TABLE OF CONTENTS

TERMS AND ABBREVIATIONS................................................................................... 4

1. GENERAL INFORMATION.......................................................................................5
2. PROJECT BOUNDARIES.........................................................................................6
3. AIMS AND OBJECTIVES FOR THE ESTABLISHMENT OF A SECURITY DECISION
ANNEX............................................................................................................................. 7
3.1 Objectives for creating the Security Solution Annex............................................7
3.2 Tasks Security Solutions Annex..........................................................................7
4. ARCHITECTURE REQUIREMENTS SECURITY SOLUTIONS APPLICATION..........8
5. FUNCTIONAL REQUIREMENTS FOR THE SOLUTION...........................................9
5.1 General Solution Requirements..........................................................................9
5.2 Requirements to the functions performed by the Solution...................................9
5.3 Reporting requirements Security solutions app.................................................10
6. IT INFRASTRUCTURE REQUIREMENTS..............................................................11
6.1 Technical support requirements........................................................................11
6.2 Accessibility requirements.................................................................................11
6.3 Diagnostic requirements Safety Solutions Appendix Appendix.........................11
6.4 Scaling requirements Security solutions application..........................................11
6.5 Reliability Requirements Safety Solutions Annex..............................................11
6.7 Requirements for integration with infrastructure services..................................12
6.8 Software requirements...................................................................................... 12
6.9 Requirements for technical means....................................................................12
6.10 Energy efficiency requirements.......................................................................12
6.11 Requirements for the supply of materials, equipment and software................12
6.12 Requirements for user workstations Security solutions Application.................13
7. REQUIREMENTS FOR CYBERSECURITY............................................................14
7.1 Requirements for the technical solution to ensure cybersecurity Security
solutions application................................................................................................14
7.2 Recording of significant events cybersecurity....................................................14
7.3 Ensuring the integrity of the program environment............................................14
7.4 Requirements for protection of information from unauthorized access..............14
7.5 Backup requirements.........................................................................................15
8. PROJECT MANAGEMENT REQUIREMENTS........................................................16
9. REQUIREMENTS FOR ORGANIZATION OF COMMISSIONING WORKS..............17
10. REQUIREMENTS TO THE RESULTS OF WORK.................................................18
11. WARRANTY SERVICE REQUIREMENTS............................................................19
 12. REQUIREMENTS FOR THE NUMBER AND QUALIFICATIONS OF PERSONNEL
SERVICING THE SOLUTION AND THEIR WORKING HOURS.......................................21
13. DOCUMENTATION REQUIREMENTS..................................................................22
13.1 Requirements for the composition of operational documentation....................22
13.2 Requirements for documentation execution....................................................22
Glossary
The following terms and abbreviations are used in this document:
Designation Description
IT Information Technology
OS Operating System
AI Artificial Intelligence
API Application Programming Interface
CI/CD Continuous Integration/Continuous Delivery (a
combination of continuous integration and continuous
deployment of software in the development process)
Git Distributed Version Control Application Security
Solution
GitLab Git repositories management tool
Gitlab CI A tool built into GitLab for task automation
Jenkins An open source Java-based application security
software solution designed to provide a process for
continuous software integration
SBOM File format used as entry data for SCA analysis
SVN Free centralized Version Control Application Security
Solution
 1. General Information

Full name of the Application Security Solution: Program Complex for Software
Security Control in the Corporate Information Solution (hereinafter referred to as the
Application Security Solution)
Contractor: Name of the Contractor's organization - ... (hereinafter referred to as the
Contractor) is determined by the results of an open tender.
Customer: Name of the Customer's organization - ... (hereinafter referred to as the
Customer).
 2. Project Schedule
Planned start and end dates for the creation of the Security Solution Annex:
 Planned work start date:_______
 Expected completion date:_______

Timeframes of work execution are determined by the calendar schedule of work

execution. The work schedule is agreed upon at the stage of conclusion of the work
contract and is its integral part. The deadlines may be revised in the course of works
with the consent of both parties.
 3. Objectives for creating an Application Security Solution
3.1. Objectives of creating an Application Security Solution
An application security solution is created with the purpose of:
 Development and implementation of control mechanisms for software transfer to
the Customer.
 Increasing control over software development in the interests of the Customer.
 Bringing the software development process into compliance with regulatory
requirements.
3.2. Tasks of Application Security Solution
An application security solution shall:
 Perform analysis for possible vulnerabilities and undeclared capabilities in the
software used by the Customer.
 Be compliant with the requirements of data protection by regulatory bodies.
 Reduce the cost of remediation for late-stage vulnerabilities discovered in a
running application, and prevent customer losses due to compromised or failed
applications.
 Reduce the risks of application failures and system downtime due to security
issues.
 4. Architecture requirements of Application Security Solu-
tion
The Solution architecture shall provide fast and fault-tolerant Application Security
Solution. User interaction, task distribution, and code analysis are performed by
separate modules. In addition, depending on the Customer’s needs, modules for
analyzing applications in different programming languages, dynamic application
security analysis, and software composition analysis, AI capabilities can be included /
not included in the installation.
An application security solution should consist of the following subsystems:
 static analysis subsystem
 dynamic analysis subsystem
 subsystem for analyzing third-party components
 supply chain analysis subsystem
 license risks analysis subsystem
 reporting subsystem
 5. Functional requirements for the Application Security So-
lution
5.1. General Requirements for the Solution
The following functions shall be part of the Solution:
 analyzing software for compliance with the cybersecurity requirements by source
code
 analyzing software for compliance with cybersecurity requirements by byte-code
(by static analysis method) in the absence of debug info and source codes
 analyzing software for compliance with the requirements of cybersecurity by the
method of dynamic analysis
 identification of undeclared capabilities in the software
 identification of vulnerable third-party components
 supply chain analysis
 license risks analysis
 AI-powered, automatic triage of raw results obtained after static analysis
 AI-powered, automatic fix generation for detected vulnerabilities
 trust assessment for third-party components in use
 based on the results of application analysis, the Solution shall issue
recommendations on how to configure cybersecurity features for such
vulnerabilities and undeclared capabilities, the exploitation of which can be
prevented by configuring the protection systems

Vulnerabilities and undeclared capabilities should be identified using the following static
analysis methods:
 pattern analysis
 control flow analysis
 taint analysis
 synonym analysis
 constant propagation analysis
 type distribution analysis

5.2. Requirements for the functions performed by the Application Security

Solution

5.2.1. Requirements for software analysis by source code

Source code software analysis shall meet the following requirements:
 The Solution shall perform source code analysis in Java, Java for Android,
JavaScript, TypeScript, VBScript, Scala, HTML5, PHP, Python, Groovy, Kotlin,
Go, Ruby, C#, C/C++, Objective-C, Swift, ABAP, Apex, Solidity, PL/SQL, T/SQL,
Visual Basic 6.0, Delphi, COBOL, VBA, 1C, [Link], Perl, Vyper, [Link],
LotusScript, Pascal, Dart, Rust.
 The Solution shall translate the source code into an internal representation.
 The Solution shall provide build tools integration capabilities.
  The Solution shall provide correlation of results with the dynamic analysis
method when it has been performed for the application in question.
 Vulnerability and undeclared capabilities search methods described in Clause 5.1
shall be applied to the obtained internal representation.
 The Solution shall provide automatic triage, and have the ability to change
vulnerability statuses accordingly.
 The Solution shall provide automatic fixes for vulnerabilities, confirmed by
automatic triage.

5.2.2. Requirements for software analysis by byte code

Byte code analysis of software shall meet the following requirements:
 The Solution shall analyze byte-code obtained by translation from the following
programming languages: Java/Scala: JAR/WAR/EAR/AAR; C/C++: DLL/EXE;
Android: APK; Apple iOS: IPA.
 The Solution shall translate byte code into an internal representation.
 The Solution shall provide correlation of results with the dynamic analysis
method when it has been performed for the application in question.
 Vulnerability and undeclared capabilities search methods described in Clause 5.1
shall be applied to the obtained internal representation.
 The Solution shall provide automatic triage, and have the ability to change
vulnerability statuses accordingly.
 The Solution shall provide automatic fixes for vulnerabilities, confirmed by
automatic triage.

5.2.3. Requirements for software analysis by the dynamic analysis method

Analyzing software by the dynamic analysis method shall meet the following
requirements:
 The Solution shall analyze a running application (web application) by accessing it
over a network (TCP/IP), via the HTTP (HTTPS) protocol.
 The Solution shall have the ability to authenticate in the application by means of
login/password, token, headers, authorization forms, NTLM, when the application
has such functionality.
 The Solution shall have the ability to analyze the application using AJAX
requests.
 The Solution shall have the ability to exclude endpoints defined by the Customer
from the application analysis.
 The Solution shall be able to use the API definition of the application for analysis,
if this definition can be represented as a separate component on a dedicated
URL.
 The Solution shall allow for the selection of scan mode (setting attack
parameters).
 The Solution shall enable the correlation of results from static and dynamic
analysis.
 5.2.4. Requirements for software analysis by the software composition analysis
method
Software analysis by the software composition analysis method must meet the following
requirements:
 The Solution shall perform analysis of third-party components for known
vulnerabilities (CVEs) against the source code archive.
 The Solution shall perform analysis of third-party components for known
vulnerabilities (CVEs) against the SBOM file.
 The Solution shall perform a supply chain security analysis with an SBOM file.
 The Solution shall perform license risk assessment of third-party components
with an SBOM file.
 The Solution shall provide an automatic SBOM file generation feature.
 The Solution shall provide the feature to export the SBOM file, obtained during
the analysis.
 The Solution shall search for and deduplicate known vulnerabilities in the
following international databases:
- GitHub Advisory
- GitLab Advisory
- Google OSV Database
- NIST NVD
- As well as protestware/malware databases.
 The Solution shall look for undisclosed vulnerabilities in libraries before they
become known publicly by assessing the health of a component as a part of
Supply Chain Analysis;
 The Solution shall identify vulnerabilities related to Supply Chain attacks,
including the following types:
- Dependency Confusion
- Starjacking
- Typosquatting
- MavenGate.
 The Solution shall identify the unreliability of certain participants (hacktivism)
within the development community for third-party components.
 The Solution shall be able to integrate into CI/CD and SDLC.
 The Solution shall provide a version of the library to fix the vulnerabilities found.
 The Solution shall be able to perform reachability analysis – correlate the results
of static and software composition analysis (for JavaScript/TypeScript, C#, Java,
Python), including the following requirements:
- specifying a place in the code where an unsafe construction is called
- determining exploitability of the found vulnerability
- visualization of the call trace.
 The Solution shall assess the safety of each component in the software based on
the following criteria, which are derived from international security standards for
supply chain analysis (including the CIS Benchmark Secure Supply Chain):
- popularity of the library
- authorship assessment
- community activity
- interest in security
- the first version is suspiciously high
 - the library was created recently
- the developer's only project
- meeting the 2-person review requirement.
 The Solution shall be able to filter analysis results based on CVSS and EPSS
indicators to simplify the process of evaluating, prioritizing, and processing
detected vulnerabilities.
 The Solution shall provide the functionality to identify direct and transitive
dependencies in a project.
 The Solution shall implement the feature of creating and visualizing a
dependency tree graph for the project.
5.3. Reporting requirements for Application Security Solution
The Solution shall provide reporting on the results of the application analysis that
complies with the following requirements:
 All reporting should be provided in English.
 The report should meet specific requirements for different categories of users.
 The report should be provided in different forms depending on the method of
scanning performed (after dynamic, static or software composition analysis).
 For developers, the report should contain the progress of changes in the security
of the code being developed.
 For managers, the report should contain the progress of work on the project as a
whole.
 Administrators and users should be able to customize the information to the
report – select applications, select vulnerability categories.
 6. IT infrastructure requirements
6.1. Hardware requirements
Hardware Platforms for Servers. The Application Security Solution must meet the following
requirements:
Requirement Description
Number of processors at least 2
RAM capacity at least 64 GB
Storage capacity of the HDD at least 600 GB
Number of power supplies at least 2
Number of network interfaces at least 2

6.2. Accessibility requirements

The application security solution must support 24x7x365 operation with scheduled
maintenance breaks.
The Application Security Solution must provide modularity – the ability to use the
components of the Application Security Solution together or independently.
Any of the Application Security Solution hardware shall allow its replacement by a
means with similar functional and technical characteristics without any design changes
or adjustments to the rest of the Application Security Solution hardware (except as
specifically stated in the technical documentation for the components of the Application
Security Solution).

6.3. Diagnostic requirements for Application Security Solution

The application security solution should log actions taken by users to the appropriate
event logs.

Operational errors shall be displayed in the web interface of the Solution, and shall
contain information about the error to help correct the behaviour.

6.4. Scaling requirements for Application Security Solution

Solution architecture shall support that user interaction, task distribution and code
analysis are performed by separate modules. In addition, depending on the Customer's
needs, modules for application analysis in different programming languages, dynamic
application analysis and software composition analysis can be included / not included in
the installation.
6.5. Reliability requirements for Application Security Solution
The level of reliability of the Application Security Solution depends on the main factors:
 reliability and fault tolerance of the technical means used as part of the technical
infrastructure (server equipment, network equipment, user workstations)
 reliability of application software
 qualifications of personnel administering and maintaining the Solution
  quality of planning, and organization of maintenance works for the Application
Security Solution
 the components of the application software used must not compromise each
other's integrity
 external applications integrated with the Solution must function normally.

6.6. Requirements for integration with infrastructure services

The Solution shall provide integration capabilities that comply with the following
requirements:
 integration with SVN/Git development repositories
 CI/CD services: Jenkins, TeamCity, Azure DevOps Server, Gitlab CI
 VCS hosting services: GitHub, GitLab, BitBucket
 Jira task tracking tool
 integration with other systems and services should be available through an open
built-in API.

6.7. Software requirements

All software required to create the Application Security Solution, as well as licenses for
their use, must be purchased and executed in accordance with the license agreements
offered by the manufacturers.

6.8. Requirements for technical means

The Application Security Solution shall be designed for operation as part of the
Customer's IT infrastructure, comply with the Customer's established norms and
regulations, as well as recommendations of software and equipment manufacturers.
Technical and physical protection of hardware components of the Application Security
Solution, data carriers, uninterrupted power supply, routine maintenance shall be
implemented by technical and organizational means available to the Customer.
Routine maintenance of hardware and software shall be performed during the
Customer's business hours.
Regulatory works restricting the work of the Solution’s users shall be carried out by
agreement with the Customer during non-working hours for the departments processing
documents. If it is necessary to carry out such routine works during working hours, the
Solution users shall be warned in advance (at least 4 hours prior).

6.9. Energy efficiency requirements

The technical means required for the creation of the Application Security Solution in
terms of energy efficiency shall comply with the recommended requirements of software
and hardware manufacturers.
 6.10. Requirements for the supply of materials, equipment
and software
Within the framework of implementation of the Application Security Solution, new
corporate regulations shall be developed or existing corporate regulations shall be
adjusted in accordance with the procedure established by the Customer, which are
necessary for operation of the Application Security Solution to the extent of the
functionality provided for by this Technical Assignment.
6.11. Requirements for user workstations Security solutions application
The Solution user’s workstation must be equipped with a personal computer with a
connection to the company's internal network.
 7. Requirements for cybersecurity
7.1. Requirements for the cybersecurity provisioning
The Solution shall comply with the following cybersecurity requirements:
 Access control of the Solution users to Solution resources should be performed
in accordance with user privileges, managed by the administrator.
 Access to the Solution resources should be performed only with an individual
login and a password.
 User passwords must be stored securely, in the encrypted form.
 Access to the administrator functions should only take place using the
administrator's individual login and password.
 Access to the Solution’s functionality by hierarchy levels must be ensured.
 If the Solution user is inactive for a period of time, the Solution shall provide the
ability to automatically log out of the Application Security Solution.
 The actions of users and administrators should be logged.

7.2. Registration of significant cybersecurity events

The Solution shall provide the following functionality for the administrator role:
 view logs of user actions and the Solution’s operations.
The Solution shall provide the following functionality in the interface for the roles of
developer, cybersecurity officers, and supervisors:
 scan history.

7.3. Ensuring the integrity of the program environment

The Application Security Solution must provide modularity – the ability to use the
components of the Application Security Solution together, or independently.

Any of the Application Security Solution hardware shall allow its replacement by a
means with similar functional and technical characteristics without any design changes
or adjustments to the rest of the Application Safety Solution hardware (except as
specifically stated in the technical documentation for the components of the Application
Security Solution).

7.4. Requirements for protection of information from unauthorized access

The Solution shall provide the following functionality in the interface for the administrator
role:
 view a list of all users of the Solution
 change user credentials
 change access rights for users of the Solution

7.5. Backup requirements

Backup of the components of the Application Security Solution shall be performed in
accordance with the regulations established by the Customer.
 8. Project management requirements
The Solution shall provide the following functionalities:
 provide all information in English
 provide a single point of access to information provided by the Solution.

The interface of the Application Security Solution must be adapted for the following
categories of users:
 administrator
 moderator
 developer.
 Requirements for organization of commissioning works
Pre-commissioning shall be carried out after the Customer has ensured the following
conditions for implementation:

 provision of premises for the performance of work

 provision of infrastructure and computing power.

The Contractor shall develop and agree with the Customer on a commissioning plan
before the start of commissioning. The commissioning plan shall contain:
 installation and customization of equipment
 switching of network equipment, setting up network communication between
elements
 installation of system-wide software
 installation of the components of the Application Security Solution according to
the project documentation
 installing licenses for the components of the Application Security Solution
 customization of the components of the Application Security Solution according
to the project documentation
 comprehensive testing of the components of the Application Security Solution
and conducting pre-tests.
 9. Requirements to the results of work
The result of the work shall be a set of hardware and software tools of the Application
Security Solution created in accordance with the solutions of the technical project and
ready for pilot operation.
 10. Warranty service requirements
The warranty service is aimed at eliminating malfunctions of the Application Security
Solution, as well as defects that prevent normal operation of the software.
The period during which the software warranty is valid is stipulated in the license
agreement.
The Contractor provides warranty service only for its own software. Warranty service of third
party software is not provided.
As part of the software warranty service, the Contractor shall provide:
 possibility to place requests for warranty service in the automated system for
processing requests through the dispatch service, by e-mail
 when processing a request, possibility of extended diagnostics of problems and
issuing recommendations on their elimination (by means of remote monitoring
and management, provided that these means are accessed via the Internet)
 the results of decisions on requests, including:

- consultations on remediation of identified incidents

- telephone and e-mail consultations on issues related to the configuration
and administration of the Application Security Solution
- conclusion about the reasons for deviations from the correct behavior of the
Application Security Solution described in the documentation: misuse, error
in documentation, error in software
- recommendations for the operation of the Application Security Solution if
deviation from correct behavior is caused by its improper use
- temporary solutions for defects
- temporary solutions for identified errors, if possible
- estimation of the timeframe for release of the versions in which the identified
bugs will be corrected
 updates and fixes (patches), changes made within the current software version
within the warranty period;
 on request, new versions of product-component documentation.

Key parameters of warranty service:

№ Name Significance
1 Warranty service mode
(possibility for the user to address warranty cases)

1. Receiving requests by e-mail 24×7

1 Daily, around the clock
2 Remote issue diagnostics Provided
3 Response time to requests according to criticality level
3. VERY URGENT No more than
1 An error in the operation of software components 4 working hours
that results in a failure or malfunction of the
software, that can cause the user's business
processes to stop or degrade performance, and
that has no temporary resolution
3. URGENT No more than
2 An error in the operation of software components 8 working hours
that partially affects the user's business processes
3. STANDARD No later than
3 Issues or errors related to the operation of software next business day
components or related to the operational
documentation of the software (software
components) that do not affect the user's business
processes in any way, but are categorized as
software malfunctions.
 11. Requirements for the number and qualifications of personnel
operating the Solution and their working hours
Companies with the following qualifications, experience and competencies are eligible
to participate in the procedure for work on the creation of the Application Security
Solution as executors:
 The Contractor shall provide information on the team with experience in
implementing the proposed software product, similar solutions in productive
operation.
 The Contractor shall provide information on previously implemented systems of
the proposed software product, similar solutions in productive operation with
indication of the customer company.
 The Contractor shall meet the qualification criteria specified in the tender
documentation.
 12. Documentation requirements
12.1. Requirements for the composition of operational documentation
The following documentation should be developed as part of the project (may be
expanded to meet project objectives):
 general description of the Application Security Solution
 Technical requirements for the infrastructure on which the Application Security
Solution will be deployed
 user documentation.

12.2. Requirements for documentation execution

All documentation accompanying the project and submitted by the Contractor to the
Client shall be in the form of Microsoft Word files.