# About Electrosoft

Electrosoft is an Information Technology Services company focused on
solving complex problems in the Information Technology space, with a
special focus on IT security and information assurance. We have been
serving the Federal Government since 2001, assisting various departments
and agencies including the DOD, DOC, NIST, VBA, DHS, CMS, HHS, FAA, and
DEA. We are a Small, Woman-Owned and operated business, and a Small
Disadvantaged Business (SDB) Certified by the US Small Business
Administration. We have Cleared Facilities and Cleared Staff members. We
are available on various Government Contract Vehicles and Blanket
Purchase Agreements.

We serve our customers using an integrated approach based on expert
management, deep subject matter expertise and customized solutions. We
assist customers in identifying, building, and deploying Information
Security Solutions to protect their computer and network resources and
online transactions.

# CORE COMPETENCIES

Our core competencies include tabulated below.

+---------------------+------------------------------------------------+
| **Identity          | -   Federal Credentialing (HSPD-12, FIPS 201)  |
| Management and      |                                                |
| Digital             | -   E-Authentication technologies              |
| Credentials**       |                                                |
|                     | -   Security Standards (X.509, PKIX, SMIME,    |
|                     |     SSL/TLS, XMLDSIG)                          |
|                     |                                                |
|                     | -   Federal PKI Architecture                   |
|                     |                                                |
|                     | -   Public Key Infrastructure                  |
+---------------------+------------------------------------------------+
| **IT Security       | -   HSPD-12 Compliance (FIPS 201, NIST 800-73, |
| Management and      |     800-79)                                    |
| Compliance**        |                                                |
|                     | -   IT Security Regulatory Compliance (FISMA,  |
|                     |     OMB 130 App III, FIPS 199)                 |
|                     |                                                |
|                     | -   Enterprise Security Policies and           |
|                     |     Guidelines                                 |
|                     |                                                |
|                     | -   Risk and Vulnerability Assessments (NIST   |
|                     |     800-30)                                    |
|                     |                                                |
|                     | -   Certification and Accreditation (NIST      |
|                     |     800-37, DITSCAP)                           |
|                     |                                                |
|                     | -   Configuration Management                   |
|                     |                                                |
|                     | -   Contingency Planning and Continuity of     |
|                     |     Operations                                 |
|                     |                                                |
|                     | -   Intrusion Detection, Incidence Response    |
|                     |                                                |
|                     | -   Physical Security Assessments              |
+---------------------+------------------------------------------------+
| **Systems           | -   Design and Architecture for Next           |
| Engineering and     |     Generation Systems                         |
| Standards**         |                                                |
|                     | -   Concept of Operations                      |
|                     |                                                |
|                     | -   Systems Integration Strategy               |
|                     |                                                |
|                     | -   Advanced Technology Prototyping            |
|                     |                                                |
|                     | -   Technology Demonstrations                  |
|                     |                                                |
|                     | -   Functional and Interoperability Testing    |
|                     |                                                |
|                     | -   Development of Standards and Guidance      |
|                     |                                                |
|                     | Engineering Analyses and White Papers          |
+---------------------+------------------------------------------------+
| **Software          | -   J2EE, Java, EJB, Servlets, Portlets        |
| Development and     |                                                |
| Tools**             | -   XML and related technologies               |
|                     |                                                |
|                     | -   Web Applications and Web Services          |
|                     |                                                |
|                     | -   Service Oriented Architecture, Rational    |
|                     |     Unified Process                            |
|                     |                                                |
|                     | -   Identity Management Portals                |
|                     |                                                |
|                     | -   Microsoft .NET Architecture                |
|                     |                                                |
|                     | -   Microsoft Cryptographic API                |
|                     |                                                |
|                     | -   Document Management Solutions              |
+---------------------+------------------------------------------------+

# Electrosoft's Product Portfolio

-   Electrosoft Security Web Audit Tool (ESWAT) - Web-based tool that
    automates the management and reporting of security data for IT
    Certification and Accreditation

-   HSPD-12 Compliance and Gap Analysis Tool (ESWAT-PIV) - Online tool
    that facilitates the assessment of HSPD-12 and PIV Card issuance
    systems against NIST guidelines

-   Electrosoft Trust Rules Applicator (E-TRAP) - Plug-in for COTS PKI
    applications that allows the fine-tuned control of PKI Trust Anchors
    and their scope of applicability

# Electrosoft's Experience with HSPD-12 aND FIPS 201

Electrosoft plays a very unique role amongst various service providers
that offer FIPS 201 related services to federal agencies. Not only do we
understand FIPS 201 and related guidance material thoroughly and can
support the implementation of FIPS 201 compliant ID systems, we
participated as a part of the core technical team that helped to create
the FIPS 201 standard.

-   Electrosoft was a part of the core team at NIST that developed
    FIPS 201. Areas of significant contributions include:

> --*Identity proofing, registration and issuance*
>
> --*Graduated assurance levels*
>
> --*PIV system architectural model and lifecycle definition*
>
> --*PIV logical credentials, including CHUID and PKI certificates*
>
> --*Management of the PIV Card and its credentials*
>
> --*PIV Card usage for identity authentication and access control*

-   Electrosoft assisted in the development of NIST SP 800-73:

> --*Wrote sections of Appendix A on PIV Data Model*
>
> --*Wrote the Appendix C on PIV Authentication Use Cases*

-   Electrosoft is supporting GSA and NIST in developing the PIV
    compliance test program for use through the NIST Personal Identity
    Verification Program (NPIVP):

> --*Developing PKI test cases and data for NPIVP and an automated test
> tool to conduct the tests*
>
> --*Developing PIV test program and test suites for GSA*

-   Electrosoft is implementing a PIV Card Demonstration Laboratory at
    NIST. Secure applications that will be demonstrated to operate with
    a PIV Card include:

> --*Microsoft Smart Card Logon*
>
> --*Client Authenticated TLS/SSL secure web session*
>
> --*Secure Email, IPSEC Virtual Private Network connections*
>
> --*Physical Access Control point*

-   Electrosoft has developed a Microsoft Cryptographic Service Provider
    (CSP) module for a PIV Card for NIST. Highlights of the CSP include:

> --*Ability to work with any Microsoft Application that invokes
> CryptoAPI*
>
> --*Ability to interface with the NIST PIV Middleware Reference
> Implementation*
>
> --*Ability to work with the NIST PIV Card Simulator*

-   Electrosoft is currently supporting the Department of Commerce,
    Office of Security in implementing a department-wide PIV-I
    compliance program. Primary activities include:

> --*Develop FIPS 201 compliant PIV Issuance procedures*
>
> --*Develop PIV-I Implementation Guidance for DOC and its PCI
> Facilities*
>
> --*Develop PIV Assessment Questionnaire*
>
> --*Use the ESWAT-PIV Assessment Tool to facilitate 800-79
> accreditation of DOC PCI facilities*