Questions Vulnerablity Scanning.pdf

1. Page 3, SUMMARY OF REQUIREMENTS, states:

The Vendor shall provide a solution that has the ability to meet the following requirements. The equipment in the solution must be 100% redundant against all components, i.e., compute/storage nodes, node power supplies, node disk drives, management systems, etc.

Question: Is the Department looking for a DR, HA, or both?

DoS is looking for a High Availability solution. It would be good to have DR if it's not cost prohibitive.

2. In the section titled High – Considered Critical for our environment bullet on pages 3 &

4:

Bullet #2: Function across 2 geographically separate points of presence (POPs).

Question: Where are the 2 POP’s? Is there connectivity between them? Is one site a

DR site, HA site or both?

DoS has a continental region and a non-continental region that both require scanning. Yes, there is connectivity between the two. No, they are not DR or HA.

Bullet #5: Must provide continuous, uninterrupted detection (Always up, Always compliant).

Question: Can you please elaborate on this; do you want the scans run continuously?

High Availability is the solution for this. In the past, scanning solutions have gone down or performed in a degraded state. With today's technology, a suitable vendor should present and always up solution for their application. Scans will not run continuously but should be able to. Maintenance and updates also must be timely.

Bullet #13: Must have the ability to integrate with DoS cloud and virtual infrastructure (FedRamp approved is preferred).

Question: Please clarify – is the Dept looking for an on prem solution or SaaS?

Question: What cloud environment is the DoS Cloud? (AWS, AZURE, etc.?)

Please see RFI doc #4 under Current Cyber Security Architecture (Hybrid\IaaS). The scope for this project is not yet etched in stone. The information and environment description presented in this request is for the benefit of considering both. The

Statement of Work will present a more defined scope.

Bullet #15: Must have the ability to integrate with secure privilege access security tool.

Question: Please clarify if you mean integration with a PAM solution; if yes, which one? (Cyberark, etc.?)

Yes, this question is pertaining to privileged access management. CyberArk is critical. Please present other solutions that integrate with your product.

3. In the section titled Medium– highly-desired and will increase usability and efficiency of the product, page 4:

Bullet #1: The ability to collect data from remote endpoints that cannot be actively scanned.

Question: Please elaborate on endpoints that can’t be scanned? Does this mean air gapped networks and databases?

The solution must have the ability to scan low bandwidth sites, for example

DSL. The solution must have the ability to scan into a DMZ and also air gapped environments.

4. In the section titled Low - non-essential features that would improve the experience, but are not essential to operation or management of the product, page 4:

Bullet #3: Supported by multiple certified manufacturer resellers.

Question: Can you please explain what “certified manufacturer resellers” means?

Removed that bullet

5. On the top of page 5, “Justification”:

JUSTIFICATION

NIST 800-53 RA-3 (Risk Assessment)

NIST 800-53 RA-5 (Vulnerability Scanning)

NIST 800-53 SI-2 (Flaw Remediation)

Question: What exactly is the DoS asking for? Are you asking if our products adhere to these standards? Please explain further.

Removed

6. Page 5, under Services and Support, #5 (a):

Onsite support & solution optimization at the DoS Security Operations Center (SOC) in

Beltsville, MD for the period of performance in support of configuration and installation of the Contractor solution.

Question: What is the period of performance?

The period of performance will be a base year and multiple option years. Beginning in 3rd quarter of

FY21.

7. Does the 10 page response limitation incude the cover letter , executive summary and conclusion?

Yes