ACAS 2026 Requirements FINAL 2.xlsx
XLSX spreadsheet 41 KB Posted
- Solicitation number
- 842674622
- Issued by
-
Defense Information Systems Agency
About this file
This is a technical requirements document for the Assured Compliance Assessment Solution (ACAS) 2026, establishing critical, high, and desired specifications for a next-generation vulnerability and compliance assessment system sought by the Defense Information Systems Agency (DISA) for the Program Acquisition Executive (PAE) Cyber Sensing Portfolio Management Office.
The requirements span network discovery, automated vulnerability scanning, application assessment, configuration compliance, and reporting capabilities. Critical requirements include automated network scanning across IPv4 and IPv6 environments; identification of host details including operating systems, ports, protocols, and services; customizable agent-based scanning with optional non-administrative privilege operation; vulnerability and compliance scanning against NIST USGCB standards, DoD STIGs, and vendor checklists using OVAL and XCCDF formats; support for Windows Server 2016-2025, current Linux distributions, virtualized and containerized environments; assessment of patch management, web applications, and network infrastructure devices; centralized management with hierarchical reporting aligned to DoD CIO operational attributes; SCAP 1.4 compliance for data export in CVE, CCE, CPE, and XCCDF formats; role-based access controls leveraging DoD CAC PKI; and non-disruptive scanning operations. High-priority requirements include network mapping and asset discovery by device type, passive vulnerability identification through traffic analysis, detailed system identification collection including serial numbers and BIOS GUIDs, agent-based scanning with non-persistent capabilities, customizable scanning frequencies, risk quantification with adjustable computational weights, comprehensive assessment of Windows 32/64-bit, UNIX, Linux, Apple, and thin-client operating systems for hardware, software, firmware, user policies, file and registry permissions, and service configurations, non-agent assessment of printers, multifunction devices, firewalls, routers, VPN servers, email servers, and wireless infrastructure, intuitive GUI with drill-down and grouping capabilities, customizable report generation with executive and technical summaries, and integration with ticketing and SIEM systems. Desired attributes include passive and active OS fingerprinting, rogue device identification, internal and external attack simulation, behavioral assessments, compliance standards beyond DoD scope (PCI-DSS, HIPAA, SOX, GLBA), Office 365 assessment, collaborative audit task development, alternative vendor support for network infrastructure, and advanced event correlation and alerting with customizable response rules.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Sources Sought ACAS 052626 FINAL 2.docx | DOCX document | |
| ACAS SSN Final.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Critical
| CRITICAL Technical Requirements | |
| 1 | Network Discovery Requirements |
| 1.1 | The system shall provide an automated and reliable assessment capability. The system shall have the ability to scan all portions of the network (e.g. computers, switches, routers, and other networked devices) without human intervention. It will consistently provide an accurate inventory of the devices discovered. |
| 1.7 | The system shall provide a capability to identify host details including operating system, listening ports, protocols and open services. Open services shall be assessed against Internet Engineering Task Force (IETF) Network Endpoint Assement (NEA) defined network services. |
| 1.19 | The system shall provide an optional means to have installed agents. The agents shall be customizable to scan with administrative and non administrative privileges and not require Root/Admin privileges to operate (e.g. use of a priviledged Service Account). |
| 1.24 | The system shall identify, track, and maintain "system identity" uniqueness during assessments/evaluations and data management ensuring the changes within the authoritative record are flagged when changes to the system's identity are discovered. |
| 1.34 | The system shall have the ability to scan networks in both IPv4 and IPv6 instances. |
| 2 | Automated Network Vulnerability/Compliance Scanning Requirements |
| 2.6 | The system shall provide customizable scans for specific or identified vulnerabilities or categories of configurations. |
| 2.15 | The system shall operate on one or more of the following operating systems / environment(s) |
| 2.15.1 | Windows Server Operating Systems that are currently supported by Micosoft. As of this requirement's writing the following would be supported: |
-Windows Server 2016 (v1607) -Windows Server 2019 (v1809) -Windows Server 2022 -Windows Server 2025
2.15.2 Linux Server Operating Systems that are currently supported. As of this requirement's writing the following would be supported:
-Red Hat Enterprise Linux (RHEL) 8 and newer.
-CentOS Stream
| 2.15.3 | Virtualized OS via HyperVisor (e.g. ESX/ESXi, VMWare, HyperV, etc.) |
| 2.15.4 | Containerized OS'es (e.g. Docker, Kubernetes, etc.) |
| 3 | Application Vulnerability Scanning Requirements (Web, Database, etc.) |
| 3.1 | The system shall provide a capability to assess application vulnerabilities. (e.g. Microsoft Office Suite, Browsers, Apache, Java etc.) |
| 4 | Configuration Assessment Requirements |
| 4.6 | The system shall provide a capability to assess compliance via NIST's USGCB standard(s). |
| 4.6.1 | The system shall provide the capability to assess compliance for DOD STIGs using the native OVAL and XCCDF provided on the current DOD content repository, currently Cyber.mil. |
| 4.6.2 | The system shall provide the capability to extend DOD STIGs with non-OVAL checks to provide the most complete possible assessment of automatable and semi-automatable compliance checks. |
| 4.6.3 | The system shall provide vendor compliance checklists for STIGs where available and CIS or vendor compliance checklists where STIGs are not available. Checks will expose standard XCCDF data elements to include benchmark id, profile, version, and distinct rule_id identifiers for each included check, along with results using the XCCDF results enumeration. |
| 4.6.4 | The system shall assess and report when endpoint compliance results change between compliance assessments. |
| 4.12 | The system shall provide a capability to assess patch management configurations for Windows-based systems. |
| 4.13 | The system shall provide a capability to assess patch management configurations for non-Windows based systems. Examples include: |
1. Linux OS'es: RedHat Enterprise Linux, Ubuntu, CentOS, Debian.
2. UNIX OS'es: Solaris & HP-UX.
3. BSD OS'es: FreeBSD & OpenBSD.
4. Specialized OS'es: Cisco IOS & ESXi.
5. Cloud native OS'es: CoreOS & Photon OS.
| 4.16 | The system shall provide a capability to perform website assessments. |
| 4.17.1 | The system shall provide the ability to provide authenticated scans for common network infrastructure operating systems (e.g. Cisco IOS and Juniper). Authenticated scans include scans conducted using Secure Shell, SNMP, NetConf, vendor proprietary interfaces, or other protocols where complete system data collection can be accessed and assessed for vulnerabilities and compliance. |
| 4.18 | The system shall provide a capability to provide assessments against Windows 32 bit operating systems. |
| 4.19 | The system shall provide a capability to provide assessments against Windows 64 bit operating systems. |
| 4.20 | The system shall provide a capability to provide assessments against UNIX operating systems. |
| 4.21 | The system shall provide a capability to provide assessments against LINUX operating systems. |
| 4.22 | The system shall provide a capability to provide assessments against macOS, iOS and other Apple operating systems. |
| 4.24 | The system shall provide a capability to assess DoD IAVM Notice compliance with IAVM compliance reported per specific product version and/or patch. |
| 4.25 | The system shall provide a capability to assess whether EOL/EOS operating systems are licensed for extended security updates. |
| 4.26 | The system shall assess compliance and vulnerabilities on endpoints running EOL/EOS operating systems to the last known patch or configuration issued. |
| 4.27 | The system shall assess endpoints for operating systems and applications that are EOL/EOS or have upcoming EOL/EOS events scheduled within 12 months and include advisories in assessment results. |
| 5 | Remote and Peripheral Device Configuration (Non-Agent Based) |
| 5.1 | The system shall provide a non-agent based capability to assess remote and peripheral devices (e.g. IoT & OT) and their configurations. |
| 7 | Report Generation and Data Export |
| 7.2 | The system shall provide a capability to natively display all standard or customized reports. |
| 7.5 | The system shall provide a capability to automatically export or securely (e.g. encrypted email) send the results of an automatically executed or recurring scan to a remote destination. Export format examples include: .html, .xml, .pdf, or .doc/x. |
| 7.8 | The system shall provide a capability to build customized reports based on selectable report criteria. |
| 7.14 | The system shall provide a capability to support a tiered hierarchical assessment and reporting function. |
| 7.14.1 | The system shall provide hierarchical rollup, drilldown, grouping, and filtering of DoD tags. The required tags, as outlined by the Operational Attribute Guidebook published by DoD CIO include: |
1: "AREA OF OPERATIONS"
2: "OWNING ORGANIZATION” / “OWNING UNIT"
3: "ADMINISTRATION ORGANIZATION"
4: "CSSP" (CYBERSECURITY SERVICE PROVIDER)
5: "GEOGRAPHIC AOR"
6: “GEOLOCATION”
7: “OPERATIONAL AUTHORIZATION”
| 7.14.2 | The system shall provide the ability to ingest COAMS and update hierarchies to match, including deletions, display name changes and parent/child changes |
| 7.14.3 | The system shall provide full rollup, drilldown, grouping, and filtering seamlessly between tags applied through automated processes and by users |
| 7.17 | The system shall provide a capability to support administrative input to cross reference commercially identified (i.e. National Vulnerability Database) or categorized vulnerabilities to the DoD IAVM reporting compliance requirements based on CVE ID or on patch ID. |
| 7.27 | The system shall provide a capability to support replication of detailed per-asset findings to external subscribers using an XML Schema that can export all collected data and be transformed to DoD or NIST standards using XML/JSON. |
| 7.28 | The system shall provide the capability to collect applicable data elements of the DOD Master Device Endpoint Record (MDER) and export the data to external systems through the use of APIs, JSON data exports, and/or XML data exports per 7.27 above |
| 7.29 | The system shall enforce robust access control and/or permission management for report viewing, scan scheduling, content updates, and other user and administrative functions. |
| 9 | Non-Disruptive to Normal Operations |
| 9.2 | The system shall provide a management capability to customize network assessment bandwidth utilization, throttling, or system performance impacts. |
| 9.3 | The systems shall not cause accidental denial of service attacks (DoS and DDoS) throughout its normal scanning operations/activities. |
| 10 | SCAP Compliance |
| 10.1 | The system shall export assessment and vulnerability data IAW SCAP standards in each of the following formats where appropriate: |
| 10.1.1 | Common Vulnerabilities and Exposures (CVE) |
| 10.1.2 | Common Configuration Enumeration (CCE) |
| 10.1.3 | Common Platform Enumeration (CPE) |
| 10.1.4 | Extensible Configuration Checklist Description Format (XCCDF) version 1.2 |
| 10.2 | The system shall perform compliance assessment and vulnerability checklists and definitions IAW the latest NIST published SCAP standards, supporting all of the following standards, performing assessments using SCAP specified methods. Current version of SCAP as of this publishing is 1.4. |
| 10.2.4 | Extensible Configuration Checklist Description Format (XCCDF) version 1.2 |
| 10.2.5 | Open Vulnerability and Assessment Language (OVAL) version 5.12.x |
| 10.2.5.1 | Detailed pass/fail rule results shall be saved to XCCDF rule-result messages, with a severity of 'info' |
| 12 | Logging/Alerting |
| 12.4 | The system shall store the results from vulnerability scans. Stored data shall contain the time of the scan, the identity of the asset that was scanned, and the scan results/findings. |
| 13 | Centralized Management |
| 13.3 | The system shall provide an open API and SDK for integration of third party data sources. API and SDK integrations shall enable external submission of data and creation of new visualizations in the solution. |
| 13.4 | The system shall provide a capability for the input of user-created compliance assessment checks without vendor involvement or integration efforts. |
| 13.4.1 | The ability to export/display information, to include: System Configuration(s), Policy Configuration(s), etc. Repos/Scan zones for Orgs |
| 13.22 | The system shall be updatable through online and offline (standalone) techniques. |
| 13.23 | The system shall be configurable to receive updates exclusively from a DoD-specified site. |
| 15 | Console Data Entry and Data Enrichment |
| 15.1 | Attribution Tagging or generic tagging allowing equivalent of attribution data consistent with the DOD CIO defined 7 required tags (see requirement 7.14.1). |
| 15.2 | Automated tag application based on endpoint properties (OS, IP range, installed apps, running processes, previously applied tags, plus others) |
| 15.3 | Implementation of DOD correlators being added to vendor content (e.g. IAVM identifiers) |
High
| HIGH Technical Requirements | |
| 1 | Network Discovery Requirements |
| 1.2 | The system shall provide a capability to discover and provide a detailed network map illustrating (via GUI or through text) all assets on a defined IP range across the network. Assets will be identified by common network functions such as workstation, database server, domain controller, file server, to best represent exposed attack surface required to prioritize defensive measures and remediation activities. |
| 1.3 | The system shall provide a capability to discover all devices on a network that respond to ICMP "ping" requests. |
| 1.4 | The system shall provide a capability to discover and provide a network device inventory of all devices on a defined IP range on a network. |
| 1.5 | The system shall provide a capability to identify attached virtual network devices/systems that are on-prem and/or in the cloud (e.g. cloud mounted block store solutions like Elastic Block Store or Azure Disk Storage). |
| 1.6 | The system shall provide a capability to identify and scan virtual operating systems on-prem and/or in the cloud. |
| 1.8 | The system shall provide a capability to perform passive vulnerability identification based upon network traffic analysis. |
| 1.12 | The system shall provide a capability to collect system identification information. System identification information will include Fully Qualified Domain Name, Globally Unique Identifier of the Operating System [1 per installed OS], IP address (IPv4 & IPv6), and MAC address per each scanned network interface. Additionally, the system shall provide: |
| 1.12.1 | Serial Number |
| 1.12.2 | BIOS GUID |
| 1.12.3 | Host Name |
| 1.12.4 | Vendor Make & Model of System |
| 1.12.5 | Vendor Make & Model of NIC |
| 1.12.6 | Microsoft Entre ID, if applicable |
| 1.13 | The system shall provide a capability to perform passive vulnerability identification based upon network traffic analysis. |
| 1.15 | The system shall collect detailed data about OS and application vendors, names and versions and their respective installation timestamps. The solutions shall provide this data using names mapped against the SCAP CPE names to support passive vulnerability inference. All application repositories shall be inventoried, to include (for Windows) Add/Remove programs, Windows Features, Windows Store, file extensions mapped to trigger executables when double-clicked. Similar data collection shall be provided for other operating systems. Any package management systems or mobile application repositories shall be queried for "installed" applications. Installation timestamps shall be recovered where available. Where installation timestamps are not available, a "firstSeen" timestamp shall be recorded. |
| 1.15.1 | The system shall collect detailed data about removed or upgraded OS and applications. Data shall include the same data elements as the inventory of installed applications. |
| 1.16 | The system shall support an agent-based capability to perform assessments and vulnerability identification through the use of dissolving, temporary, or non-persistent host-based agents or equivalent. |
| 1.17 | The system shall support non-persistent agents for non-Microsoft server and workstation OS'es (e.g. UNIX, Linux, Apple, etc.) |
| 1.18 | The system shall support non-persistent agents for Microsoft server and workstation operating systems. |
| 1.23 | The system shall provide a capability to adjust the frequency that devices are re-assessed in a range that varies from continuous scanning to a user defined time periods (e.g. daily, weekly, monthly, etc.) "Continuous" scanning may include monitoring of software event logs. |
| 1.33 | The system shall support a capability to acquire and display the network gateways for each identified asset on a per-interface basis. |
| 1.35 | The system shall provide a capability to identify when a vulnerability was first discovered, as well as highlight vulnerabilities that have persisted in the environment. |
| 2 | Automated Network Vulnerability Scanning Requirements |
| 2.1 | The system shall provide a capability to execute an automated recurring scan based upon a scheduled time period such as hourly (agent scans), daily, weekly, or monthly. |
| 2.3 | The system shall provide a capability to execute an automated and recurring scan based upon a specified grouping of devices such as mission assignment, organization, system type, MAC level, application type etc. |
| 2.3.1 | The system shall include Agent ID & MAC Address as system identifiers. |
| 2.4 | The system shall provide a quantifiable (i.e. numeric and/or stoplight) risk assessment of the network. |
| 2.5 | The system shall provide a capability to adjust computational weights and measures used to compute risk. |
| 2.9 | The system shall provide a capability to assess vulnerabilities by performing service banner testing. |
| 2.1 | The system shall provide a capability to assess policy banners (textual context) for compliance with stated policies |
| 2.12 | The system shall be fault-tolerant of network and target latency issues. |
| 2.13 | The system shall have the capability to provide the status to the operator and a way to degrade and end the scan gracefully if it must be aborted. |
| 2.14 | The system shall provide a capability to abort a scan and successfully restart a new scan within the user interface with the resumption of the assessment at or near the point of failure without loss of previously obtained scan results. |
| 2.17 | The system shall enable administrators to schedule partial and full scans on protected/managed computing platforms. It shall support scheduling partial scans of specific files, folders, systems, and/or asset groups - as well as full scans of designated assets/asset groups |
| 2.18 | The system shall scan target objects with and without any privileged access. |
| 2.2 | The system shall perform benchmarking such that one scan can be used as a baseline to compare against the assessment results of other scans. |
| 2.21 | The system shall have clearly defined subsets of vulnerability checks based on target type, OS type, or other definable fact. |
| 2.22 | The system shall accept input based on industry-standard formats that can be used as seed information for scans. (eg., output from an NMAP scan shall be importable into the tools and the object scanned. |
| 2.23 | The system shall provide the capability to pause/resume scans. |
| 3 | Application Vulnerability Scanning Requirements (Web, Database, etc.) |
| 3.2 | The system shall provide a capability to assess databases (e.g. MySQL, MS SQL, Oracle, etc.). |
| 3.3 | The system shall provide a capability to perform Layer 7 security testing (application level testing) |
| 4 | Configuration Assessment Requirements |
| 4.4 | The system shall provide a capability to assess compliance IAW FISMA standards |
| 4.7 | The system shall provide a capability to assess compliance IAW DoD STIG standards |
| 4.1 | The system shall provide a capability to assess authentication controls. |
| 4.11 | The system shall provide a capability to assess access controls. |
| 4.14 | The system shall provide a capability to assess anti-spyware, anti-malware, or anti-virus product configurations on scan targets. |
| 4.16 | The system shall provide a capability to perform web-site assessments to include: |
| 4.16.1 | Input Validation |
| 4.16.2 | Access Control |
| 4.16.3 | Session/Account Management |
| 4.16.4 | Cross-site Scripting (XSS) |
| 4.16.5 | Buffer Overflows |
| 4.16.6 | Database Command Injection |
| 4.16.7 | Error Handling |
| 4.16.8 | Use of Cryptography |
| 4.16.9 | Remote Administration |
| 4.16.10 | Server Configuration |
| 4.16.11 | 508 Compliance |
| 4.16.12 | PKI Login Support |
| 4.17 | The system shall provide the ability to scan common network infrastructure operating systems to include: |
| 4.18 | The system shall provide a capability to provide assessments against Windows 32 bit (Windows XP, Windows 7, Windows 8.1, Windows 10, etc.) operating systems for the following: |
| 4.18.1 | hardware configuration |
| 4.18.2 | software configuration |
| 4.18.3 | firmware configuration |
| 4.18.4 | user policies |
| 4.18.5 | file permissions |
| 4.18.6 | registry permissions |
| 4.18.7 | service permissions |
| 4.18.8 | services running |
| 4.18.9 | specific security policies such as Kerberos |
| 4.18.10 | processes running |
| 4.18.11 | file content checks |
| 4.18.12 | password policy auditor |
| 4.19 | The system shall provide a capability to provide assessments against Windows 64 bit (Windows 7, Windows 8.1, Windows 10, Windows 11, etc.) operating systems for the following: |
| 4.19.1 | hardware configuration |
| 4.19.2 | software configuration |
| 4.19.3 | firmware configuration |
| 4.19.4 | user policies |
| 4.19.5 | file permissions |
| 4.19.6 | registry permissions |
| 4.19.7 | service permissions |
| 4.19.8 | services running |
| 4.19.9 | specific security policies such as Kerberos |
| 4.19.10 | processes running |
| 4.19.11 | file content checks |
| 4.19.12 | password policy auditor |
| 4.20 | The system shall provide a capability to provide assessments against UNIX (e.g. HP-UX, Solaris, etc.) operating systems for the following: |
| 4.20.1 | hardware configuration |
| 4.20.2 | software configuration |
| 4.20.3 | firmware configuration |
| 4.20.4 | user policies |
| 4.20.5 | file permissions |
| 4.20.6 | registry permissions |
| 4.20.7 | service permissions |
| 4.20.8 | services running |
| 4.20.9 | specific security policies such as Kerberos |
| 4.20.10 | processes running |
| 4.20.11 | file content checks |
| 4.20.12 | password policy auditor |
| 4.21 | The system shall provide a capability to provide assessments against Linux (e.g. Ubuntu, RHEL, CentOS, etc.) operating systems for the following: |
| 4.21.1 | hardware configuration |
| 4.21.2 | software configuration |
| 4.21.3 | firmware configuration |
| 4.21.4 | user policies |
| 4.21.5 | file permissions |
| 4.21.6 | registry permissions |
| 4.21.7 | service permissions |
| 4.21.8 | services running |
| 4.21.9 | specific security policies such as Kerberos |
| 4.21.10 | processes running |
| 4.21.11 | file content checks |
| 4.21.12 | password policy auditor |
| 4.22 | The system shall provide a capability to provide assessments against Apple (e.g. MacOS, iOS, etc.) operating systems for the following: |
| 4.22.1 | hardware configuration |
| 4.22.2 | software configuration |
| 4.22.3 | firmware configuration |
| 4.22.4 | user policies |
| 4.22.5 | file permissions |
| 4.22.6 | registry permissions |
| 4.22.7 | service permissions |
| 4.22.8 | services running |
| 4.22.9 | specific security policies such as Kerberos |
| 4.22.10 | processes running |
| 4.22.11 | file content checks |
| 4.22.12 | password policy auditor |
| 4.23 | The system shall provide a capability to provide assessments against thin-client operating systems for the following: |
| 4.23.1 | hardware configuration |
| 4.23.2 | software configuration |
| 4.23.3 | firmware configuration |
| 4.23.4 | user policies |
| 4.23.5 | file permissions |
| 4.23.6 | registry permissions |
| 4.23.7 | service permissions |
| 4.23.8 | services running |
| 4.23.9 | specific security policies such as Kerberos |
| 4.23.10 | processes running |
| 4.23.11 | file content checks |
| 4.23.12 | password policy auditor |
| 5 | Remote and Peripheral Device Configuration (Non-Agent Based) |
| 5.1 | The system shall provide a non-agent based capability to assess: |
| 5.1.1 | Network printer systems. |
| 5.1.2 | Multi-functioning device (MFD) systems. |
| 5.1.3 | USB connected devices on connected systems. |
| 5.1.4 | Firewall configurations. |
| 5.1.5 | Router configurations. |
| 5.1.6 | Virtual private networking servers and connected clients. |
| 5.1.7 | E-mail server configurations. |
| 5.1.8 | Remote access service (RAS) servers and clients. |
| 5.1.9 | DMZ servers and security. |
| 5.1.10 | Wireless security, wireless access points and clients, and wireless configuration settings. |
| 5.1.11 | Voice Over Internet Protocol (VOIP) servers, clients, or applications. |
| 6 | Graphical User Interface (GUI) |
| 6.1 | The system shall provide a graphical user interface for unified execution and management of assessments and reporting. |
| 6.2 | The system shall provide a capability to display reports through a graphical user interface. |
| 6.3 | The console interface shall be intuitive or easy to navigate and use. |
| 6.4 | The system shall provide interactive help functionality through the graphical user interface. |
| 6.5 | The system shall provide the ability to see detailed descriptions for every vulnerability checked or identified. |
| 6.6 | The system shall provide a capability to easily expand (drill down) on identified vulnerability definitions and explanations. |
| 6.7 | The system shall support SSL TLS 1.2 security web access capability or higher. |
| 6.12 | The system shall provide a capability to automatically group or break out identified systems by identified type such as; routers/switches, printers or other devices during initial scanning. |
| 6.13 | The system shall provide a capability to easily move identified devices to create new groups when necessary or reassign individual or groups of identified systems |
| 6.14 | The system shall assess and display the severity of the detected vulnerabilities customizable by the user. |
| 6.15 | The system shall provide a flexible, capability to create, maintain and execute assessments based on user-defined or operator-created groups which can be stored and modified. |
| 6.16 | The system shall support command-line control over the assessment process. |
| 6.19 | The system shall provide a capability to create, edit, archive and delete named vulnerability profiles. It shall enable administrators to name each profile, identify a particular asset/asset group it applies to, and list or link to all standard and custom vulnerability signatures that are applicable to that asset/asset group. It shall permit them to define permanent profiles and ad-hoc profiles |
| 7 | Report Generation and Data Export |
| 7.1 | The system shall provide a capability to natively display a generated logical network map. |
| 7.3 | The system shall provide a capability to provide a detailed network map illustrating what systems, devices, servers and services have been added, removed or changed since the last scan. |
| 7.6 | The system shall export scan results on a per-device basis using a defined schema that is provided to the government |
| 7.9 | The system shall provide a capability to build selectable report criteria to meet regulatory reporting requirements of the required assessment standards. |
| 7.10 | The system shall provide a capability to provide differential reporting capabilities based on an assessed host or group of hosts |
| 7.11 | The system shall provide a capability to provide differential reporting capabilities based on an assessed scalable group of hosts. |
| 7.12 | The system shall provide a capability to provide differential reporting capabilities based upon non-assessed or non-reachable hosts. |
| 7.13 | The system shall provide a capability to provide status changes in the assessed vulnerabilities of all assessed devices to establish and support trending analysis. |
| 7.15 | The system shall provide a capability to create ad hoc reports based on the products' stored information including as a minimum the operating system, service pack level, IAVM status, account names and account privileges. |
| 7.16 | The system shall provide a capability to create reports that show the check used to identify a vulnerability or other assessed value; e.g. registry setting, service running, OVAL definition, proprietary definition, etc |
| 7.18 | The system shall provide a capability to support administrative input to cross reference commercially identified or categorized assessment results (vulnerabilities) to the DoD CPCON reporting compliance requirements. |
| 7.19 | The system shall provide a capability to normalize data by re-using common elements, findings and data. |
| 7.2 | The system shall provide a capability to provide customizable technical-level summary reports. |
| 7.21 | The system shall provide a capability to provide executive-level summary reports. |
| 7.22 | All reporting generation and data exportations shall be accomplished within the User Interface (UI). |
| 7.23 | The system's presentation interface shall provide a high-level vulnerability view, hierarchically arranged to permit the operator to drill down to specific vulnerability details |
| 7.24 | The system's presentation interface shall provide a high-level compliance reporting view, hierarchically arranged to permit the operator to drill down to specific compliance details. |
| 7.25 | The system shall provide a capability to group vulnerability data into analytically meaningful categories such as: vulnerability and vulnerability type detected, threat level, risk level, vulnerability count, Alphabetically / Lexically, and Severity/Priority identified within categories such as critical, important, moderate, and low. |
| 8 | Help Features |
| 8.1 | The system shall provide adequate information or help capabilities embedded within the tool to provide additional information concerning the capabilities either through help pages, right-click functionality or mouse-over content displays. |
| 8.2 | The system shall provide the SA with step-by-step instructions appropriate for the platform to facilitate ease of installation and configuration operations. |
| 8.3 | The system shall provide possible remediation techniques. |
| 8.4 | The system shall provide clear and concise update notes outlining all changes to the product and scanning and signature updates. |
| 9 | Non-Disruptive to Normal Operations |
| 9.1 | The system shall provide minimum interference with user(s) day-to-day productivity, usability and functionality. |
| 10 | SCAP Compliance |
| 10.1 | The system shall export assessment and vulnerability data IAW SCAP standards in each of the following formats where appropriate: |
| 10.1.5 | Open Vulnerability and Assessment Language (OVAL) |
| 10.1.6 | Common Vulnerability Scoring System (CVSS) |
| 10.1.7 | Assessment Results Format (ARF) |
| 10.1.8 | Open Checklist Interactive Language (OCIL) |
| 10.1.9 | Asset Summary Reporting (ASR) |
| 10.2 | The system shall perform compliance assessment and vulnerability checklists and definitions IAW the latest NIST published SCAP standards, supporting all of the following standards, performing assessments using SCAP specified methods. Current version of SCAP as of this publishing is 1.4. |
| 10.2.1 | Common Vulnerabilities and Exposures (CVE) |
| 10.2.2 | Common Configuration Enumeration (CCE) |
| 10.2.3 | Common Platform Enumeration (CPE) |
| 10.2.6 | Common Vulnerability Scoring System (CVSS) |
| 10.2.7 | Assessment Results Format (ARF) |
| 10.2.8 | Application Programming Interfaces (API) |
| 10.2.9 | JavaScript Object Notation (JSON) |
| 10.2.10 | Assessment Summary Results (ASR) |
| 10.3 | The system shall provide the ability to download XCCDF and OVAL checks from the National Institute of Standards and Technology National Vulnerability Database. |
| 11 | Access Control |
| 11.1 | The system shall enforce role-based access controls supported through the DoD CAC PKI for administrators, auditors, remote access, or risk managers to the system. |
| 11.2 | The system (including any of its agents) shall guide and coordinate multiple administrators and authorized users through common tasks or default processes and allow only those with proper authority to perform each task/job/transaction. |
| 11.3 | The system shall have the capability to allow administrators to create, add, modify, or delete new threat/event correlation rule sets. Administrators may not delete predefined rule sets or rule sets developed by other administrators. |
| 12 | Logging/Alerting |
| 12.1 | The system shall support external help-desk trouble ticketing applications for problem resolution and escalation. |
| 12.2 | The system shall support external integration with SIEM vendors. This shall be done directly through the product and/or through open standards & protocols. |
| 12.5 | The system shall permit the administrator to define the time period to retain the scan results and support removal and archiving. |
| 12.8 | System log access shall be limited to a security manager account. |
| 13 | Centralized Management |
| 13.1 | The system shall store the results from assessments in a centralized repository or be able to access decentralized storage, if used, seamlessly. |
| 13.2 | The system shall operate in an MS Active Directory or Entre Domain. |
| 13.5 | The system shall protect the confidentiality and integrity of all stored data. |
| 13.8 | The system shall support scan auditing and validation such as timestamp, scan lapse time, scan policy attributes, and non-repudiation. |
| 13.9 | The system shall support enterprise deployments from an organization's top-level architecture to individualized deployments in smaller enclaves that may be protected by firewalls and other security devices that are part of the DoD defense-in-depth posture. |
| 13.1 | The system shall have a low false positive rate of assessed systems and vulnerabilities (inaccurate finding of a vulnerable system). |
| 13.11 | The system shall have a low false negative rate of assessed systems and vulnerabilities (failure to identify an actual vulnerability). |
| 13.13 | The system shall manage and correlate vulnerabilities discovered by 3rd party scanners. |
| Non-Traditional IT Assessment | |
| 14 | The systems shall provide the ability to assess IT functionality that exists at different levels of abstraction than physical or virtual devices. This functionality shall include, but not limited to: containers, clouds, Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS) |
| 14.1 | SaaS capabilities |
| 14.2 | PaaS capabilities |
| 14.3 | IaaS capabilities |
| 14.4 | Container capabilities |
| 14.5 | The system shall have the capability to passively and/or actively query an operational technology (OT) environment to retrieve information. OT environments include but aren’t limited to: Industrial Control Systems, Programmable Logic Controllers, Distributed Control Systems, Supervisory Control and Data Acquisition Systems, Building Management Systems, Fire Control Systems, Remote Terminal Units, Human Machine Interfaces. |
| 14.6 | The system shall have the capability to passively and/or actively enumerate Internet of Things (IoT) devices. Examples of IoT devices include but aren't limited to: VOIP Telephones, Smart Printers, Smart TVs, Smart UPS Systems, RFID / Barcode Scanning Systems, etc. |
Other
| Other Desired Technical Attributes | |
| 1 | Network Discovery Requirements |
| 1.9 | The system shall use a variety of active operating system (OS) and vulnerability discovery techniques and fingerprinting. Fingerprinting entails careful inspection for subtle variations in implementation of RFC standards. |
| 1.1 | The system correlates OS and fingerprint tests to find true vulnerabilities and minimize false positives. |
| 1.11 | The system shall process OVAL definitions present in SCAP Source Datastreams, using SCAP specified checking methods. |
| 1.14 | The System shall use a variety of passive operating system (OS) and vulnerability discovery techniques and fingerprinting. Fingerprinting entails careful inspection for subtle variations in implementation of RFC (request for comments) standards. |
| 1.20 | The non-persistent agent will have the capability for remote installation from the ACAS tool. |
| 1.21 | The system shall provide the ability to install agents on devices using removable media and local administrator rights if applicable. |
| 1.22 | The system shall manage (add, delete, change) network assessment scope. The rules for network discovery must include a flexible combination of at least the following parameters: specific device addresses, address ranges (starting and bounding points), sub-nets, and networks |
| 1.25 | The system shall provide a capability to identify networks that do not have permission to connect to the network from a cognizant authority. |
| 1.26 | The system shall provide a capability to identify rogue workgroups. |
| 1.27 | The system shall provide a capability to identify rogue domains. |
| 1.28 | The system shall provide a capability to identify rogue SNMP managed devices. |
| 1.29 | The system shall provide a capability to identify rogue SNMP device managers. |
| 1.30 | The system shall provide a capability to identify devices on the network which are prohibited by policy. |
| 1.31 | The system shall provide a capability to identify rogue policy prohibited peripherals. |
| 1.32 | The system shall support classful mappings of Class A, B, and C networks. |
| 1.8.1 | The system shall identify if a vulnerability was identified as patched and is now vulnerable again, while keeping the first discovered date. |
| 2 | Automated Network Vulnerability Scanning Requirements |
| 2.2 | The system shall provide a capability to execute a customized scan based on any priority of effort, such as speed, accuracy, or network impact. |
| 2.7 | The system shall provide an automated capability to simulate real attacks originating internally to the enclave. |
| 2.8 | The system shall provide an automated capability to simulate real attacks originating externally to the enclave. |
| 2.11 | The system shall provide a capability to assess vulnerabilities by performing behavioral assessments through canned or customized exploits such as social engineering, spam, and phishing assessments. |
| 2.16 | The system shall provide a capability to configure a queue of events for a defined period of time for later collection by the Manager. This includes enabling customers/ users to define optimal times for non-disruptive data collection. |
| 2.19 | The system shall be capable of assuming an administrative account role by supplying the appropriate account information via a service account. |
| 3 | Application Vulnerability Scanning Requirements (Web, Database, etc.) |
| 3.4 | The system shall assess configurations of the Microsoft Office Suite (e.g. Microsoft Office 365) |
| 4 | Configuration Assessment Requirements |
| 4.1 | The system shall provide a capability to assess compliance IAW Payment Card Industry Data Security Standard (PCI DSS) standards |
| 4.2 | The system shall provide a capability to assess compliance IAW HIPAA standards |
| 4.3 | The system shall provide a capability to assess compliance IAW SOX standards |
| 4.5 | The system shall provide a capability to assess compliance IAW GLBA standards |
| 4.8 | The system shall provide a capability to assess compliance IAW organizationally implemented best practices or standards. |
| 4.9 | The system shall provide a capability to provide a security compliance questionnaire response capability for non-technical compliance reporting. |
| 4.15 | The system shall provide a capability to perform assessments on electronic banking or payment clients and servers. |
| 4.16 | The system shall provide a capability to perform web-site assessments to include: |
| 4.16.13 | Administratively defined restricted or prohibited content. |
| 4.17 | The system shall provide the ability to scan common network infrastructure operating systems to include: |
| 4.17.3 | Bay Networks |
| 4.17.4 | Other common routers and switches |
| 5 | Remote and Peripheral Device Configuration (Non-Agent Based) |
| 6 | Graphical User Interface (GUI) |
| 6.8 | The system shall provide a capability to collaborate with others to create new security audit tasks and tests. |
| 6.9 | The system shall provide a capability to collaborate with others to share new security audit tasks and tests. |
| 6.1 | The system shall provide a flexible/"on the fly" capability to configure or customize existing security audit tasks to expedite or refine assessments. |
| 6.11 | The system shall provide alternative course of actions or hints through the graphical user interface. |
| 6.17 | The system shall provide a status bar to indicate meaningful information about what phase the scanner is in or level of completion. |
| 6.18 | The system shall provide a capability to execute default or template scanning or a selection from a list of identifiable threat categories within the application to expedite deployment and user acceptance and confidence with the least amount of risks to the network. |
| 6.2 | The system shall provide options to automate common or repetitive steps/processes (e.g., field entries on forms) and to automatically route transactions/jobs, reports, and other analytic output to designated administrators', users and/or managed assets |
| 7 | Report Generation and Data Export |
| 7.4 | The system network mapping capability shall be able customizable or configurable to display nodal groupings or layers and selectable network mapping information. |
| 7.7 | The system shall export scan results on a per-device basis using a defined XML schema that is provided to the government |
| 7.26 | The system shall provide a capability to publish frequently updated, automated or recurring scan information over a content publishing service such as RSS VER 2.0. |
| 8 | Help Features |
| 9 | Non-Disruptive to Normal Operations |
| 11 | Access Control |
| 11.4 | The system shall provide secure communication parameters and enable the administrator to manage the secure communication sessions between the vulnerability scanners and the management console. |
| 11.5 | The system shall not require the scanner to logon to the OS as an administrator to initiate the scan. |
| 12 | Logging/Alerting |
| 12.3 | The system shall support other external SIM/SIEM applications. |
| 12.6 | The system shall log activities of users and administrators. |
| 12.7 | The system shall store user and administrator logs in a syslog or other structured format. |
| 12.9 | System log data shall be exportable to external tools. |
| 13 | Centralized Management |
| 13.6 | The contractor shall ensure that its tool allows for the storage of all assessment and vulnerability information in an ODBC-addressable database. |
| 13.7 | The system shall support a verification method such as an approved digital signatures for validation of authenticity. |
| 13.12 | The system shall aggregate vulnerabilities and exposures information collected from a group of scanners. |
| 13.14 | The system shall store Alarm/Event data collected and analyzed by the management system. Alarm data is generated based on predefined criteria established and rules run against event/operational data received by the management platform |
| 13.15 | The system shall identify trends in vulnerabilities and exposures to assess the progress of security enhancement or management initiatives. |
| 13.16 | The system shall manage internal scanner configuration data. Configuration data is defined as those values and settings (e.g., vulnerability signatures, network addresses of scanners and controlled devices, etc.) that enable the scanner hardware and software to perform as it is installed in the network. The configuration parameters that control the identification of the management console and the secure communications session must be defined explicitly for both primary and alternate manager(s) |
| 13.17 | The system shall enable administrators to create, copy, modify, archive and delete system event response/operations rules for environment specific (local) events or administratively defined filters. The system's automated response options shall support audible alarms, visual alarms, administrator defined text messaging (e.g., email/pager alerts), normalization of externally generated events, correlation/consolidation of redundant/associated events, setting event classification/priority data, and execution of other operations using administratively defined variable entries. |
| 13.18 | The system shall enable administrators to create a rule set of related rules used to match specific data fields and the data entry that results from the match. It shall enable them to provide a named set of these combination rules. The system shall enable administrators to manage a pick list of these rules/rules sets for latter execution by administrators and authorized users |
| 13.19 | The system shall enable administrators to analyze system events by multiple criteria. It shall enable them to analyze events relating to two or more administrator designated criteria, to include (but not limited to) specific times, assets (HW, SW, Agents), services, users, administrators, threat signatures, behavioral profiles, asset/threat type, management system transactions/job, capacity/availability/performance data, business impact, data source, and/or configuration items |
| 13.2 | The system shall enable the administrator to create, modify, and save the logic necessary to produce comprehensive rule sets. Rules sets are used to send messages, trigger alerts, detect events, route files/data for processing, sequence jobs/transactions, etc |
| 13.21 | The system shall provide the capability to include or omit a standard signature in the set of signatures to be distributed to the appropriate vulnerability scanners. Common vulnerability signatures are received from authoritative sources (e.g., vendors) and are stored in a vulnerability signature repository. |
| 13.24 | The system shall provide a capability to notify or publish updates over a content publishing service such as RSS VER 2.0. |
File details come from the government source that posted it. Updated .