Questions_and_Answers_-_LSC_OIG_RFP_For_IT_Grantee_Vulnerability_Scans.pdf

Questions and Answers

LSC OIG RFP for LSC Grantees IT Vulnerability Scans

The LSC OIG received the following questions. Please note our answers:

Though neither LSC nor grantees are subject FISMA, have the security categorization of grantee systems (per FIPS-199) been determined? If so, how many grantee systems are Low, Moderate, or High impact systems?

We doubt this would have been done on any of the grantees.

Other appropriate guidance in the NIST 800 series, e.g., NIST SP 800-53 Rev. 4, discuss the value of running credentialed vulnerability scans, particularly for FIPS-199 Moderate and High impact systems. Does LSC expect credentialed vulnerability scans to be utilized while performing Part 1 assessment of external vulnerabilities? Does LSC expect credentialed vulnerability scans to be utilized while performing Part 2 internal vulnerability systems scans?

We believe they would not be credentialed for part 1 and credentialed for part 2.

From how many insertion points or logical locations will Part 2 internal vulnerability systems scans be conducted?

Probably only 1 unless there is a need for additional locations. We are not sure why additional locations would be needed, but we are not that familiar with the process.

Could you please provide a typical or average size (i.e. number of IP addresses) of a grantee that will be subject to vulnerability scans both from an internal and external perspective?

This would vary on the grantee. A medium sized grantee we recently conducted a financial audit had 45+ internal IP addresses. We estimate an average of 4 external IP addresses.

Will LSC provide specific templates for the site scan reports, monthly reports and annual reports?

No. The contractor should develop a standard template.

Will the licenses for Nessus be provided by LSC or by the contractor?

The Contractor is responsible for the software license.

Is there currently an incumbent performing this work? If so, whom?

No. This is a new IG initiative.

Has LSC determined the FIPS Impact rating for the sites to be assessed?

No. I am highly doubtful that this has been done. I would expect a moderate rating for most grantees.

Will LSC provide an inventory for each site prior to the assigned assessment?

No. This is a pilot program. Depending on the initial results, the program and effort could be expanded over time to cover a significant number of our grantees.

Is the Nessus Vulnerability Scanner acceptable for both the internal and external scans?

Yes. We are looking for an industry standard in vulnerability testing and we believe that NESSUS would meet that standard.

Is there an incumbent contractor or contractor(s) currently providing services to the

OIG/LSC?

No. This is a first time contract initiative for the OIG.

o If so, who is the incumbent(s)?

o If so, what are the contract number(s), award date(s), and contract value(s)

(total, as well as base and option years)?

Section 6 (Place of performance) states “External scans will be performed from the contractors’ offices and internal scans at grantees locations.” Could you please provide a list of the 5-15 expected grantee’s sites the contractor will need to work from?

They could be anywhere in the continental United States. We anticipate the first five to be in the Mid-Atlantic region.

Is there any chance that any of these sites would be located outside the United States?

There are some potential sites like Puerto Rico, St Croix, Guam. We do not anticipate doing these for the year or two.

Is remote vulnerability scanning allowed?

External scans would be ok. If the contractor has a viable solution for doing an internal scan remotely, we would consider that as well.

Does LSC have any preference for an industry standard vulnerability scanner?

No.

Will the contractor be required to scan:

o Systems o Networks o Applications o Websites

Yes. We are looking to identify vulnerabilities and offer solutions for remediation.

What is the approximate size of each internal scan?

This would vary on the grantee. A medium sized grantee we recently conducted a financial audit had 45+ internal IP addresses

What is an approximation of how many IP addresses need to be scanned with Nessus?

We estimate an average of 4 external IP addresses.