Appendix B_EDR_EPP Reqs March 4 2025.xlsx
XLSX spreadsheet 83 KB Posted
- Solicitation number
- 36C10B25Q0203
About this file
This file is an Excel spreadsheet containing detailed technical requirements for an Enterprise Endpoint Protection (EPP) solution for the Department of Veterans Affairs (VA). The requirements document outlines specifications across seven major categories: General Requirements, EPP Operational Requirements, Cyber Hunt & Threat Analysis Requirements, Incident Response Requirements, Endpoint Forensics Requirements, Heuristic Behavior Analytics Requirements, and Application Control Requirements.
The solution must support at least 200,000 devices with scalability up to 600,000+ endpoints across multiple operating systems including Windows, Linux, Unix variants, and VMware. Key capabilities required include malware detection/prevention, host-based firewall, application whitelisting, device control, threat intelligence sharing, forensics capabilities, and integration with existing VA security tools. The solution must meet federal security requirements including FIPS 140-2 compliance, FedRAMP certification if cloud-based, and Section 508 compliance. Specific technical requirements address areas such as encryption, forensic analysis, incident response, threat detection, remote management, reporting capabilities, and system resource utilization limits. The solution must integrate with ServiceNow, Active Directory, SIEM systems and support both on-premise and cloud environments while maintaining functionality for air-gapped networks.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 36C10B25Q0203 0001.docx | DOCX document | |
| RFI Questions and Answers 3172025.pdf | ||
| Appendix B_EDR_EPP Reqs March 4 2025.xlsx | XLSX spreadsheet | |
| Appendix A - VASEES SERVICE LEVEL AGREEMENTS RFI.pdf | ||
| RFI QUESTIONS 36C10B25Q0203.pdf | ||
| PWS VASEES RFI.pdf | ||
| 36C10B25Q0203.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Endpoint (EPP) Solution Requirements | ||||||||||||||||||||||||||
| Spec# | Description | Solution Capability | OS Type | Detailed Response | ||||||||||||||||||||||
| .00. | General requirements (common requirements for most CSOC tools / technologies / vendor products) | Y | N | Windows Server 2003 | Windows Server 2008 | Windows Server 2008 R2 | Windows Server 2012 | Windows Server 2012 R2 | Windows Server 2016 | Windows Server 2019 | Windows Server 2022 | CentOS Linux | IBM Unix | Linux | Red Hat Linux 4.0-6.x | Red Hat Linux 7.x | Red Hat Linux 8.x | Red Hat Linux 9.x | SUN Unix | Solaris | SUSE Linux 11 & 12 | SUSE Linux 15 | Ubuntu Linux | VMWare Photon | Other | Please provide a response outlining gaps or deltas comparing all checked applicable OS versions that clearly describe how this requirement is met based on the solution used for the response and which vendor technology is used if the solution includes multiple. |
| GEN.00.01 | Solution must have demonstrated the ability to provide a full enterprise host endpoint monitoring solution scalable at 200,000 devices or above and OS types as defined | |||||||||||||||||||||||||
| GEN.00.02 | All communication between agents and console are encrypted | |||||||||||||||||||||||||
| GEN.00.03 | Utilizes FIPS 140-2 compliant encryption for data-in-motion and data-at-rest | |||||||||||||||||||||||||
| GEN.00.04 | Multiple OS support, full native manageability within the console to include all current and planned OS deployments in the VA; must be able to support new OS's and Versions within 6 months of release/deployment at the VA | |||||||||||||||||||||||||
| GEN.00.05 | Modular system enabling the VA to update components and extend COTS functionality | |||||||||||||||||||||||||
| GEN.00.06 | Different levels of network throttling are available to control host system impact and bandwidth utilization | |||||||||||||||||||||||||
| GEN.00.07 | System admins can schedule endpoint scans and analyze jobs from console that execute on specified hosts | |||||||||||||||||||||||||
| GEN.00.08 | Agents, updates, and patches are deployable with standardized deployment methods, systems, and tools | |||||||||||||||||||||||||
| GEN.00.09 | Logging levels can be calibrated to control the types and volume of logged events on the agent and console but are able to meet all M-21-31 requirements | |||||||||||||||||||||||||
| GEN.00.10 | Agents can be persistent or deployed to hosts of interest on demand | |||||||||||||||||||||||||
| GEN.00.11 | Enables multiple analysts to connect to the system and run jobs concurrently | |||||||||||||||||||||||||
| GEN.00.12 | Utilizes a web-based user interface to the console. If more than one web based interface is needed to manage endpoints i.e. policy assignment, task assignments, product updates, endpoint health, and creating and running actionable reports. List those interfaces and which items from the list can be managed from each of the respective web interface. | |||||||||||||||||||||||||
| GEN.00.13 | Supports a simple to use query language that allows queries to be easily constructed against all available data sources | |||||||||||||||||||||||||
| GEN.00.14 | Create and run summary and detailed reports, as a scheduled job or manually on demand using either canned or user-customized options. | |||||||||||||||||||||||||
| GEN.00.15 | Reports can be created via a GUI report wizard without the requirement to use scripting or query languages for report creation and generation. | |||||||||||||||||||||||||
| GEN.00.16 | Reports can be created by generating custom queries against the threat database | |||||||||||||||||||||||||
| GEN.00.17 | Allows the export of reports in multiple formats (DOC, DOCX, PDF, XML, CSV at a minimum) via email, download, or posting to a share. The capability must be native to the relevant product console. | |||||||||||||||||||||||||
| GEN.00.18 | Threat alerts are delivered to the centralized console and security team users notified | |||||||||||||||||||||||||
| GEN.00.19 | Single central database console for actively querying for files (names, type, hash, or other) with role-based access capabilities | |||||||||||||||||||||||||
| GEN.00.20 | Event data and scan results across concurrently running agents are collected within a centralized, queryable database | |||||||||||||||||||||||||
| GEN.00.21 | Near real-time enterprise visibility (1 hour or less from the relevant console) across the entire network infrastructure including endpoints, servers, cloud, systems, and applications to include off-network clients. | |||||||||||||||||||||||||
| GEN.00.22 | Real-time analysis of collected event data and alerts from all security devices | |||||||||||||||||||||||||
| GEN.00.23 | Minimal host and enterprise resource impact from endpoint agent (example, network utilization, processing, memory,etc) | |||||||||||||||||||||||||
| GEN.00.24 | Support medical device endpoints without internet or cloud connectivity. | |||||||||||||||||||||||||
| GEN.00.25 | API-driven integration with other security tools | |||||||||||||||||||||||||
| GEN.00.26 | Ability to automatically ingest data, such as IOC feeds in a common format | |||||||||||||||||||||||||
| GEN.00.27 | Ability to automatically export data in a standard format | |||||||||||||||||||||||||
| GEN.00.28 | Ability to allow query of data via APIs | |||||||||||||||||||||||||
| GEN.00.29 | Ability to integrate with visualization tools | |||||||||||||||||||||||||
| GEN.00.30 | Ability to integrate with Splunk and other SIEM for searching and correlation of all endpoint data | |||||||||||||||||||||||||
| GEN.00.31 | Must support all enterprise managed OS versions and device types | |||||||||||||||||||||||||
| GEN.00.31 | Must support on-premise and cloud hosted systems/devices | |||||||||||||||||||||||||
| GEN.00.32 | Must maintain the ability to communicate, query, and manage clients not connected to the enterprise network | |||||||||||||||||||||||||
| GEN.00.33 | Must be able to integrate with and manage devices therein large cloud service providers contracted with VA for cloud hosting (Azure, AWS, etc) | |||||||||||||||||||||||||
| GEN.00.34 | Must integrate with industry accepted security orchestration, automation and response (SOAR) products/vendors | |||||||||||||||||||||||||
| GEN.00.35 | Must be able to integrate with ServiceNow and other industry standard ticketing systems | |||||||||||||||||||||||||
| GEN.00.36 | Performance benchmarking via public communities (such as Virus Total), 3rd party testing services (such as NSS labs, others) | |||||||||||||||||||||||||
| GEN.00.37 | Compatibility with existing / planned endpoint agents such as DLP, NGAV, HBA | |||||||||||||||||||||||||
| GEN.00.38 | Ability to scale / perform at very large deployments ( 600,000 + endpoints) | |||||||||||||||||||||||||
| GEN.00.39 | Ability to work within a federated / distributed network while providing a common admin interface | |||||||||||||||||||||||||
| GEN.00.40 | Ability to fully function within air-gapped networks / devices | |||||||||||||||||||||||||
| GEN.00.41 | Zero / low false positive rate | |||||||||||||||||||||||||
| GEN.00.42 | RBAC to set and manage different administrative access levels for users | |||||||||||||||||||||||||
| GEN.00.43 | Integrate with Microsoft Active Directory for authentication | |||||||||||||||||||||||||
| GEN.00.44 | Centralized, role-centric console or dashboard to enable the real-time visibility of VA's endpoint security state | |||||||||||||||||||||||||
| GEN.00.45 | Provides clearly prioritized alerts and warnings | |||||||||||||||||||||||||
| GEN.00.46 | Provides intuitive administration workflows | |||||||||||||||||||||||||
| GEN.00.47 | If SaaS or cloud-hosted, shall provide security documentation with FEPPAMP templates within 90 days of contract award | |||||||||||||||||||||||||
| GEN.00.48 | If SaaS or cloud-hosted, shall provide 3PAO assessment of the cloud service within 180 days after completing FEPPAMP security documentation | |||||||||||||||||||||||||
| GEN.00.49 | If SaaS or cloud-hosted, shall respond to and remediate high severity risks documented in 3PAO assessment within 60 days | |||||||||||||||||||||||||
| GEN.00.50 | Solution MUST be FEPPAMP certified if a cloud component is part of the solution; certification MUST NOT be reliant on VA sponsorship | |||||||||||||||||||||||||
| GEN.00.51 | Solution must be to meet or certified 508 compliance | |||||||||||||||||||||||||
| GEN.00.52 | Solution must adhere to NIST and OMB federal requirements | |||||||||||||||||||||||||
| GEN.00.53 | Solution must be able to utilize varying levels of storage retention (active, warm storage, cold storage retention) | |||||||||||||||||||||||||
| GEN.00.54 | Solution must be able to adhere to MFA agency requirements for all access levels | |||||||||||||||||||||||||
| GEN.00.55 | Solution must be able to assign role-based account to include but not be limited to: reviewer, analyst, site/group admin, multiple site/group admin, and full administrator | |||||||||||||||||||||||||
| GEN.00.56 | Solution must maintain a complete audit log of all actions by each user within the management console. | |||||||||||||||||||||||||
| GEN.00.57 | Solution must be able to utilize certificate and PIV or equivalent based validation for access | |||||||||||||||||||||||||
| GEN.00.58 | Solution must offer a single point of administration across the entire solution set and all modules therein | |||||||||||||||||||||||||
| GEN.00.59 | Solution must provide industry standard level anti-virus and malware protection for all managed endpoint devices | |||||||||||||||||||||||||
| GEN.00.60 | Solution must provide industry standard level host-based firewall capabilities for all managed endpoint devices | |||||||||||||||||||||||||
| GEN.00.61 | Solution must provide industry standard level application containment based on a risk score automatically utilizing available threat heuristic behavior analysis of activities for all managed endpoint devices | |||||||||||||||||||||||||
| GEN.00.62 | Solution must provide external or peripheral device management (device control) for all managed endpoint devices | |||||||||||||||||||||||||
| GEN.00.63 | Solution must provide industry standard level application control whitelisting capabilities for all managed endpoint devices | |||||||||||||||||||||||||
| GEN.00.64 | Solution must provide industry standard level web traffic analysis and blocking capabilities for all managed endpoint devices | |||||||||||||||||||||||||
| GEN.00.65 | Solution must provide industry standard level threat intelligence sharing amongst all manage devices | |||||||||||||||||||||||||
| GEN.00.66 | Solution must maintain a high degree of 3rd party integration with other cybersecurity tools | |||||||||||||||||||||||||
| GEN.00.67 | Solution must be able to identify non-managed clients on network segments and/or cloud classless inter-domain routings (CIDRs) | |||||||||||||||||||||||||
| GEN.00.68 | Solution must provide industry standard level endpoint detection and response (EDR) and/or extended detection and response (XDR) capabilities for all managed endpoint devices |
| .01. | EPP Operational Requirements |
| EPP.01.01 | Risk management - determine scope of compromise |
| EPP.01.02 | Full asset inventory and profile reporting over a 24 hour, 1 week, 1 month, quarter, semi-annual, and yearly basis at minimum |
| EPP.01.03 | Automatic scanning of unknown files and performing file integrity checks |
| EPP.01.04 | Gather forensic data including but not limited to memory, volatile data, files, process data, and files on disk |
| EPP.01.05 | Continuous packet capture |
| EPP.01.06 | Contain and fix malicious files by quarantine and removal |
| EPP.01.07 | Blacklisting for malicious files, hashes, wildcard values, and file types. |
| EPP.01.08 | Continuous file whitelisting |
| EPP.01.09 | Application, folder, and file level whitelisting |
| EPP.01.10 | Identify and report capabilities and behaviors of binaries and processes to the analyst |
| EPP.01.11 | Can perform static, on-demand malware detection scans of folders, drives or devices such as USB drives and network share locations |
| EPP.01.12 | Suspicious event data can be stored in a centralized location, for retrospective IOC/IOA searching and analysis |
| EPP.01.13 | Allows real-time IOC/IOA searching across all endpoints |
| EPP.01.14 | Allows remote quarantining or network resource isolation of an endpoint, restricting network access to only the EPP management server and/or other forensic applications |
| EPP.01.15 | Automatically update policies, controls, security postures, definition files, and new agent/engine versions without connecting directly to the VA network |
| EPP.01.16 | Continues to collect event data when device is outside of the VA network |
| EPP.01.17 | Ability to update indicators of attack or compromise from threat intelligence sources other than the proprietary signatures and indicators from the vendor (API, STIX/TAXII or other standard indicator sharing connection) |
| EPP.01.18 | Ability to detect file-based malware |
| EPP.01.19 | Ability to detect fileless or memory-based malware |
| EPP.01.20 | Ability to detect malware based on signatures |
| EPP.01.21 | Ability to detect malware based on heuristics |
| EPP.01.22 | Ability to detect malware based on behavior analytics |
| EPP.01.23 | Ability to use and provide reputation scoring data for all endpoint protection actions |
| EPP.01.24 | Ability to detect malware based on threat intelligence data |
| EPP.01.25 | Alerting on intrusion attempts and must allow for custom signature creation and IOC ingestion |
| EPP.01.26 | Detections and alerts include severity and confidence indicators to aid in prioritization |
| EPP.01.27 | Detects suspicious and malicious activity based on the behavior of a process |
| EPP.01.28 | Ability to detect lateral movement in APTs on the network. Detect workstation to workstation communications. Detect communication attempts to Domain Controllers or other HVAs that require "jump box" or controlled access from specific administrator machines/servers. |
| EPP.01.29 | Must not impair authorized system operations (e.g., patching, scanning, business software usage, information assurance tools/initiatives, secure host baseline, assured compliance assessment solution, etc.) nor shall it degrade managed system performance in any way, which may adversely impact a system's primary business functions. |
| EPP.01.30 | Software updates are pushed to the server over the network and the agents can be updated without reboot. Additionally Patches, Updates, Engines, Agents and Version must be capable of being evaluated, tested, and pass a configuration review prior to role out . |
| EPP.01.31 | Product should provide Devices Control management for all managed endpoints |
| EPP.01.32 | Product should provide Device Control policy that is granular enough to allow specific user and device ID customization across managed endpoint devices |
| EPP.01.33 | Device Control should include a monitor/ learning capability |
| EPP.01.34 | Device Control exclusion creation should be done via a GUI interface in the console. |
| EPP.01.35 | Product must provide removable media encryption when media creation is authorized. |
| EPP.01.36 | Printers should be managed as a device class and not individual devices. |
| EPP.01.37 | Product will provide out of the box reporting for Device Control event reporting. |
| EPP.01.38 | Regardless of Operating System, all managed endpoint devices should be managed from a single console, including all functionality and/or modules. |
| EPP.01.39 | All aspects of client management should be managed from one web based console i.e. policy assignment, task assignments, product updates, endpoint health, creating and running actionable reports |
| EPP.01.40 | Support centralized, role-centric console or dashboard to enable the real-time visibility of VA's endpoint security state |
| EPP.01.41 | Support Real Time Enterprise Visibility across the entire network infrastructure including endpoints, servers, cloud, systems, and applications |
| EPP.01.42 | Event and client health reporting with actionable information should be available in the product management console. |
| EPP.01.43 | Product will have the ability to create and run summary and detailed reports, whether manually or automated, using canned or user-customized options |
| EPP.01.44 | Allows the export of reports in multiple formats (PDF, XML, CSV) to be downloaded, stored within a document store (SharePoint, file server, etc), or emailed. Capability must be native to relevant product console |
| EPP.01.45 | Product should allow for use of wild cards in creation of scanning exclusion for drive, file or path. |
| EPP.01.46 | Systems with restricted ACLs (MDI or SPDIA) require ability to receive updates with no internet or cloud connectivity. |
| EPP.01.47 | Ransomware Rollback capability is required on all protected clients. |
| EPP.01.48 | System admins can schedule endpoint scans and analyze jobs from console that execute on specified hosts |
| EPP.01.49 | Reports must be easily generated via a GUI report wizard, or other native tool within the solution |
| EPP.01.50 | Device encryption capabilities must be natively available for removable media based on policy assigned to a user, group, device, or other unique identifiers |
| EPP.01.51 | Output able to be emailed, saved locally, or saved on a shared location and/or service must be able to be encrypted |
| EPP.01.52 | the solution shall have ability to share suspicious or heuristic behavior files/sites/executions with other managed clients to prevent further spread or infection |
| EPP.01.53 | The solution shall have the ability to block domains and/or category groupings of activity from client browsers via policies |
| EPP.01.54 | The solution shall maintain temper protection on all supported Osse which prevents the disabling, removing, or modifying of system behavior outside of policy constraints |
| .02. | EPP Protection capabilities |
| EPP.02.01 | Ability to apply process isolation |
| EPP.02.02 | Ability to apply memory protection |
| EPP.02.03 | Ability to apply exploit prevention |
| EPP.02.04 | Ability to apply sandbox detonation |
| EPP.02.05 | Ability to apply cloud detonation |
| EPP.02.06 | Ability to apply hash lookups |
| EPP.02.07 | Ability to apply application whitelisting |
| EPP.02.08 | Ability to apply TTP based protection |
| EPP.02.09 | Ability to apply integrated patch management |
| EPP.02.10 | Incident prevention and investigation capabilities, with guided response tools |
| EPP.02.11 | Incident prevention and investigation capabilities with discovery, reporting, and prioritization of vulnerabilities |
| EPP.02.12 | Active response capabilities such as killing processes, blocking network connections, and quarantining and removing files automatically |
| EPP.02.13 | Malware detection accuracy performance benchmarking via public communities (such as Virus Total) |
| EPP.02.14 | Malware detection performance benchmarking via 3rd party testing services (such as NSS labs, others) |
| EPP.02.15 | Ability to block malware when offline / disconnected from network |
| EPP.02.16 | Blocks known and unknown file-based malware, without relying on daily signature distribution |
| EPP.02.17 | Implements protection for common application vulnerabilities and memory exploit techniques |
| EPP.02.18 | Automatically quarantines malicious files |
| EPP.02.19 | Identifies changes made by malware and provides the recommended remediation steps |
| EPP.02.20 | Detects, blocks, and reports attempts to disable or remove the EPP agent |
| EPP.02.21 | Implements vulnerability shielding (aka virtual patching) for known vulnerabilities in the OS and for non-OS applications |
| EPP.02.22 | Can implement default-deny whitelisting with a vendor maintained "app store"-type approach, and user self-service features |
| EPP.02.23 | Can implement application isolation, to separate untrusted applications from the rest of the system |
| EPP.02.24 | Includes access to a cloud or network-based sandbox that is VM-aware |
| EPP.02.25 | Includes deception detection capabilities designed to expose an attacker |
| EPP.02.26 | Includes a Host Based FW that can manage all VA Endpoints regardless of Operating System. |
| EPP.02.27 | Host based FW should have the capability to operate in a listening or adaptive mode that identifies traffic that would have been blocked in an active mode. |
| EPP.02.28 | Product should have the ability to apply customer defined threat reputation for VA developed applications with no signed certificate |
| EPP.02.29 | Product must have a host firewall solution that allows management of all VA endpoints (see GEN.00. DT/LT, GEN. 00.SRVR and GEN.00.CLD |
| EPP.02.30 | Product host firewall must deny by policy allow by exception. |
| EPP.02.31 | Product should provide capability for real time and scheduled threat scans of Network Area Storage. |
| EPP.02.32 | Solution should have the ability to track changes with a change management mindset/approach natively (example: connection to ServiceNow or other ticketing system, or track changes within an audit log that can be notated with change control information) |
| .03. | Cyber Hunt & Threat Analysis Requirements |
| CHTA.03.01 | Basic endpoint metadata: Internet Protocol (IP) address, Media Access Control (MAC) address, DNS names |
| CHTA.03.02 | Basic endpoint metadata: hardware data |
| CHTA.03.03 | Basic endpoint metadata: plugged USB devices |
| CHTA.03.04 | Network data: endpoint DNS, ARP and routing tables, and other live network data |
| CHTA.03.05 | Network data: open ports and related processes |
| CHTA.03.06 | Network data: network connections to/from the endpoint |
| CHTA.03.07 | Network data: URLs browsed from the endpoint |
| CHTA.03.08 | Execution data: running processes, threads, and their metadata |
| CHTA.03.09 | Execution data: Windows services |
| CHTA.03.10 | Execution data: user logon and logoff activity |
| CHTA.03.11 | Execution data: inter-process communications (IPC) channel |
| CHTA.03.12 | Execution data: process actions such as data reads/writes |
| CHTA.03.13 | Stored data: file metadata (such as name, size, type, and cryptographic hash sums) |
| CHTA.03.14 | Stored data: files (usually specific files or those that executed) |
| CHTA.03.15 | Stored data: changes to files |
| CHTA.03.16 | Stored data: select Windows registry settings |
| CHTA.03.17 | Stored data: observed Windows registry changes |
| CHTA.03.18 | Stored data: endpoint logs such as Windows event logs or Linux syslog |
| CHTA.03.19 | Stored data: master boot record (MBR) information |
| CHTA.03.20 | Stored data: loaded DLLs |
| CHTA.03.21 | Stored data: active device drivers and loaded kernel modules |
| CHTA.03.22 | Stored data: browser extension and history |
| CHTA.03.23 | Stored data: CMD and PowerShell command history |
| CHTA.03.24 | Memory contents |
| CHTA.03.25 | Server-side detection: rare and new processes |
| CHTA.03.26 | Server-side detection: deviations from collected baselines |
| CHTA.03.27 | Server-side detection: comparisons with endpoint behavior models built over time across the entire environment |
| CHTA.03.28 | Server-side detection: historical data matching with recently obtained IOCs |
| CHTA.03.29 | Cloud-side detection: deviation from baselines across organizations |
| CHTA.03.30 | Cloud-side detection: whitelisting, blacklisting, and other reputation list checks for files, URLs, domains, etc. |
| CHTA.03.31 | Data presentation/visualization: pivoting/correlation |
| CHTA.03.32 | Data presentation/visualization: kill chain mapping |
| CHTA.03.33 | File hash querying and identification |
| CHTA.03.34 | Registry monitoring in all hives |
| CHTA.03.35 | Port usage monitoring |
| CHTA.03.36 | Process tracking (with parameters) |
| CHTA.03.37 | Machine profiling (based on OS, use, etc.) |
| CHTA.03.38 | Over the wire capability (basic infection information) |
| CHTA.03.39 | Sweep or hunt capability |
| CHTA.03.40 | File forwarding for additional analysis |
| CHTA.03.41 | Automated identification & isolation of suspected malicious files or signatures |
| CHTA.03.42 | File structure monitoring |
| CHTA.03.43 | File retention of flagged |
| CHTA.03.44 | Cache inspection of incident event (historical tracking) |
| CHTA.03.45 | Automated triage |
| CHTA.03.46 | Quarantine of infected devices |
| CHTA.03.47 | Whitelisting of forensic processing during quarantine processing |
| CHTA.03.48 | Scriptable acquisitions |
| CHTA.03.49 | File object acquisitions |
| CHTA.03.50 | Ability to detect and block memory attacks such as process injection, buffer overflows, and privilege escalation |
| .04. | Incident Response Requirements |
| IRP.04.01 | Ability to detect local account creation |
| IRP.04.02 | Ability to manage agents off the network |
| IRP.04.03 | Ability to query file and process hashes across enterprise |
| IRP.04.04 | Ability to isolate infected system, but retain ability to gather artifacts and ensure no artifacts are left behind following removal |
| IRP.04.05 | Ability to replay attack chain |
| IRP.04.06 | Ability to automate responses and workflows |
| IRP.04.07 | Ability to create custom signatures |
| IRP.04.08 | Ability to integrate external threat data feeds in response |
| IRP.04.09 | Ability to integrate with ServiceNow and Remedy ticketing solution |
| IRP.04.10 | Ability to safely capture and transport malicious artifacts |
| IRP.04.11 | Ability to configure sandboxing of known malicious vectors |
| IRP.04.12 | Ability to support safe web browsing |
| IRP.04.13 | Ability to alert on registry modifications |
| IRP.04.14 | Ability to detect and alert on lateral movement |
| IRP.04.15 | Ability to detect suspicious shellcode processes |
| IRP.04.16 | Ability to detect ransomware via encryption of large quantities of files in a short period of time or any attempts to encrypt MBR or root files while the system is operational |
| IRP.04.17 | Ability to detect and mitigate crypto mining malware |
| IRP.04.18 | Remotely remediate infected hosts on the network to a pre-infection state |
| IRP.04.19 | Ability to ingest IOCs that can be used to scan hosts for known breach indicators |
| .05. | Endpoint Forensics Requirements |
| FORN.05.01 | The solution must support remote live read-only investigation(s) and artifact recovery with no file level locking |
| FORN.05.02 | The solution must support remote forensic preview of hard disks and copying of files and artifacts from suspect machines in a forensically sound manner |
| FORN.05.03 | The solution must enable remote imaging of physical RAM in a forensically sound fashion |
| FORN.05.04 | The solution must enable physical and logical disk acquisitions in a forensically sound fashion |
| FORN.05.05 | The solution must provide connectivity to VAEC cloud providers to enable acquisition and analysis of data in the cloud |
| FORN.05.06 | The solution must be vendor neutral and able to integrate with any VA forensic analysis tool |
| FORN.05.07 | The solution must be deployable through standard application deployment methods such as SCCM and BigFix |
| FORN.05.08 | The solution must be scalable to support a large enterprise network. Installs on unlimited number of endpoints and provides multiple simultaneous connections. |
| FORN.05.09 | The solution must be deployable to the vast majority of OS platforms used in the VA. This includes Windows (32 & 64 bit), OS X, Linux, Solaris, AIX, and HPUX |
| FORN.05.10 | The solution must facilitate forensically sound, authenticated, and secure communication from CSOC to endpoints. Examiner cannot alter files or make any changes to the machine under investigation. All connections are write-protected and industry standard authentication mechanisms are used. |
| FORN.05.11 | The solution must maintain an audit log that records individual analyst activity and connection information |
| FORN.05.12 | The solution must utilize a non-intrusive agent with a small footprint that does not cause any performance impact to the end-user |
| FORN.05.13 | The endpoint agent should require no drivers for installation, install seamlessly without endpoint interruption, as well as not to require a system reboot when deployed or installed |
| FORN.05.14 | The endpoint agent licensing must be unlimited instead of per endpoint |
| FORN.05.15 | Data in transit from the endpoint to the analyst must be encrypted using a validated FIPS 140-2 cryptographic module |
| FORN.05.16 | The solution may remotely remediate infected hosts on the network to a pre-infection state |
| FORN.05.17 | The endpoint agent should be able resume an acquisition in case of network disconnect/failure without restarting |
| FORN.05.18 | The solution must support searches that can be performed against physical memory, binary objects, live OS, and raw disk |
| FORN.05.19 | The solution must support all current and legacy file systems used in the VA. This includes Windows FAT, NTFS, HFS/+, Solaris, ext2/ext3, XFS, etc. |
| FORN.05.20 | The solution must be able to search hosts using a multitude of attributes such as file names, file signatures, hash values, registry keys, event logs, low level file/executable attributes, etc. |
| FORN.05.21 | The solution must allow for easy importing of custom whitelist and blacklist rules for filtering specific threat data |
| FORN.05.22 | The solution must be able to natively decrypt volumes encrypted with BitLocker and other full-disk encryption solutions used in the VA |
| FORN.05.23 | The solution must be able to read and analyze evidence files stored in common formats (i.e., DD raw, E01, EX1, etc) |
| FORN.05.24 | The solution must be compatible with all VA forensic hardware. This includes Tableau write blockers, TX1 duplicator, and other peripherals. |
| FORN.05.25 | The solution must be able to read and image different forms of media such as SATA, IDE, SCSI, SAS, RAID disk sets, etc. |
| FORN.05.26 | The solution must be able to produce an exact duplicate of an original drive or media in a forensically sound manner and then verify it by using hash values such as MD5 or SHA1. It must detect when evidence has been tampered or altered. |
| FORN.05.27 | The solution must be able to produce a logical evidence container of only files and folders specified by the analyst |
| FORN.05.28 | The solution must be able to automatically search for and recover deleted partitions, files, folders, and artifacts from the file system, file slack, and unallocated space |
| FORN.05.29 | The solution must have the ability to write custom scripts or use built-in scripts to automate forensic actions |
| FORN.05.30 | The solution must have robust search and indexing capabilities. It must support string and GREP searches, filters, conditions, raw binary, proximity searches, internet and email artifact search, and keywords in multiple languages. |
| FORN.05.31 | The solution must be capable of generating user-customized reports |
| FORN.05.32 | The solution must have bookmarking capability for all forensic data. Analysts should be able highlight and organize notable files, folders, and artifacts. |
| FORN.05.33 | The solution must support internet and email investigations. It should be capable of parsing browser artifacts, web history, cache, P2P, and HTML across all web browsers. It must be able to analyze email artifacts from all versions of Outlook, O365, webmail, Exchange, and other email software. It must be able to recover deleted data and analyze evidence from the deleted items folder, .pst files, and in unallocated disk space. |
| FORN.05.34 | The solution must have built-in native viewing for all known file types. This includes Adobe files, compressed files, email, MS Office, HTML, image files, text files, etc. It must also support external file viewers, integrated image viewer, built-in registry viewer, and timeline/calendar viewer. For mobile devices, it must be capable of analyzing plist files, SQLite databases, iTunes backups, and other mobile artifacts. It must support non-proprietary, non-encrypted images and file formats from 3rd party vendors. |
| FORN.05.35 | The solution must be compatible with CSOC forensic hardware |
| FORN.05.36 | The solution may use either hardware or software licenses. The license must be perpetual and usable in a remote environment. |
| FORN.05.37 | The solution must support logical and filesystem acquisitions of mobile forensic devices including iOS and Android. |
| FORN.05.38 | The solution should perform automated decryption by utilizing tokens and keychains from mobile devices |
| FORN.05.39 | The solution must be capable of parsing partitioned and non-partitioned virtual machine disk files |
| FORN.05.40 | The solution must support advanced analysis and decoding of extracted mobile application data |
| .06. | Heuristic Behavior Analytics |
| HBA.06.01 | The solution must support Psycholinguistic Analysis. |
| HBA.06.02 | The solution must have the ability to track key words |
| HBA.06.03 | The solution must have default/pre-packaged use case. |
| HBA.06.04 | The solution must have the flexibility to allow the creation of custom use cases. |
| HBA.06.05 | The solution must have the ability to identify and report on new anomalous traffic and support manual entry of threat risk lists. |
| HBA.06.06 | The solution must detect anomalous activity in near real time. |
| HBA.06.07 | The solution must have the ability to create watch lists for users both automatically for defined criteria and manually. |
| HBA.06.08 | The solution must provide multivariate risk scores for all VA users; risk scores must consider current activity, recent historical activity, comparisons against the individual user’s activity, and comparisons against the users work peer group. |
| HBA.06.09 | The solution must provide combined risk scores of insider risk scenarios computed by behavior models analyzing data from disparate data sources and separate networks. |
| HBA.06.10 | The solution must provide a library of user and network behavior models. |
| HBA.06.11 | The solution must provide automatic timelines for Incident. |
| HBA.06.12 | The solution must be able to ingest and analyze logs from industry standard sources. |
| HBA.06.13 | The solution must comply with The National Insider Threat Task Force (NITTF) requirements for insider threat programs. |
| HBA.06.14 | The solution must support machine learning based and behavioral based threat detection, analysis, and mitigation. |
| HBA.06.15 | The solution must monitor and record all analyst forensic activity performed, enabling verification that investigations are performed in accordance with established policies, e.g. annual audits. |
| HBA.06.16 | The solution must monitor and record all analyst administration activity performed, enabling verification that changes are performed in accordance with established policies, e.g. annual audits. |
| HBA.06.17 | The solution must automatically escalate the monitoring of a user based on event triggers which can be customized; these escalations must at a minimum include but not be limited to keystroke logging and screen video capture. |
| HBA.06.18 | The solution must monitor and collect data when any user is not connected to the network and must have the capability to cache data including keystrokes and video on the endpoint on a per-user per-policy basis to be uploaded at the next network connection. |
| HBA.06.19 | The solution must group and export information into a "case" for the purpose of investigations. |
| HBA.06.20 | The solution must support data filtering to determine the appropriate action based on defined policies. |
| HBA.06.21 | Must provide identity and user visibility in network traffic. |
| HBA.06.22 | Must be capable of incorporating human risk to detect anomalies and outlier indicators. |
| HBA.06.23 | The solution must support ingestion and analysis of unstructured communication data sources. |
| HBA..06.24 | It is expected that the solution shall have the ability to be configured, tune, and be fully operated by Tier II and III analysts; the solution will not require a Data Scientist for optimum operation, |
| 0.07 | Application Control |
| APPC.07.01 | The solution shall utilize installable agents for the defined operating systems and future needs within 60 days of enterprise adoption |
| APPC.07.02 | The solution shall be able to report and track system resource utilization along with the ability to scale down or limit said resource utilization |
| APPC.07.03 | The solution shall not utilize more than 10% of the total processor time while a user is logged in. |
| APPC.07.04 | The solution shall not utilize more than 10% of the total available memory while a user is logged in. |
| APPC.07.05 | The solution shall not utilize more than 40% of the total processor time while the user is idle. |
| APPC.07.06 | The solution shall not utilize more than 25% of the total available memory at any time. |
| APPC.07.07 | The solution shall not require a reboot for installation or uninstallation. |
| APPC.07.08 | The solution shall support changing execution enforcement levels without requiring a reboot. |
| APPC.07.09 | The solution shall support installation in a passive mode with no enforcement. |
| APPC.07.10 | The solution shall support scanning of all files on a workstation within 20 minutes. |
| APPC.07.11 | The solution shall support scanning of all files on a server’s primary OS and application volumes within 1 hour. |
| APPC.07.12 | The solution shall support monitoring from the management console the level of completeness of the file scanning of a given system in near real time. |
| APPC.07.13 | The solution shall hash all applicable file types (Example but not limited to: EXE, PS1, JS, BAT, DLL,…) |
| APPC.07.14 | The solution shall track changes to hash values of all applicable file types and corresponding new hash values (Example but not limited to: EXE, PS1, JS, BAT, DLL,…) |
| APPC.07.15 | The solution shall prevent the execution of unauthorized files. |
| APPC.07.16 | The solution shall prevent the execution of malicious files. |
| APPC.07.17 | The solution shall prevent the execution of untrusted files. |
| APPC.07.18 | The solution shall prevent the execution of unwanted files. |
| APPC.07.19 | The solution shall support a Monitor Only enforcement level. |
| APPC.07.20 | The solution shall support a Low enforcement level where the end-user is allowed to self-approve file execution. |
| APPC.07.21 | The solution shall support High enforcement where only administrators of the solution can approve executables through the console. |
| APPC.07.22 | The solution shall support being disabled on specified endpoints. |
| APPC.07.23 | The solution shall support file execution denial by hash |
| APPC.07.24 | The solution shall support file execution denial by trusted updaters/publishers |
| APPC.07.25 | The solution shall support file execution denial by trusted installers. |
| APPC.07.26 | The solution shall support file execution denial by certificates. |
| APPC.07.27 | The solution shall support file execution denial by reputation. |
| APPC.07.28 | The solution shall support file execution denial by trusted directory path. |
| APPC.07.29 | The solution shall support file execution denial by a trusted network path. |
| APPC.07.30 | The solution shall support file execution denial by user identity. |
| APPC.07.31 | The solution shall support file execution denial by parent process identity. |
| APPC.07.32 | The solution shall support file execution denial by a combination of the previous listed. |
| APPC.07.33 | The solution shall support file execution approval based on the approval of the parent file. |
| APPC.07.34 | The solution shall support reporting of all file creation and execution in a near-real time manner. |
| APPC.07.35 | The solution shall support the generation of a complete, accurate, and update date (within 1 hour) file inventory list of each endpoint that is reporting. |
| APPC.07.36 | The solution shall support inventory collection from 100k managed devices with no enforcement and maintain the ability to scale upwards of one million managed devices |
| APPC.07.37 | The solution shall support inventory collection from network shares on the defined OSes and future adoptions of new OSes |
| APPC.07.38 | The solution shall support importing list of known file hashes into a policy from which execution mode could be Approved. |
| APPC.07.39 | The solution shall support importing list of known file hashes into a policy from which execution mode could be Blocked and Reported. |
| APPC.07.40 | The solution shall support importing list of known file hashes into a policy from which execution mode could be Banned and Deleted. |
| APPC.07.41 | The solution shall report the percentage of files that are synchronized between the endpoint and the console. |
| APPC.07.42 | The solution shall include file attributes for all files. |
| APPC.07.43 | The solution shall include the time created for all files. |
| APPC.07.44 | The solution shall include SHA-1 (Secured Hash Algorithm 1) hash value for all files. |
| APPC.07.45 | The solution shall include SHA-256 (Secured Hash Algorithm 2) hash value for all files. |
| APPC.07.46 | The solution shall include MD5 (Message Digest Algorithm) hash value for all files. |
| APPC.07.47 | The solution shall include file type for all files. |
| APPC.07.48 | The solution shall include file owner for all files. |
| APPC.07.49 | The solution shall include folder path for all files. |
| APPC.07.50 | The solution shall include product name for all files. |
| APPC.07.51 | The solution shall include product version for all files. |
| APPC.07.52 | The solution shall include name of signer for the digital signature for all digitally signed files. |
| APPC.07.53 | The solution shall include time created for all files. |
| APPC.07.54 | The solution shall include a count of instances throughout the network for all files. |
| APPC.07.55 | The solution shall include first execution time for all file executions. |
| APPC.07.56 | The solution shall include last execution time for all file executions. |
| APPC.07.57 | The solution shall include executed by user for all file executions. |
| APPC.07.58 | The solution shall include count of executions throughout the network for all file executions. |
| APPC.07.59 | The solution shall be able to store baseline configurations. |
| APPC.07.60 | The solution shall be able to use specified systems / images for baseline purposes. |
| APPC.07.61 | The solution shall be able to report baseline drift of files on a specified system. |
| APPC.07.62 | The solution shall be able to report baseline drift on an aggregation of systems across the network. |
| APPC.07.63 | The solution shall support exporting reports in PDF (Portable Document Format File) Format. |
| APPC.07.64 | The solution shall support exporting reports in Excel Format. |
| APPC.07.65 | The solution shall support exporting reports in Word Format. |
| APPC.07.66 | The solution shall support the logging of changes to made to policies. |
| APPC.07.67 | The solution shall support the logging of changes to made to Approval Lists/Deny Lists. |
| APPC.07.68 | The solution shall support the logging of changes to made to policy assignments. |
| APPC.07.69 | The solution shall support the logging of changes to made to user accounts. |
| APPC.07.70 | The solution shall support exporting of logs to SIEM (Security Information and Event Management) solution. |
| APPC.07.71 | The solution shall support detailed summary reporting for auditing policies. |
| APPC.07.72 | The solution shall support detailed summary reporting for auditing approved files. |
| APPC.07.73 | The solution shall support detailed summary reporting for auditing unapproved files. |
| APPC.07.74 | The solution shall support detailed summary reporting for auditing execution blocks. |
| APPC.07.75 | The solution shall support detailed summary reporting for auditing user accounts. |
| APPC.07.76 | The solution shall support log retention configurable by time. |
| APPC.07.77 | The solution shall support log retention configurable by space. |
| APPC.07.78 | The solution shall support log retention configurable by user events. |
| APPC.07.79 | The solution shall support log retention configurable by console events. |
| APPC.07.80 | The solution shall support the ability to search for files by SHA-1 Hash Value |
| APPC.07.81 | The solution shall support the ability to search for files by SHA-256 Hash Value |
| APPC.07.82 | The solution shall support the ability to search for files by MD5 Hash Value |
| APPC.07.83 | The solution shall support the ability to search for files by execution time. |
| APPC.07.84 | The solution shall support the ability to search for files by file path. |
| APPC.07.85 | The solution shall support the ability to search for files by file name. |
| APPC.07.86 | The solution shall support the ability to search for files by executing user. |
| APPC.07.87 | The solution shall provide support for file execution approval by Certificates. |
| APPC.07.88 | The solution shall utilize reputation scoring for each file. |
| APPC.07.89 | The solution’s reputation score shall include file rarity as part of that rating. |
| APPC.07.90 | The solution shall have and provide a mechanism for submitting suspicious files to a service for additional analysis |
| APPC.07.91 | The solution shall include integrated mechanism for requesting ad-hoc file execution requests for review and approval by the administrators of the console. |
| APPC.07.92 | The solution shall provide an integrated method for file review by global reputation rating. |
| APPC.07.93 | The solution shall provide reputation rating based on trust scoring. |
| APPC.07.94 | The solution shall provide a method or overriding provided reputation rating by the customer. |
| APPC.07.95 | The solution shall provide an integrated method for creating a reputation for files that do not have a rating provided by the vendor. |
| APPC.07.96 | The solution shall support specific user accounts designated for Application Program Interface (API) calls. These users shall only work with API calls and not the normal console. |
| APPC.07.97 | The solution shall support Active directory integration for API user accounts. |
| APPC.07.98 | The solution shall support Composite API's |
| APPC.07.99 | The solution shall support REST (Representational State Transfer) API Architecture. |
| APPC.07.100 | The solution shall support the SOAP (Simple Object Access Protocol) API. |
| APPC.07.101 | The solution shall support RPC (Remote Procedure Calls) API protocol. |
| APPC.07.102 | The solution shall support automation of configurations through API calls. |
| APPC.07.103 | The solution shall support automation of policies through API calls. |
| APPC.07.104 | The solution shall support automation of reports through API calls. |
| APPC.07.105 | The solution shall support automation of endpoint management through API calls. |
| APPC.07.106 | The solution shall support automation of console maintenance through API calls. |
| APPC.07.107 | The solution shall support automation of user account creation through API calls. |
| APPC.07.108 | The solution shall support automation of user account modification through API calls. |
| APPC.07.109 | The solution shall support automation of user account deletion through API calls. |
| APPC.07.110 | The solution shall provide support for importing and exporting policies, rules, and configurations for backup purposes. |
| APPC.07.111 | The solution shall provide support for importing and exporting policies, rules, and configurations in SQL (Structure Query Language) format |
| APPC.07.112 | The solution shall provide support for importing and exporting policies, rules, and configurations in word format |
| APPC.07.113 | The solution shall provide support for importing and exporting policies, rules, and configurations in excel format |
| APPC.07.114 | The solution shall provide support for importing and exporting policies, rules, and configurations in XML (Extensible Markup Language) format |
| APPC.07.115 | The solution shall support policy update propagation to endpoints in less than ten minutes. |
| APPC.07.116 | The solution shall support policy update propagation to endpoints in less than thirty minutes. |
| APPC.07.117 | The solution shall support policy update propagation to endpoints in less than two hours. |
| APPC.07.118 | The solution shall support policy update propagation to endpoints in less than three hours. |
| APPC.07.119 | The solution shall support revoking execution should a file no longer be approved by the enterprise. |
| APPC.07.120 | The solution shall include an integrated mechanism for file collection without user reliance or impact. |
| APPC.07.121 | The solution shall support application grouping, policy and/or rule assignment by grouping. |
| APPC.07.122 | The solution shall integrate with industry standard acceptable SIEM products |
| APPC.07.123 | The solution shall integrate with industry standard acceptable enterprise deployment solutions (Example: SCCM, BigFix, etc) |
| APPC.07.124 | The solution shall integrate with other industry standard acceptable endpoint protection products (An example but not limited to: Trellix, Microsoft, Symantec, etc.) |
| APPC.07.125 | The solution shall integrate with industry standard acceptable EDR (Endpoint Detection and Response) and XDR (Extended Detection and Response) products |
| APPC.07.126 | The solution shall integrate with industry standard acceptable asset management and monitoring products (Example: ForeScout) |
| APPC.07.127 | The solution shall integrate with industry standard acceptable enterprise ticketing systems for tracking, change management, creation, and assignment |
| APPC.07.128 | The solution shall not be dependent on other application versions on the endpoint. |
| APPC.07.129 | The solution shall have a simplistic Operating System dependency model. |
| APPC.07.130 | The solution shall adhere to the least privileged model of management that integrates with Active Directory and provides tiered access within the console. |
| APPC.07.131 | The solution shall provide application enforcement for offline devices. |
| APPC.07.132 | The solution shall provide for time-based policy enforcement. |
| APPC.07.133 | The solution shall be FedRamp High Impact compliant. |
| APPC.07.135 | The solution shall be FIPS 140-2 (Federal Information processing Standards) compliant. |
| APPC.07.136 | The solution shall be 508 compliant. |
| APPC.07.137 | The solution shall be capable of leveraging PIV (Personal Identity Verification) console authentication. |
| APPC.07.138 | The solution shall have features that specifically target crypto miners. |
| APPC.07.139 | The solution shall have features that specifically target PowerShell abuse. |
| APPC.07.140 | The solution shall have features that specifically target ransomware. |
| APPC.07.141 | The solution shall include a mechanism for suspicious files to be submitted for analysis via the console. |
| APPC.07.142 | The solution shall include a mechanism for submitting files for analysis to a variety of vendors. |
| APPC.07.143 | The solution shall provide a menu-driven option to delete or remove targeted files directly from a server or workstation. |
| APPC.07.144 | The solution shall provide a menu driven option to quickly lockdown or quarantine the enterprise within a few minutes. |
| APPC.07.145 | The solution shall provide detailed history of all files in the catalog that show when a file was introduced to the environment. |
| APPC.07.146 | The solution shall provide a detailed history of all files in the catalog that show how the file was introduced to the environment. |
| APPC.07.147 | The solution shall provide a detailed history of all files in the catalog that show when the file was approved and how it was approved. |
| APPC.07.148 | The solution shall provide detailed history of all files in the catalog that show if the file executed or did not execute. |
| APPC.07.149 | Vendor shall provide direct telephone technical support to engineers within a hold time of no longer than 15 minutes. |
| APPC.07.150 | Vendor shall provide email technical support for less urgent questions. |
| APPC.07.151 | Vendor shall provide an escalation process and contact information should technical issues fail to be resolved in a timely manner. |
| APPC.07.152 | Vendor shall provide support for creating a support case via a web portal. |
| APPC.07.153 | Vendor shall provide quality product documentation explaining how to perform product installation, uninstallation, explain features, and perform basic tasks. |
| APPC.07.154 | Vendor shall provide online knowledge base articles for advanced use cases and troubleshooting steps. |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .