management Services will fulfill its statutory duties in providing the State communications network known as SUNCOM. This presentation and other SUNCOM documentation related to the rules are not substitutes for the actual rules nor do they provide comprehensive or final interpretations of the rules.

Reasons for SUNCOM Rule Changes Demise of State Technology Office n STO owned SUNCOM rules under 60 DD Core of 60 DD was over twenty years old Marketplace changes n Industry competition led SUNCOM to replace leased backbone with public switched network services Technology changes n n Continuing ramifications of the Internet Protocol Open systems Make rules comport with Statutes n n Subsection 282. 103 (3), F. S. calls for “exemptions” for use of communications services outside of SUNCOM CPLA process had vague statutory basis, i. e. nothing in F. S. about hardware approvals

Rule Change Process: Publications, Announcements and Input Required n n n Administrative weekly Workshop One Public Hearing (if requested) Additional n n Invitations to CIOs with drafts Invitations to customers with drafts Two extra public hearings Meetings with: Joint Administrative Procedures Committee Technology Review Workgroup House, Senate and Governor’s Office staff n Web site postings Latest internal rule drafts Meeting announcements Log of input and changes n Email input Posted rules

Intent of New Rules Foster collaboration Minimize duplication Promote compatibility Leverage economies of scale n n Bulk purchasing power Standardization of solutions Maximize network predictability and up-time Provide for basic network security Govern SUNCOM relationships n n With customers With vendors

60 FF-1 Highlights Definitions of terms Usage eligibility etc. Notices and requests to SUNCOM n n Notice of Security Concern Exemption Request Clearance Request Network Solution Replacement Declaration

Notice of Security Concern 60 FF-1. 005, F. A. C. Petitioners: n n Any customer using State Intranet Any vendor implementing an IP Network Solution for a SUNCOM customer Purpose: n n Notify SUNCOM of (potential) network security exposures Establish collaborative conditions Get SUNCOM’s help Secure SUNCOM’s sanction Circumstances: n n A Customer establishes or is aware of existing or expected conditions not in compliance with SUNCOM security standards A vendor plans to implement a Network Solution in violation of SUNCOM security standards SUNCOM possible responses n n Authorize Conditionally authorize Negotiate alternatives Disallow Process

Exemption Request 60 FF-1. 007 -1. 012, F. A. C. Petitioners: n Required User Purpose: n To notify SUNCOM of a communications need Informal notice required upon identifying the Business Objective Two-parts in escalating detail n To obtain permission to use non-SUNCOM services Circumstances: n n Seeking to use a Network Solution not provided by SUNCOM Using an existing Network Solution not provided by SUNCOM after December, 2008 if not previously approved through a CPLA Expanding any CPLA approved Network Solution Continuing to use a CPLA approved Network Solution after the CPLA term (contract) ends for anything other than Maintenance SUNCOM possible response n n Seek collaboration Approve Conditionally approve Deny and suggest the SUNCOM alternative Process

Clearance Request 60 FF-1. 013 -1. 014, F. A. C. Petitioner: n Eligible Users who are a part of the State Intranet and are not Required Users Purpose: n Prevent security exposures from Network Solutions not covered by Exemption Requests Circumstances: n Customer wishes to implement a non-SUNCOM IP based Network Solution SUNCOM Responses n n Seek collaboration Approve Conditionally approve Deny and suggest the SUNCOM alternative Process

Network Solution Replacement Declaration 60 FF-1. 006, F. A. C. Petitioner: n Any SUNCOM customer Purpose: n Verify termination of a Network Solution for which no exemption, CPLA or security sanction has been obtained Circumstances: n n Customer intends to discontinue use of an unsanctioned Network Solution or configuration Customer was unable to obtain necessary SUNCOM approval for a Network Solution SUNCOM Responses n n Acknowledge Negotiate more rapid replacement

60 FF-2 Highlights Defines order processing and related responsibilities of SUNCOM, customers and vendors n n Codifies most of current process Allows for modernization Governs payment processing for SUNCOM, customers and vendors

60 FF-3 Highlights Provides conditions for changing or terminating services Provides Security Protection Standards Provides for address distribution and authorization on the State Network

60 FF-3 Security Protection Standards Highlights Any conditions that allow for Unauthorized Activity are prohibited. Absent approval through a Notice of Security Concern, the following are prohibited when they are not managed by SUNCOM: n n Backdoors Virtual Connections with the State Intranet; Tunnels with the State Intranet Remote access with the State Intranet. Authorization of these conditions and non-SUNCOM firewalls require the following: n n n Firewall transaction logs and; Appropriate and modern processes and tools for protecting the State Intranet and; Trained staff and; Monitoring activities and; Necessary transparency for SUNCOM. Use of scanning, discovery and automatic traffic generating tools must be approved to prevent: n n Alarming SUNCOM, its Providers and Customers. Impairing the State Network Remedies n n To limit damages and exposures To establish liability and liquidated damages Return to sending page

60 FF-3 Address Distribution Highlights SUNCOM will distribute or authorize all Internet Protocol Version Six (IPV 6) addresses on the State Network Customers must register all private IPV 4 addresses used outside of the customer’s Sub-network n SUNCOM will resolve duplicate usage in favor of the first to register Customers must provide a full listing of addresses upon request from SUNCOM

Summary of Rules Status Rules went into effect June 25 th, 2008 No more CPLAs New processes now required n n n Exemption Requests Notices of Security Concern Network Solution Replacement Declarations SUNCOM will ultimately provide complete plain language guides that preclude the need to read most of the rules n n n On-line Exemption forms have replaced on-line CPLAs SUNCOM Portfolio of Services will contain plain language explanations and templates These guides are not substitutes for the rules (per disclaimer on first slide) Future rule adjustments n n To correspond with AEIT rules To improve and refine with legislation

Definitions Business Objective Clearance Request CPLA Eligible User Exemption Request Maintenance Network Solution Replacement Declaration Notice of Security Concern Required User Sub-network Unauthorized Activity Hit “Esc” to return to sending page

Definition: Business Objective An operational or cost savings benefit expected from use of Network Equipment, Software or Services. The mere implementation, ownership or use of Network Equipment, Software or Services or Communications Devices shall not be considered to be a genuine Business Objective. Return to sending page Definitions Table of Contents

Definition: Clearance Request A request from a Customer, that is not a Required User, to implement a Network Solution that uses Internet technology and is not provided through SUNCOM. See 60 FF-1. 013 & 1. 014. Return to sending page Definitions Table of Contents

Definition: CPLA Communications Purchase or Lease Authorization The means that was used by Required Users to seek and obtain approval from DMS to purchase or lease communications equipment prior to establishment of Chapter 60 FF, F. A. C. Return to sending page Definitions Table of Contents

Definition: Eligible User Qualifying user of SUNCOM Services including state agencies, county and municipal agencies, public schools and districts, private, nonprofit elementary and secondary schools (provided they do not have an endowment in excess of $50 million), state universities, community colleges, libraries, water management districts, state commissions and councils, and nonprofit corporations. Any entity ordering or using or paying for a SUNCOM Service must be an Eligible User. Return to sending page Definitions Table of Contents

Definition: Exemption Request A request from Required Users seeking Department approval to use Network Solutions that are not provided through SUNCOM. See 60 FF-1. 007 through 60 FF-1. 012, F. A. C. Return to sending page Definitions Table of Contents

Definition: Maintenance Activity to ensure the ongoing availability of a Network Solution through replacement of parts, software patches and associated services without expanding the scope, functionality, volume by more than 10% over the volume that was approved by SUNCOM, or changes to the architecture of the Network Solution. Return to sending page Definitions Table of Contents

Definition: Network Solution Use of Network Equipment, Network Software and/or Network Services to meet a Business Objective. Return to sending page Definitions Table of Contents

Definition: Network Solution Replacement Declaration A commitment from a Customer to replace a Custom Network Solution with a SUNCOM solution by a specific date. See 60 FF-1. 006, F. A. C. Return to sending page Definitions Table of Contents

Definition: Notice of Security Concern A statement warning DMS that a condition exists that may violate DMS Security Standards. See 60 FF-1. 005, F. A. C. Return to sending page Definitions Table of Contents

Definition: Required User All state agencies and state universities mandated to use SUNCOM in Section 282. 103, F. S. 282. 103 SUNCOM Network; exemptions from the required use. -(1) There is created within the Department of Management Services the SUNCOM Network which shall be developed to serve as the state communications system for providing local and long-distance communications services to state agencies, political subdivisions of the state, municipalities, state universities, and nonprofit corporations … (3) All state agencies and state universities are required to use the SUNCOM Network for agency and state university communications services as the services…If a SUNCOM Network service does not meet the communications requirements of an agency or university, the agency or university shall notify the State Technology Office in writing and detail the requirements for that communications service. If the office is unable to meet an agency's or university's requirements by enhancing SUNCOM Network service, the office may grant the agency or university an exemption from the required use of specified SUNCOM Network services. Return to sending page Definitions Table of Contents

Definition: Sub-Network established by Customers within, or attached to, the broader State Network that is maintained by SUNCOM. Return to sending page Definitions Table of Contents

Definition: Unauthorized… Access - Any sign-on and/or log-on activity accessing any part of the State Network and/or connected devices performed by an Unauthorized User. Activity - Unauthorized Access to, Unauthorized Connection to, Unauthorized Traffic on and Unauthorized Use of the State Network. Connection - Any virtual private network, private virtual circuit, extranet and/or point-to-point connection to the State Network that has not been disclosed to and recorded by the Department. Traffic - Any communications transported across the State Network that is not directly relevant to state business and/or that is directed to or from an Unauthorized User - Individual user not affiliated with and authorized by a current Customer of SUNCOM who is using the State Network. Return to sending page Definitions Table of Contents