![](media/image1.png){width="3.207638888888889in"
height="1.1458333333333333in"}

*[(DUATS)]{.mark}*

SYSTEM CHARACTERIZATION

System Characterization Template FY08 Version 1.0

*01/30/08*

Prepared by:

Federal Aviation Administration

Air Traffic Organization

Name of Service Unit

**TEMPLATE INSTRUCTION**

1.  This template is to be used as the basis for the System
    Characterization document as part of ***both*** the Security
    Certification and Authorization Package (SCAP) and Annual Assessment
    document development process for Air Traffic Organization (ATO)
    National Airspace System (NAS) Operational, Mission Support, and
    Administrative systems. This template provides a framework for
    standardizing system SCAPs and Annual Assessments throughout the
    ATO. However, each user may add additional information to
    accommodate information required to accurately describe the system,
    as appropriate.

2.  Instructional notations and examples are provided in italicized text
    and should be deleted from the final document.

3.  Information to be filled in is in *[UPPERCASE ITALICIZED
    TEXT]{.mark}*. Highlighting should be removed.

4.  Retain template version number on finished document to facilitate
    document review.

5.  All security markings on the System Characterization should be in
    accordance with current FAA Order 1600.75 Protecting Sensitive
    Unclassified Information. Note: the SSI header and footer is
    required on the outside face of the last page of the document.

6.  Detailed descriptions, tables, figures, etc. are encouraged.

Table of Contents

[1.0 INTRODUCTION 1](#introduction)

[1.1. General System Information 1](#general-system-information)

[1.2. Purpose 1](#purpose)

[1.3. References 2](#references)

[1.4. Summary of Changes (revisions only)
2](#summary-of-changes-revisions-only)

[1.5. Document Organization 2](#document-organization)

[2.0 SYSTEM DESCRIPTION 3](#system-description)

[2.1. System Overview and Mission 3](#system-overview-and-mission)

[2.2. System Architecture 3](#system-architecture)

[2.2.1. [MAJOR SUBSYSTEM 1]{.mark} 3](#major-subsystem-1)

[2.2.2. [MAJOR SUBSYSTEM 2]{.mark} 4](#major-subsystem-2)

[2.3. System Interfaces, Interconnections, and Data Flow
5](#system-interfaces-interconnections-and-data-flow)

[2.3.1. External Interfaces 5](#external-interfaces)

[2.3.2. Internal Interfaces 6](#internal-interfaces)

[2.4. Security Categorization 6](#security-categorization)

[2.4.1. Personally Identifiable Information (PII)
7](#personally-identifiable-information-pii)

[3.0 SYSTEM ENVIRONMENT 8](#system-environment)

[3.1. Facility Description 8](#facility-description)

[3.2. System User Types 8](#system-user-types)

[3.3. Operational Agreements 8](#operational-agreements)

[3.4. Development, Support, and Maintenance
8](#development-support-and-maintenance)

[APPENDIX A SYSTEM LOCATIONS A-1](#system-locations)

[APPENDIX B ACRONYMS B-1](#acronyms)

List of Tables

[Table 1-1. General System Information 1](#__RefHeading___Toc179773817)

[Table 2-1. Example: Major Subsystem 1 Hardware/Firmware and Software
4](#__RefHeading___Toc179773818)

[Table 2-2. Example: Major Subsystem 2 Hardware/Firmware and Software
4](#__RefHeading___Toc179773819)

[Table 2-3. System Information Security Categories
6](#__RefHeading___Toc179773820)

# INTRODUCTION

This *DUATS System Characterization* documents the system description,
including the system overview and mission; system architecture; hardware
and software; internal and external connectivity; and system
data/information types, sensitivity, and criticality. The system
characterization is included as part of the *DUATS* Security
Certification and Authorization Package (SCAP)/Annual Security
Assessment.

## General System Information

Table 1-1 provides general system information for the system.

[]{#__RefHeading___Toc179773817 .anchor}Table 1-1. General System
Information

+-----------------------------------+-----------------------------------+
| System name                       |                                   |
+-----------------------------------+-----------------------------------+
| System acronym                    |                                   |
+-----------------------------------+-----------------------------------+
| System owner and telephone number |                                   |
+-----------------------------------+-----------------------------------+
| Organization responsible for this |                                   |
| system                            |                                   |
+-----------------------------------+-----------------------------------+
| System FIPS 199 Security          |                                   |
| Categorization                    |                                   |
|                                   |                                   |
| **SC** ~system~ =                 |                                   |
| {(**confidentiality**, *impact*), |                                   |
| (**integrity**, *impact*),        |                                   |
| (**availability**, *impact*)}     |                                   |
+-----------------------------------+-----------------------------------+
| Where in the Program\'s lifecycle | Check the phase(s) that applies:  |
| is the system?                    |                                   |
|                                   | -   Mission Analysis Phase        |
|                                   |                                   |
|                                   | -   Investment Analysis Phase     |
|                                   |                                   |
|                                   | -   Solution Implementation Phase |
|                                   |                                   |
|                                   | -   In-Service Management Phase   |
|                                   |                                   |
|                                   | -   Service Life Extension Phase  |
+-----------------------------------+-----------------------------------+
| If the system is deployed, how    |                                   |
| many sites?                       |                                   |
+-----------------------------------+-----------------------------------+

## Purpose

The purpose of this *DUATS* System Characterization is to provide a
single document that contains relevant system description information
for inclusion in the system SCAP/Annual Security Assessment, including
system architecture, interfaces, data/information types, and the general
system operations and maintenance environment.

## References

-   FAA Order 1370.82A, *Information System Security Program*

-   Federal Information Processing Standards (FIPS) Publication (PUB)
    199, *Standards for Security Categorization of Federal Information
    and Information Systems*

-   National Institute of Standards and Technology (NIST) Special
    Publication (SP) 800-53 as amended *Recommended Security Controls
    for Federal Information Systems*

-   *List all other references that are applicable for this system.*

## Summary of Changes (revisions only)

*If this is a change to the initial System Characterization, provide a
summary of changes (e.g., This System Characterization dated September
2007 replaces the System Characterization dated August 2004).*

## Document Organization

The remainder of this System Characterization contains the following
sections:

-   **2.0 System Description**−provides a detailed description of the
    system in terms of the system overview/mission; system architecture,
    including all major subsystems; system/subsystem hardware/firmware;
    software; external and internal interfaces, including system
    boundaries; data flows; and information sensitivity and criticality.

-   **3.0 System Environment**−describes system environmental factors,
    including the facility types where the system is located, system
    user types, and the development, support, and maintenance
    environment.

# SYSTEM DESCRIPTION

This section describes the functional and technical characteristics of
the *DUATS,* including: system overview and mission description; system
architecture; system interfaces; data type; and the criticality and
sensitivity of information that is received, processed, and transmitted
by the system.

## System Overview and Mission

*Provide a high-level description of the system functionality (e.g.,
what the system is and what it does) and FAA mission that the system
supports (e.g., system x consists of main frame computers and
workstations distributed throughout the NAS that process and transmit
flight plans in support of Air Traffic Control operations). In Appendix
A, identify all operational sites and all support sites (e.g. system
management facilities, system lab facilities, system development
facilities).*

## System Architecture

*Describe the overall system architecture and all major subsystems.
Provide an overall systems architecture diagram, including
identification of system interfaces, major subsystems, subsystem
hardware, firmware, and software assets. Support systems (both hardware
and software) that are used for development, operational support and
maintenance must be described. For networks and transmissions system,
the network management configurations need to be addressed.
Additionally, the Certification and Authorization (C&A) boundary must be
described, including diagrams or text to clearly delineate which
components are to be evaluated as part of the SCAP process and which are
not included. Elements not included in the C&A boundary must be
identified in paragraph 2.3.1 External Interfaces.*

### [MAJOR SUBSYSTEM 1]{.mark}

*Provide a detailed description of the first major subsystem in this
paragraph and associated subparagraphs. Each asset within a subsystem
must be identified and described. If the system is comprised of several
subsystems, then each major subsystem should be detailed in its own
paragraph. For example, if the system were comprised of three major
subsystems, then three subparagraphs would be required (e.g., 2.2.1,
2.2.2, 2.2.3). Tables 2-1 and 2-2 provide a recommended format for
detailing subsystem hardware/firmware and associated software.*

[]{#__RefHeading___Toc179773818 .anchor}Table 2-1. Example: Major
Subsystem 1 Hardware/Firmware and Software

+--------------+-------------------+---------------------+------------+
| **Item**     | **Ha              | **Operating         | **Appl     |
|              | rdware/Firmware** | System**            | ications** |
+--------------+-------------------+---------------------+------------+
| *Database    | *Dell PowerEdge   | *Windows 2000, SP4* | *Oracle    |
| Server*      | 3250*             |                     | 8.1*       |
|              |                   |                     |            |
|              | *2                |                     | *Open      |
|              | Intel^®^ X        |                     | Manage^TM^ |
|              | eon^®^ processors |                     | server     |
|              | at 1.8GHz to      |                     | assistant  |
|              | 3.0GHz*           |                     | software*  |
|              |                   |                     |            |
|              | *128MB to 6GB ECC |                     |            |
|              | SDRAM memory*     |                     |            |
|              |                   |                     |            |
|              | *365 GB internal  |                     |            |
|              | storage*          |                     |            |
|              |                   |                     |            |
|              | *Dual-Channel     |                     |            |
|              | RAID*             |                     |            |
+--------------+-------------------+---------------------+------------+
| *Maintenance | *Dell PowerEdge   | *Linux Version X.X, | *System    |
| Console*     | 2200*             | Kernal 2.4.23*      | controller |
|              |                   |                     | ap         |
|              | *2                |                     | plication* |
|              | Intel®            |                     |            |
|              |  Xeon® processors |                     | *System    |
|              | at 2.4GHz*        |                     | monitor    |
|              |                   |                     | ap         |
|              | *128MB to 6GB ECC |                     | plication* |
|              | SDRAM memory*     |                     |            |
|              |                   |                     | *Report    |
|              | *584GB internal   |                     | generation |
|              | storage*          |                     | ap         |
|              |                   |                     | plication* |
|              | *CD-R/W*          |                     |            |
|              |                   |                     | *MS Office |
|              | *3.5 Floppy       |                     | Suite      |
|              | Drive*            |                     | app        |
|              |                   |                     | lications* |
|              | *2 USB 2.0 Ports* |                     |            |
|              |                   |                     | *MS        |
|              | *1 IEEE1394 Port* |                     | Explorer   |
|              |                   |                     | 6.0*       |
+--------------+-------------------+---------------------+------------+
| *Message     | *Describe         | *Net BSD*           | *Custom    |
| Transfer     | hardware*         |                     | message    |
| Agent*       |                   |                     | transfer   |
|              |                   |                     | ap         |
|              |                   |                     | plication* |
+--------------+-------------------+---------------------+------------+

#### *[MAJOR SUBSYSTEM 1]{.mark}* Hardware/Firmware

*Describe the major hardware and/or firmware components that comprise
the subsystem, such as make, model number, processor type,
internal/external data storage devices, and other peripherals, if
applicable. If the system consists of numerous subsystems, identify the
hardware/firmware components broken out by each major subsystem*

#### *[MAJOR SUBSYSTEM 1]{.mark}* Software

*Describe the major software operating systems and applications that
comprise the subsystem, including vendor, version number, and what
software is installed on each hardware/firmware component listed in the
preceding paragraph. Define whether the software is
Commercial-off-the-Shelf (COTS), Government-off-the-Shelf (GOTS), or
developmental.*

### *[MAJOR SUBSYSTEM 2]{.mark}*

[]{#__RefHeading___Toc179773819 .anchor}Table 2-2. Example: Major
Subsystem 2 Hardware/Firmware and Software

  -------------- ----------------------- ---------------------- ------------------
  **Item**       **Hardware/Firmware**   **Operating System**   **Applications**

  Subsystem                                                     
  Asset A                                                       

  Subsystem                                                     
  Asset B                                                       

  Subsystem                                                     
  Asset C                                                       
  -------------- ----------------------- ---------------------- ------------------

#### *[MAJOR SUBSYSTEM 2]{.mark}* Hardware/Firmware

#### *[MAJOR SUBSYSTEM 2]{.mark}* Software

## System Interfaces, Interconnections, and Data Flow

*Interfaces, interconnections, and information flowing between this
system and other systems must be presented. Internal interfaces,
external interfaces, and system boundaries need to be included.*

### External Interfaces

*External interfaces define the C&A boundary between the system in
question and other systems external to the C&A boundary. Clearly define
the C&A boundary of the system. Describe external interfaces in terms of
the system/subsystem-to-external system interfaces and data exchanged
between this system under assessment and the external systems. If
subsystems interface with each other through some other external
transmission media of network, address functionally as an external
interface. Continuously connected interfaces as well periodic connected
interfaces (e.g. maintenance interfaces such as modems that may be
either continuously or periodically connected) must be included. Provide
a table or tables that efficiently list*

-   *Interfaces*

-   *Protocols*

-   *Ports*

-   *Services*

-   *Data types.*

### Internal Interfaces

*Describe internal interfaces in terms of the subsystem-to-subsystem
interfaces and data exchanged between subsystems. Present in tables to
list interfaces, protocols, and data types.*

## Security Categorization

*The ATO ISS Program Remediation Management Working Group performed a
FIPS-199 analysis for ATO Services. The results of the analysis defined
a FIPS-199 Security Categorization baseline for all ATO systems. The
baseline is available on the ATO ISS Program website URL, as follows:*

> <http://intranet.faa.gov/faaemployees/org/linebusiness/ato_online/ato_issp>

*The ATO System Security Categorization Baseline provides a starting
point for developing the system security categorization. Each system
owner should evaluate the security categorization baseline information
for applicability and accuracy for all information types that are
processed, transmitted or received by their system. If the system owner
determines that the baseline security categorization information is
inaccurate, then the system owner should contact the ATO ISS Program
**immediately** to resolve the issue.*

The security category (SC) of this system is determined based on the
impacts to C, I, and A of all system data, per Federal Information
Processing Standards Publication (FIPS PUB) 199 *Standards for Security
Categorization of Federal Information and Information Systems*. Table
2-3 identifies the system information and corresponding SC for each
information type. *(Examples are provided in Table 2-3).*

[]{#__RefHeading___Toc179773820 .anchor}Table 2-3. System Information
Security Categories

+--------------------------------+---+---+---+--------------------------+
| **Information Type**           | * |   |   | **SC for Overall         |
|                                | * |   |   | Information Type**       |
|                                | F |   |   |                          |
|                                | I |   |   |                          |
|                                | P |   |   |                          |
|                                | S |   |   |                          |
|                                | 1 |   |   |                          |
|                                | 9 |   |   |                          |
|                                | 9 |   |   |                          |
|                                | I |   |   |                          |
|                                | m |   |   |                          |
|                                | p |   |   |                          |
|                                | a |   |   |                          |
|                                | c |   |   |                          |
|                                | t |   |   |                          |
|                                | A |   |   |                          |
|                                | s |   |   |                          |
|                                | s |   |   |                          |
|                                | e |   |   |                          |
|                                | s |   |   |                          |
|                                | s |   |   |                          |
|                                | m |   |   |                          |
|                                | e |   |   |                          |
|                                | n |   |   |                          |
|                                | t |   |   |                          |
|                                | * |   |   |                          |
|                                | * |   |   |                          |
+================================+===+===+===+==========================+
|                                | * | * | * |                          |
|                                | * | * | * |                          |
|                                | C | I | A |                          |
|                                | * | * | * |                          |
|                                | * | * | * |                          |
+--------------------------------+---+---+---+--------------------------+
| > *Example: NAS Outage         | * | * | * |                          |
| > Statistics*                  | L | L | L |                          |
|                                | * | * | * |                          |
+--------------------------------+---+---+---+--------------------------+
| > *Example: Personnel Data*    | * | * | * |                          |
|                                | M | L | L |                          |
|                                | * | * | * |                          |
+--------------------------------+---+---+---+--------------------------+
| > *Example: Flight Plans*      | * | * | * |                          |
|                                | L | L | L |                          |
|                                | * | * | * |                          |
+--------------------------------+---+---+---+--------------------------+
| > *Example: Weather*           | * | * | * |                          |
|                                | L | L | L |                          |
|                                | * | * | * |                          |
+--------------------------------+---+---+---+--------------------------+
| > *Example: Airport Systems    | * | * | * |                          |
| > Layout*                      | L | L | L |                          |
|                                | * | * | * |                          |
+--------------------------------+---+---+---+--------------------------+

Based on the system information identified in Table 2-3, the SC for the
system and each subsystem is as follows:

**SC** ~subsystem\ 1~ = {(**confidentiality**, *impact*),
(**integrity**, *impact*), (**availability**, *impact*)}.

**SC** ~subsystem\ 2~ = {(**confidentiality**, *impact*),
(**integrity**, *impact*), (**availability**, *impact*)}.

**SC** ~system~ = {(**confidentiality**, *impact*), (**integrity**,
*impact*), (**availability**, *impact*)}.

### Personally Identifiable Information (PII)

*Use the following text as applicable:*

-   *The system does not contain PII,\
    \
    **OR***

-   *This system does contain PII which is documented in the PTA/PIA
    included with this SCAP/Annual Security Assessment (select one)*

# SYSTEM ENVIRONMENT

## Facility Description

*Identify and describe the facility type(s) where the system is located,
including but not limited to:*

-   *Manned Operational Sites (e.g., Air Route Traffic Control Centers,
    Towers, Systems Maintenance Offices, Automated Flight Service
    Stations)*

-   *Unmanned Operational Sites*

-   *Administrative facilities (Regional Offices, FAA Headquarters
    Offices)*

-   *Development, Support, and Maintenance Facilities*

-   *Contractor or Vendor Owned Facilities (e.g., Data Centers, Network
    Management Centers)*

*Additionally, describe where the system and subsystem components are
located within each facility type (e.g., the system is located in an
equipment room that is protected with a swipe-card device). Also
describe other environmental on-site equipment, including smoke
detectors, fire extinguishers, plumbing, and HVAC.*

## System User Types

*Identify the types of personnel who have local and remote access to the
system, including operators, system specialists, system administrators,
super users, FAA 1^st^ and 2^nd^ Level Support, contractors, vendors,
and other general system users. Identify what user types have access to
what subsystems (e.g., distributed systems located in various facilities
may consist of several subsystems that have restricted access to certain
user types).*

## Operational Agreements

*List and describe all system-related operational agreements such as
Memorandums of Agreement (MOAs) that may exist with other FAA (e.g.,
Extranet) and/or non-FAA (e.g., private industry or Department of
Defense) system users.*

## Development, Support, and Maintenance

*Describe the system development, support and maintenance environments.
Describe the process and controls for moving data between the
development, support, and maintenance environments. Topics may include,
but are not limited to the following:*

-   *Configuration management (e.g., describe formal NAS and/or
    Administrative Configuration Controls)*

-   *1^st^ and 2^nd^ Level Support*

-   *Local/remote maintenance procedures, including involvement of FAA
    and contractor/vendor maintenance personnel*

-   *Procedures for modifying/debugging software (local and remote),
    including how files with bugs are identified, transferred to the
    appropriate organization for resolution, tested, and reloaded onto
    the system*

-   *Maintenance/disposal, handling, storage, and marking of hard
    drives, magnetic/optical media, other devices, and documents that
    contain system data*

-   *What type of backups are performed (e.g., full, incremental) and
    how often*

####### SYSTEM LOCATIONS

  -----------------------------------------------------------------------
  **OPERATIONAL SITES**              **SYSTEM SUPPORT SITES**
  ---------------------------------- ------------------------------------
  *Examples: Houston ARTCC, Southern *Examples: William J. Hughes
  California TRACON, FAA             Technical Center, Mike Monroney
  Headquarters Building FOB10B,      Aeronautical Center, Vendor sites,
  Chicago Regional Office, St. Louis contractor sites, network operations
  Air Traffic Control Tower, Battle  centers, etc.*
  Mountain (unmanned facility). This 
  data may be obtained from the FSEP 
  for some NAS systems.*             

                                     

                                     

                                     

                                     

                                     

                                     

                                     

                                     

                                     

                                     

                                     

                                     

                                     

                                     
  -----------------------------------------------------------------------

####### ACRONYMS

  -----------------------------------------------------------------------
  **ACRONYM**           **NAME OF ACRONYM**
  --------------------- -------------------------------------------------
                        

                        

                        

                        

                        

                        

                        

                        

                        

                        

                        

                        

                        

                        

                        

                        
  -----------------------------------------------------------------------