Just-in-Time Pilot High Level Requirements

+-------+--------------------------------------------------------------+
| # U   |                                                              |
| ser/E |                                                              |
| xtern |                                                              |
| al In |                                                              |
| terfa |                                                              |
| ce Re |                                                              |
| quire |                                                              |
| ments |                                                              |
+-------+--------------------------------------------------------------+
| TI01  | The Just-in-Time system must have a standardized user        |
|       | interface.                                                   |
+-------+--------------------------------------------------------------+
| TI02  | The Just-in-Time system must support open messaging protocol |
|       | architecture.                                                |
+-------+--------------------------------------------------------------+
| TI03  | The Just-in-Time system must accept and route request for    |
|       | data to the appropriate states.                              |
+-------+--------------------------------------------------------------+
| TI04  | The Just-in-Time system must not store case detail data      |
|       | transferred between states.                                  |
+-------+--------------------------------------------------------------+
| TI05  | The Just-in-Time system must allow for communications in a   |
|       | platform independent manner.                                 |
+-------+--------------------------------------------------------------+
| TI06  | The Just-in-Time system must display data in Section         |
|       | 508-compliant views.                                         |
+-------+--------------------------------------------------------------+
| TI07  | The Just-in-Time system must only accept and route data from |
|       | and to users in authorized states.                           |
+-------+--------------------------------------------------------------+
| TI08  | The Just-in-Time system must provide case identifying        |
|       | information on every page of the display.                    |
+-------+--------------------------------------------------------------+
| *     |                                                              |
| *Data |                                                              |
| Requ  |                                                              |
| ireme |                                                              |
| nts** |                                                              |
+-------+--------------------------------------------------------------+
| TD01  | The Just-in-Time system must display an 'as of' date with    |
|       | the case identifying information.                            |
+-------+--------------------------------------------------------------+
| TD02  | The Just-in-Time system must accept and send all of the data |
|       | elements specified in the Data Standard for Interstate Pilot |
|       | Payment Data Exchange document.                              |
+-------+--------------------------------------------------------------+
| TD03  | The Just-in-Time system must accept and display a Family     |
|       | Violence indicator for a participant.                        |
+-------+--------------------------------------------------------------+
| #     |                                                              |
|  Func |                                                              |
| tiona |                                                              |
| l Req |                                                              |
| uirem |                                                              |
| ents  |                                                              |
+-------+--------------------------------------------------------------+
| TF01  | The Just-in-Time system must present data organized by case  |
|       | in a logical manner.                                         |
+-------+--------------------------------------------------------------+
| TF02  | The Just-in-Time system must display OCSE approved           |
|       | disclaimers regarding the use of the data.                   |
+-------+--------------------------------------------------------------+
| TF03  | The Just-in-Time system must provide printer-ready view of   |
|       | the information and include OCSE approved disclaimers        |
|       | regarding the use of the data.                               |
+-------+--------------------------------------------------------------+
| TF04  | The Just-in-Time system must validate transaction formats    |
|       | before routing data between states.                          |
+-------+--------------------------------------------------------------+
| TF05  | The Just-in-Time system host server must accept inbound      |
|       | requests for data in HTML or XML.                            |
+-------+--------------------------------------------------------------+
| TF06  | The Just-in-Time system host server must provide data        |
|       | received from the providing state to the requesting state in |
|       | the same format in which it received the request.            |
+-------+--------------------------------------------------------------+
| TF07  | The Just-in-Time system host server must provide data        |
|       | received from the providing state to the requesting state    |
|       | within 10 seconds after receipt when there are 100 or fewer  |
|       | concurrent users.                                            |
+-------+--------------------------------------------------------------+
| TF08  | The Just-in-Time system must provide authorized users with a |
|       | list of the participating states.                            |
+-------+--------------------------------------------------------------+
| TF09  | The Just-in-Time system must provide context sensitive Help  |
|       | for all fields.                                              |
+-------+--------------------------------------------------------------+
| TF10  | The Just-in-Time system must collect and report data to      |
|       | measure system performance.                                  |
+-------+--------------------------------------------------------------+
| TF11  | The Just-in-Time system must collect and report data to      |
|       | measure functional usage.                                    |
+-------+--------------------------------------------------------------+
| TF12  | The Just-in-Time system must allow for authorized states to  |
|       | be added incrementally.                                      |
+-------+--------------------------------------------------------------+

  ---------------- --------------------------------------------------------------
  **Security and   
  Audit            
  Requirements**   

  TS01             The Just-in-Time system must support point-to-point data
                   encryption.

  TS02             The Just-in-Time system must provide access to authorized
                   users only.

  TS03             The Just-in-Time system must maintain an audit trail of the
                   following information: the initiating state name and user
                   identification, system date and time stamp, the responding
                   state name and case ID, type of data requested, and
                   requesting/responding user IP address and status of response.

  TS04             The Just-in-Time system must pass the audit trail elements in
                   every data exchange.

  TS05             The OCSE web server must generate and use self-signed
                   certificates for authentication.

  TS06             The Just-in-Time system must store and use for authentication
                   one certificate for each state server IP address.

  TS07             The Just-in-Time system must use Secure Socket Layers (SSL)
                   between its web server and the state server.

  TS08             The Just-in-Time system must provide access to audit trail
                   data from OCSE to states.

  TS09             The Just-in-Time system must maintain the system time stamp in
                   GMT.

  TS10             The Just-in-Time system must have a process in place to change
                   the certificate if the state changes the certificate.
  ---------------- --------------------------------------------------------------

In addition to the high level requirements, constraints have been
identified that impact development options. These include: a) regulatory
policies; b) hardware limitations (e.g., signal timing requirements); c)
interfaces to other applications; d) reliability requirements. Those
identified for the Just-in-Time Pilot are listed below:

+----+-----------------------------------------------------------------+
| #  |                                                                 |
| Ju |                                                                 |
| st |                                                                 |
| -I |                                                                 |
| n- |                                                                 |
| Ti |                                                                 |
| me |                                                                 |
|  P |                                                                 |
| il |                                                                 |
| ot |                                                                 |
|  C |                                                                 |
| on |                                                                 |
| st |                                                                 |
| ra |                                                                 |
| in |                                                                 |
| ts |                                                                 |
+----+-----------------------------------------------------------------+
| C0 | The Just-in-Time system pilot must support the exchange of data |
| 01 | via an intranet.                                                |
+----+-----------------------------------------------------------------+
| C0 | The Just-in-Time system pilot software architecture must be in  |
| 02 | compliance with the SSA and ACF standards for web applications. |
+----+-----------------------------------------------------------------+
| C0 | The Just-in-Time system pilot must not be accessible to users   |
| 03 | via the Internet.                                               |
+----+-----------------------------------------------------------------+
| C0 | The Just-in-Time system pilot must support the two most recent  |
| 04 | versions of MS Internet Explorer, Mozilla and Netscape          |
|    | Communicator web browsers.                                      |
+----+-----------------------------------------------------------------+
| C0 | States participating in the Just-in-Time system pilot must have |
| 05 | auditing access capabilities (auditability).                    |
+----+-----------------------------------------------------------------+
| C0 | All users must be authenticated by the state and the            |
| 06 | authentication requirements must be included in the Memorandum  |
|    | of Understanding (MOU).                                         |
+----+-----------------------------------------------------------------+
| C0 | The responding state's case ID must be used for the input       |
| 07 | argument for data access.                                       |
+----+-----------------------------------------------------------------+
| C0 | The Just-in-Time system pilot must support either XML-RPC or    |
| 08 | SOAP.                                                           |
+----+-----------------------------------------------------------------+
| C0 | The state's proxy server must not be connected to the Internet. |
| 09 |                                                                 |
+----+-----------------------------------------------------------------+
| C0 | Encryption must be used between the proxy server and the        |
| 10 | browser.                                                        |
+----+-----------------------------------------------------------------+
| C0 | States must use one certificate for each server IP address.     |
| 11 |                                                                 |
+----+-----------------------------------------------------------------+

Below is a list of assumptions and/or project dependencies that have
been identified during discussions with the Workgroup.

+-------+--------------------------------------------------------------+
| # J   |                                                              |
| ust-i |                                                              |
| n-Tim |                                                              |
| e Ass |                                                              |
| umpti |                                                              |
| ons a |                                                              |
| nd De |                                                              |
| pende |                                                              |
| ncies |                                                              |
+-------+--------------------------------------------------------------+
| A001  | OCSE is responsible for configuring and maintaining all      |
|       | communications between the OCSE router and an OCSE web       |
|       | server used for the Just-in-Time pilot.                      |
+-------+--------------------------------------------------------------+
| A002  | Each state is responsible for developing and maintaining     |
|       | software to receive and respond to message-based requests.   |
+-------+--------------------------------------------------------------+
| A003  | The server employed by states for use in this pilot must be  |
|       | isolated from accessibility through the Internet.            |
+-------+--------------------------------------------------------------+
| A004  | States will authenticate and authorize the OCSE web server   |
|       | before responding to requests.                               |
+-------+--------------------------------------------------------------+
| A005  | States will authenticate their own users before accessing    |
|       | the OCSE web services. User authentication requirements are  |
|       | determined at the state level.                               |
+-------+--------------------------------------------------------------+
| A006  | States will be responsible for retrieving the requested data |
|       | from the statewide system.                                   |
+-------+--------------------------------------------------------------+
| A007  | HTTPS can be used to satisfy the point-to-point data         |
|       | encryption for the transfer of data over the intranet.       |
+-------+--------------------------------------------------------------+
| A008  | States will be responsible for developing and maintaining an |
|       | interface between their state users and their proxy server.  |
|       | States will route the request from the user between the      |
|       | proxy and an OCSE web server.                                |
+-------+--------------------------------------------------------------+
| A009  | The Just-in-Time system will allow HTTP for traffic between  |
|       | the host and the state for non-sensitive data.               |
+-------+--------------------------------------------------------------+
| A010  | The Just-in-Time system will be able to display current, up  |
|       | to one year, and available historical financial data.        |
+-------+--------------------------------------------------------------+
| A011  | The pilot design will consist of a hybrid of options 1 and   |
|       | 2.                                                           |
+-------+--------------------------------------------------------------+
| A012  | Case ID verification is not a requirement at the state       |
|       | level.                                                       |
+-------+--------------------------------------------------------------+
| A013  | Addressing non-repudiation at the state level is not a       |
|       | requirement.                                                 |
+-------+--------------------------------------------------------------+
| A014  | UDDI registry is not a requirement for the pilot.            |
+-------+--------------------------------------------------------------+
| A015  | States (responding and initiating) will individually         |
|       | maintain an audit trail of the following information: the    |
|       | initiating state name and user identification, system date   |
|       | and time stamp, the responding state name and case ID, type  |
|       | of data requested, and requesting/responding state IP        |
|       | address and status of response.                              |
+-------+--------------------------------------------------------------+
| A016  | Audit trail data elements will be passed by the state in     |
|       | every data exchange.                                         |
+-------+--------------------------------------------------------------+
| A017  | The providing state will provide data within 10 seconds      |
|       | after request when there are 100 or fewer concurrent users.  |
+-------+--------------------------------------------------------------+
| A018  | States will be able to receive data sent by the OCSE server, |
|       | retrieve the requested data from their system, and return    |
|       | the data to the OCSE server.                                 |
+-------+--------------------------------------------------------------+